Merge 4.16-rc6 into tty-next

We want the serial/tty fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

746 files changed, 7575 insertions, 4876 deletions

diff --git a/Documentation/PCI/pci.txt b/Documentation/PCI/pci.txt
index 611a75e4366e..badb26ac33dc 100644
--- a/Documentation/PCI/pci.txt
+++ b/Documentation/PCI/pci.txt
@@ -570,7 +570,9 @@ your driver if they're helpful, or just use plain hex constants.
 The device IDs are arbitrary hex numbers (vendor controlled) and normally used
 only in a single location, the pci_device_id table.
 
-Please DO submit new vendor/device IDs to http://pciids.sourceforge.net/.
+Please DO submit new vendor/device IDs to http://pci-ids.ucw.cz/.
+There are mirrors of the pci.ids file at http://pciids.sourceforge.net/
+and https://github.com/pciutils/pciids.
 
 
 
diff --git a/Documentation/accelerators/ocxl.rst b/Documentation/accelerators/ocxl.rst
index 4f7af841d935..ddcc58d01cfb 100644
--- a/Documentation/accelerators/ocxl.rst
+++ b/Documentation/accelerators/ocxl.rst
@@ -152,6 +152,11 @@ OCXL_IOCTL_IRQ_SET_FD:
   Associate an event fd to an AFU interrupt so that the user process
   can be notified when the AFU sends an interrupt.
 
+OCXL_IOCTL_GET_METADATA:
+
+  Obtains configuration information from the card, such at the size of
+  MMIO areas, the AFU version, and the PASID for the current context.
+
 
 mmap
 ----
diff --git a/Documentation/devicetree/bindings/misc/arm-charlcd.txt b/Documentation/devicetree/bindings/auxdisplay/arm-charlcd.txt
index e28e2aac47f1..e28e2aac47f1 100644
--- a/Documentation/devicetree/bindings/misc/arm-charlcd.txt
+++ b/Documentation/devicetree/bindings/auxdisplay/arm-charlcd.txt
diff --git a/Documentation/devicetree/bindings/dma/mv-xor-v2.txt b/Documentation/devicetree/bindings/dma/mv-xor-v2.txt
index 217a90eaabe7..9c38bbe7e6d7 100644
--- a/Documentation/devicetree/bindings/dma/mv-xor-v2.txt
+++ b/Documentation/devicetree/bindings/dma/mv-xor-v2.txt
@@ -11,7 +11,11 @@ Required properties:
   interrupts.
 
 Optional properties:
-- clocks: Optional reference to the clock used by the XOR engine.
+- clocks: Optional reference to the clocks used by the XOR engine.
+- clock-names: mandatory if there is a second clock, in this case the
+   name must be "core" for the first clock and "reg" for the second
+   one
+
 
 Example:
 
diff --git a/Documentation/devicetree/bindings/eeprom/at24.txt b/Documentation/devicetree/bindings/eeprom/at24.txt
index 1812c848e369..abfae1beca2b 100644
--- a/Documentation/devicetree/bindings/eeprom/at24.txt
+++ b/Documentation/devicetree/bindings/eeprom/at24.txt
@@ -38,9 +38,9 @@ Required properties:
 
                 "catalyst",
                 "microchip",
+                "nxp",
                 "ramtron",
                 "renesas",
-                "nxp",
                 "st",
 
                 Some vendors use different model names for chips which are just
diff --git a/Documentation/devicetree/bindings/interrupt-controller/renesas,irqc.txt b/Documentation/devicetree/bindings/interrupt-controller/renesas,irqc.txt
index 33c9a10fdc91..20f121daa910 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/renesas,irqc.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/renesas,irqc.txt
@@ -14,6 +14,7 @@ Required properties:
     - "renesas,irqc-r8a7794" (R-Car E2)
     - "renesas,intc-ex-r8a7795" (R-Car H3)
     - "renesas,intc-ex-r8a7796" (R-Car M3-W)
+    - "renesas,intc-ex-r8a77965" (R-Car M3-N)
     - "renesas,intc-ex-r8a77970" (R-Car V3M)
     - "renesas,intc-ex-r8a77995" (R-Car D3)
 - #interrupt-cells: has to be <2>: an interrupt index and flags, as defined in
diff --git a/Documentation/devicetree/bindings/net/renesas,ravb.txt b/Documentation/devicetree/bindings/net/renesas,ravb.txt
index c902261893b9..92fd4b2f17b2 100644
--- a/Documentation/devicetree/bindings/net/renesas,ravb.txt
+++ b/Documentation/devicetree/bindings/net/renesas,ravb.txt
@@ -18,6 +18,7 @@ Required properties:
       - "renesas,etheravb-r8a7795" for the R8A7795 SoC.
       - "renesas,etheravb-r8a7796" for the R8A7796 SoC.
       - "renesas,etheravb-r8a77970" for the R8A77970 SoC.
+      - "renesas,etheravb-r8a77980" for the R8A77980 SoC.
       - "renesas,etheravb-r8a77995" for the R8A77995 SoC.
       - "renesas,etheravb-rcar-gen3" as a fallback for the above
                 R-Car Gen3 devices.
diff --git a/Documentation/devicetree/bindings/power/wakeup-source.txt b/Documentation/devicetree/bindings/power/wakeup-source.txt
index 3c81f78b5c27..5d254ab13ebf 100644
--- a/Documentation/devicetree/bindings/power/wakeup-source.txt
+++ b/Documentation/devicetree/bindings/power/wakeup-source.txt
@@ -60,7 +60,7 @@ Examples
                 #size-cells = <0>;
 
                 button@1 {
-                        debounce_interval = <50>;
+                        debounce-interval = <50>;
                         wakeup-source;
                         linux,code = <116>;
                         label = "POWER";
diff --git a/Documentation/devicetree/bindings/thermal/imx-thermal.txt b/Documentation/devicetree/bindings/thermal/imx-thermal.txt
index 28be51afdb6a..379eb763073e 100644
--- a/Documentation/devicetree/bindings/thermal/imx-thermal.txt
+++ b/Documentation/devicetree/bindings/thermal/imx-thermal.txt
@@ -22,7 +22,32 @@ Optional properties:
 - clocks : thermal sensor's clock source.
 
 Example:
+ocotp: ocotp@21bc000 {
+        #address-cells = <1>;
+        #size-cells = <1>;
+        compatible = "fsl,imx6sx-ocotp", "syscon";
+        reg = <0x021bc000 0x4000>;
+        clocks = <&clks IMX6SX_CLK_OCOTP>;
 
+        tempmon_calib: calib@38 {
+                reg = <0x38 4>;
+        };
+
+        tempmon_temp_grade: temp-grade@20 {
+                reg = <0x20 4>;
+        };
+};
+
+tempmon: tempmon {
+        compatible = "fsl,imx6sx-tempmon", "fsl,imx6q-tempmon";
+        interrupts = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>;
+        fsl,tempmon = <&anatop>;
+        nvmem-cells = <&tempmon_calib>, <&tempmon_temp_grade>;
+        nvmem-cell-names = "calib", "temp_grade";
+        clocks = <&clks IMX6SX_CLK_PLL3_USB_OTG>;
+};
+
+Legacy method (Deprecated):
 tempmon {
         compatible = "fsl,imx6q-tempmon";
         fsl,tempmon = <&anatop>;
diff --git a/Documentation/devicetree/bindings/usb/dwc2.txt b/Documentation/devicetree/bindings/usb/dwc2.txt
index e64d903bcbe8..46da5f184460 100644
--- a/Documentation/devicetree/bindings/usb/dwc2.txt
+++ b/Documentation/devicetree/bindings/usb/dwc2.txt
@@ -19,7 +19,7 @@ Required properties:
   configured in FS mode;
   - "st,stm32f4x9-hsotg": The DWC2 USB HS controller instance in STM32F4x9 SoCs
   configured in HS mode;
-  - "st,stm32f7xx-hsotg": The DWC2 USB HS controller instance in STM32F7xx SoCs
+  - "st,stm32f7-hsotg": The DWC2 USB HS controller instance in STM32F7 SoCs
     configured in HS mode;
 - reg : Should contain 1 register range (address and length)
 - interrupts : Should contain 1 interrupt
diff --git a/Documentation/devicetree/bindings/usb/renesas_usb3.txt b/Documentation/devicetree/bindings/usb/renesas_usb3.txt
index 87a45e2f9b7f..2c071bb5801e 100644
--- a/Documentation/devicetree/bindings/usb/renesas_usb3.txt
+++ b/Documentation/devicetree/bindings/usb/renesas_usb3.txt
@@ -4,6 +4,7 @@ Required properties:
   - compatible: Must contain one of the following:
         - "renesas,r8a7795-usb3-peri"
         - "renesas,r8a7796-usb3-peri"
+        - "renesas,r8a77965-usb3-peri"
         - "renesas,rcar-gen3-usb3-peri" for a generic R-Car Gen3 compatible
           device
 
diff --git a/Documentation/devicetree/bindings/usb/renesas_usbhs.txt b/Documentation/devicetree/bindings/usb/renesas_usbhs.txt
index d060172f1529..43960faf5a88 100644
--- a/Documentation/devicetree/bindings/usb/renesas_usbhs.txt
+++ b/Documentation/devicetree/bindings/usb/renesas_usbhs.txt
@@ -12,6 +12,7 @@ Required properties:
         - "renesas,usbhs-r8a7794" for r8a7794 (R-Car E2) compatible device
         - "renesas,usbhs-r8a7795" for r8a7795 (R-Car H3) compatible device
         - "renesas,usbhs-r8a7796" for r8a7796 (R-Car M3-W) compatible device
+        - "renesas,usbhs-r8a77965" for r8a77965 (R-Car M3-N) compatible device
         - "renesas,usbhs-r8a77995" for r8a77995 (R-Car D3) compatible device
         - "renesas,usbhs-r7s72100" for r7s72100 (RZ/A1) compatible device
         - "renesas,rcar-gen2-usbhs" for R-Car Gen2 or RZ/G1 compatible devices
diff --git a/Documentation/devicetree/bindings/usb/usb-xhci.txt b/Documentation/devicetree/bindings/usb/usb-xhci.txt
index e2ea59bbca93..1651483a7048 100644
--- a/Documentation/devicetree/bindings/usb/usb-xhci.txt
+++ b/Documentation/devicetree/bindings/usb/usb-xhci.txt
@@ -13,6 +13,7 @@ Required properties:
     - "renesas,xhci-r8a7793" for r8a7793 SoC
     - "renesas,xhci-r8a7795" for r8a7795 SoC
     - "renesas,xhci-r8a7796" for r8a7796 SoC
+    - "renesas,xhci-r8a77965" for r8a77965 SoC
     - "renesas,rcar-gen2-xhci" for a generic R-Car Gen2 or RZ/G1 compatible
       device
     - "renesas,rcar-gen3-xhci" for a generic R-Car Gen3 compatible device
diff --git a/Documentation/ia64/serial.txt b/Documentation/ia64/serial.txt
index 6869c73de4e2..a63d2c54329b 100644
--- a/Documentation/ia64/serial.txt
+++ b/Documentation/ia64/serial.txt
@@ -111,7 +111,7 @@ TROUBLESHOOTING SERIAL CONSOLE PROBLEMS
 
         - If you don't have an HCDP, the kernel doesn't know where
           your console lives until the driver discovers serial
-          devices.  Use "console=uart, io,0x3f8" (or appropriate
+          devices.  Use "console=uart,io,0x3f8" (or appropriate
           address for your machine).
 
     Kernel and init script output works fine, but no "login:" prompt:
diff --git a/Documentation/media/dmx.h.rst.exceptions b/Documentation/media/dmx.h.rst.exceptions
index 63f55a9ae2b1..a8c4239ed95b 100644
--- a/Documentation/media/dmx.h.rst.exceptions
+++ b/Documentation/media/dmx.h.rst.exceptions
@@ -50,9 +50,15 @@ replace typedef dmx_filter_t :c:type:`dmx_filter`
 replace typedef dmx_pes_type_t :c:type:`dmx_pes_type`
 replace typedef dmx_input_t :c:type:`dmx_input`
 
-ignore symbol DMX_OUT_DECODER
-ignore symbol DMX_OUT_TAP
-ignore symbol DMX_OUT_TS_TAP
-ignore symbol DMX_OUT_TSDEMUX_TAP
+replace symbol DMX_BUFFER_FLAG_HAD_CRC32_DISCARD :c:type:`dmx_buffer_flags`
+replace symbol DMX_BUFFER_FLAG_TEI :c:type:`dmx_buffer_flags`
+replace symbol DMX_BUFFER_PKT_COUNTER_MISMATCH :c:type:`dmx_buffer_flags`
+replace symbol DMX_BUFFER_FLAG_DISCONTINUITY_DETECTED :c:type:`dmx_buffer_flags`
+replace symbol DMX_BUFFER_FLAG_DISCONTINUITY_INDICATOR :c:type:`dmx_buffer_flags`
+
+replace symbol DMX_OUT_DECODER :c:type:`dmx_output`
+replace symbol DMX_OUT_TAP :c:type:`dmx_output`
+replace symbol DMX_OUT_TS_TAP :c:type:`dmx_output`
+replace symbol DMX_OUT_TSDEMUX_TAP :c:type:`dmx_output`
 
 replace ioctl DMX_DQBUF dmx_qbuf
diff --git a/Documentation/media/uapi/dvb/dmx-qbuf.rst b/Documentation/media/uapi/dvb/dmx-qbuf.rst
index b48c4931658e..be5a4c6f1904 100644
--- a/Documentation/media/uapi/dvb/dmx-qbuf.rst
+++ b/Documentation/media/uapi/dvb/dmx-qbuf.rst
@@ -51,9 +51,10 @@ out to disk. Buffers remain locked until dequeued, until the
 the device is closed.
 
 Applications call the ``DMX_DQBUF`` ioctl to dequeue a filled
-(capturing) buffer from the driver's outgoing queue. They just set the ``reserved`` field array to zero. When ``DMX_DQBUF`` is called with a
-pointer to this structure, the driver fills the remaining fields or
-returns an error code.
+(capturing) buffer from the driver's outgoing queue.
+They just set the ``index`` field withe the buffer ID to be queued.
+When ``DMX_DQBUF`` is called with a pointer to struct :c:type:`dmx_buffer`,
+the driver fills the remaining fields or returns an error code.
 
 By default ``DMX_DQBUF`` blocks when no buffer is in the outgoing
 queue. When the ``O_NONBLOCK`` flag was given to the
diff --git a/Documentation/sphinx/kerneldoc.py b/Documentation/sphinx/kerneldoc.py
index 39aa9e8697cc..fbedcc39460b 100644
--- a/Documentation/sphinx/kerneldoc.py
+++ b/Documentation/sphinx/kerneldoc.py
@@ -36,8 +36,7 @@ import glob
 
 from docutils import nodes, statemachine
 from docutils.statemachine import ViewList
-from docutils.parsers.rst import directives
-from sphinx.util.compat import Directive
+from docutils.parsers.rst import directives, Directive
 from sphinx.ext.autodoc import AutodocReporter
 
 __version__  = '1.0'
diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
index 792fa8717d13..d6b3ff51a14f 100644
--- a/Documentation/virtual/kvm/api.txt
+++ b/Documentation/virtual/kvm/api.txt
@@ -123,14 +123,15 @@ memory layout to fit in user mode), check KVM_CAP_MIPS_VZ and use the
 flag KVM_VM_MIPS_VZ.
 
 
-4.3 KVM_GET_MSR_INDEX_LIST
+4.3 KVM_GET_MSR_INDEX_LIST, KVM_GET_MSR_FEATURE_INDEX_LIST
 
-Capability: basic
+Capability: basic, KVM_CAP_GET_MSR_FEATURES for KVM_GET_MSR_FEATURE_INDEX_LIST
 Architectures: x86
-Type: system
+Type: system ioctl
 Parameters: struct kvm_msr_list (in/out)
 Returns: 0 on success; -1 on error
 Errors:
+  EFAULT:    the msr index list cannot be read from or written to
   E2BIG:     the msr index list is to be to fit in the array specified by
              the user.
 
@@ -139,16 +140,23 @@ struct kvm_msr_list {
         __u32 indices[0];
 };
 
-This ioctl returns the guest msrs that are supported.  The list varies
-by kvm version and host processor, but does not change otherwise.  The
-user fills in the size of the indices array in nmsrs, and in return
-kvm adjusts nmsrs to reflect the actual number of msrs and fills in
-the indices array with their numbers.
+The user fills in the size of the indices array in nmsrs, and in return
+kvm adjusts nmsrs to reflect the actual number of msrs and fills in the
+indices array with their numbers.
+
+KVM_GET_MSR_INDEX_LIST returns the guest msrs that are supported.  The list
+varies by kvm version and host processor, but does not change otherwise.
 
 Note: if kvm indicates supports MCE (KVM_CAP_MCE), then the MCE bank MSRs are
 not returned in the MSR list, as different vcpus can have a different number
 of banks, as set via the KVM_X86_SETUP_MCE ioctl.
 
+KVM_GET_MSR_FEATURE_INDEX_LIST returns the list of MSRs that can be passed
+to the KVM_GET_MSRS system ioctl.  This lets userspace probe host capabilities
+and processor features that are exposed via MSRs (e.g., VMX capabilities).
+This list also varies by kvm version and host processor, but does not change
+otherwise.
+
 
 4.4 KVM_CHECK_EXTENSION
 
@@ -475,14 +483,22 @@ Support for this has been removed.  Use KVM_SET_GUEST_DEBUG instead.
 
 4.18 KVM_GET_MSRS
 
-Capability: basic
+Capability: basic (vcpu), KVM_CAP_GET_MSR_FEATURES (system)
 Architectures: x86
-Type: vcpu ioctl
+Type: system ioctl, vcpu ioctl
 Parameters: struct kvm_msrs (in/out)
-Returns: 0 on success, -1 on error
+Returns: number of msrs successfully returned;
+        -1 on error
+
+When used as a system ioctl:
+Reads the values of MSR-based features that are available for the VM.  This
+is similar to KVM_GET_SUPPORTED_CPUID, but it returns MSR indices and values.
+The list of msr-based features can be obtained using KVM_GET_MSR_FEATURE_INDEX_LIST
+in a system ioctl.
 
+When used as a vcpu ioctl:
 Reads model-specific registers from the vcpu.  Supported msr indices can
-be obtained using KVM_GET_MSR_INDEX_LIST.
+be obtained using KVM_GET_MSR_INDEX_LIST in a system ioctl.
 
 struct kvm_msrs {
         __u32 nmsrs; /* number of msrs in entries */
diff --git a/Documentation/virtual/kvm/cpuid.txt b/Documentation/virtual/kvm/cpuid.txt
index dcab6dc11e3b..87a7506f31c2 100644
--- a/Documentation/virtual/kvm/cpuid.txt
+++ b/Documentation/virtual/kvm/cpuid.txt
@@ -58,6 +58,10 @@ KVM_FEATURE_PV_TLB_FLUSH           ||     9 || guest checks this feature bit
                                    ||       || before enabling paravirtualized
                                    ||       || tlb flush.
 ------------------------------------------------------------------------------
+KVM_FEATURE_ASYNC_PF_VMEXIT        ||    10 || paravirtualized async PF VM exit
+                                   ||       || can be enabled by setting bit 2
+                                   ||       || when writing to msr 0x4b564d02
+------------------------------------------------------------------------------
 KVM_FEATURE_CLOCKSOURCE_STABLE_BIT ||    24 || host will warn if no guest-side
                                    ||       || per-cpu warps are expected in
                                    ||       || kvmclock.
diff --git a/Documentation/virtual/kvm/msr.txt b/Documentation/virtual/kvm/msr.txt
index 1ebecc115dc6..f3f0d57ced8e 100644
--- a/Documentation/virtual/kvm/msr.txt
+++ b/Documentation/virtual/kvm/msr.txt
@@ -170,7 +170,8 @@ MSR_KVM_ASYNC_PF_EN: 0x4b564d02
         when asynchronous page faults are enabled on the vcpu 0 when
         disabled. Bit 1 is 1 if asynchronous page faults can be injected
         when vcpu is in cpl == 0. Bit 2 is 1 if asynchronous page faults
-        are delivered to L1 as #PF vmexits.
+        are delivered to L1 as #PF vmexits.  Bit 2 can be set only if
+        KVM_FEATURE_ASYNC_PF_VMEXIT is present in CPUID.
 
         First 4 byte of 64 byte memory location will be written to by
         the hypervisor at the time of asynchronous page fault (APF)
diff --git a/Documentation/x86/intel_rdt_ui.txt b/Documentation/x86/intel_rdt_ui.txt
index 756fd76b78a6..71c30984e94d 100644
--- a/Documentation/x86/intel_rdt_ui.txt
+++ b/Documentation/x86/intel_rdt_ui.txt
@@ -671,7 +671,7 @@ occupancy of the real time threads on these cores.
 # mkdir p1
 
 Move the cpus 4-7 over to p1
-# echo f0 > p0/cpus
+# echo f0 > p1/cpus
 
 View the llc occupancy snapshot
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 93a12af4f180..205c8fc12a9c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1238,7 +1238,7 @@ F:	drivers/clk/at91
 
 ARM/ATMEL AT91RM9200, AT91SAM9 AND SAMA5 SOC SUPPORT
 M:      Nicolas Ferre <nicolas.ferre@microchip.com>
-M:      Alexandre Belloni <alexandre.belloni@free-electrons.com>
+M:      Alexandre Belloni <alexandre.belloni@bootlin.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://www.linux4sam.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/nferre/linux-at91.git
@@ -1590,7 +1590,7 @@ ARM/Marvell Dove/MV78xx0/Orion SOC support
 M:      Jason Cooper <jason@lakedaemon.net>
 M:      Andrew Lunn <andrew@lunn.ch>
 M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
-M:      Gregory Clement <gregory.clement@free-electrons.com>
+M:      Gregory Clement <gregory.clement@bootlin.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      Documentation/devicetree/bindings/soc/dove/
@@ -1604,7 +1604,7 @@ F:	arch/arm/boot/dts/orion5x*
 ARM/Marvell Kirkwood and Armada 370, 375, 38x, 39x, XP, 3700, 7K/8K SOC support
 M:      Jason Cooper <jason@lakedaemon.net>
 M:      Andrew Lunn <andrew@lunn.ch>
-M:      Gregory Clement <gregory.clement@free-electrons.com>
+M:      Gregory Clement <gregory.clement@bootlin.com>
 M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
@@ -1999,8 +1999,10 @@ M:	Maxime Coquelin <mcoquelin.stm32@gmail.com>
 M:      Alexandre Torgue <alexandre.torgue@st.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mcoquelin/stm32.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32.git stm32-next
 N:      stm32
+F:      arch/arm/boot/dts/stm32*
+F:      arch/arm/mach-stm32/
 F:      drivers/clocksource/armv7m_systick.c
 
 ARM/TANGO ARCHITECTURE
@@ -7600,8 +7602,10 @@ F:	mm/kasan/
 F:      scripts/Makefile.kasan
 
 KCONFIG
+M:      Masahiro Yamada <yamada.masahiro@socionext.com>
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild.git kconfig
 L:      linux-kbuild@vger.kernel.org
-S:      Orphan
+S:      Maintained
 F:      Documentation/kbuild/kconfig-language.txt
 F:      scripts/kconfig/
 
@@ -9921,6 +9925,13 @@ F:	Documentation/ABI/stable/sysfs-bus-nvmem
 F:      include/linux/nvmem-consumer.h
 F:      include/linux/nvmem-provider.h
 
+NXP SGTL5000 DRIVER
+M:      Fabio Estevam <fabio.estevam@nxp.com>
+L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
+S:      Maintained
+F:      Documentation/devicetree/bindings/sound/sgtl5000.txt
+F:      sound/soc/codecs/sgtl5000*
+
 NXP TDA998X DRM DRIVER
 M:      Russell King <linux@armlinux.org.uk>
 S:      Supported
@@ -10926,6 +10937,17 @@ L:	linux-gpio@vger.kernel.org
 S:      Supported
 F:      drivers/pinctrl/pinctrl-at91-pio4.*
 
+PIN CONTROLLER - FREESCALE
+M:      Dong Aisheng <aisheng.dong@nxp.com>
+M:      Fabio Estevam <festevam@gmail.com>
+M:      Shawn Guo <shawnguo@kernel.org>
+M:      Stefan Agner <stefan@agner.ch>
+R:      Pengutronix Kernel Team <kernel@pengutronix.de>
+L:      linux-gpio@vger.kernel.org
+S:      Maintained
+F:      drivers/pinctrl/freescale/
+F:      Documentation/devicetree/bindings/pinctrl/fsl,*
+
 PIN CONTROLLER - INTEL
 M:      Mika Westerberg <mika.westerberg@linux.intel.com>
 M:      Heikki Krogerus <heikki.krogerus@linux.intel.com>
@@ -12092,6 +12114,7 @@ M:	Sylwester Nawrocki <s.nawrocki@samsung.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 S:      Supported
 F:      sound/soc/samsung/
+F:      Documentation/devicetree/bindings/sound/samsung*
 
 SAMSUNG EXYNOS PSEUDO RANDOM NUMBER GENERATOR (RNG) DRIVER
 M:      Krzysztof Kozlowski <krzk@kernel.org>
diff --git a/Makefile b/Makefile
index 659a7780aeb3..d65e2e229017 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 4
 PATCHLEVEL = 16
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc6
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
@@ -388,7 +388,7 @@ PYTHON		= python
 CHECK           = sparse
 
 CHECKFLAGS     := -D__linux__ -Dlinux -D__STDC__ -Dunix -D__unix__ \
-                  -Wbitwise -Wno-return-void $(CF)
+                  -Wbitwise -Wno-return-void -Wno-unknown-attribute $(CF)
 NOSTDINC_FLAGS  =
 CFLAGS_MODULE   =
 AFLAGS_MODULE   =
@@ -489,6 +489,11 @@ KBUILD_CFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC)
 KBUILD_AFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC)
 endif
 
+RETPOLINE_CFLAGS_GCC := -mindirect-branch=thunk-extern -mindirect-branch-register
+RETPOLINE_CFLAGS_CLANG := -mretpoline-external-thunk
+RETPOLINE_CFLAGS := $(call cc-option,$(RETPOLINE_CFLAGS_GCC),$(call cc-option,$(RETPOLINE_CFLAGS_CLANG)))
+export RETPOLINE_CFLAGS
+
 ifeq ($(config-targets),1)
 # ===========================================================================
 # *config targets only - make sure prerequisites are updated, and descend
@@ -579,10 +584,9 @@ ifeq ($(KBUILD_EXTMOD),)
 # To avoid any implicit rule to kick in, define an empty command
 $(KCONFIG_CONFIG) include/config/auto.conf.cmd: ;
 
-# If .config is newer than include/config/auto.conf, someone tinkered
-# with it and forgot to run make oldconfig.
-# if auto.conf.cmd is missing then we are probably in a cleaned tree so
-# we execute the config step to be sure to catch updated Kconfig files
+# The actual configuration files used during the build are stored in
+# include/generated/ and include/config/. Update them if .config is newer than
+# include/config/auto.conf (which mirrors .config).
 include/config/%.conf: $(KCONFIG_CONFIG) include/config/auto.conf.cmd
         $(Q)$(MAKE) -f $(srctree)/Makefile silentoldconfig
 else
@@ -857,8 +861,7 @@ KBUILD_AFLAGS   += $(ARCH_AFLAGS)   $(KAFLAGS)
 KBUILD_CFLAGS   += $(ARCH_CFLAGS)   $(KCFLAGS)
 
 # Use --build-id when available.
-LDFLAGS_BUILD_ID := $(patsubst -Wl$(comma)%,%,\
-                              $(call cc-ldoption, -Wl$(comma)--build-id,))
+LDFLAGS_BUILD_ID := $(call ld-option, --build-id)
 KBUILD_LDFLAGS_MODULE += $(LDFLAGS_BUILD_ID)
 LDFLAGS_vmlinux += $(LDFLAGS_BUILD_ID)
 
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index f3a80cf164cc..d76bf4a83740 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -484,7 +484,6 @@ config ARC_CURR_IN_REG
 
 config ARC_EMUL_UNALIGNED
         bool "Emulate unaligned memory access (userspace only)"
-        default N
         select SYSCTL_ARCH_UNALIGN_NO_WARN
         select SYSCTL_ARCH_UNALIGN_ALLOW
         depends on ISA_ARCOMPACT
diff --git a/arch/arc/boot/dts/axs101.dts b/arch/arc/boot/dts/axs101.dts
index 70aec7d6ca60..626b694c7be7 100644
--- a/arch/arc/boot/dts/axs101.dts
+++ b/arch/arc/boot/dts/axs101.dts
@@ -17,6 +17,6 @@
         compatible = "snps,axs101", "snps,arc-sdp";
 
         chosen {
-                bootargs = "earlycon=uart8250,mmio32,0xe0022000,115200n8 console=tty0 console=ttyS3,115200n8 consoleblank=0 video=1280x720@60";
+                bootargs = "earlycon=uart8250,mmio32,0xe0022000,115200n8 console=tty0 console=ttyS3,115200n8 consoleblank=0 video=1280x720@60 print-fatal-signals=1";
         };
 };
diff --git a/arch/arc/boot/dts/axs10x_mb.dtsi b/arch/arc/boot/dts/axs10x_mb.dtsi
index 74d070cd3c13..47b74fbc403c 100644
--- a/arch/arc/boot/dts/axs10x_mb.dtsi
+++ b/arch/arc/boot/dts/axs10x_mb.dtsi
@@ -214,13 +214,13 @@
                         };
 
                         eeprom@0x54{
-                                compatible = "24c01";
+                                compatible = "atmel,24c01";
                                 reg = <0x54>;
                                 pagesize = <0x8>;
                         };
 
                         eeprom@0x57{
-                                compatible = "24c04";
+                                compatible = "atmel,24c04";
                                 reg = <0x57>;
                                 pagesize = <0x8>;
                         };
diff --git a/arch/arc/boot/dts/haps_hs_idu.dts b/arch/arc/boot/dts/haps_hs_idu.dts
index 215cddd0b63b..0c603308aeb3 100644
--- a/arch/arc/boot/dts/haps_hs_idu.dts
+++ b/arch/arc/boot/dts/haps_hs_idu.dts
@@ -22,7 +22,7 @@
         };
 
         chosen {
-                bootargs = "earlycon=uart8250,mmio32,0xf0000000,115200n8 console=ttyS0,115200n8 debug";
+                bootargs = "earlycon=uart8250,mmio32,0xf0000000,115200n8 console=ttyS0,115200n8 debug print-fatal-signals=1";
         };
 
         aliases {
diff --git a/arch/arc/boot/dts/nsim_700.dts b/arch/arc/boot/dts/nsim_700.dts
index 5ee96b067c08..ff2f2c70c545 100644
--- a/arch/arc/boot/dts/nsim_700.dts
+++ b/arch/arc/boot/dts/nsim_700.dts
@@ -17,7 +17,7 @@
         interrupt-parent = <&core_intc>;
 
         chosen {
-                bootargs = "earlycon=arc_uart,mmio32,0xc0fc1000,115200n8 console=ttyARC0,115200n8";
+                bootargs = "earlycon=arc_uart,mmio32,0xc0fc1000,115200n8 console=ttyARC0,115200n8 print-fatal-signals=1";
         };
 
         aliases {
diff --git a/arch/arc/boot/dts/nsim_hs.dts b/arch/arc/boot/dts/nsim_hs.dts
index 8d787b251f73..8e2489b16b0a 100644
--- a/arch/arc/boot/dts/nsim_hs.dts
+++ b/arch/arc/boot/dts/nsim_hs.dts
@@ -24,7 +24,7 @@
         };
 
         chosen {
-                bootargs = "earlycon=arc_uart,mmio32,0xc0fc1000,115200n8 console=ttyARC0,115200n8";
+                bootargs = "earlycon=arc_uart,mmio32,0xc0fc1000,115200n8 console=ttyARC0,115200n8 print-fatal-signals=1";
         };
 
         aliases {
diff --git a/arch/arc/boot/dts/nsim_hs_idu.dts b/arch/arc/boot/dts/nsim_hs_idu.dts
index 4f98ebf71fd8..ed12f494721d 100644
--- a/arch/arc/boot/dts/nsim_hs_idu.dts
+++ b/arch/arc/boot/dts/nsim_hs_idu.dts
@@ -15,7 +15,7 @@
         interrupt-parent = <&core_intc>;
 
         chosen {
-                bootargs = "earlycon=arc_uart,mmio32,0xc0fc1000,115200n8 console=ttyARC0,115200n8";
+                bootargs = "earlycon=arc_uart,mmio32,0xc0fc1000,115200n8 console=ttyARC0,115200n8 print-fatal-signals=1";
         };
 
         aliases {
diff --git a/arch/arc/boot/dts/nsimosci.dts b/arch/arc/boot/dts/nsimosci.dts
index 3c391ba565ed..7842e5eb4ab5 100644
--- a/arch/arc/boot/dts/nsimosci.dts
+++ b/arch/arc/boot/dts/nsimosci.dts
@@ -20,7 +20,7 @@
                 /* this is for console on PGU */
                 /* bootargs = "console=tty0 consoleblank=0"; */
                 /* this is for console on serial */
-                bootargs = "earlycon=uart8250,mmio32,0xf0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug video=640x480-24";
+                bootargs = "earlycon=uart8250,mmio32,0xf0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug video=640x480-24 print-fatal-signals=1";
         };
 
         aliases {
diff --git a/arch/arc/boot/dts/nsimosci_hs.dts b/arch/arc/boot/dts/nsimosci_hs.dts
index 14a727cbf4c9..b8838cf2b4ec 100644
--- a/arch/arc/boot/dts/nsimosci_hs.dts
+++ b/arch/arc/boot/dts/nsimosci_hs.dts
@@ -20,7 +20,7 @@
                 /* this is for console on PGU */
                 /* bootargs = "console=tty0 consoleblank=0"; */
                 /* this is for console on serial */
-                bootargs = "earlycon=uart8250,mmio32,0xf0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug video=640x480-24";
+                bootargs = "earlycon=uart8250,mmio32,0xf0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug video=640x480-24 print-fatal-signals=1";
         };
 
         aliases {
diff --git a/arch/arc/boot/dts/nsimosci_hs_idu.dts b/arch/arc/boot/dts/nsimosci_hs_idu.dts
index 5052917d4a99..72a2c723f1f7 100644
--- a/arch/arc/boot/dts/nsimosci_hs_idu.dts
+++ b/arch/arc/boot/dts/nsimosci_hs_idu.dts
@@ -18,7 +18,7 @@
 
         chosen {
                 /* this is for console on serial */
-                bootargs = "earlycon=uart8250,mmio32,0xf0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblan=0 debug video=640x480-24";
+                bootargs = "earlycon=uart8250,mmio32,0xf0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblan=0 debug video=640x480-24 print-fatal-signals=1";
         };
 
         aliases {
diff --git a/arch/arc/include/asm/entry-arcv2.h b/arch/arc/include/asm/entry-arcv2.h
index 257a68f3c2fe..309f4e6721b3 100644
--- a/arch/arc/include/asm/entry-arcv2.h
+++ b/arch/arc/include/asm/entry-arcv2.h
@@ -184,7 +184,7 @@
 .macro FAKE_RET_FROM_EXCPN
         lr      r9, [status32]
         bic     r9, r9, (STATUS_U_MASK|STATUS_DE_MASK|STATUS_AE_MASK)
-        or      r9, r9, (STATUS_L_MASK|STATUS_IE_MASK)
+        or      r9, r9, STATUS_IE_MASK
         kflag   r9
 .endm
 
diff --git a/arch/arc/kernel/mcip.c b/arch/arc/kernel/mcip.c
index f61a52b01625..5fe84e481654 100644
--- a/arch/arc/kernel/mcip.c
+++ b/arch/arc/kernel/mcip.c
@@ -22,10 +22,79 @@ static DEFINE_RAW_SPINLOCK(mcip_lock);
 
 static char smp_cpuinfo_buf[128];
 
+/*
+ * Set mask to halt GFRC if any online core in SMP cluster is halted.
+ * Only works for ARC HS v3.0+, on earlier versions has no effect.
+ */
+static void mcip_update_gfrc_halt_mask(int cpu)
+{
+        struct bcr_generic gfrc;
+        unsigned long flags;
+        u32 gfrc_halt_mask;
+
+        READ_BCR(ARC_REG_GFRC_BUILD, gfrc);
+
+        /*
+         * CMD_GFRC_SET_CORE and CMD_GFRC_READ_CORE commands were added in
+         * GFRC 0x3 version.
+         */
+        if (gfrc.ver < 0x3)
+                return;
+
+        raw_spin_lock_irqsave(&mcip_lock, flags);
+
+        __mcip_cmd(CMD_GFRC_READ_CORE, 0);
+        gfrc_halt_mask = read_aux_reg(ARC_REG_MCIP_READBACK);
+        gfrc_halt_mask |= BIT(cpu);
+        __mcip_cmd_data(CMD_GFRC_SET_CORE, 0, gfrc_halt_mask);
+
+        raw_spin_unlock_irqrestore(&mcip_lock, flags);
+}
+
+static void mcip_update_debug_halt_mask(int cpu)
+{
+        u32 mcip_mask = 0;
+        unsigned long flags;
+
+        raw_spin_lock_irqsave(&mcip_lock, flags);
+
+        /*
+         * mcip_mask is same for CMD_DEBUG_SET_SELECT and CMD_DEBUG_SET_MASK
+         * commands. So read it once instead of reading both CMD_DEBUG_READ_MASK
+         * and CMD_DEBUG_READ_SELECT.
+         */
+        __mcip_cmd(CMD_DEBUG_READ_SELECT, 0);
+        mcip_mask = read_aux_reg(ARC_REG_MCIP_READBACK);
+
+        mcip_mask |= BIT(cpu);
+
+        __mcip_cmd_data(CMD_DEBUG_SET_SELECT, 0, mcip_mask);
+        /*
+         * Parameter specified halt cause:
+         * STATUS32[H]/actionpoint/breakpoint/self-halt
+         * We choose all of them (0xF).
+         */
+        __mcip_cmd_data(CMD_DEBUG_SET_MASK, 0xF, mcip_mask);
+
+        raw_spin_unlock_irqrestore(&mcip_lock, flags);
+}
+
 static void mcip_setup_per_cpu(int cpu)
 {
+        struct mcip_bcr mp;
+
+        READ_BCR(ARC_REG_MCIP_BCR, mp);
+
         smp_ipi_irq_setup(cpu, IPI_IRQ);
         smp_ipi_irq_setup(cpu, SOFTIRQ_IRQ);
+
+        /* Update GFRC halt mask as new CPU came online */
+        if (mp.gfrc)
+                mcip_update_gfrc_halt_mask(cpu);
+
+        /* Update MCIP debug mask as new CPU came online */
+        if (mp.dbg)
+                mcip_update_debug_halt_mask(cpu);
 }
 
 static void mcip_ipi_send(int cpu)
@@ -101,11 +170,6 @@ static void mcip_probe_n_setup(void)
                 IS_AVAIL1(mp.gfrc, "GFRC"));
 
         cpuinfo_arc700[0].extn.gfrc = mp.gfrc;
-
-        if (mp.dbg) {
-                __mcip_cmd_data(CMD_DEBUG_SET_SELECT, 0, 0xf);
-                __mcip_cmd_data(CMD_DEBUG_SET_MASK, 0xf, 0xf);
-        }
 }
 
 struct plat_smp_ops plat_smp_ops = {
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index ec12fe1c2f07..b2cae79a25d7 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -51,7 +51,7 @@ static const struct id_to_str arc_cpu_rel[] = {
         { 0x51, "R2.0" },
         { 0x52, "R2.1" },
         { 0x53, "R3.0" },
-        { 0x54, "R4.0" },
+        { 0x54, "R3.10a" },
 #endif
         { 0x00, NULL   }
 };
diff --git a/arch/arc/kernel/smp.c b/arch/arc/kernel/smp.c
index efe8b4200a67..21d86c36692b 100644
--- a/arch/arc/kernel/smp.c
+++ b/arch/arc/kernel/smp.c
@@ -24,6 +24,7 @@
 #include <linux/reboot.h>
 #include <linux/irqdomain.h>
 #include <linux/export.h>
+#include <linux/of_fdt.h>
 
 #include <asm/processor.h>
 #include <asm/setup.h>
@@ -47,6 +48,42 @@ void __init smp_prepare_boot_cpu(void)
 {
 }
 
+static int __init arc_get_cpu_map(const char *name, struct cpumask *cpumask)
+{
+        unsigned long dt_root = of_get_flat_dt_root();
+        const char *buf;
+
+        buf = of_get_flat_dt_prop(dt_root, name, NULL);
+        if (!buf)
+                return -EINVAL;
+
+        if (cpulist_parse(buf, cpumask))
+                return -EINVAL;
+
+        return 0;
+}
+
+/*
+ * Read from DeviceTree and setup cpu possible mask. If there is no
+ * "possible-cpus" property in DeviceTree pretend all [0..NR_CPUS-1] exist.
+ */
+static void __init arc_init_cpu_possible(void)
+{
+        struct cpumask cpumask;
+
+        if (arc_get_cpu_map("possible-cpus", &cpumask)) {
+                pr_warn("Failed to get possible-cpus from dtb, pretending all %u cpus exist\n",
+                        NR_CPUS);
+
+                cpumask_setall(&cpumask);
+        }
+
+        if (!cpumask_test_cpu(0, &cpumask))
+                panic("Master cpu (cpu[0]) is missed in cpu possible mask!");
+
+        init_cpu_possible(&cpumask);
+}
+
 /*
  * Called from setup_arch() before calling setup_processor()
  *
@@ -58,10 +95,7 @@ void __init smp_prepare_boot_cpu(void)
  */
 void __init smp_init_cpus(void)
 {
-        unsigned int i;
-
-        for (i = 0; i < NR_CPUS; i++)
-                set_cpu_possible(i, true);
+        arc_init_cpu_possible();
 
         if (plat_smp_ops.init_early_smp)
                 plat_smp_ops.init_early_smp();
@@ -70,16 +104,12 @@ void __init smp_init_cpus(void)
 /* called from init ( ) =>  process 1 */
 void __init smp_prepare_cpus(unsigned int max_cpus)
 {
-        int i;
-
         /*
          * if platform didn't set the present map already, do it now
          * boot cpu is set to present already by init/main.c
          */
-        if (num_present_cpus() <= 1) {
-                for (i = 0; i < max_cpus; i++)
-                        set_cpu_present(i, true);
-        }
+        if (num_present_cpus() <= 1)
+                init_cpu_present(cpu_possible_mask);
 }
 
 void __init smp_cpus_done(unsigned int max_cpus)
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index eee924dfffa6..2072f3451e9c 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -780,7 +780,10 @@ noinline static void slc_entire_op(const int op)
 
         write_aux_reg(r, ctrl);
 
-        write_aux_reg(ARC_REG_SLC_INVALIDATE, 1);
+        if (op & OP_INV)        /* Inv or flush-n-inv use same cmd reg */
+                write_aux_reg(ARC_REG_SLC_INVALIDATE, 0x1);
+        else
+                write_aux_reg(ARC_REG_SLC_FLUSH, 0x1);
 
         /* Make sure "busy" bit reports correct stataus, see STAR 9001165532 */
         read_aux_reg(r);
diff --git a/arch/arm/boot/dts/bcm11351.dtsi b/arch/arm/boot/dts/bcm11351.dtsi
index 18045c38bcf1..db7cded1b7ad 100644
--- a/arch/arm/boot/dts/bcm11351.dtsi
+++ b/arch/arm/boot/dts/bcm11351.dtsi
@@ -55,7 +55,7 @@
                       <0x3ff00100 0x100>;
         };
 
-        smc@0x3404c000 {
+        smc@3404c000 {
                 compatible = "brcm,bcm11351-smc", "brcm,kona-smc";
                 reg = <0x3404c000 0x400>; /* 1 KiB in SRAM */
         };
diff --git a/arch/arm/boot/dts/bcm21664.dtsi b/arch/arm/boot/dts/bcm21664.dtsi
index 6dde95f21cef..266f2611dc22 100644
--- a/arch/arm/boot/dts/bcm21664.dtsi
+++ b/arch/arm/boot/dts/bcm21664.dtsi
@@ -55,7 +55,7 @@
                       <0x3ff00100 0x100>;
         };
 
-        smc@0x3404e000 {
+        smc@3404e000 {
                 compatible = "brcm,bcm21664-smc", "brcm,kona-smc";
                 reg = <0x3404e000 0x400>; /* 1 KiB in SRAM */
         };
diff --git a/arch/arm/boot/dts/bcm2835.dtsi b/arch/arm/boot/dts/bcm2835.dtsi
index 0e3d2a5ff208..a5c3824c8056 100644
--- a/arch/arm/boot/dts/bcm2835.dtsi
+++ b/arch/arm/boot/dts/bcm2835.dtsi
@@ -18,10 +18,10 @@
         soc {
                 ranges = <0x7e000000 0x20000000 0x02000000>;
                 dma-ranges = <0x40000000 0x00000000 0x20000000>;
+        };
 
-                arm-pmu {
-                        compatible = "arm,arm1176-pmu";
-                };
+        arm-pmu {
+                compatible = "arm,arm1176-pmu";
         };
 };
 
diff --git a/arch/arm/boot/dts/bcm2836.dtsi b/arch/arm/boot/dts/bcm2836.dtsi
index 1dfd76442777..c933e8413884 100644
--- a/arch/arm/boot/dts/bcm2836.dtsi
+++ b/arch/arm/boot/dts/bcm2836.dtsi
@@ -9,19 +9,19 @@
                          <0x40000000 0x40000000 0x00001000>;
                 dma-ranges = <0xc0000000 0x00000000 0x3f000000>;
 
-                local_intc: local_intc {
+                local_intc: local_intc@40000000 {
                         compatible = "brcm,bcm2836-l1-intc";
                         reg = <0x40000000 0x100>;
                         interrupt-controller;
                         #interrupt-cells = <2>;
                         interrupt-parent = <&local_intc>;
                 };
+        };
 
-                arm-pmu {
-                        compatible = "arm,cortex-a7-pmu";
-                        interrupt-parent = <&local_intc>;
-                        interrupts = <9 IRQ_TYPE_LEVEL_HIGH>;
-                };
+        arm-pmu {
+                compatible = "arm,cortex-a7-pmu";
+                interrupt-parent = <&local_intc>;
+                interrupts = <9 IRQ_TYPE_LEVEL_HIGH>;
         };
 
         timer {
diff --git a/arch/arm/boot/dts/bcm2837.dtsi b/arch/arm/boot/dts/bcm2837.dtsi
index efa7d3387ab2..7704bb029605 100644
--- a/arch/arm/boot/dts/bcm2837.dtsi
+++ b/arch/arm/boot/dts/bcm2837.dtsi
@@ -8,7 +8,7 @@
                          <0x40000000 0x40000000 0x00001000>;
                 dma-ranges = <0xc0000000 0x00000000 0x3f000000>;
 
-                local_intc: local_intc {
+                local_intc: local_intc@40000000 {
                         compatible = "brcm,bcm2836-l1-intc";
                         reg = <0x40000000 0x100>;
                         interrupt-controller;
diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
index 18db25a5a66e..9d293decf8d3 100644
--- a/arch/arm/boot/dts/bcm283x.dtsi
+++ b/arch/arm/boot/dts/bcm283x.dtsi
@@ -465,7 +465,7 @@
                         status = "disabled";
                 };
 
-                aux: aux@0x7e215000 {
+                aux: aux@7e215000 {
                         compatible = "brcm,bcm2835-aux";
                         #clock-cells = <1>;
                         reg = <0x7e215000 0x8>;
diff --git a/arch/arm/boot/dts/bcm958625hr.dts b/arch/arm/boot/dts/bcm958625hr.dts
index 6a44b8021702..f0e2008f7490 100644
--- a/arch/arm/boot/dts/bcm958625hr.dts
+++ b/arch/arm/boot/dts/bcm958625hr.dts
@@ -49,7 +49,7 @@
 
         memory {
                 device_type = "memory";
-                reg = <0x60000000 0x80000000>;
+                reg = <0x60000000 0x20000000>;
         };
 
         gpio-restart {
diff --git a/arch/arm/boot/dts/gemini-dlink-dns-313.dts b/arch/arm/boot/dts/gemini-dlink-dns-313.dts
index 08568ce24d06..da8bb9d60f99 100644
--- a/arch/arm/boot/dts/gemini-dlink-dns-313.dts
+++ b/arch/arm/boot/dts/gemini-dlink-dns-313.dts
@@ -269,7 +269,7 @@
 
                 sata: sata@46000000 {
                         /* The ROM uses this muxmode */
-                        cortina,gemini-ata-muxmode = <3>;
+                        cortina,gemini-ata-muxmode = <0>;
                         cortina,gemini-enable-sata-bridge;
                         status = "okay";
                 };
diff --git a/arch/arm/boot/dts/imx6dl-icore-rqs.dts b/arch/arm/boot/dts/imx6dl-icore-rqs.dts
index cf42c2f5cdc7..1281bc39b7ab 100644
--- a/arch/arm/boot/dts/imx6dl-icore-rqs.dts
+++ b/arch/arm/boot/dts/imx6dl-icore-rqs.dts
@@ -42,7 +42,7 @@
 
 /dts-v1/;
 
-#include "imx6q.dtsi"
+#include "imx6dl.dtsi"
 #include "imx6qdl-icore-rqs.dtsi"
 
 / {
diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi
index c1aa7a4518fb..a30ee9fcb3ae 100644
--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi
+++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi
@@ -71,6 +71,8 @@
 };
 
 &i2c1 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&i2c1_pins>;
         clock-frequency = <2600000>;
 
         twl: twl@48 {
@@ -189,7 +191,12 @@
                 >;
         };
 
-
+        i2c1_pins: pinmux_i2c1_pins {
+                pinctrl-single,pins = <
+                        OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0)        /* i2c1_scl.i2c1_scl */
+                        OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0)        /* i2c1_sda.i2c1_sda */
+                >;
+        };
 };
 
 &omap3_pmx_wkup {
diff --git a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
index b50b796e15c7..47915447a826 100644
--- a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
+++ b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
@@ -66,6 +66,8 @@
 };
 
 &i2c1 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&i2c1_pins>;
         clock-frequency = <2600000>;
 
         twl: twl@48 {
@@ -136,6 +138,12 @@
                         OMAP3_CORE1_IOPAD(0x21b8, PIN_INPUT | MUX_MODE0)        /* hsusb0_data7.hsusb0_data7 */
                 >;
         };
+        i2c1_pins: pinmux_i2c1_pins {
+                pinctrl-single,pins = <
+                        OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0)        /* i2c1_scl.i2c1_scl */
+                        OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0)        /* i2c1_sda.i2c1_sda */
+                >;
+        };
 };
 
 &uart2 {
diff --git a/arch/arm/boot/dts/omap5-uevm.dts b/arch/arm/boot/dts/omap5-uevm.dts
index ec2c8baef62a..592e17fd4eeb 100644
--- a/arch/arm/boot/dts/omap5-uevm.dts
+++ b/arch/arm/boot/dts/omap5-uevm.dts
@@ -47,7 +47,7 @@
                         gpios = <&gpio3 19 GPIO_ACTIVE_LOW>;    /* gpio3_83 */
                         wakeup-source;
                         autorepeat;
-                        debounce_interval = <50>;
+                        debounce-interval = <50>;
                 };
         };
 
diff --git a/arch/arm/boot/dts/rk3036.dtsi b/arch/arm/boot/dts/rk3036.dtsi
index 3b704cfed69a..a97458112ff6 100644
--- a/arch/arm/boot/dts/rk3036.dtsi
+++ b/arch/arm/boot/dts/rk3036.dtsi
@@ -280,7 +280,7 @@
                 max-frequency = <37500000>;
                 clocks = <&cru HCLK_SDIO>, <&cru SCLK_SDIO>,
                          <&cru SCLK_SDIO_DRV>, <&cru SCLK_SDIO_SAMPLE>;
-                clock-names = "biu", "ciu", "ciu_drv", "ciu_sample";
+                clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
                 fifo-depth = <0x100>;
                 interrupts = <GIC_SPI 15 IRQ_TYPE_LEVEL_HIGH>;
                 resets = <&cru SRST_SDIO>;
@@ -298,7 +298,7 @@
                 max-frequency = <37500000>;
                 clocks = <&cru HCLK_EMMC>, <&cru SCLK_EMMC>,
                          <&cru SCLK_EMMC_DRV>, <&cru SCLK_EMMC_SAMPLE>;
-                clock-names = "biu", "ciu", "ciu_drv", "ciu_sample";
+                clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
                 default-sample-phase = <158>;
                 disable-wp;
                 dmas = <&pdma 12>;
diff --git a/arch/arm/boot/dts/rk322x.dtsi b/arch/arm/boot/dts/rk322x.dtsi
index 780ec3a99b21..341deaf62ff6 100644
--- a/arch/arm/boot/dts/rk322x.dtsi
+++ b/arch/arm/boot/dts/rk322x.dtsi
@@ -621,7 +621,7 @@
                 interrupts = <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&cru HCLK_SDMMC>, <&cru SCLK_SDMMC>,
                          <&cru SCLK_SDMMC_DRV>, <&cru SCLK_SDMMC_SAMPLE>;
-                clock-names = "biu", "ciu", "ciu_drv", "ciu_sample";
+                clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
                 fifo-depth = <0x100>;
                 pinctrl-names = "default";
                 pinctrl-0 = <&sdmmc_clk &sdmmc_cmd &sdmmc_bus4>;
@@ -634,7 +634,7 @@
                 interrupts = <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&cru HCLK_SDIO>, <&cru SCLK_SDIO>,
                          <&cru SCLK_SDIO_DRV>, <&cru SCLK_SDIO_SAMPLE>;
-                clock-names = "biu", "ciu", "ciu_drv", "ciu_sample";
+                clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
                 fifo-depth = <0x100>;
                 pinctrl-names = "default";
                 pinctrl-0 = <&sdio_clk &sdio_cmd &sdio_bus4>;
@@ -649,7 +649,7 @@
                 max-frequency = <37500000>;
                 clocks = <&cru HCLK_EMMC>, <&cru SCLK_EMMC>,
                          <&cru SCLK_EMMC_DRV>, <&cru SCLK_EMMC_SAMPLE>;
-                clock-names = "biu", "ciu", "ciu_drv", "ciu_sample";
+                clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
                 bus-width = <8>;
                 default-sample-phase = <158>;
                 fifo-depth = <0x100>;
diff --git a/arch/arm/boot/dts/rk3288-phycore-som.dtsi b/arch/arm/boot/dts/rk3288-phycore-som.dtsi
index 99cfae875e12..5eae4776ffde 100644
--- a/arch/arm/boot/dts/rk3288-phycore-som.dtsi
+++ b/arch/arm/boot/dts/rk3288-phycore-som.dtsi
@@ -110,26 +110,6 @@
         };
 };
 
-&cpu0 {
-        cpu0-supply = <&vdd_cpu>;
-        operating-points = <
-                /* KHz    uV */
-                1800000 1400000
-                1608000 1350000
-                1512000 1300000
-                1416000 1200000
-                1200000 1100000
-                1008000 1050000
-                 816000 1000000
-                 696000  950000
-                 600000  900000
-                 408000  900000
-                 312000  900000
-                 216000  900000
-                 126000  900000
-        >;
-};
-
 &emmc {
         status = "okay";
         bus-width = <8>;
diff --git a/arch/arm/boot/dts/zx296702.dtsi b/arch/arm/boot/dts/zx296702.dtsi
index 8a74efdb6360..240e7a23d81f 100644
--- a/arch/arm/boot/dts/zx296702.dtsi
+++ b/arch/arm/boot/dts/zx296702.dtsi
@@ -56,7 +56,7 @@
                         clocks = <&topclk ZX296702_A9_PERIPHCLK>;
                 };
 
-                l2cc: l2-cache-controller@0x00c00000 {
+                l2cc: l2-cache-controller@c00000 {
                         compatible = "arm,pl310-cache";
                         reg = <0x00c00000 0x1000>;
                         cache-unified;
@@ -67,30 +67,30 @@
                         arm,double-linefill-incr = <0>;
                 };
 
-                pcu: pcu@0xa0008000 {
+                pcu: pcu@a0008000 {
                         compatible = "zte,zx296702-pcu";
                         reg = <0xa0008000 0x1000>;
                 };
 
-                topclk: topclk@0x09800000 {
+                topclk: topclk@9800000 {
                         compatible = "zte,zx296702-topcrm-clk";
                         reg = <0x09800000 0x1000>;
                         #clock-cells = <1>;
                 };
 
-                lsp1clk: lsp1clk@0x09400000 {
+                lsp1clk: lsp1clk@9400000 {
                         compatible = "zte,zx296702-lsp1crpm-clk";
                         reg = <0x09400000 0x1000>;
                         #clock-cells = <1>;
                 };
 
-                lsp0clk: lsp0clk@0x0b000000 {
+                lsp0clk: lsp0clk@b000000 {
                         compatible = "zte,zx296702-lsp0crpm-clk";
                         reg = <0x0b000000 0x1000>;
                         #clock-cells = <1>;
                 };
 
-                uart0: serial@0x09405000 {
+                uart0: serial@9405000 {
                         compatible = "zte,zx296702-uart";
                         reg = <0x09405000 0x1000>;
                         interrupts = <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>;
@@ -98,7 +98,7 @@
                         status = "disabled";
                 };
 
-                uart1: serial@0x09406000 {
+                uart1: serial@9406000 {
                         compatible = "zte,zx296702-uart";
                         reg = <0x09406000 0x1000>;
                         interrupts = <GIC_SPI 38 IRQ_TYPE_LEVEL_HIGH>;
@@ -106,7 +106,7 @@
                         status = "disabled";
                 };
 
-                mmc0: mmc@0x09408000 {
+                mmc0: mmc@9408000 {
                         compatible = "snps,dw-mshc";
                         #address-cells = <1>;
                         #size-cells = <0>;
@@ -119,7 +119,7 @@
                         status = "disabled";
                 };
 
-                mmc1: mmc@0x0b003000 {
+                mmc1: mmc@b003000 {
                         compatible = "snps,dw-mshc";
                         #address-cells = <1>;
                         #size-cells = <0>;
@@ -132,7 +132,7 @@
                         status = "disabled";
                 };
 
-                sysctrl: sysctrl@0xa0007000 {
+                sysctrl: sysctrl@a0007000 {
                         compatible = "zte,sysctrl", "syscon";
                         reg = <0xa0007000 0x1000>;
                 };
diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index 2f145c4af93a..92674f247a12 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -319,7 +319,7 @@ CONFIG_MEDIA_CAMERA_SUPPORT=y
 CONFIG_RC_CORE=m
 CONFIG_MEDIA_CONTROLLER=y
 CONFIG_VIDEO_V4L2_SUBDEV_API=y
-CONFIG_LIRC=m
+CONFIG_LIRC=y
 CONFIG_RC_DEVICES=y
 CONFIG_IR_RX51=m
 CONFIG_V4L_PLATFORM_DRIVERS=y
diff --git a/arch/arm/kvm/hyp/Makefile b/arch/arm/kvm/hyp/Makefile
index 5638ce0c9524..63d6b404d88e 100644
--- a/arch/arm/kvm/hyp/Makefile
+++ b/arch/arm/kvm/hyp/Makefile
@@ -7,6 +7,8 @@ ccflags-y += -fno-stack-protector -DDISABLE_BRANCH_PROFILING
 
 KVM=../../../../virt/kvm
 
+CFLAGS_ARMV7VE             :=$(call cc-option, -march=armv7ve)
+
 obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/vgic-v2-sr.o
 obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/vgic-v3-sr.o
 obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/timer-sr.o
@@ -15,7 +17,10 @@ obj-$(CONFIG_KVM_ARM_HOST) += tlb.o
 obj-$(CONFIG_KVM_ARM_HOST) += cp15-sr.o
 obj-$(CONFIG_KVM_ARM_HOST) += vfp.o
 obj-$(CONFIG_KVM_ARM_HOST) += banked-sr.o
+CFLAGS_banked-sr.o         += $(CFLAGS_ARMV7VE)
+
 obj-$(CONFIG_KVM_ARM_HOST) += entry.o
 obj-$(CONFIG_KVM_ARM_HOST) += hyp-entry.o
 obj-$(CONFIG_KVM_ARM_HOST) += switch.o
+CFLAGS_switch.o            += $(CFLAGS_ARMV7VE)
 obj-$(CONFIG_KVM_ARM_HOST) += s2-setup.o
diff --git a/arch/arm/kvm/hyp/banked-sr.c b/arch/arm/kvm/hyp/banked-sr.c
index 111bda8cdebd..be4b8b0a40ad 100644
--- a/arch/arm/kvm/hyp/banked-sr.c
+++ b/arch/arm/kvm/hyp/banked-sr.c
@@ -20,6 +20,10 @@
 
 #include <asm/kvm_hyp.h>
 
+/*
+ * gcc before 4.9 doesn't understand -march=armv7ve, so we have to
+ * trick the assembler.
+ */
 __asm__(".arch_extension     virt");
 
 void __hyp_text __banked_save_state(struct kvm_cpu_context *ctxt)
diff --git a/arch/arm/mach-clps711x/board-dt.c b/arch/arm/mach-clps711x/board-dt.c
index ee1f83b1a332..4c89a8e9a2e3 100644
--- a/arch/arm/mach-clps711x/board-dt.c
+++ b/arch/arm/mach-clps711x/board-dt.c
@@ -69,7 +69,7 @@ static void clps711x_restart(enum reboot_mode mode, const char *cmd)
         soft_restart(0);
 }
 
-static const char *clps711x_compat[] __initconst = {
+static const char *const clps711x_compat[] __initconst = {
         "cirrus,ep7209",
         NULL
 };
diff --git a/arch/arm/mach-davinci/board-dm355-evm.c b/arch/arm/mach-davinci/board-dm355-evm.c
index e457f299cd44..d6b11907380c 100644
--- a/arch/arm/mach-davinci/board-dm355-evm.c
+++ b/arch/arm/mach-davinci/board-dm355-evm.c
@@ -368,7 +368,7 @@ static struct spi_eeprom at25640a = {
         .flags          = EE_ADDR2,
 };
 
-static struct spi_board_info dm355_evm_spi_info[] __initconst = {
+static const struct spi_board_info dm355_evm_spi_info[] __initconst = {
         {
                 .modalias       = "at25",
                 .platform_data  = &at25640a,
diff --git a/arch/arm/mach-davinci/board-dm355-leopard.c b/arch/arm/mach-davinci/board-dm355-leopard.c
index be997243447b..fad9a5611a5d 100644
--- a/arch/arm/mach-davinci/board-dm355-leopard.c
+++ b/arch/arm/mach-davinci/board-dm355-leopard.c
@@ -217,7 +217,7 @@ static struct spi_eeprom at25640a = {
         .flags          = EE_ADDR2,
 };
 
-static struct spi_board_info dm355_leopard_spi_info[] __initconst = {
+static const struct spi_board_info dm355_leopard_spi_info[] __initconst = {
         {
                 .modalias       = "at25",
                 .platform_data  = &at25640a,
diff --git a/arch/arm/mach-davinci/board-dm365-evm.c b/arch/arm/mach-davinci/board-dm365-evm.c
index e75741fb2c1d..e3780986d2a3 100644
--- a/arch/arm/mach-davinci/board-dm365-evm.c
+++ b/arch/arm/mach-davinci/board-dm365-evm.c
@@ -726,7 +726,7 @@ static struct spi_eeprom at25640 = {
         .flags          = EE_ADDR2,
 };
 
-static struct spi_board_info dm365_evm_spi_info[] __initconst = {
+static const struct spi_board_info dm365_evm_spi_info[] __initconst = {
         {
                 .modalias       = "at25",
                 .platform_data  = &at25640,
diff --git a/arch/arm/mach-mvebu/Kconfig b/arch/arm/mach-mvebu/Kconfig
index 6b32dc527edc..2c20599cc350 100644
--- a/arch/arm/mach-mvebu/Kconfig
+++ b/arch/arm/mach-mvebu/Kconfig
@@ -41,7 +41,7 @@ config MACH_ARMADA_375
         depends on ARCH_MULTI_V7
         select ARMADA_370_XP_IRQ
         select ARM_ERRATA_720789
-        select ARM_ERRATA_753970
+        select PL310_ERRATA_753970
         select ARM_GIC
         select ARMADA_375_CLK
         select HAVE_ARM_SCU
@@ -57,7 +57,7 @@ config MACH_ARMADA_38X
         bool "Marvell Armada 380/385 boards"
         depends on ARCH_MULTI_V7
         select ARM_ERRATA_720789
-        select ARM_ERRATA_753970
+        select PL310_ERRATA_753970
         select ARM_GIC
         select ARM_GLOBAL_TIMER
         select CLKSRC_ARM_GLOBAL_TIMER_SCHED_CLOCK
diff --git a/arch/arm/mach-omap1/clock.c b/arch/arm/mach-omap1/clock.c
index 43e3e188f521..fa512413a471 100644
--- a/arch/arm/mach-omap1/clock.c
+++ b/arch/arm/mach-omap1/clock.c
@@ -1011,17 +1011,17 @@ static int clk_debugfs_register_one(struct clk *c)
                 return -ENOMEM;
         c->dent = d;
 
-        d = debugfs_create_u8("usecount", S_IRUGO, c->dent, (u8 *)&c->usecount);
+        d = debugfs_create_u8("usecount", S_IRUGO, c->dent, &c->usecount);
         if (!d) {
                 err = -ENOMEM;
                 goto err_out;
         }
-        d = debugfs_create_u32("rate", S_IRUGO, c->dent, (u32 *)&c->rate);
+        d = debugfs_create_ulong("rate", S_IRUGO, c->dent, &c->rate);
         if (!d) {
                 err = -ENOMEM;
                 goto err_out;
         }
-        d = debugfs_create_x32("flags", S_IRUGO, c->dent, (u32 *)&c->flags);
+        d = debugfs_create_x8("flags", S_IRUGO, c->dent, &c->flags);
         if (!d) {
                 err = -ENOMEM;
                 goto err_out;
diff --git a/arch/arm/mach-omap2/omap-wakeupgen.c b/arch/arm/mach-omap2/omap-wakeupgen.c
index 4bb6751864a5..fc5fb776a710 100644
--- a/arch/arm/mach-omap2/omap-wakeupgen.c
+++ b/arch/arm/mach-omap2/omap-wakeupgen.c
@@ -299,8 +299,6 @@ static void irq_save_context(void)
         if (soc_is_dra7xx())
                 return;
 
-        if (!sar_base)
-                sar_base = omap4_get_sar_ram_base();
         if (wakeupgen_ops && wakeupgen_ops->save_context)
                 wakeupgen_ops->save_context();
 }
@@ -598,6 +596,8 @@ static int __init wakeupgen_init(struct device_node *node,
         irq_hotplug_init();
         irq_pm_init();
 
+        sar_base = omap4_get_sar_ram_base();
+
         return 0;
 }
 IRQCHIP_DECLARE(ti_wakeupgen, "ti,omap4-wugen-mpu", wakeupgen_init);
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 124f9af34a15..34156eca8e23 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -977,6 +977,9 @@ static int _enable_clocks(struct omap_hwmod *oh)
 
         pr_debug("omap_hwmod: %s: enabling clocks\n", oh->name);
 
+        if (oh->flags & HWMOD_OPT_CLKS_NEEDED)
+                _enable_optional_clocks(oh);
+
         if (oh->_clk)
                 clk_enable(oh->_clk);
 
@@ -985,9 +988,6 @@ static int _enable_clocks(struct omap_hwmod *oh)
                         clk_enable(os->_clk);
         }
 
-        if (oh->flags & HWMOD_OPT_CLKS_NEEDED)
-                _enable_optional_clocks(oh);
-
         /* The opt clocks are controlled by the device driver. */
 
         return 0;
diff --git a/arch/arm/mach-omap2/pm.c b/arch/arm/mach-omap2/pm.c
index 366158a54fcd..6f68576e5695 100644
--- a/arch/arm/mach-omap2/pm.c
+++ b/arch/arm/mach-omap2/pm.c
@@ -186,7 +186,7 @@ static void omap_pm_end(void)
         cpu_idle_poll_ctrl(false);
 }
 
-static void omap_pm_finish(void)
+static void omap_pm_wake(void)
 {
         if (soc_is_omap34xx())
                 omap_prcm_irq_complete();
@@ -196,7 +196,7 @@ static const struct platform_suspend_ops omap_pm_ops = {
         .begin          = omap_pm_begin,
         .end            = omap_pm_end,
         .enter          = omap_pm_enter,
-        .finish         = omap_pm_finish,
+        .wake           = omap_pm_wake,
         .valid          = suspend_valid_only_mem,
 };
 
diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
index ece09c9461f7..d61fbd7a2840 100644
--- a/arch/arm/mach-omap2/timer.c
+++ b/arch/arm/mach-omap2/timer.c
@@ -156,12 +156,6 @@ static struct clock_event_device clockevent_gpt = {
         .tick_resume            = omap2_gp_timer_shutdown,
 };
 
-static struct property device_disabled = {
-        .name = "status",
-        .length = sizeof("disabled"),
-        .value = "disabled",
-};
-
 static const struct of_device_id omap_timer_match[] __initconst = {
         { .compatible = "ti,omap2420-timer", },
         { .compatible = "ti,omap3430-timer", },
@@ -203,8 +197,17 @@ static struct device_node * __init omap_get_timer_dt(const struct of_device_id *
                                   of_get_property(np, "ti,timer-secure", NULL)))
                         continue;
 
-                if (!of_device_is_compatible(np, "ti,omap-counter32k"))
-                        of_add_property(np, &device_disabled);
+                if (!of_device_is_compatible(np, "ti,omap-counter32k")) {
+                        struct property *prop;
+
+                        prop = kzalloc(sizeof(*prop), GFP_KERNEL);
+                        if (!prop)
+                                return NULL;
+                        prop->name = "status";
+                        prop->value = "disabled";
+                        prop->length = strlen(prop->value);
+                        of_add_property(np, prop);
+                }
                 return np;
         }
 
diff --git a/arch/arm/mach-orion5x/Kconfig b/arch/arm/mach-orion5x/Kconfig
index 2a7bb6ccdcb7..a810f4dd34b1 100644
--- a/arch/arm/mach-orion5x/Kconfig
+++ b/arch/arm/mach-orion5x/Kconfig
@@ -58,7 +58,6 @@ config MACH_KUROBOX_PRO
 
 config MACH_DNS323
         bool "D-Link DNS-323"
-        select GENERIC_NET_UTILS
         select I2C_BOARDINFO if I2C
         help
           Say 'Y' here if you want your kernel to support the
@@ -66,7 +65,6 @@ config MACH_DNS323
 
 config MACH_TS209
         bool "QNAP TS-109/TS-209"
-        select GENERIC_NET_UTILS
         help
           Say 'Y' here if you want your kernel to support the
           QNAP TS-109/TS-209 platform.
@@ -101,7 +99,6 @@ config MACH_LINKSTATION_LS_HGL
 
 config MACH_TS409
         bool "QNAP TS-409"
-        select GENERIC_NET_UTILS
         help
           Say 'Y' here if you want your kernel to support the
           QNAP TS-409 platform.
diff --git a/arch/arm/mach-orion5x/dns323-setup.c b/arch/arm/mach-orion5x/dns323-setup.c
index cd483bfb5ca8..d13344b2ddcd 100644
--- a/arch/arm/mach-orion5x/dns323-setup.c
+++ b/arch/arm/mach-orion5x/dns323-setup.c
@@ -173,10 +173,42 @@ static struct mv643xx_eth_platform_data dns323_eth_data = {
         .phy_addr = MV643XX_ETH_PHY_ADDR(8),
 };
 
+/* dns323_parse_hex_*() taken from tsx09-common.c; should a common copy of these
+ * functions be kept somewhere?
+ */
+static int __init dns323_parse_hex_nibble(char n)
+{
+        if (n >= '0' && n <= '9')
+                return n - '0';
+
+        if (n >= 'A' && n <= 'F')
+                return n - 'A' + 10;
+
+        if (n >= 'a' && n <= 'f')
+                return n - 'a' + 10;
+
+        return -1;
+}
+
+static int __init dns323_parse_hex_byte(const char *b)
+{
+        int hi;
+        int lo;
+
+        hi = dns323_parse_hex_nibble(b[0]);
+        lo = dns323_parse_hex_nibble(b[1]);
+
+        if (hi < 0 || lo < 0)
+                return -1;
+
+        return (hi << 4) | lo;
+}
+
 static int __init dns323_read_mac_addr(void)
 {
         u_int8_t addr[6];
-        void __iomem *mac_page;
+        int i;
+        char *mac_page;
 
         /* MAC address is stored as a regular ol' string in /dev/mtdblock4
          * (0x007d0000-0x00800000) starting at offset 196480 (0x2ff80).
@@ -185,8 +217,23 @@ static int __init dns323_read_mac_addr(void)
         if (!mac_page)
                 return -ENOMEM;
 
-        if (!mac_pton((__force const char *) mac_page, addr))
-                goto error_fail;
+        /* Sanity check the string we're looking at */
+        for (i = 0; i < 5; i++) {
+                if (*(mac_page + (i * 3) + 2) != ':') {
+                        goto error_fail;
+                }
+        }
+
+        for (i = 0; i < 6; i++) {
+                int byte;
+
+                byte = dns323_parse_hex_byte(mac_page + (i * 3));
+                if (byte < 0) {
+                        goto error_fail;
+                }
+
+                addr[i] = byte;
+        }
 
         iounmap(mac_page);
         printk("DNS-323: Found ethernet MAC address: %pM\n", addr);
diff --git a/arch/arm/mach-orion5x/tsx09-common.c b/arch/arm/mach-orion5x/tsx09-common.c
index 89774985d380..905d4f2dd0b8 100644
--- a/arch/arm/mach-orion5x/tsx09-common.c
+++ b/arch/arm/mach-orion5x/tsx09-common.c
@@ -53,12 +53,53 @@ struct mv643xx_eth_platform_data qnap_tsx09_eth_data = {
         .phy_addr       = MV643XX_ETH_PHY_ADDR(8),
 };
 
+static int __init qnap_tsx09_parse_hex_nibble(char n)
+{
+        if (n >= '0' && n <= '9')
+                return n - '0';
+
+        if (n >= 'A' && n <= 'F')
+                return n - 'A' + 10;
+
+        if (n >= 'a' && n <= 'f')
+                return n - 'a' + 10;
+
+        return -1;
+}
+
+static int __init qnap_tsx09_parse_hex_byte(const char *b)
+{
+        int hi;
+        int lo;
+
+        hi = qnap_tsx09_parse_hex_nibble(b[0]);
+        lo = qnap_tsx09_parse_hex_nibble(b[1]);
+
+        if (hi < 0 || lo < 0)
+                return -1;
+
+        return (hi << 4) | lo;
+}
+
 static int __init qnap_tsx09_check_mac_addr(const char *addr_str)
 {
         u_int8_t addr[6];
+        int i;
 
-        if (!mac_pton(addr_str, addr))
-                return -1;
+        for (i = 0; i < 6; i++) {
+                int byte;
+
+                /*
+                 * Enforce "xx:xx:xx:xx:xx:xx\n" format.
+                 */
+                if (addr_str[(i * 3) + 2] != ((i < 5) ? ':' : '\n'))
+                        return -1;
+
+                byte = qnap_tsx09_parse_hex_byte(addr_str + (i * 3));
+                if (byte < 0)
+                        return -1;
+                addr[i] = byte;
+        }
 
         printk(KERN_INFO "tsx09: found ethernet mac address %pM\n", addr);
 
@@ -77,12 +118,12 @@ void __init qnap_tsx09_find_mac_addr(u32 mem_base, u32 size)
         unsigned long addr;
 
         for (addr = mem_base; addr < (mem_base + size); addr += 1024) {
-                void __iomem *nor_page;
+                char *nor_page;
                 int ret = 0;
 
                 nor_page = ioremap(addr, 1024);
                 if (nor_page != NULL) {
-                        ret = qnap_tsx09_check_mac_addr((__force const char *)nor_page);
+                        ret = qnap_tsx09_check_mac_addr(nor_page);
                         iounmap(nor_page);
                 }
 
diff --git a/arch/arm/plat-orion/common.c b/arch/arm/plat-orion/common.c
index aff6994950ba..a2399fd66e97 100644
--- a/arch/arm/plat-orion/common.c
+++ b/arch/arm/plat-orion/common.c
@@ -472,28 +472,27 @@ void __init orion_ge11_init(struct mv643xx_eth_platform_data *eth_data,
 /*****************************************************************************
  * Ethernet switch
  ****************************************************************************/
-static __initconst const char *orion_ge00_mvmdio_bus_name = "orion-mii";
-static __initdata struct mdio_board_info
-                  orion_ge00_switch_board_info;
+static __initdata struct mdio_board_info orion_ge00_switch_board_info = {
+        .bus_id   = "orion-mii",
+        .modalias = "mv88e6085",
+};
 
 void __init orion_ge00_switch_init(struct dsa_chip_data *d)
 {
-        struct mdio_board_info *bd;
         unsigned int i;
 
         if (!IS_BUILTIN(CONFIG_PHYLIB))
                 return;
 
-        for (i = 0; i < ARRAY_SIZE(d->port_names); i++)
-                if (!strcmp(d->port_names[i], "cpu"))
+        for (i = 0; i < ARRAY_SIZE(d->port_names); i++) {
+                if (!strcmp(d->port_names[i], "cpu")) {
+                        d->netdev[i] = &orion_ge00.dev;
                         break;
+                }
+        }
 
-        bd = &orion_ge00_switch_board_info;
-        bd->bus_id = orion_ge00_mvmdio_bus_name;
-        bd->mdio_addr = d->sw_addr;
-        d->netdev[i] = &orion_ge00.dev;
-        strcpy(bd->modalias, "mv88e6085");
-        bd->platform_data = d;
+        orion_ge00_switch_board_info.mdio_addr = d->sw_addr;
+        orion_ge00_switch_board_info.platform_data = d;
 
         mdiobus_register_board_info(&orion_ge00_switch_board_info, 1);
 }
diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
index a80632641b39..70c776ef7aa7 100644
--- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
@@ -165,14 +165,14 @@
 
                         uart_A: serial@24000 {
                                 compatible = "amlogic,meson-gx-uart", "amlogic,meson-uart";
-                                reg = <0x0 0x24000 0x0 0x14>;
+                                reg = <0x0 0x24000 0x0 0x18>;
                                 interrupts = <GIC_SPI 26 IRQ_TYPE_EDGE_RISING>;
                                 status = "disabled";
                         };
 
                         uart_B: serial@23000 {
                                 compatible = "amlogic,meson-gx-uart", "amlogic,meson-uart";
-                                reg = <0x0 0x23000 0x0 0x14>;
+                                reg = <0x0 0x23000 0x0 0x18>;
                                 interrupts = <GIC_SPI 75 IRQ_TYPE_EDGE_RISING>;
                                 status = "disabled";
                         };
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
index 6cb3c2a52baf..4ee2e7951482 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
@@ -235,14 +235,14 @@
 
                         uart_A: serial@84c0 {
                                 compatible = "amlogic,meson-gx-uart";
-                                reg = <0x0 0x84c0 0x0 0x14>;
+                                reg = <0x0 0x84c0 0x0 0x18>;
                                 interrupts = <GIC_SPI 26 IRQ_TYPE_EDGE_RISING>;
                                 status = "disabled";
                         };
 
                         uart_B: serial@84dc {
                                 compatible = "amlogic,meson-gx-uart";
-                                reg = <0x0 0x84dc 0x0 0x14>;
+                                reg = <0x0 0x84dc 0x0 0x18>;
                                 interrupts = <GIC_SPI 75 IRQ_TYPE_EDGE_RISING>;
                                 status = "disabled";
                         };
@@ -287,7 +287,7 @@
 
                         uart_C: serial@8700 {
                                 compatible = "amlogic,meson-gx-uart";
-                                reg = <0x0 0x8700 0x0 0x14>;
+                                reg = <0x0 0x8700 0x0 0x18>;
                                 interrupts = <GIC_SPI 93 IRQ_TYPE_EDGE_RISING>;
                                 status = "disabled";
                         };
@@ -404,14 +404,14 @@
 
                         uart_AO: serial@4c0 {
                                 compatible = "amlogic,meson-gx-uart", "amlogic,meson-ao-uart";
-                                reg = <0x0 0x004c0 0x0 0x14>;
+                                reg = <0x0 0x004c0 0x0 0x18>;
                                 interrupts = <GIC_SPI 193 IRQ_TYPE_EDGE_RISING>;
                                 status = "disabled";
                         };
 
                         uart_AO_B: serial@4e0 {
                                 compatible = "amlogic,meson-gx-uart", "amlogic,meson-ao-uart";
-                                reg = <0x0 0x004e0 0x0 0x14>;
+                                reg = <0x0 0x004e0 0x0 0x18>;
                                 interrupts = <GIC_SPI 197 IRQ_TYPE_EDGE_RISING>;
                                 status = "disabled";
                         };
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
index 4f355f17eed6..c8514110b9da 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
@@ -631,6 +631,7 @@
 
                         internal_phy: ethernet-phy@8 {
                                 compatible = "ethernet-phy-id0181.4400", "ethernet-phy-ieee802.3-c22";
+                                interrupts = <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>;
                                 reg = <8>;
                                 max-speed = <100>;
                         };
diff --git a/arch/arm64/boot/dts/cavium/thunder2-99xx.dtsi b/arch/arm64/boot/dts/cavium/thunder2-99xx.dtsi
index 4220fbdcb24a..ff5c4c47b22b 100644
--- a/arch/arm64/boot/dts/cavium/thunder2-99xx.dtsi
+++ b/arch/arm64/boot/dts/cavium/thunder2-99xx.dtsi
@@ -98,7 +98,7 @@
                 clock-output-names = "clk125mhz";
         };
 
-        pci {
+        pcie@30000000 {
                 compatible = "pci-host-ecam-generic";
                 device_type = "pci";
                 #interrupt-cells = <1>;
@@ -118,6 +118,7 @@
                 ranges =
                   <0x02000000    0 0x40000000    0 0x40000000    0 0x20000000
                    0x43000000 0x40 0x00000000 0x40 0x00000000 0x20 0x00000000>;
+                bus-range = <0 0xff>;
                 interrupt-map-mask = <0 0 0 7>;
                 interrupt-map =
                       /* addr  pin  ic   icaddr  icintr */
diff --git a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
index e94fa1a53192..047641fe294c 100644
--- a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
+++ b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
@@ -51,7 +51,7 @@
                 #size-cells = <2>;
                 ranges;
 
-                ramoops@0x21f00000 {
+                ramoops@21f00000 {
                         compatible = "ramoops";
                         reg = <0x0 0x21f00000 0x0 0x00100000>;
                         record-size     = <0x00020000>;
diff --git a/arch/arm64/boot/dts/mediatek/mt8173.dtsi b/arch/arm64/boot/dts/mediatek/mt8173.dtsi
index 9fbe4705ee88..94597e33c806 100644
--- a/arch/arm64/boot/dts/mediatek/mt8173.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8173.dtsi
@@ -341,7 +341,7 @@
                         reg = <0 0x10005000 0 0x1000>;
                 };
 
-                pio: pinctrl@0x10005000 {
+                pio: pinctrl@10005000 {
                         compatible = "mediatek,mt8173-pinctrl";
                         reg = <0 0x1000b000 0 0x1000>;
                         mediatek,pctl-regmap = <&syscfg_pctl_a>;
diff --git a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi b/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi
index 492a011f14f6..1c8f1b86472d 100644
--- a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi
+++ b/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi
@@ -140,16 +140,16 @@
                 };
 
                 agnoc@0 {
-                        qcom,pcie@00600000 {
+                        qcom,pcie@600000 {
                                 perst-gpio = <&msmgpio 35 GPIO_ACTIVE_LOW>;
                         };
 
-                        qcom,pcie@00608000 {
+                        qcom,pcie@608000 {
                                 status = "okay";
                                 perst-gpio = <&msmgpio 130 GPIO_ACTIVE_LOW>;
                         };
 
-                        qcom,pcie@00610000 {
+                        qcom,pcie@610000 {
                                 status = "okay";
                                 perst-gpio = <&msmgpio 114 GPIO_ACTIVE_LOW>;
                         };
diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
index 4b2afcc4fdf4..0a6f7952bbb1 100644
--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
@@ -840,7 +840,7 @@
                         #size-cells = <1>;
                         ranges;
 
-                        pcie0: qcom,pcie@00600000 {
+                        pcie0: qcom,pcie@600000 {
                                 compatible = "qcom,pcie-msm8996", "snps,dw-pcie";
                                 status = "disabled";
                                 power-domains = <&gcc PCIE0_GDSC>;
@@ -893,7 +893,7 @@
 
                         };
 
-                        pcie1: qcom,pcie@00608000 {
+                        pcie1: qcom,pcie@608000 {
                                 compatible = "qcom,pcie-msm8996", "snps,dw-pcie";
                                 power-domains = <&gcc PCIE1_GDSC>;
                                 bus-range = <0x00 0xff>;
@@ -946,7 +946,7 @@
                                                 "bus_slave";
                         };
 
-                        pcie2: qcom,pcie@00610000 {
+                        pcie2: qcom,pcie@610000 {
                                 compatible = "qcom,pcie-msm8996", "snps,dw-pcie";
                                 power-domains = <&gcc PCIE2_GDSC>;
                                 bus-range = <0x00 0xff>;
diff --git a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
index 3890468678ce..28257724a56e 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
@@ -132,17 +132,16 @@
         assigned-clocks = <&cru SCLK_MAC2IO>, <&cru SCLK_MAC2IO_EXT>;
         assigned-clock-parents = <&gmac_clkin>, <&gmac_clkin>;
         clock_in_out = "input";
-        /* shows instability at 1GBit right now */
-        max-speed = <100>;
         phy-supply = <&vcc_io>;
         phy-mode = "rgmii";
         pinctrl-names = "default";
         pinctrl-0 = <&rgmiim1_pins>;
+        snps,force_thresh_dma_mode;
         snps,reset-gpio = <&gpio1 RK_PC2 GPIO_ACTIVE_LOW>;
         snps,reset-active-low;
         snps,reset-delays-us = <0 10000 50000>;
-        tx_delay = <0x26>;
-        rx_delay = <0x11>;
+        tx_delay = <0x24>;
+        rx_delay = <0x18>;
         status = "okay";
 };
 
diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
index a037ee56fead..cae341554486 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
@@ -730,7 +730,7 @@
                 interrupts = <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&cru HCLK_SDMMC>, <&cru SCLK_SDMMC>,
                          <&cru SCLK_SDMMC_DRV>, <&cru SCLK_SDMMC_SAMPLE>;
-                clock-names = "biu", "ciu", "ciu_drv", "ciu_sample";
+                clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
                 fifo-depth = <0x100>;
                 status = "disabled";
         };
@@ -741,7 +741,7 @@
                 interrupts = <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&cru HCLK_SDIO>, <&cru SCLK_SDIO>,
                          <&cru SCLK_SDIO_DRV>, <&cru SCLK_SDIO_SAMPLE>;
-                clock-names = "biu", "ciu", "ciu_drv", "ciu_sample";
+                clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
                 fifo-depth = <0x100>;
                 status = "disabled";
         };
@@ -752,7 +752,7 @@
                 interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&cru HCLK_EMMC>, <&cru SCLK_EMMC>,
                          <&cru SCLK_EMMC_DRV>, <&cru SCLK_EMMC_SAMPLE>;
-                clock-names = "biu", "ciu", "ciu_drv", "ciu_sample";
+                clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
                 fifo-depth = <0x100>;
                 status = "disabled";
         };
diff --git a/arch/arm64/boot/dts/rockchip/rk3368.dtsi b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
index aa4d07046a7b..03458ac44201 100644
--- a/arch/arm64/boot/dts/rockchip/rk3368.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
@@ -257,7 +257,7 @@
                 max-frequency = <150000000>;
                 clocks = <&cru HCLK_SDIO0>, <&cru SCLK_SDIO0>,
                          <&cru SCLK_SDIO0_DRV>, <&cru SCLK_SDIO0_SAMPLE>;
-                clock-names = "biu", "ciu", "ciu_drv", "ciu_sample";
+                clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
                 fifo-depth = <0x100>;
                 interrupts = <GIC_SPI 33 IRQ_TYPE_LEVEL_HIGH>;
                 resets = <&cru SRST_SDIO0>;
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
index 0f873c897d0d..ce592a4c0c4c 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
@@ -457,7 +457,7 @@
         assigned-clocks = <&cru SCLK_PCIEPHY_REF>;
         assigned-clock-parents = <&cru SCLK_PCIEPHY_REF100M>;
         assigned-clock-rates = <100000000>;
-        ep-gpios = <&gpio3 RK_PB5 GPIO_ACTIVE_HIGH>;
+        ep-gpios = <&gpio2 RK_PA4 GPIO_ACTIVE_HIGH>;
         num-lanes = <4>;
         pinctrl-names = "default";
         pinctrl-0 = <&pcie_clkreqn_cpm>;
diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
index 7aa2144e0d47..2605118d4b4c 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
@@ -1739,8 +1739,8 @@
                 compatible = "rockchip,rk3399-edp";
                 reg = <0x0 0xff970000 0x0 0x8000>;
                 interrupts = <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH 0>;
-                clocks = <&cru PCLK_EDP>, <&cru PCLK_EDP_CTRL>;
-                clock-names = "dp", "pclk";
+                clocks = <&cru PCLK_EDP>, <&cru PCLK_EDP_CTRL>, <&cru PCLK_VIO_GRF>;
+                clock-names = "dp", "pclk", "grf";
                 pinctrl-names = "default";
                 pinctrl-0 = <&edp_hpd>;
                 power-domains = <&power RK3399_PD_EDP>;
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index 52f15cd896e1..b5a28336c077 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -178,7 +178,7 @@ static int enable_smccc_arch_workaround_1(void *data)
         case PSCI_CONDUIT_HVC:
                 arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
                                   ARM_SMCCC_ARCH_WORKAROUND_1, &res);
-                if (res.a0)
+                if ((int)res.a0 < 0)
                         return 0;
                 cb = call_hvc_arch_workaround_1;
                 smccc_start = __smccc_workaround_1_hvc_start;
@@ -188,7 +188,7 @@ static int enable_smccc_arch_workaround_1(void *data)
         case PSCI_CONDUIT_SMC:
                 arm_smccc_1_1_smc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
                                   ARM_SMCCC_ARCH_WORKAROUND_1, &res);
-                if (res.a0)
+                if ((int)res.a0 < 0)
                         return 0;
                 cb = call_smc_arch_workaround_1;
                 smccc_start = __smccc_workaround_1_smc_start;
diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c
index d7e3299a7734..959e50d2588c 100644
--- a/arch/arm64/kvm/guest.c
+++ b/arch/arm64/kvm/guest.c
@@ -363,8 +363,6 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(struct kvm_vcpu *vcpu,
 {
         int ret = 0;
 
-        vcpu_load(vcpu);
-
         trace_kvm_set_guest_debug(vcpu, dbg->control);
 
         if (dbg->control & ~KVM_GUESTDBG_VALID_MASK) {
@@ -386,7 +384,6 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(struct kvm_vcpu *vcpu,
         }
 
 out:
-        vcpu_put(vcpu);
         return ret;
 }
 
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 84a019f55022..8c704f1e53c2 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -108,7 +108,7 @@ static bool pgattr_change_is_safe(u64 old, u64 new)
          * The following mapping attributes may be updated in live
          * kernel mappings without the need for break-before-make.
          */
-        static const pteval_t mask = PTE_PXN | PTE_RDONLY | PTE_WRITE;
+        static const pteval_t mask = PTE_PXN | PTE_RDONLY | PTE_WRITE | PTE_NG;
 
         /* creating or taking down mappings is always safe */
         if (old == 0 || new == 0)
@@ -118,9 +118,9 @@ static bool pgattr_change_is_safe(u64 old, u64 new)
         if ((old | new) & PTE_CONT)
                 return false;
 
-        /* Transitioning from Global to Non-Global is safe */
-        if (((old ^ new) == PTE_NG) && (new & PTE_NG))
-                return true;
+        /* Transitioning from Non-Global to Global is unsafe */
+        if (old & ~new & PTE_NG)
+                return false;
 
         return ((old ^ new) & ~mask) == 0;
 }
diff --git a/arch/ia64/include/asm/atomic.h b/arch/ia64/include/asm/atomic.h
index 762eeb0fcc1d..2524fb60fbc2 100644
--- a/arch/ia64/include/asm/atomic.h
+++ b/arch/ia64/include/asm/atomic.h
@@ -66,38 +66,35 @@ ATOMIC_OPS(add, +)
 ATOMIC_OPS(sub, -)
 
 #ifdef __OPTIMIZE__
-#define __ia64_atomic_const(i)  __builtin_constant_p(i) ?               \
+#define __ia64_atomic_const(i)                                          \
+        static const int __ia64_atomic_p = __builtin_constant_p(i) ?    \
                 ((i) == 1 || (i) == 4 || (i) == 8 || (i) == 16 ||       \
-                 (i) == -1 || (i) == -4 || (i) == -8 || (i) == -16) : 0
+                 (i) == -1 || (i) == -4 || (i) == -8 || (i) == -16) : 0;\
+        __ia64_atomic_p
+#else
+#define __ia64_atomic_const(i)  0
+#endif
 
-#define atomic_add_return(i, v)                                         \
+#define atomic_add_return(i,v)                                          \
 ({                                                                      \
-        int __i = (i);                                                  \
-        static const int __ia64_atomic_p = __ia64_atomic_const(i);      \
-        __ia64_atomic_p ? ia64_fetch_and_add(__i, &(v)->counter) :      \
-                                ia64_atomic_add(__i, v);                \
+        int __ia64_aar_i = (i);                                         \
+        __ia64_atomic_const(i)                                          \
+                ? ia64_fetch_and_add(__ia64_aar_i, &(v)->counter)       \
+                : ia64_atomic_add(__ia64_aar_i, v);                     \
 })
 
-#define atomic_sub_return(i, v)                                         \
+#define atomic_sub_return(i,v)                                          \
 ({                                                                      \
-        int __i = (i);                                                  \
-        static const int __ia64_atomic_p = __ia64_atomic_const(i);      \
-        __ia64_atomic_p ? ia64_fetch_and_add(-__i, &(v)->counter) :     \
-                                ia64_atomic_sub(__i, v);                \
+        int __ia64_asr_i = (i);                                         \
+        __ia64_atomic_const(i)                                          \
+                ? ia64_fetch_and_add(-__ia64_asr_i, &(v)->counter)      \
+                : ia64_atomic_sub(__ia64_asr_i, v);                     \
 })
-#else
-#define atomic_add_return(i, v) ia64_atomic_add(i, v)
-#define atomic_sub_return(i, v) ia64_atomic_sub(i, v)
-#endif
 
 #define atomic_fetch_add(i,v)                                           \
 ({                                                                      \
         int __ia64_aar_i = (i);                                         \
-        (__builtin_constant_p(i)                                        \
-         && (   (__ia64_aar_i ==  1) || (__ia64_aar_i ==   4)           \
-             || (__ia64_aar_i ==  8) || (__ia64_aar_i ==  16)           \
-             || (__ia64_aar_i == -1) || (__ia64_aar_i ==  -4)           \
-             || (__ia64_aar_i == -8) || (__ia64_aar_i == -16)))         \
+        __ia64_atomic_const(i)                                          \
                 ? ia64_fetchadd(__ia64_aar_i, &(v)->counter, acq)       \
                 : ia64_atomic_fetch_add(__ia64_aar_i, v);               \
 })
@@ -105,11 +102,7 @@ ATOMIC_OPS(sub, -)
 #define atomic_fetch_sub(i,v)                                           \
 ({                                                                      \
         int __ia64_asr_i = (i);                                         \
-        (__builtin_constant_p(i)                                        \
-         && (   (__ia64_asr_i ==   1) || (__ia64_asr_i ==   4)          \
-             || (__ia64_asr_i ==   8) || (__ia64_asr_i ==  16)          \
-             || (__ia64_asr_i ==  -1) || (__ia64_asr_i ==  -4)          \
-             || (__ia64_asr_i ==  -8) || (__ia64_asr_i == -16)))        \
+        __ia64_atomic_const(i)                                          \
                 ? ia64_fetchadd(-__ia64_asr_i, &(v)->counter, acq)      \
                 : ia64_atomic_fetch_sub(__ia64_asr_i, v);               \
 })
@@ -170,11 +163,7 @@ ATOMIC64_OPS(sub, -)
 #define atomic64_add_return(i,v)                                        \
 ({                                                                      \
         long __ia64_aar_i = (i);                                        \
-        (__builtin_constant_p(i)                                        \
-         && (   (__ia64_aar_i ==  1) || (__ia64_aar_i ==   4)           \
-             || (__ia64_aar_i ==  8) || (__ia64_aar_i ==  16)           \
-             || (__ia64_aar_i == -1) || (__ia64_aar_i ==  -4)           \
-             || (__ia64_aar_i == -8) || (__ia64_aar_i == -16)))         \
+        __ia64_atomic_const(i)                                          \
                 ? ia64_fetch_and_add(__ia64_aar_i, &(v)->counter)       \
                 : ia64_atomic64_add(__ia64_aar_i, v);                   \
 })
@@ -182,11 +171,7 @@ ATOMIC64_OPS(sub, -)
 #define atomic64_sub_return(i,v)                                        \
 ({                                                                      \
         long __ia64_asr_i = (i);                                        \
-        (__builtin_constant_p(i)                                        \
-         && (   (__ia64_asr_i ==   1) || (__ia64_asr_i ==   4)          \
-             || (__ia64_asr_i ==   8) || (__ia64_asr_i ==  16)          \
-             || (__ia64_asr_i ==  -1) || (__ia64_asr_i ==  -4)          \
-             || (__ia64_asr_i ==  -8) || (__ia64_asr_i == -16)))        \
+        __ia64_atomic_const(i)                                          \
                 ? ia64_fetch_and_add(-__ia64_asr_i, &(v)->counter)      \
                 : ia64_atomic64_sub(__ia64_asr_i, v);                   \
 })
@@ -194,11 +179,7 @@ ATOMIC64_OPS(sub, -)
 #define atomic64_fetch_add(i,v)                                         \
 ({                                                                      \
         long __ia64_aar_i = (i);                                        \
-        (__builtin_constant_p(i)                                        \
-         && (   (__ia64_aar_i ==  1) || (__ia64_aar_i ==   4)           \
-             || (__ia64_aar_i ==  8) || (__ia64_aar_i ==  16)           \
-             || (__ia64_aar_i == -1) || (__ia64_aar_i ==  -4)           \
-             || (__ia64_aar_i == -8) || (__ia64_aar_i == -16)))         \
+        __ia64_atomic_const(i)                                          \
                 ? ia64_fetchadd(__ia64_aar_i, &(v)->counter, acq)       \
                 : ia64_atomic64_fetch_add(__ia64_aar_i, v);             \
 })
@@ -206,11 +187,7 @@ ATOMIC64_OPS(sub, -)
 #define atomic64_fetch_sub(i,v)                                         \
 ({                                                                      \
         long __ia64_asr_i = (i);                                        \
-        (__builtin_constant_p(i)                                        \
-         && (   (__ia64_asr_i ==   1) || (__ia64_asr_i ==   4)          \
-             || (__ia64_asr_i ==   8) || (__ia64_asr_i ==  16)          \
-             || (__ia64_asr_i ==  -1) || (__ia64_asr_i ==  -4)          \
-             || (__ia64_asr_i ==  -8) || (__ia64_asr_i == -16)))        \
+        __ia64_atomic_const(i)                                          \
                 ? ia64_fetchadd(-__ia64_asr_i, &(v)->counter, acq)      \
                 : ia64_atomic64_fetch_sub(__ia64_asr_i, v);             \
 })
diff --git a/arch/ia64/kernel/err_inject.c b/arch/ia64/kernel/err_inject.c
index 85bba43e7d5d..8b5b8e6bc9d9 100644
--- a/arch/ia64/kernel/err_inject.c
+++ b/arch/ia64/kernel/err_inject.c
@@ -117,7 +117,7 @@ store_call_start(struct device *dev, struct device_attribute *attr,
 
 #ifdef ERR_INJ_DEBUG
         printk(KERN_DEBUG "Returns: status=%d,\n", (int)status[cpu]);
-        printk(KERN_DEBUG "capapbilities=%lx,\n", capabilities[cpu]);
+        printk(KERN_DEBUG "capabilities=%lx,\n", capabilities[cpu]);
         printk(KERN_DEBUG "resources=%lx\n", resources[cpu]);
 #endif
         return size;
@@ -142,7 +142,7 @@ store_virtual_to_phys(struct device *dev, struct device_attribute *attr,
         u64 virt_addr=simple_strtoull(buf, NULL, 16);
         int ret;
 
-        ret = get_user_pages(virt_addr, 1, FOLL_WRITE, NULL, NULL);
+        ret = get_user_pages_fast(virt_addr, 1, FOLL_WRITE, NULL);
         if (ret<=0) {
 #ifdef ERR_INJ_DEBUG
                 printk("Virtual address %lx is not existing.\n",virt_addr);
diff --git a/arch/ia64/scripts/unwcheck.py b/arch/ia64/scripts/unwcheck.py
index 89f3a1480a63..c55276e31b6b 100644
--- a/arch/ia64/scripts/unwcheck.py
+++ b/arch/ia64/scripts/unwcheck.py
@@ -16,7 +16,7 @@ import re
 import sys
 
 if len(sys.argv) != 2:
-    print "Usage: %s FILE" % sys.argv[0]
+    print("Usage: %s FILE" % sys.argv[0])
     sys.exit(2)
 
 readelf = os.getenv("READELF", "readelf")
@@ -29,7 +29,7 @@ def check_func (func, slots, rlen_sum):
         global num_errors
         num_errors += 1
         if not func: func = "[%#x-%#x]" % (start, end)
-        print "ERROR: %s: %lu slots, total region length = %lu" % (func, slots, rlen_sum)
+        print("ERROR: %s: %lu slots, total region length = %lu" % (func, slots, rlen_sum))
     return
 
 num_funcs = 0
@@ -43,23 +43,23 @@ for line in os.popen("%s -u %s" % (readelf, sys.argv[1])):
         check_func(func, slots, rlen_sum)
 
         func  = m.group(1)
-        start = long(m.group(2), 16)
-        end   = long(m.group(3), 16)
+        start = int(m.group(2), 16)
+        end   = int(m.group(3), 16)
         slots = 3 * (end - start) / 16
-        rlen_sum = 0L
+        rlen_sum = 0
         num_funcs += 1
     else:
         m = rlen_pattern.match(line)
         if m:
-            rlen_sum += long(m.group(1))
+            rlen_sum += int(m.group(1))
 check_func(func, slots, rlen_sum)
 
 if num_errors == 0:
-    print "No errors detected in %u functions." % num_funcs
+    print("No errors detected in %u functions." % num_funcs)
 else:
     if num_errors > 1:
         err="errors"
     else:
         err="error"
-    print "%u %s detected in %u functions." % (num_errors, err, num_funcs)
+    print("%u %s detected in %u functions." % (num_errors, err, num_funcs))
     sys.exit(1)
diff --git a/arch/microblaze/Kconfig b/arch/microblaze/Kconfig
index 4f798aa671dd..3817a3e2146c 100644
--- a/arch/microblaze/Kconfig
+++ b/arch/microblaze/Kconfig
@@ -24,6 +24,7 @@ config MICROBLAZE
         select HAVE_FTRACE_MCOUNT_RECORD
         select HAVE_FUNCTION_GRAPH_TRACER
         select HAVE_FUNCTION_TRACER
+        select NO_BOOTMEM
         select HAVE_MEMBLOCK
         select HAVE_MEMBLOCK_NODE_MAP
         select HAVE_OPROFILE
diff --git a/arch/microblaze/Kconfig.platform b/arch/microblaze/Kconfig.platform
index 6996f397c16c..f7f1739c11b9 100644
--- a/arch/microblaze/Kconfig.platform
+++ b/arch/microblaze/Kconfig.platform
@@ -8,7 +8,6 @@ menu "Platform options"
 
 config OPT_LIB_FUNCTION
         bool "Optimalized lib function"
-        depends on CPU_LITTLE_ENDIAN
         default y
         help
           Allows turn on optimalized library function (memcpy and memmove).
@@ -21,6 +20,7 @@ config OPT_LIB_FUNCTION
 config OPT_LIB_ASM
         bool "Optimalized lib function ASM"
         depends on OPT_LIB_FUNCTION && (XILINX_MICROBLAZE0_USE_BARREL = 1)
+        depends on CPU_BIG_ENDIAN
         default n
         help
           Allows turn on optimalized library function (memcpy and memmove).
diff --git a/arch/microblaze/include/asm/setup.h b/arch/microblaze/include/asm/setup.h
index be84a4d3917f..7c968c1d1729 100644
--- a/arch/microblaze/include/asm/setup.h
+++ b/arch/microblaze/include/asm/setup.h
@@ -44,7 +44,6 @@ void machine_shutdown(void);
 void machine_halt(void);
 void machine_power_off(void);
 
-extern void *alloc_maybe_bootmem(size_t size, gfp_t mask);
 extern void *zalloc_maybe_bootmem(size_t size, gfp_t mask);
 
 # endif /* __ASSEMBLY__ */
diff --git a/arch/microblaze/lib/fastcopy.S b/arch/microblaze/lib/fastcopy.S
index 62021d7e249e..fdc48bb065d8 100644
--- a/arch/microblaze/lib/fastcopy.S
+++ b/arch/microblaze/lib/fastcopy.S
@@ -29,10 +29,6 @@
  *      between mem locations with size of xfer spec'd in bytes
  */
 
-#ifdef __MICROBLAZEEL__
-#error Microblaze LE not support ASM optimized lib func. Disable OPT_LIB_ASM.
-#endif
-
 #include <linux/linkage.h>
         .text
         .globl  memcpy
diff --git a/arch/microblaze/mm/init.c b/arch/microblaze/mm/init.c
index 434639f9a3a6..df6de7ccdc2e 100644
--- a/arch/microblaze/mm/init.c
+++ b/arch/microblaze/mm/init.c
@@ -32,9 +32,6 @@ int mem_init_done;
 #ifndef CONFIG_MMU
 unsigned int __page_offset;
 EXPORT_SYMBOL(__page_offset);
-
-#else
-static int init_bootmem_done;
 #endif /* CONFIG_MMU */
 
 char *klimit = _end;
@@ -117,7 +114,6 @@ static void __init paging_init(void)
 
 void __init setup_memory(void)
 {
-        unsigned long map_size;
         struct memblock_region *reg;
 
 #ifndef CONFIG_MMU
@@ -174,17 +170,6 @@ void __init setup_memory(void)
         pr_info("%s: max_low_pfn: %#lx\n", __func__, max_low_pfn);
         pr_info("%s: max_pfn: %#lx\n", __func__, max_pfn);
 
-        /*
-         * Find an area to use for the bootmem bitmap.
-         * We look for the first area which is at least
-         * 128kB in length (128kB is enough for a bitmap
-         * for 4GB of memory, using 4kB pages), plus 1 page
-         * (in case the address isn't page-aligned).
-         */
-        map_size = init_bootmem_node(NODE_DATA(0),
-                PFN_UP(TOPHYS((u32)klimit)), min_low_pfn, max_low_pfn);
-        memblock_reserve(PFN_UP(TOPHYS((u32)klimit)) << PAGE_SHIFT, map_size);
-
         /* Add active regions with valid PFNs */
         for_each_memblock(memory, reg) {
                 unsigned long start_pfn, end_pfn;
@@ -196,32 +181,9 @@ void __init setup_memory(void)
                                   &memblock.memory, 0);
         }
 
-        /* free bootmem is whole main memory */
-        free_bootmem_with_active_regions(0, max_low_pfn);
-
-        /* reserve allocate blocks */
-        for_each_memblock(reserved, reg) {
-                unsigned long top = reg->base + reg->size - 1;
-
-                pr_debug("reserved - 0x%08x-0x%08x, %lx, %lx\n",
-                         (u32) reg->base, (u32) reg->size, top,
-                                                memory_start + lowmem_size - 1);
-
-                if (top <= (memory_start + lowmem_size - 1)) {
-                        reserve_bootmem(reg->base, reg->size, BOOTMEM_DEFAULT);
-                } else if (reg->base < (memory_start + lowmem_size - 1)) {
-                        unsigned long trunc_size = memory_start + lowmem_size -
-                                                                reg->base;
-                        reserve_bootmem(reg->base, trunc_size, BOOTMEM_DEFAULT);
-                }
-        }
-
         /* XXX need to clip this if using highmem? */
         sparse_memory_present_with_active_regions(0);
 
-#ifdef CONFIG_MMU
-        init_bootmem_done = 1;
-#endif
         paging_init();
 }
 
@@ -398,30 +360,16 @@ asmlinkage void __init mmu_init(void)
 /* This is only called until mem_init is done. */
 void __init *early_get_page(void)
 {
-        void *p;
-        if (init_bootmem_done) {
-                p = alloc_bootmem_pages(PAGE_SIZE);
-        } else {
-                /*
-                 * Mem start + kernel_tlb -> here is limit
-                 * because of mem mapping from head.S
-                 */
-                p = __va(memblock_alloc_base(PAGE_SIZE, PAGE_SIZE,
-                                        memory_start + kernel_tlb));
-        }
-        return p;
+        /*
+         * Mem start + kernel_tlb -> here is limit
+         * because of mem mapping from head.S
+         */
+        return __va(memblock_alloc_base(PAGE_SIZE, PAGE_SIZE,
+                                memory_start + kernel_tlb));
 }
 
 #endif /* CONFIG_MMU */
 
-void * __ref alloc_maybe_bootmem(size_t size, gfp_t mask)
-{
-        if (mem_init_done)
-                return kmalloc(size, mask);
-        else
-                return alloc_bootmem(size);
-}
-
 void * __ref zalloc_maybe_bootmem(size_t size, gfp_t mask)
 {
         void *p;
diff --git a/arch/mips/ath25/board.c b/arch/mips/ath25/board.c
index 9ab48ff80c1c..6d11ae581ea7 100644
--- a/arch/mips/ath25/board.c
+++ b/arch/mips/ath25/board.c
@@ -135,6 +135,8 @@ int __init ath25_find_config(phys_addr_t base, unsigned long size)
         }
 
         board_data = kzalloc(BOARD_CONFIG_BUFSZ, GFP_KERNEL);
+        if (!board_data)
+                goto error;
         ath25_board.config = (struct ath25_boarddata *)board_data;
         memcpy_fromio(board_data, bcfg, 0x100);
         if (broken_boarddata) {
diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c
index 5b3a3f6a9ad3..d99f5242169e 100644
--- a/arch/mips/cavium-octeon/octeon-irq.c
+++ b/arch/mips/cavium-octeon/octeon-irq.c
@@ -2277,6 +2277,8 @@ static int __init octeon_irq_init_cib(struct device_node *ciu_node,
         }
 
         host_data = kzalloc(sizeof(*host_data), GFP_KERNEL);
+        if (!host_data)
+                return -ENOMEM;
         raw_spin_lock_init(&host_data->lock);
 
         addr = of_get_address(ciu_node, 0, NULL, NULL);
diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
index 9d41732a9146..159e83add4bb 100644
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -168,11 +168,11 @@ static void bmips_prepare_cpus(unsigned int max_cpus)
                 return;
         }
 
-        if (request_irq(IPI0_IRQ, bmips_ipi_interrupt, IRQF_PERCPU,
-                        "smp_ipi0", NULL))
+        if (request_irq(IPI0_IRQ, bmips_ipi_interrupt,
+                        IRQF_PERCPU | IRQF_NO_SUSPEND, "smp_ipi0", NULL))
                 panic("Can't request IPI0 interrupt");
-        if (request_irq(IPI1_IRQ, bmips_ipi_interrupt, IRQF_PERCPU,
-                        "smp_ipi1", NULL))
+        if (request_irq(IPI1_IRQ, bmips_ipi_interrupt,
+                        IRQF_PERCPU | IRQF_NO_SUSPEND, "smp_ipi1", NULL))
                 panic("Can't request IPI1 interrupt");
 }
 
diff --git a/arch/mips/loongson64/Kconfig b/arch/mips/loongson64/Kconfig
index bc2fdbfa8223..72af0c183969 100644
--- a/arch/mips/loongson64/Kconfig
+++ b/arch/mips/loongson64/Kconfig
@@ -7,6 +7,8 @@ choice
 config LEMOTE_FULOONG2E
         bool "Lemote Fuloong(2e) mini-PC"
         select ARCH_SPARSEMEM_ENABLE
+        select ARCH_MIGHT_HAVE_PC_PARPORT
+        select ARCH_MIGHT_HAVE_PC_SERIO
         select CEVT_R4K
         select CSRC_R4K
         select SYS_HAS_CPU_LOONGSON2E
@@ -33,6 +35,8 @@ config LEMOTE_FULOONG2E
 config LEMOTE_MACH2F
         bool "Lemote Loongson 2F family machines"
         select ARCH_SPARSEMEM_ENABLE
+        select ARCH_MIGHT_HAVE_PC_PARPORT
+        select ARCH_MIGHT_HAVE_PC_SERIO
         select BOARD_SCACHE
         select BOOT_ELF32
         select CEVT_R4K if ! MIPS_EXTERNAL_TIMER
@@ -62,6 +66,8 @@ config LEMOTE_MACH2F
 config LOONGSON_MACH3X
         bool "Generic Loongson 3 family machines"
         select ARCH_SPARSEMEM_ENABLE
+        select ARCH_MIGHT_HAVE_PC_PARPORT
+        select ARCH_MIGHT_HAVE_PC_SERIO
         select GENERIC_ISA_DMA_SUPPORT_BROKEN
         select BOOT_ELF32
         select BOARD_SCACHE
diff --git a/arch/parisc/include/asm/cacheflush.h b/arch/parisc/include/asm/cacheflush.h
index 3742508cc534..bd5ce31936f5 100644
--- a/arch/parisc/include/asm/cacheflush.h
+++ b/arch/parisc/include/asm/cacheflush.h
@@ -26,6 +26,7 @@ void flush_user_icache_range_asm(unsigned long, unsigned long);
 void flush_kernel_icache_range_asm(unsigned long, unsigned long);
 void flush_user_dcache_range_asm(unsigned long, unsigned long);
 void flush_kernel_dcache_range_asm(unsigned long, unsigned long);
+void purge_kernel_dcache_range_asm(unsigned long, unsigned long);
 void flush_kernel_dcache_page_asm(void *);
 void flush_kernel_icache_page(void *);
 
diff --git a/arch/parisc/include/asm/processor.h b/arch/parisc/include/asm/processor.h
index 0e6ab6e4a4e9..2dbe5580a1a4 100644
--- a/arch/parisc/include/asm/processor.h
+++ b/arch/parisc/include/asm/processor.h
@@ -316,6 +316,8 @@ extern int _parisc_requires_coherency;
 #define parisc_requires_coherency()     (0)
 #endif
 
+extern int running_on_qemu;
+
 #endif /* __ASSEMBLY__ */
 
 #endif /* __ASM_PARISC_PROCESSOR_H */
diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
index 19c0c141bc3f..e3b45546d589 100644
--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -465,10 +465,10 @@ EXPORT_SYMBOL(copy_user_page);
 int __flush_tlb_range(unsigned long sid, unsigned long start,
                       unsigned long end)
 {
-        unsigned long flags, size;
+        unsigned long flags;
 
-        size = (end - start);
-        if (size >= parisc_tlb_flush_threshold) {
+        if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) &&
+            end - start >= parisc_tlb_flush_threshold) {
                 flush_tlb_all();
                 return 1;
         }
@@ -539,13 +539,12 @@ void flush_cache_mm(struct mm_struct *mm)
         struct vm_area_struct *vma;
         pgd_t *pgd;
 
-        /* Flush the TLB to avoid speculation if coherency is required. */
-        if (parisc_requires_coherency())
-                flush_tlb_all();
-
         /* Flushing the whole cache on each cpu takes forever on
            rp3440, etc.  So, avoid it if the mm isn't too big.  */
-        if (mm_total_size(mm) >= parisc_cache_flush_threshold) {
+        if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) &&
+            mm_total_size(mm) >= parisc_cache_flush_threshold) {
+                if (mm->context)
+                        flush_tlb_all();
                 flush_cache_all();
                 return;
         }
@@ -553,9 +552,9 @@ void flush_cache_mm(struct mm_struct *mm)
         if (mm->context == mfsp(3)) {
                 for (vma = mm->mmap; vma; vma = vma->vm_next) {
                         flush_user_dcache_range_asm(vma->vm_start, vma->vm_end);
-                        if ((vma->vm_flags & VM_EXEC) == 0)
-                                continue;
-                        flush_user_icache_range_asm(vma->vm_start, vma->vm_end);
+                        if (vma->vm_flags & VM_EXEC)
+                                flush_user_icache_range_asm(vma->vm_start, vma->vm_end);
+                        flush_tlb_range(vma, vma->vm_start, vma->vm_end);
                 }
                 return;
         }
@@ -573,6 +572,8 @@ void flush_cache_mm(struct mm_struct *mm)
                         pfn = pte_pfn(*ptep);
                         if (!pfn_valid(pfn))
                                 continue;
+                        if (unlikely(mm->context))
+                                flush_tlb_page(vma, addr);
                         __flush_cache_page(vma, addr, PFN_PHYS(pfn));
                 }
         }
@@ -581,30 +582,45 @@ void flush_cache_mm(struct mm_struct *mm)
 void flush_cache_range(struct vm_area_struct *vma,
                 unsigned long start, unsigned long end)
 {
-        BUG_ON(!vma->vm_mm->context);
-
-        /* Flush the TLB to avoid speculation if coherency is required. */
-        if (parisc_requires_coherency())
-                flush_tlb_range(vma, start, end);
+        pgd_t *pgd;
+        unsigned long addr;
 
-        if ((end - start) >= parisc_cache_flush_threshold
-            || vma->vm_mm->context != mfsp(3)) {
+        if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) &&
+            end - start >= parisc_cache_flush_threshold) {
+                if (vma->vm_mm->context)
+                        flush_tlb_range(vma, start, end);
                 flush_cache_all();
                 return;
         }
 
-        flush_user_dcache_range_asm(start, end);
-        if (vma->vm_flags & VM_EXEC)
-                flush_user_icache_range_asm(start, end);
+        if (vma->vm_mm->context == mfsp(3)) {
+                flush_user_dcache_range_asm(start, end);
+                if (vma->vm_flags & VM_EXEC)
+                        flush_user_icache_range_asm(start, end);
+                flush_tlb_range(vma, start, end);
+                return;
+        }
+
+        pgd = vma->vm_mm->pgd;
+        for (addr = vma->vm_start; addr < vma->vm_end; addr += PAGE_SIZE) {
+                unsigned long pfn;
+                pte_t *ptep = get_ptep(pgd, addr);
+                if (!ptep)
+                        continue;
+                pfn = pte_pfn(*ptep);
+                if (pfn_valid(pfn)) {
+                        if (unlikely(vma->vm_mm->context))
+                                flush_tlb_page(vma, addr);
+                        __flush_cache_page(vma, addr, PFN_PHYS(pfn));
+                }
+        }
 }
 
 void
 flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long pfn)
 {
-        BUG_ON(!vma->vm_mm->context);
-
         if (pfn_valid(pfn)) {
-                if (parisc_requires_coherency())
+                if (likely(vma->vm_mm->context))
                         flush_tlb_page(vma, vmaddr);
                 __flush_cache_page(vma, vmaddr, PFN_PHYS(pfn));
         }
@@ -613,21 +629,33 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long
 void flush_kernel_vmap_range(void *vaddr, int size)
 {
         unsigned long start = (unsigned long)vaddr;
+        unsigned long end = start + size;
 
-        if ((unsigned long)size > parisc_cache_flush_threshold)
+        if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) &&
+            (unsigned long)size >= parisc_cache_flush_threshold) {
+                flush_tlb_kernel_range(start, end);
                 flush_data_cache();
-        else
-                flush_kernel_dcache_range_asm(start, start + size);
+                return;
+        }
+
+        flush_kernel_dcache_range_asm(start, end);
+        flush_tlb_kernel_range(start, end);
 }
 EXPORT_SYMBOL(flush_kernel_vmap_range);
 
 void invalidate_kernel_vmap_range(void *vaddr, int size)
 {
         unsigned long start = (unsigned long)vaddr;
+        unsigned long end = start + size;
 
-        if ((unsigned long)size > parisc_cache_flush_threshold)
+        if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) &&
+            (unsigned long)size >= parisc_cache_flush_threshold) {
+                flush_tlb_kernel_range(start, end);
                 flush_data_cache();
-        else
-                flush_kernel_dcache_range_asm(start, start + size);
+                return;
+        }
+
+        purge_kernel_dcache_range_asm(start, end);
+        flush_tlb_kernel_range(start, end);
 }
 EXPORT_SYMBOL(invalidate_kernel_vmap_range);
diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S
index bbbe360b458f..fbb4e43fda05 100644
--- a/arch/parisc/kernel/head.S
+++ b/arch/parisc/kernel/head.S
@@ -138,6 +138,16 @@ $pgt_fill_loop:
         std             %dp,0x18(%r10)
 #endif
 
+#ifdef CONFIG_64BIT
+        /* Get PDCE_PROC for monarch CPU. */
+#define MEM_PDC_LO 0x388
+#define MEM_PDC_HI 0x35C
+        ldw             MEM_PDC_LO(%r0),%r3
+        ldw             MEM_PDC_HI(%r0),%r10
+        depd            %r10, 31, 32, %r3        /* move to upper word */
+#endif
+
+
 #ifdef CONFIG_SMP
         /* Set the smp rendezvous address into page zero.
         ** It would be safer to do this in init_smp_config() but
@@ -196,12 +206,6 @@ common_stext:
         ** Someday, palo might not do this for the Monarch either.
         */
 2:
-#define MEM_PDC_LO 0x388
-#define MEM_PDC_HI 0x35C
-        ldw             MEM_PDC_LO(%r0),%r3
-        ldw             MEM_PDC_HI(%r0),%r6
-        depd            %r6, 31, 32, %r3        /* move to upper word */
-
         mfctl           %cr30,%r6               /* PCX-W2 firmware bug */
 
         ldo             PDC_PSW(%r0),%arg0              /* 21 */
@@ -268,6 +272,8 @@ $install_iva:
 aligned_rfi:
         pcxt_ssm_bug
 
+        copy            %r3, %arg0      /* PDCE_PROC for smp_callin() */
+
         rsm             PSW_SM_QUIET,%r0        /* off troublesome PSW bits */
         /* Don't need NOPs, have 8 compliant insn before rfi */
 
diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S
index 2d40c4ff3f69..67b0f7532e83 100644
--- a/arch/parisc/kernel/pacache.S
+++ b/arch/parisc/kernel/pacache.S
@@ -1110,6 +1110,28 @@ ENTRY_CFI(flush_kernel_dcache_range_asm)
         .procend
 ENDPROC_CFI(flush_kernel_dcache_range_asm)
 
+ENTRY_CFI(purge_kernel_dcache_range_asm)
+        .proc
+        .callinfo NO_CALLS
+        .entry
+
+        ldil            L%dcache_stride, %r1
+        ldw             R%dcache_stride(%r1), %r23
+        ldo             -1(%r23), %r21
+        ANDCM           %r26, %r21, %r26
+
+1:      cmpb,COND(<<),n %r26, %r25,1b
+        pdc,m           %r23(%r26)
+
+        sync
+        syncdma
+        bv              %r0(%r2)
+        nop
+        .exit
+
+        .procend
+ENDPROC_CFI(purge_kernel_dcache_range_asm)
+
 ENTRY_CFI(flush_user_icache_range_asm)
         .proc
         .callinfo NO_CALLS
diff --git a/arch/parisc/kernel/smp.c b/arch/parisc/kernel/smp.c
index 30c28ab14540..4065b5e48c9d 100644
--- a/arch/parisc/kernel/smp.c
+++ b/arch/parisc/kernel/smp.c
@@ -292,10 +292,15 @@ smp_cpu_init(int cpunum)
  * Slaves start using C here. Indirectly called from smp_slave_stext.
  * Do what start_kernel() and main() do for boot strap processor (aka monarch)
  */
-void __init smp_callin(void)
+void __init smp_callin(unsigned long pdce_proc)
 {
         int slave_id = cpu_now_booting;
 
+#ifdef CONFIG_64BIT
+        WARN_ON(((unsigned long)(PAGE0->mem_pdc_hi) << 32
+                        | PAGE0->mem_pdc) != pdce_proc);
+#endif
+
         smp_cpu_init(slave_id);
         preempt_disable();
 
diff --git a/arch/parisc/kernel/time.c b/arch/parisc/kernel/time.c
index 4b8fd6dc22da..f7e684560186 100644
--- a/arch/parisc/kernel/time.c
+++ b/arch/parisc/kernel/time.c
@@ -76,10 +76,10 @@ irqreturn_t __irq_entry timer_interrupt(int irq, void *dev_id)
         next_tick = cpuinfo->it_value;
 
         /* Calculate how many ticks have elapsed. */
+        now = mfctl(16);
         do {
                 ++ticks_elapsed;
                 next_tick += cpt;
-                now = mfctl(16);
         } while (next_tick - now > cpt);
 
         /* Store (in CR16 cycles) up to when we are accounting right now. */
@@ -103,16 +103,17 @@ irqreturn_t __irq_entry timer_interrupt(int irq, void *dev_id)
          * if one or the other wrapped. If "now" is "bigger" we'll end up
          * with a very large unsigned number.
          */
-        while (next_tick - mfctl(16) > cpt)
+        now = mfctl(16);
+        while (next_tick - now > cpt)
                 next_tick += cpt;
 
         /* Program the IT when to deliver the next interrupt.
          * Only bottom 32-bits of next_tick are writable in CR16!
          * Timer interrupt will be delivered at least a few hundred cycles
-         * after the IT fires, so if we are too close (<= 500 cycles) to the
+         * after the IT fires, so if we are too close (<= 8000 cycles) to the
          * next cycle, simply skip it.
          */
-        if (next_tick - mfctl(16) <= 500)
+        if (next_tick - now <= 8000)
                 next_tick += cpt;
         mtctl(next_tick, 16);
 
@@ -248,7 +249,7 @@ static int __init init_cr16_clocksource(void)
          * different sockets, so mark them unstable and lower rating on
          * multi-socket SMP systems.
          */
-        if (num_online_cpus() > 1) {
+        if (num_online_cpus() > 1 && !running_on_qemu) {
                 int cpu;
                 unsigned long cpu0_loc;
                 cpu0_loc = per_cpu(cpu_data, 0).cpu_loc;
diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index 48f41399fc0b..cab32ee824d2 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -629,7 +629,12 @@ void __init mem_init(void)
 #endif
 
         mem_init_print_info(NULL);
-#ifdef CONFIG_DEBUG_KERNEL /* double-sanity-check paranoia */
+
+#if 0
+        /*
+         * Do not expose the virtual kernel memory layout to userspace.
+         * But keep code for debugging purposes.
+         */
         printk("virtual kernel memory layout:\n"
                "    vmalloc : 0x%px - 0x%px   (%4ld MB)\n"
                "    memory  : 0x%px - 0x%px   (%4ld MB)\n"
diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
index ef6549e57157..26d5d2a5b8e9 100644
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -101,7 +101,8 @@ $(addprefix $(obj)/,$(zlib-y)): \
 libfdt       := fdt.c fdt_ro.c fdt_wip.c fdt_sw.c fdt_rw.c fdt_strerror.c
 libfdtheader := fdt.h libfdt.h libfdt_internal.h
 
-$(addprefix $(obj)/,$(libfdt) libfdt-wrapper.o simpleboot.o epapr.o opal.o): \
+$(addprefix $(obj)/,$(libfdt) libfdt-wrapper.o simpleboot.o epapr.o opal.o \
+        treeboot-akebono.o treeboot-currituck.o treeboot-iss4xx.o): \
         $(addprefix $(obj)/,$(libfdtheader))
 
 src-wlib-y := string.S crt0.S stdio.c decompress.c main.c \
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index d22c41c26bb3..acf4b2e0530c 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -874,7 +874,6 @@ struct ibm_arch_vec __cacheline_aligned ibm_architecture_vec = {
                 .mmu = 0,
                 .hash_ext = 0,
                 .radix_ext = 0,
-                .byte22 = 0,
         },
 
         /* option vector 6: IBM PAPR hints */
diff --git a/arch/powerpc/kvm/book3s_64_mmu_radix.c b/arch/powerpc/kvm/book3s_64_mmu_radix.c
index 0c854816e653..5cb4e4687107 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_radix.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_radix.c
@@ -195,6 +195,12 @@ static void kvmppc_pte_free(pte_t *ptep)
         kmem_cache_free(kvm_pte_cache, ptep);
 }
 
+/* Like pmd_huge() and pmd_large(), but works regardless of config options */
+static inline int pmd_is_leaf(pmd_t pmd)
+{
+        return !!(pmd_val(pmd) & _PAGE_PTE);
+}
+
 static int kvmppc_create_pte(struct kvm *kvm, pte_t pte, unsigned long gpa,
                              unsigned int level, unsigned long mmu_seq)
 {
@@ -219,7 +225,7 @@ static int kvmppc_create_pte(struct kvm *kvm, pte_t pte, unsigned long gpa,
         else
                 new_pmd = pmd_alloc_one(kvm->mm, gpa);
 
-        if (level == 0 && !(pmd && pmd_present(*pmd)))
+        if (level == 0 && !(pmd && pmd_present(*pmd) && !pmd_is_leaf(*pmd)))
                 new_ptep = kvmppc_pte_alloc();
 
         /* Check if we might have been invalidated; let the guest retry if so */
@@ -244,12 +250,30 @@ static int kvmppc_create_pte(struct kvm *kvm, pte_t pte, unsigned long gpa,
                 new_pmd = NULL;
         }
         pmd = pmd_offset(pud, gpa);
-        if (pmd_large(*pmd)) {
-                /* Someone else has instantiated a large page here; retry */
-                ret = -EAGAIN;
-                goto out_unlock;
-        }
-        if (level == 1 && !pmd_none(*pmd)) {
+        if (pmd_is_leaf(*pmd)) {
+                unsigned long lgpa = gpa & PMD_MASK;
+
+                /*
+                 * If we raced with another CPU which has just put
+                 * a 2MB pte in after we saw a pte page, try again.
+                 */
+                if (level == 0 && !new_ptep) {
+                        ret = -EAGAIN;
+                        goto out_unlock;
+                }
+                /* Valid 2MB page here already, remove it */
+                old = kvmppc_radix_update_pte(kvm, pmdp_ptep(pmd),
+                                              ~0UL, 0, lgpa, PMD_SHIFT);
+                kvmppc_radix_tlbie_page(kvm, lgpa, PMD_SHIFT);
+                if (old & _PAGE_DIRTY) {
+                        unsigned long gfn = lgpa >> PAGE_SHIFT;
+                        struct kvm_memory_slot *memslot;
+                        memslot = gfn_to_memslot(kvm, gfn);
+                        if (memslot && memslot->dirty_bitmap)
+                                kvmppc_update_dirty_map(memslot,
+                                                        gfn, PMD_SIZE);
+                }
+        } else if (level == 1 && !pmd_none(*pmd)) {
                 /*
                  * There's a page table page here, but we wanted
                  * to install a large page.  Tell the caller and let
@@ -412,28 +436,24 @@ int kvmppc_book3s_radix_page_fault(struct kvm_run *run, struct kvm_vcpu *vcpu,
         } else {
                 page = pages[0];
                 pfn = page_to_pfn(page);
-                if (PageHuge(page)) {
-                        page = compound_head(page);
-                        pte_size <<= compound_order(page);
+                if (PageCompound(page)) {
+                        pte_size <<= compound_order(compound_head(page));
                         /* See if we can insert a 2MB large-page PTE here */
                         if (pte_size >= PMD_SIZE &&
-                            (gpa & PMD_MASK & PAGE_MASK) ==
-                            (hva & PMD_MASK & PAGE_MASK)) {
+                            (gpa & (PMD_SIZE - PAGE_SIZE)) ==
+                            (hva & (PMD_SIZE - PAGE_SIZE))) {
                                 level = 1;
                                 pfn &= ~((PMD_SIZE >> PAGE_SHIFT) - 1);
                         }
                 }
                 /* See if we can provide write access */
                 if (writing) {
-                        /*
-                         * We assume gup_fast has set dirty on the host PTE.
-                         */
                         pgflags |= _PAGE_WRITE;
                 } else {
                         local_irq_save(flags);
                         ptep = find_current_mm_pte(current->mm->pgd,
                                                    hva, NULL, NULL);
-                        if (ptep && pte_write(*ptep) && pte_dirty(*ptep))
+                        if (ptep && pte_write(*ptep))
                                 pgflags |= _PAGE_WRITE;
                         local_irq_restore(flags);
                 }
@@ -459,18 +479,15 @@ int kvmppc_book3s_radix_page_fault(struct kvm_run *run, struct kvm_vcpu *vcpu,
                 pte = pfn_pte(pfn, __pgprot(pgflags));
                 ret = kvmppc_create_pte(kvm, pte, gpa, level, mmu_seq);
         }
-        if (ret == 0 || ret == -EAGAIN)
-                ret = RESUME_GUEST;
 
         if (page) {
-                /*
-                 * We drop pages[0] here, not page because page might
-                 * have been set to the head page of a compound, but
-                 * we have to drop the reference on the correct tail
-                 * page to match the get inside gup()
-                 */
-                put_page(pages[0]);
+                if (!ret && (pgflags & _PAGE_WRITE))
+                        set_page_dirty_lock(page);
+                put_page(page);
         }
+
+        if (ret == 0 || ret == -EAGAIN)
+                ret = RESUME_GUEST;
         return ret;
 }
 
@@ -644,7 +661,7 @@ void kvmppc_free_radix(struct kvm *kvm)
                                 continue;
                         pmd = pmd_offset(pud, 0);
                         for (im = 0; im < PTRS_PER_PMD; ++im, ++pmd) {
-                                if (pmd_huge(*pmd)) {
+                                if (pmd_is_leaf(*pmd)) {
                                         pmd_clear(pmd);
                                         continue;
                                 }
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 89707354c2ef..9cb9448163c4 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -2885,7 +2885,7 @@ static noinline void kvmppc_run_core(struct kvmppc_vcore *vc)
          */
         trace_hardirqs_on();
 
-        guest_enter();
+        guest_enter_irqoff();
 
         srcu_idx = srcu_read_lock(&vc->kvm->srcu);
 
@@ -2893,8 +2893,6 @@ static noinline void kvmppc_run_core(struct kvmppc_vcore *vc)
 
         srcu_read_unlock(&vc->kvm->srcu, srcu_idx);
 
-        guest_exit();
-
         trace_hardirqs_off();
         set_irq_happened(trap);
 
@@ -2937,6 +2935,7 @@ static noinline void kvmppc_run_core(struct kvmppc_vcore *vc)
         kvmppc_set_host_core(pcpu);
 
         local_irq_enable();
+        guest_exit();
 
         /* Let secondaries go back to the offline loop */
         for (i = 0; i < controlled_threads; ++i) {
@@ -3656,15 +3655,17 @@ static int kvmppc_hv_setup_htab_rma(struct kvm_vcpu *vcpu)
                 goto up_out;
 
         psize = vma_kernel_pagesize(vma);
-        porder = __ilog2(psize);
 
         up_read(&current->mm->mmap_sem);
 
         /* We can handle 4k, 64k or 16M pages in the VRMA */
-        err = -EINVAL;
-        if (!(psize == 0x1000 || psize == 0x10000 ||
-              psize == 0x1000000))
-                goto out_srcu;
+        if (psize >= 0x1000000)
+                psize = 0x1000000;
+        else if (psize >= 0x10000)
+                psize = 0x10000;
+        else
+                psize = 0x1000;
+        porder = __ilog2(psize);
 
         senc = slb_pgsize_encoding(psize);
         kvm->arch.vrma_slb_v = senc | SLB_VSID_B_1T |
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index f31f357b8c5a..d33264697a31 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -320,7 +320,6 @@ kvm_novcpu_exit:
         stw     r12, STACK_SLOT_TRAP(r1)
         bl      kvmhv_commence_exit
         nop
-        lwz     r12, STACK_SLOT_TRAP(r1)
         b       kvmhv_switch_to_host
 
 /*
@@ -1220,6 +1219,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
 
 secondary_too_late:
         li      r12, 0
+        stw     r12, STACK_SLOT_TRAP(r1)
         cmpdi   r4, 0
         beq     11f
         stw     r12, VCPU_TRAP(r4)
@@ -1558,12 +1558,12 @@ mc_cont:
 3:      stw     r5,VCPU_SLB_MAX(r9)
 
 guest_bypass:
+        stw     r12, STACK_SLOT_TRAP(r1)
         mr      r3, r12
         /* Increment exit count, poke other threads to exit */
         bl      kvmhv_commence_exit
         nop
         ld      r9, HSTATE_KVM_VCPU(r13)
-        lwz     r12, VCPU_TRAP(r9)
 
         /* Stop others sending VCPU interrupts to this physical CPU */
         li      r0, -1
@@ -1898,6 +1898,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_POWER9_DD1)
          * POWER7/POWER8 guest -> host partition switch code.
          * We don't have to lock against tlbies but we do
          * have to coordinate the hardware threads.
+         * Here STACK_SLOT_TRAP(r1) contains the trap number.
          */
 kvmhv_switch_to_host:
         /* Secondary threads wait for primary to do partition switch */
@@ -1950,12 +1951,12 @@ BEGIN_FTR_SECTION
 END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
 
         /* If HMI, call kvmppc_realmode_hmi_handler() */
+        lwz     r12, STACK_SLOT_TRAP(r1)
         cmpwi   r12, BOOK3S_INTERRUPT_HMI
         bne     27f
         bl      kvmppc_realmode_hmi_handler
         nop
         cmpdi   r3, 0
-        li      r12, BOOK3S_INTERRUPT_HMI
         /*
          * At this point kvmppc_realmode_hmi_handler may have resync-ed
          * the TB, and if it has, we must not subtract the guest timebase
@@ -2008,10 +2009,8 @@ BEGIN_FTR_SECTION
         lwz     r8, KVM_SPLIT_DO_RESTORE(r3)
         cmpwi   r8, 0
         beq     47f
-        stw     r12, STACK_SLOT_TRAP(r1)
         bl      kvmhv_p9_restore_lpcr
         nop
-        lwz     r12, STACK_SLOT_TRAP(r1)
         b       48f
 47:
 END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
@@ -2049,6 +2048,7 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_TYPE_RADIX)
         li      r0, KVM_GUEST_MODE_NONE
         stb     r0, HSTATE_IN_GUEST(r13)
 
+        lwz     r12, STACK_SLOT_TRAP(r1)        /* return trap # in r12 */
         ld      r0, SFS+PPC_LR_STKOFF(r1)
         addi    r1, r1, SFS
         mtlr    r0
diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
index 403e642c78f5..52c205373986 100644
--- a/arch/powerpc/kvm/powerpc.c
+++ b/arch/powerpc/kvm/powerpc.c
@@ -1345,7 +1345,7 @@ static int kvmppc_emulate_mmio_vsx_loadstore(struct kvm_vcpu *vcpu,
 int kvmppc_handle_load128_by2x64(struct kvm_run *run, struct kvm_vcpu *vcpu,
                 unsigned int rt, int is_default_endian)
 {
-        enum emulation_result emulated;
+        enum emulation_result emulated = EMULATE_DONE;
 
         while (vcpu->arch.mmio_vmx_copy_nums) {
                 emulated = __kvmppc_handle_load(run, vcpu, rt, 8,
@@ -1608,7 +1608,9 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run)
 
         kvm_sigset_deactivate(vcpu);
 
+#ifdef CONFIG_ALTIVEC
 out:
+#endif
         vcpu_put(vcpu);
         return r;
 }
diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
index 0a34b0cec7b7..0ef3d9580e98 100644
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -240,6 +240,7 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32
          *   goto out;
          */
         PPC_LWZ(b2p[TMP_REG_1], b2p_bpf_array, offsetof(struct bpf_array, map.max_entries));
+        PPC_RLWINM(b2p_index, b2p_index, 0, 0, 31);
         PPC_CMPLW(b2p_index, b2p[TMP_REG_1]);
         PPC_BCC(COND_GE, out);
 
diff --git a/arch/riscv/include/asm/barrier.h b/arch/riscv/include/asm/barrier.h
index c0319cbf1eec..5510366d169a 100644
--- a/arch/riscv/include/asm/barrier.h
+++ b/arch/riscv/include/asm/barrier.h
@@ -34,9 +34,9 @@
 #define wmb()           RISCV_FENCE(ow,ow)
 
 /* These barriers do not need to enforce ordering on devices, just memory. */
-#define smp_mb()        RISCV_FENCE(rw,rw)
-#define smp_rmb()       RISCV_FENCE(r,r)
-#define smp_wmb()       RISCV_FENCE(w,w)
+#define __smp_mb()      RISCV_FENCE(rw,rw)
+#define __smp_rmb()     RISCV_FENCE(r,r)
+#define __smp_wmb()     RISCV_FENCE(w,w)
 
 /*
  * This is a very specific barrier: it's currently only used in two places in
diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
index 65154eaa3714..6c8ce15cde7b 100644
--- a/arch/s390/include/asm/mmu_context.h
+++ b/arch/s390/include/asm/mmu_context.h
@@ -63,6 +63,7 @@ static inline int init_new_context(struct task_struct *tsk,
                                    _ASCE_USER_BITS | _ASCE_TYPE_SEGMENT;
                 /* pgd_alloc() did not account this pmd */
                 mm_inc_nr_pmds(mm);
+                mm_inc_nr_puds(mm);
         }
         crst_table_init((unsigned long *) mm->pgd, pgd_entry_type(mm));
         return 0;
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 13a133a6015c..a5621ea6d123 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -14,6 +14,7 @@
 #include <asm/processor.h>
 #include <asm/cache.h>
 #include <asm/ctl_reg.h>
+#include <asm/dwarf.h>
 #include <asm/errno.h>
 #include <asm/ptrace.h>
 #include <asm/thread_info.h>
@@ -230,7 +231,7 @@ _PIF_WORK	= (_PIF_PER_TRAP | _PIF_SYSCALL_RESTART)
         .hidden \name
         .type \name,@function
 \name:
-        .cfi_startproc
+        CFI_STARTPROC
 #ifdef CONFIG_HAVE_MARCH_Z10_FEATURES
         exrl    0,0f
 #else
@@ -239,7 +240,7 @@ _PIF_WORK	= (_PIF_PER_TRAP | _PIF_SYSCALL_RESTART)
 #endif
         j       .
 0:      br      \reg
-        .cfi_endproc
+        CFI_ENDPROC
         .endm
 
         GEN_BR_THUNK __s390x_indirect_jump_r1use_r9,%r9,%r1
@@ -426,13 +427,13 @@ ENTRY(system_call)
         UPDATE_VTIME %r8,%r9,__LC_SYNC_ENTER_TIMER
         BPENTER __TI_flags(%r12),_TIF_ISOLATE_BP
         stmg    %r0,%r7,__PT_R0(%r11)
-        # clear user controlled register to prevent speculative use
-        xgr     %r0,%r0
         mvc     __PT_R8(64,%r11),__LC_SAVE_AREA_SYNC
         mvc     __PT_PSW(16,%r11),__LC_SVC_OLD_PSW
         mvc     __PT_INT_CODE(4,%r11),__LC_SVC_ILC
         stg     %r14,__PT_FLAGS(%r11)
 .Lsysc_do_svc:
+        # clear user controlled register to prevent speculative use
+        xgr     %r0,%r0
         # load address of system call table
         lg      %r10,__THREAD_sysc_table(%r13,%r12)
         llgh    %r8,__PT_INT_CODE+2(%r11)
@@ -1439,6 +1440,7 @@ cleanup_critical:
         stg     %r15,__LC_SYSTEM_TIMER
 0:      # update accounting time stamp
         mvc     __LC_LAST_UPDATE_TIMER(8),__LC_SYNC_ENTER_TIMER
+        BPENTER __TI_flags(%r12),_TIF_ISOLATE_BP
         # set up saved register r11
         lg      %r15,__LC_KERNEL_STACK
         la      %r9,STACK_FRAME_OVERHEAD(%r15)
diff --git a/arch/s390/kernel/nospec-branch.c b/arch/s390/kernel/nospec-branch.c
index 69d7fcf48158..9aff72d3abda 100644
--- a/arch/s390/kernel/nospec-branch.c
+++ b/arch/s390/kernel/nospec-branch.c
@@ -2,8 +2,8 @@
 #include <linux/module.h>
 #include <asm/nospec-branch.h>
 
-int nospec_call_disable = IS_ENABLED(EXPOLINE_OFF);
-int nospec_return_disable = !IS_ENABLED(EXPOLINE_FULL);
+int nospec_call_disable = IS_ENABLED(CONFIG_EXPOLINE_OFF);
+int nospec_return_disable = !IS_ENABLED(CONFIG_EXPOLINE_FULL);
 
 static int __init nospectre_v2_setup_early(char *str)
 {
diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c
index 9c7d70715862..07c6e81163bf 100644
--- a/arch/s390/kvm/intercept.c
+++ b/arch/s390/kvm/intercept.c
@@ -22,22 +22,6 @@
 #include "trace.h"
 #include "trace-s390.h"
 
-
-static const intercept_handler_t instruction_handlers[256] = {
-        [0x01] = kvm_s390_handle_01,
-        [0x82] = kvm_s390_handle_lpsw,
-        [0x83] = kvm_s390_handle_diag,
-        [0xaa] = kvm_s390_handle_aa,
-        [0xae] = kvm_s390_handle_sigp,
-        [0xb2] = kvm_s390_handle_b2,
-        [0xb6] = kvm_s390_handle_stctl,
-        [0xb7] = kvm_s390_handle_lctl,
-        [0xb9] = kvm_s390_handle_b9,
-        [0xe3] = kvm_s390_handle_e3,
-        [0xe5] = kvm_s390_handle_e5,
-        [0xeb] = kvm_s390_handle_eb,
-};
-
 u8 kvm_s390_get_ilen(struct kvm_vcpu *vcpu)
 {
         struct kvm_s390_sie_block *sie_block = vcpu->arch.sie_block;
@@ -129,16 +113,39 @@ static int handle_validity(struct kvm_vcpu *vcpu)
 
 static int handle_instruction(struct kvm_vcpu *vcpu)
 {
-        intercept_handler_t handler;
-
         vcpu->stat.exit_instruction++;
         trace_kvm_s390_intercept_instruction(vcpu,
                                              vcpu->arch.sie_block->ipa,
                                              vcpu->arch.sie_block->ipb);
-        handler = instruction_handlers[vcpu->arch.sie_block->ipa >> 8];
-        if (handler)
-                return handler(vcpu);
-        return -EOPNOTSUPP;
+
+        switch (vcpu->arch.sie_block->ipa >> 8) {
+        case 0x01:
+                return kvm_s390_handle_01(vcpu);
+        case 0x82:
+                return kvm_s390_handle_lpsw(vcpu);
+        case 0x83:
+                return kvm_s390_handle_diag(vcpu);
+        case 0xaa:
+                return kvm_s390_handle_aa(vcpu);
+        case 0xae:
+                return kvm_s390_handle_sigp(vcpu);
+        case 0xb2:
+                return kvm_s390_handle_b2(vcpu);
+        case 0xb6:
+                return kvm_s390_handle_stctl(vcpu);
+        case 0xb7:
+                return kvm_s390_handle_lctl(vcpu);
+        case 0xb9:
+                return kvm_s390_handle_b9(vcpu);
+        case 0xe3:
+                return kvm_s390_handle_e3(vcpu);
+        case 0xe5:
+                return kvm_s390_handle_e5(vcpu);
+        case 0xeb:
+                return kvm_s390_handle_eb(vcpu);
+        default:
+                return -EOPNOTSUPP;
+        }
 }
 
 static int inject_prog_on_prog_intercept(struct kvm_vcpu *vcpu)
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index aabf46f5f883..b04616b57a94 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -169,8 +169,15 @@ static int ckc_interrupts_enabled(struct kvm_vcpu *vcpu)
 
 static int ckc_irq_pending(struct kvm_vcpu *vcpu)
 {
-        if (vcpu->arch.sie_block->ckc >= kvm_s390_get_tod_clock_fast(vcpu->kvm))
+        const u64 now = kvm_s390_get_tod_clock_fast(vcpu->kvm);
+        const u64 ckc = vcpu->arch.sie_block->ckc;
+
+        if (vcpu->arch.sie_block->gcr[0] & 0x0020000000000000ul) {
+                if ((s64)ckc >= (s64)now)
+                        return 0;
+        } else if (ckc >= now) {
                 return 0;
+        }
         return ckc_interrupts_enabled(vcpu);
 }
 
@@ -187,12 +194,6 @@ static int cpu_timer_irq_pending(struct kvm_vcpu *vcpu)
         return kvm_s390_get_cpu_timer(vcpu) >> 63;
 }
 
-static inline int is_ioirq(unsigned long irq_type)
-{
-        return ((irq_type >= IRQ_PEND_IO_ISC_7) &&
-                (irq_type <= IRQ_PEND_IO_ISC_0));
-}
-
 static uint64_t isc_to_isc_bits(int isc)
 {
         return (0x80 >> isc) << 24;
@@ -236,10 +237,15 @@ static inline int kvm_s390_gisa_tac_ipm_gisc(struct kvm_s390_gisa *gisa, u32 gis
         return test_and_clear_bit_inv(IPM_BIT_OFFSET + gisc, (unsigned long *) gisa);
 }
 
-static inline unsigned long pending_irqs(struct kvm_vcpu *vcpu)
+static inline unsigned long pending_irqs_no_gisa(struct kvm_vcpu *vcpu)
 {
         return vcpu->kvm->arch.float_int.pending_irqs |
-                vcpu->arch.local_int.pending_irqs |
+                vcpu->arch.local_int.pending_irqs;
+}
+
+static inline unsigned long pending_irqs(struct kvm_vcpu *vcpu)
+{
+        return pending_irqs_no_gisa(vcpu) |
                 kvm_s390_gisa_get_ipm(vcpu->kvm->arch.gisa) << IRQ_PEND_IO_ISC_7;
 }
 
@@ -337,7 +343,7 @@ static void __reset_intercept_indicators(struct kvm_vcpu *vcpu)
 
 static void set_intercept_indicators_io(struct kvm_vcpu *vcpu)
 {
-        if (!(pending_irqs(vcpu) & IRQ_PEND_IO_MASK))
+        if (!(pending_irqs_no_gisa(vcpu) & IRQ_PEND_IO_MASK))
                 return;
         else if (psw_ioint_disabled(vcpu))
                 kvm_s390_set_cpuflags(vcpu, CPUSTAT_IO_INT);
@@ -1011,24 +1017,6 @@ out:
         return rc;
 }
 
-typedef int (*deliver_irq_t)(struct kvm_vcpu *vcpu);
-
-static const deliver_irq_t deliver_irq_funcs[] = {
-        [IRQ_PEND_MCHK_EX]        = __deliver_machine_check,
-        [IRQ_PEND_MCHK_REP]       = __deliver_machine_check,
-        [IRQ_PEND_PROG]           = __deliver_prog,
-        [IRQ_PEND_EXT_EMERGENCY]  = __deliver_emergency_signal,
-        [IRQ_PEND_EXT_EXTERNAL]   = __deliver_external_call,
-        [IRQ_PEND_EXT_CLOCK_COMP] = __deliver_ckc,
-        [IRQ_PEND_EXT_CPU_TIMER]  = __deliver_cpu_timer,
-        [IRQ_PEND_RESTART]        = __deliver_restart,
-        [IRQ_PEND_SET_PREFIX]     = __deliver_set_prefix,
-        [IRQ_PEND_PFAULT_INIT]    = __deliver_pfault_init,
-        [IRQ_PEND_EXT_SERVICE]    = __deliver_service,
-        [IRQ_PEND_PFAULT_DONE]    = __deliver_pfault_done,
-        [IRQ_PEND_VIRTIO]         = __deliver_virtio,
-};
-
 /* Check whether an external call is pending (deliverable or not) */
 int kvm_s390_ext_call_pending(struct kvm_vcpu *vcpu)
 {
@@ -1066,13 +1054,19 @@ int kvm_cpu_has_pending_timer(struct kvm_vcpu *vcpu)
 
 static u64 __calculate_sltime(struct kvm_vcpu *vcpu)
 {
-        u64 now, cputm, sltime = 0;
+        const u64 now = kvm_s390_get_tod_clock_fast(vcpu->kvm);
+        const u64 ckc = vcpu->arch.sie_block->ckc;
+        u64 cputm, sltime = 0;
 
         if (ckc_interrupts_enabled(vcpu)) {
-                now = kvm_s390_get_tod_clock_fast(vcpu->kvm);
-                sltime = tod_to_ns(vcpu->arch.sie_block->ckc - now);
-                /* already expired or overflow? */
-                if (!sltime || vcpu->arch.sie_block->ckc <= now)
+                if (vcpu->arch.sie_block->gcr[0] & 0x0020000000000000ul) {
+                        if ((s64)now < (s64)ckc)
+                                sltime = tod_to_ns((s64)ckc - (s64)now);
+                } else if (now < ckc) {
+                        sltime = tod_to_ns(ckc - now);
+                }
+                /* already expired */
+                if (!sltime)
                         return 0;
                 if (cpu_timer_interrupts_enabled(vcpu)) {
                         cputm = kvm_s390_get_cpu_timer(vcpu);
@@ -1192,7 +1186,6 @@ void kvm_s390_clear_local_irqs(struct kvm_vcpu *vcpu)
 int __must_check kvm_s390_deliver_pending_interrupts(struct kvm_vcpu *vcpu)
 {
         struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
-        deliver_irq_t func;
         int rc = 0;
         unsigned long irq_type;
         unsigned long irqs;
@@ -1212,16 +1205,57 @@ int __must_check kvm_s390_deliver_pending_interrupts(struct kvm_vcpu *vcpu)
         while ((irqs = deliverable_irqs(vcpu)) && !rc) {
                 /* bits are in the reverse order of interrupt priority */
                 irq_type = find_last_bit(&irqs, IRQ_PEND_COUNT);
-                if (is_ioirq(irq_type)) {
+                switch (irq_type) {
+                case IRQ_PEND_IO_ISC_0:
+                case IRQ_PEND_IO_ISC_1:
+                case IRQ_PEND_IO_ISC_2:
+                case IRQ_PEND_IO_ISC_3:
+                case IRQ_PEND_IO_ISC_4:
+                case IRQ_PEND_IO_ISC_5:
+                case IRQ_PEND_IO_ISC_6:
+                case IRQ_PEND_IO_ISC_7:
                         rc = __deliver_io(vcpu, irq_type);
-                } else {
-                        func = deliver_irq_funcs[irq_type];
-                        if (!func) {
-                                WARN_ON_ONCE(func == NULL);
-                                clear_bit(irq_type, &li->pending_irqs);
-                                continue;
-                        }
-                        rc = func(vcpu);
+                        break;
+                case IRQ_PEND_MCHK_EX:
+                case IRQ_PEND_MCHK_REP:
+                        rc = __deliver_machine_check(vcpu);
+                        break;
+                case IRQ_PEND_PROG:
+                        rc = __deliver_prog(vcpu);
+                        break;
+                case IRQ_PEND_EXT_EMERGENCY:
+                        rc = __deliver_emergency_signal(vcpu);
+                        break;
+                case IRQ_PEND_EXT_EXTERNAL:
+                        rc = __deliver_external_call(vcpu);
+                        break;
+                case IRQ_PEND_EXT_CLOCK_COMP:
+                        rc = __deliver_ckc(vcpu);
+                        break;
+                case IRQ_PEND_EXT_CPU_TIMER:
+                        rc = __deliver_cpu_timer(vcpu);
+                        break;
+                case IRQ_PEND_RESTART:
+                        rc = __deliver_restart(vcpu);
+                        break;
+                case IRQ_PEND_SET_PREFIX:
+                        rc = __deliver_set_prefix(vcpu);
+                        break;
+                case IRQ_PEND_PFAULT_INIT:
+                        rc = __deliver_pfault_init(vcpu);
+                        break;
+                case IRQ_PEND_EXT_SERVICE:
+                        rc = __deliver_service(vcpu);
+                        break;
+                case IRQ_PEND_PFAULT_DONE:
+                        rc = __deliver_pfault_done(vcpu);
+                        break;
+                case IRQ_PEND_VIRTIO:
+                        rc = __deliver_virtio(vcpu);
+                        break;
+                default:
+                        WARN_ONCE(1, "Unknown pending irq type %ld", irq_type);
+                        clear_bit(irq_type, &li->pending_irqs);
                 }
         }
 
@@ -1701,7 +1735,8 @@ static void __floating_irq_kick(struct kvm *kvm, u64 type)
                 kvm_s390_set_cpuflags(dst_vcpu, CPUSTAT_STOP_INT);
                 break;
         case KVM_S390_INT_IO_MIN...KVM_S390_INT_IO_MAX:
-                kvm_s390_set_cpuflags(dst_vcpu, CPUSTAT_IO_INT);
+                if (!(type & KVM_S390_INT_IO_AI_MASK && kvm->arch.gisa))
+                        kvm_s390_set_cpuflags(dst_vcpu, CPUSTAT_IO_INT);
                 break;
         default:
                 kvm_s390_set_cpuflags(dst_vcpu, CPUSTAT_EXT_INT);
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index ba4c7092335a..339ac0964590 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -86,6 +86,7 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
         { "deliver_prefix_signal", VCPU_STAT(deliver_prefix_signal) },
         { "deliver_restart_signal", VCPU_STAT(deliver_restart_signal) },
         { "deliver_program_interruption", VCPU_STAT(deliver_program_int) },
+        { "deliver_io_interrupt", VCPU_STAT(deliver_io_int) },
         { "exit_wait_state", VCPU_STAT(exit_wait_state) },
         { "instruction_epsw", VCPU_STAT(instruction_epsw) },
         { "instruction_gs", VCPU_STAT(instruction_gs) },
@@ -179,6 +180,28 @@ int kvm_arch_hardware_enable(void)
 static void kvm_gmap_notifier(struct gmap *gmap, unsigned long start,
                               unsigned long end);
 
+static void kvm_clock_sync_scb(struct kvm_s390_sie_block *scb, u64 delta)
+{
+        u8 delta_idx = 0;
+
+        /*
+         * The TOD jumps by delta, we have to compensate this by adding
+         * -delta to the epoch.
+         */
+        delta = -delta;
+
+        /* sign-extension - we're adding to signed values below */
+        if ((s64)delta < 0)
+                delta_idx = -1;
+
+        scb->epoch += delta;
+        if (scb->ecd & ECD_MEF) {
+                scb->epdx += delta_idx;
+                if (scb->epoch < delta)
+                        scb->epdx += 1;
+        }
+}
+
 /*
  * This callback is executed during stop_machine(). All CPUs are therefore
  * temporarily stopped. In order not to change guest behavior, we have to
@@ -194,13 +217,17 @@ static int kvm_clock_sync(struct notifier_block *notifier, unsigned long val,
         unsigned long long *delta = v;
 
         list_for_each_entry(kvm, &vm_list, vm_list) {
-                kvm->arch.epoch -= *delta;
                 kvm_for_each_vcpu(i, vcpu, kvm) {
-                        vcpu->arch.sie_block->epoch -= *delta;
+                        kvm_clock_sync_scb(vcpu->arch.sie_block, *delta);
+                        if (i == 0) {
+                                kvm->arch.epoch = vcpu->arch.sie_block->epoch;
+                                kvm->arch.epdx = vcpu->arch.sie_block->epdx;
+                        }
                         if (vcpu->arch.cputm_enabled)
                                 vcpu->arch.cputm_start += *delta;
                         if (vcpu->arch.vsie_block)
-                                vcpu->arch.vsie_block->epoch -= *delta;
+                                kvm_clock_sync_scb(vcpu->arch.vsie_block,
+                                                   *delta);
                 }
         }
         return NOTIFY_OK;
@@ -902,12 +929,9 @@ static int kvm_s390_set_tod_ext(struct kvm *kvm, struct kvm_device_attr *attr)
         if (copy_from_user(&gtod, (void __user *)attr->addr, sizeof(gtod)))
                 return -EFAULT;
 
-        if (test_kvm_facility(kvm, 139))
-                kvm_s390_set_tod_clock_ext(kvm, &gtod);
-        else if (gtod.epoch_idx == 0)
-                kvm_s390_set_tod_clock(kvm, gtod.tod);
-        else
+        if (!test_kvm_facility(kvm, 139) && gtod.epoch_idx)
                 return -EINVAL;
+        kvm_s390_set_tod_clock(kvm, &gtod);
 
         VM_EVENT(kvm, 3, "SET: TOD extension: 0x%x, TOD base: 0x%llx",
                 gtod.epoch_idx, gtod.tod);
@@ -932,13 +956,14 @@ static int kvm_s390_set_tod_high(struct kvm *kvm, struct kvm_device_attr *attr)
 
 static int kvm_s390_set_tod_low(struct kvm *kvm, struct kvm_device_attr *attr)
 {
-        u64 gtod;
+        struct kvm_s390_vm_tod_clock gtod = { 0 };
 
-        if (copy_from_user(&gtod, (void __user *)attr->addr, sizeof(gtod)))
+        if (copy_from_user(&gtod.tod, (void __user *)attr->addr,
+                           sizeof(gtod.tod)))
                 return -EFAULT;
 
-        kvm_s390_set_tod_clock(kvm, gtod);
-        VM_EVENT(kvm, 3, "SET: TOD base: 0x%llx", gtod);
+        kvm_s390_set_tod_clock(kvm, &gtod);
+        VM_EVENT(kvm, 3, "SET: TOD base: 0x%llx", gtod.tod);
         return 0;
 }
 
@@ -2122,6 +2147,7 @@ static void sca_add_vcpu(struct kvm_vcpu *vcpu)
                 /* we still need the basic sca for the ipte control */
                 vcpu->arch.sie_block->scaoh = (__u32)(((__u64)sca) >> 32);
                 vcpu->arch.sie_block->scaol = (__u32)(__u64)sca;
+                return;
         }
         read_lock(&vcpu->kvm->arch.sca_lock);
         if (vcpu->kvm->arch.use_esca) {
@@ -2389,6 +2415,7 @@ void kvm_arch_vcpu_postcreate(struct kvm_vcpu *vcpu)
         mutex_lock(&vcpu->kvm->lock);
         preempt_disable();
         vcpu->arch.sie_block->epoch = vcpu->kvm->arch.epoch;
+        vcpu->arch.sie_block->epdx = vcpu->kvm->arch.epdx;
         preempt_enable();
         mutex_unlock(&vcpu->kvm->lock);
         if (!kvm_is_ucontrol(vcpu->kvm)) {
@@ -3021,8 +3048,8 @@ retry:
         return 0;
 }
 
-void kvm_s390_set_tod_clock_ext(struct kvm *kvm,
-                                 const struct kvm_s390_vm_tod_clock *gtod)
+void kvm_s390_set_tod_clock(struct kvm *kvm,
+                            const struct kvm_s390_vm_tod_clock *gtod)
 {
         struct kvm_vcpu *vcpu;
         struct kvm_s390_tod_clock_ext htod;
@@ -3034,10 +3061,12 @@ void kvm_s390_set_tod_clock_ext(struct kvm *kvm,
         get_tod_clock_ext((char *)&htod);
 
         kvm->arch.epoch = gtod->tod - htod.tod;
-        kvm->arch.epdx = gtod->epoch_idx - htod.epoch_idx;
-
-        if (kvm->arch.epoch > gtod->tod)
-                kvm->arch.epdx -= 1;
+        kvm->arch.epdx = 0;
+        if (test_kvm_facility(kvm, 139)) {
+                kvm->arch.epdx = gtod->epoch_idx - htod.epoch_idx;
+                if (kvm->arch.epoch > gtod->tod)
+                        kvm->arch.epdx -= 1;
+        }
 
         kvm_s390_vcpu_block_all(kvm);
         kvm_for_each_vcpu(i, vcpu, kvm) {
@@ -3050,22 +3079,6 @@ void kvm_s390_set_tod_clock_ext(struct kvm *kvm,
         mutex_unlock(&kvm->lock);
 }
 
-void kvm_s390_set_tod_clock(struct kvm *kvm, u64 tod)
-{
-        struct kvm_vcpu *vcpu;
-        int i;
-
-        mutex_lock(&kvm->lock);
-        preempt_disable();
-        kvm->arch.epoch = tod - get_tod_clock();
-        kvm_s390_vcpu_block_all(kvm);
-        kvm_for_each_vcpu(i, vcpu, kvm)
-                vcpu->arch.sie_block->epoch = kvm->arch.epoch;
-        kvm_s390_vcpu_unblock_all(kvm);
-        preempt_enable();
-        mutex_unlock(&kvm->lock);
-}
-
 /**
  * kvm_arch_fault_in_page - fault-in guest page if necessary
  * @vcpu: The corresponding virtual cpu
diff --git a/arch/s390/kvm/kvm-s390.h b/arch/s390/kvm/kvm-s390.h
index bd31b37b0e6f..f55ac0ef99ea 100644
--- a/arch/s390/kvm/kvm-s390.h
+++ b/arch/s390/kvm/kvm-s390.h
@@ -19,8 +19,6 @@
 #include <asm/processor.h>
 #include <asm/sclp.h>
 
-typedef int (*intercept_handler_t)(struct kvm_vcpu *vcpu);
-
 /* Transactional Memory Execution related macros */
 #define IS_TE_ENABLED(vcpu)     ((vcpu->arch.sie_block->ecb & ECB_TE))
 #define TDB_FORMAT1             1
@@ -283,9 +281,8 @@ int kvm_s390_handle_sigp(struct kvm_vcpu *vcpu);
 int kvm_s390_handle_sigp_pei(struct kvm_vcpu *vcpu);
 
 /* implemented in kvm-s390.c */
-void kvm_s390_set_tod_clock_ext(struct kvm *kvm,
-                                 const struct kvm_s390_vm_tod_clock *gtod);
-void kvm_s390_set_tod_clock(struct kvm *kvm, u64 tod);
+void kvm_s390_set_tod_clock(struct kvm *kvm,
+                            const struct kvm_s390_vm_tod_clock *gtod);
 long kvm_arch_fault_in_page(struct kvm_vcpu *vcpu, gpa_t gpa, int writable);
 int kvm_s390_store_status_unloaded(struct kvm_vcpu *vcpu, unsigned long addr);
 int kvm_s390_vcpu_store_status(struct kvm_vcpu *vcpu, unsigned long addr);
diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index c4c4e157c036..f0b4185158af 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -85,9 +85,10 @@ int kvm_s390_handle_e3(struct kvm_vcpu *vcpu)
 /* Handle SCK (SET CLOCK) interception */
 static int handle_set_clock(struct kvm_vcpu *vcpu)
 {
+        struct kvm_s390_vm_tod_clock gtod = { 0 };
         int rc;
         u8 ar;
-        u64 op2, val;
+        u64 op2;
 
         vcpu->stat.instruction_sck++;
 
@@ -97,12 +98,12 @@ static int handle_set_clock(struct kvm_vcpu *vcpu)
         op2 = kvm_s390_get_base_disp_s(vcpu, &ar);
         if (op2 & 7)    /* Operand must be on a doubleword boundary */
                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
-        rc = read_guest(vcpu, op2, ar, &val, sizeof(val));
+        rc = read_guest(vcpu, op2, ar, &gtod.tod, sizeof(gtod.tod));
         if (rc)
                 return kvm_s390_inject_prog_cond(vcpu, rc);
 
-        VCPU_EVENT(vcpu, 3, "SCK: setting guest TOD to 0x%llx", val);
-        kvm_s390_set_tod_clock(vcpu->kvm, val);
+        VCPU_EVENT(vcpu, 3, "SCK: setting guest TOD to 0x%llx", gtod.tod);
+        kvm_s390_set_tod_clock(vcpu->kvm, &gtod);
 
         kvm_s390_set_psw_cc(vcpu, 0);
         return 0;
@@ -795,55 +796,60 @@ out:
         return rc;
 }
 
-static const intercept_handler_t b2_handlers[256] = {
-        [0x02] = handle_stidp,
-        [0x04] = handle_set_clock,
-        [0x10] = handle_set_prefix,
-        [0x11] = handle_store_prefix,
-        [0x12] = handle_store_cpu_address,
-        [0x14] = kvm_s390_handle_vsie,
-        [0x21] = handle_ipte_interlock,
-        [0x29] = handle_iske,
-        [0x2a] = handle_rrbe,
-        [0x2b] = handle_sske,
-        [0x2c] = handle_test_block,
-        [0x30] = handle_io_inst,
-        [0x31] = handle_io_inst,
-        [0x32] = handle_io_inst,
-        [0x33] = handle_io_inst,
-        [0x34] = handle_io_inst,
-        [0x35] = handle_io_inst,
-        [0x36] = handle_io_inst,
-        [0x37] = handle_io_inst,
-        [0x38] = handle_io_inst,
-        [0x39] = handle_io_inst,
-        [0x3a] = handle_io_inst,
-        [0x3b] = handle_io_inst,
-        [0x3c] = handle_io_inst,
-        [0x50] = handle_ipte_interlock,
-        [0x56] = handle_sthyi,
-        [0x5f] = handle_io_inst,
-        [0x74] = handle_io_inst,
-        [0x76] = handle_io_inst,
-        [0x7d] = handle_stsi,
-        [0xb1] = handle_stfl,
-        [0xb2] = handle_lpswe,
-};
-
 int kvm_s390_handle_b2(struct kvm_vcpu *vcpu)
 {
-        intercept_handler_t handler;
-
-        /*
-         * A lot of B2 instructions are priviledged. Here we check for
-         * the privileged ones, that we can handle in the kernel.
-         * Anything else goes to userspace.
-         */
-        handler = b2_handlers[vcpu->arch.sie_block->ipa & 0x00ff];
-        if (handler)
-                return handler(vcpu);
-
-        return -EOPNOTSUPP;
+        switch (vcpu->arch.sie_block->ipa & 0x00ff) {
+        case 0x02:
+                return handle_stidp(vcpu);
+        case 0x04:
+                return handle_set_clock(vcpu);
+        case 0x10:
+                return handle_set_prefix(vcpu);
+        case 0x11:
+                return handle_store_prefix(vcpu);
+        case 0x12:
+                return handle_store_cpu_address(vcpu);
+        case 0x14:
+                return kvm_s390_handle_vsie(vcpu);
+        case 0x21:
+        case 0x50:
+                return handle_ipte_interlock(vcpu);
+        case 0x29:
+                return handle_iske(vcpu);
+        case 0x2a:
+                return handle_rrbe(vcpu);
+        case 0x2b:
+                return handle_sske(vcpu);
+        case 0x2c:
+                return handle_test_block(vcpu);
+        case 0x30:
+        case 0x31:
+        case 0x32:
+        case 0x33:
+        case 0x34:
+        case 0x35:
+        case 0x36:
+        case 0x37:
+        case 0x38:
+        case 0x39:
+        case 0x3a:
+        case 0x3b:
+        case 0x3c:
+        case 0x5f:
+        case 0x74:
+        case 0x76:
+                return handle_io_inst(vcpu);
+        case 0x56:
+                return handle_sthyi(vcpu);
+        case 0x7d:
+                return handle_stsi(vcpu);
+        case 0xb1:
+                return handle_stfl(vcpu);
+        case 0xb2:
+                return handle_lpswe(vcpu);
+        default:
+                return -EOPNOTSUPP;
+        }
 }
 
 static int handle_epsw(struct kvm_vcpu *vcpu)
@@ -1105,25 +1111,22 @@ static int handle_essa(struct kvm_vcpu *vcpu)
         return 0;
 }
 
-static const intercept_handler_t b9_handlers[256] = {
-        [0x8a] = handle_ipte_interlock,
-        [0x8d] = handle_epsw,
-        [0x8e] = handle_ipte_interlock,
-        [0x8f] = handle_ipte_interlock,
-        [0xab] = handle_essa,
-        [0xaf] = handle_pfmf,
-};
-
 int kvm_s390_handle_b9(struct kvm_vcpu *vcpu)
 {
-        intercept_handler_t handler;
-
-        /* This is handled just as for the B2 instructions. */
-        handler = b9_handlers[vcpu->arch.sie_block->ipa & 0x00ff];
-        if (handler)
-                return handler(vcpu);
-
-        return -EOPNOTSUPP;
+        switch (vcpu->arch.sie_block->ipa & 0x00ff) {
+        case 0x8a:
+        case 0x8e:
+        case 0x8f:
+                return handle_ipte_interlock(vcpu);
+        case 0x8d:
+                return handle_epsw(vcpu);
+        case 0xab:
+                return handle_essa(vcpu);
+        case 0xaf:
+                return handle_pfmf(vcpu);
+        default:
+                return -EOPNOTSUPP;
+        }
 }
 
 int kvm_s390_handle_lctl(struct kvm_vcpu *vcpu)
@@ -1271,22 +1274,20 @@ static int handle_stctg(struct kvm_vcpu *vcpu)
         return rc ? kvm_s390_inject_prog_cond(vcpu, rc) : 0;
 }
 
-static const intercept_handler_t eb_handlers[256] = {
-        [0x2f] = handle_lctlg,
-        [0x25] = handle_stctg,
-        [0x60] = handle_ri,
-        [0x61] = handle_ri,
-        [0x62] = handle_ri,
-};
-
 int kvm_s390_handle_eb(struct kvm_vcpu *vcpu)
 {
-        intercept_handler_t handler;
-
-        handler = eb_handlers[vcpu->arch.sie_block->ipb & 0xff];
-        if (handler)
-                return handler(vcpu);
-        return -EOPNOTSUPP;
+        switch (vcpu->arch.sie_block->ipb & 0x000000ff) {
+        case 0x25:
+                return handle_stctg(vcpu);
+        case 0x2f:
+                return handle_lctlg(vcpu);
+        case 0x60:
+        case 0x61:
+        case 0x62:
+                return handle_ri(vcpu);
+        default:
+                return -EOPNOTSUPP;
+        }
 }
 
 static int handle_tprot(struct kvm_vcpu *vcpu)
@@ -1346,10 +1347,12 @@ out_unlock:
 
 int kvm_s390_handle_e5(struct kvm_vcpu *vcpu)
 {
-        /* For e5xx... instructions we only handle TPROT */
-        if ((vcpu->arch.sie_block->ipa & 0x00ff) == 0x01)
+        switch (vcpu->arch.sie_block->ipa & 0x00ff) {
+        case 0x01:
                 return handle_tprot(vcpu);
-        return -EOPNOTSUPP;
+        default:
+                return -EOPNOTSUPP;
+        }
 }
 
 static int handle_sckpf(struct kvm_vcpu *vcpu)
@@ -1380,17 +1383,14 @@ static int handle_ptff(struct kvm_vcpu *vcpu)
         return 0;
 }
 
-static const intercept_handler_t x01_handlers[256] = {
-        [0x04] = handle_ptff,
-        [0x07] = handle_sckpf,
-};
-
 int kvm_s390_handle_01(struct kvm_vcpu *vcpu)
 {
-        intercept_handler_t handler;
-
-        handler = x01_handlers[vcpu->arch.sie_block->ipa & 0x00ff];
-        if (handler)
-                return handler(vcpu);
-        return -EOPNOTSUPP;
+        switch (vcpu->arch.sie_block->ipa & 0x00ff) {
+        case 0x04:
+                return handle_ptff(vcpu);
+        case 0x07:
+                return handle_sckpf(vcpu);
+        default:
+                return -EOPNOTSUPP;
+        }
 }
diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
index ec772700ff96..8961e3970901 100644
--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -821,6 +821,7 @@ static int do_vsie_run(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
 {
         struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s;
         struct kvm_s390_sie_block *scb_o = vsie_page->scb_o;
+        int guest_bp_isolation;
         int rc;
 
         handle_last_fault(vcpu, vsie_page);
@@ -831,6 +832,20 @@ static int do_vsie_run(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
                 s390_handle_mcck();
 
         srcu_read_unlock(&vcpu->kvm->srcu, vcpu->srcu_idx);
+
+        /* save current guest state of bp isolation override */
+        guest_bp_isolation = test_thread_flag(TIF_ISOLATE_BP_GUEST);
+
+        /*
+         * The guest is running with BPBC, so we have to force it on for our
+         * nested guest. This is done by enabling BPBC globally, so the BPBC
+         * control in the SCB (which the nested guest can modify) is simply
+         * ignored.
+         */
+        if (test_kvm_facility(vcpu->kvm, 82) &&
+            vcpu->arch.sie_block->fpf & FPF_BPBC)
+                set_thread_flag(TIF_ISOLATE_BP_GUEST);
+
         local_irq_disable();
         guest_enter_irqoff();
         local_irq_enable();
@@ -840,6 +855,11 @@ static int do_vsie_run(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
         local_irq_disable();
         guest_exit_irqoff();
         local_irq_enable();
+
+        /* restore guest state for bp isolation override */
+        if (!guest_bp_isolation)
+                clear_thread_flag(TIF_ISOLATE_BP_GUEST);
+
         vcpu->srcu_idx = srcu_read_lock(&vcpu->kvm->srcu);
 
         if (rc == -EINTR) {
diff --git a/arch/sh/boot/dts/Makefile b/arch/sh/boot/dts/Makefile
index 715def00a436..01d0f7fb14cc 100644
--- a/arch/sh/boot/dts/Makefile
+++ b/arch/sh/boot/dts/Makefile
@@ -1 +1,3 @@
-obj-$(CONFIG_USE_BUILTIN_DTB) += $(patsubst "%",%,$(CONFIG_BUILTIN_DTB_SOURCE)).dtb.o
+ifneq ($(CONFIG_BUILTIN_DTB_SOURCE),"")
+obj-y += $(patsubst "%",%,$(CONFIG_BUILTIN_DTB_SOURCE)).dtb.o
+endif
diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c
index 847ddffbf38a..b5cfab711651 100644
--- a/arch/sparc/mm/tlb.c
+++ b/arch/sparc/mm/tlb.c
@@ -163,13 +163,10 @@ static void tlb_batch_pmd_scan(struct mm_struct *mm, unsigned long vaddr,
         pte_unmap(pte);
 }
 
-void set_pmd_at(struct mm_struct *mm, unsigned long addr,
-                pmd_t *pmdp, pmd_t pmd)
-{
-        pmd_t orig = *pmdp;
-
-        *pmdp = pmd;
 
+static void __set_pmd_acct(struct mm_struct *mm, unsigned long addr,
+                           pmd_t orig, pmd_t pmd)
+{
         if (mm == &init_mm)
                 return;
 
@@ -219,6 +216,15 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr,
         }
 }
 
+void set_pmd_at(struct mm_struct *mm, unsigned long addr,
+                pmd_t *pmdp, pmd_t pmd)
+{
+        pmd_t orig = *pmdp;
+
+        *pmdp = pmd;
+        __set_pmd_acct(mm, addr, orig, pmd);
+}
+
 static inline pmd_t pmdp_establish(struct vm_area_struct *vma,
                 unsigned long address, pmd_t *pmdp, pmd_t pmd)
 {
@@ -227,6 +233,7 @@ static inline pmd_t pmdp_establish(struct vm_area_struct *vma,
         do {
                 old = *pmdp;
         } while (cmpxchg64(&pmdp->pmd, old.pmd, pmd.pmd) != old.pmd);
+        __set_pmd_acct(vma->vm_mm, address, old, pmd);
 
         return old;
 }
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index c1236b187824..0fa71a78ec99 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -430,6 +430,7 @@ config GOLDFISH
 config RETPOLINE
         bool "Avoid speculative indirect branches in kernel"
         default y
+        select STACK_VALIDATION if HAVE_STACK_VALIDATION
         help
           Compile kernel with the retpoline compiler options to guard against
           kernel-to-user data leaks by avoiding speculative indirect
@@ -2306,7 +2307,7 @@ choice
           it can be used to assist security vulnerability exploitation.
 
           This setting can be changed at boot time via the kernel command
-          line parameter vsyscall=[native|emulate|none].
+          line parameter vsyscall=[emulate|none].
 
           On a system with recent enough glibc (2.14 or newer) and no
           static binaries, you can say None without a performance penalty
@@ -2314,15 +2315,6 @@ choice
 
           If unsure, select "Emulate".
 
-        config LEGACY_VSYSCALL_NATIVE
-                bool "Native"
-                help
-                  Actual executable code is located in the fixed vsyscall
-                  address mapping, implementing time() efficiently. Since
-                  this makes the mapping executable, it can be used during
-                  security vulnerability exploitation (traditionally as
-                  ROP gadgets). This configuration is not recommended.
-
         config LEGACY_VSYSCALL_EMULATE
                 bool "Emulate"
                 help
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index fad55160dcb9..498c1b812300 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -232,10 +232,9 @@ KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
 
 # Avoid indirect branches in kernel to deal with Spectre
 ifdef CONFIG_RETPOLINE
-    RETPOLINE_CFLAGS += $(call cc-option,-mindirect-branch=thunk-extern -mindirect-branch-register)
-    ifneq ($(RETPOLINE_CFLAGS),)
-        KBUILD_CFLAGS += $(RETPOLINE_CFLAGS) -DRETPOLINE
-    endif
+ifneq ($(RETPOLINE_CFLAGS),)
+  KBUILD_CFLAGS += $(RETPOLINE_CFLAGS) -DRETPOLINE
+endif
 endif
 
 archscripts: scripts_basic
diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h
index dce7092ab24a..be63330c5511 100644
--- a/arch/x86/entry/calling.h
+++ b/arch/x86/entry/calling.h
@@ -97,7 +97,7 @@ For 32-bit we have the following conventions - kernel is built with
 
 #define SIZEOF_PTREGS   21*8
 
-.macro PUSH_AND_CLEAR_REGS rdx=%rdx rax=%rax
+.macro PUSH_AND_CLEAR_REGS rdx=%rdx rax=%rax save_ret=0
         /*
          * Push registers and sanitize registers of values that a
          * speculation attack might otherwise want to exploit. The
@@ -105,32 +105,41 @@ For 32-bit we have the following conventions - kernel is built with
          * could be put to use in a speculative execution gadget.
          * Interleave XOR with PUSH for better uop scheduling:
          */
+        .if \save_ret
+        pushq   %rsi            /* pt_regs->si */
+        movq    8(%rsp), %rsi   /* temporarily store the return address in %rsi */
+        movq    %rdi, 8(%rsp)   /* pt_regs->di (overwriting original return address) */
+        .else
         pushq   %rdi            /* pt_regs->di */
         pushq   %rsi            /* pt_regs->si */
+        .endif
         pushq   \rdx            /* pt_regs->dx */
         pushq   %rcx            /* pt_regs->cx */
         pushq   \rax            /* pt_regs->ax */
         pushq   %r8             /* pt_regs->r8 */
-        xorq    %r8, %r8        /* nospec   r8 */
+        xorl    %r8d, %r8d      /* nospec   r8 */
         pushq   %r9             /* pt_regs->r9 */
-        xorq    %r9, %r9        /* nospec   r9 */
+        xorl    %r9d, %r9d      /* nospec   r9 */
         pushq   %r10            /* pt_regs->r10 */
-        xorq    %r10, %r10      /* nospec   r10 */
+        xorl    %r10d, %r10d    /* nospec   r10 */
         pushq   %r11            /* pt_regs->r11 */
-        xorq    %r11, %r11      /* nospec   r11*/
+        xorl    %r11d, %r11d    /* nospec   r11*/
         pushq   %rbx            /* pt_regs->rbx */
         xorl    %ebx, %ebx      /* nospec   rbx*/
         pushq   %rbp            /* pt_regs->rbp */
         xorl    %ebp, %ebp      /* nospec   rbp*/
         pushq   %r12            /* pt_regs->r12 */
-        xorq    %r12, %r12      /* nospec   r12*/
+        xorl    %r12d, %r12d    /* nospec   r12*/
         pushq   %r13            /* pt_regs->r13 */
-        xorq    %r13, %r13      /* nospec   r13*/
+        xorl    %r13d, %r13d    /* nospec   r13*/
         pushq   %r14            /* pt_regs->r14 */
-        xorq    %r14, %r14      /* nospec   r14*/
+        xorl    %r14d, %r14d    /* nospec   r14*/
         pushq   %r15            /* pt_regs->r15 */
-        xorq    %r15, %r15      /* nospec   r15*/
+        xorl    %r15d, %r15d    /* nospec   r15*/
         UNWIND_HINT_REGS
+        .if \save_ret
+        pushq   %rsi            /* return address on top of stack */
+        .endif
 .endm
 
 .macro POP_REGS pop_rdi=1 skip_r11rcx=0
@@ -172,12 +181,7 @@ For 32-bit we have the following conventions - kernel is built with
  */
 .macro ENCODE_FRAME_POINTER ptregs_offset=0
 #ifdef CONFIG_FRAME_POINTER
-        .if \ptregs_offset
-                leaq \ptregs_offset(%rsp), %rbp
-        .else
-                mov %rsp, %rbp
-        .endif
-        orq     $0x1, %rbp
+        leaq 1+\ptregs_offset(%rsp), %rbp
 #endif
 .endm
 
diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
index 16c2c022540d..6ad064c8cf35 100644
--- a/arch/x86/entry/entry_32.S
+++ b/arch/x86/entry/entry_32.S
@@ -252,8 +252,7 @@ ENTRY(__switch_to_asm)
          * exist, overwrite the RSB with entries which capture
          * speculative execution to prevent attack.
          */
-        /* Clobbers %ebx */
-        FILL_RETURN_BUFFER RSB_CLEAR_LOOPS, X86_FEATURE_RSB_CTXSW
+        FILL_RETURN_BUFFER %ebx, RSB_CLEAR_LOOPS, X86_FEATURE_RSB_CTXSW
 #endif
 
         /* restore callee-saved registers */
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 8971bd64d515..805f52703ee3 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -55,7 +55,7 @@ END(native_usergs_sysret64)
 
 .macro TRACE_IRQS_FLAGS flags:req
 #ifdef CONFIG_TRACE_IRQFLAGS
-        bt      $9, \flags              /* interrupts off? */
+        btl     $9, \flags              /* interrupts off? */
         jnc     1f
         TRACE_IRQS_ON
 1:
@@ -364,8 +364,7 @@ ENTRY(__switch_to_asm)
          * exist, overwrite the RSB with entries which capture
          * speculative execution to prevent attack.
          */
-        /* Clobbers %rbx */
-        FILL_RETURN_BUFFER RSB_CLEAR_LOOPS, X86_FEATURE_RSB_CTXSW
+        FILL_RETURN_BUFFER %r12, RSB_CLEAR_LOOPS, X86_FEATURE_RSB_CTXSW
 #endif
 
         /* restore callee-saved registers */
@@ -449,9 +448,19 @@ END(irq_entries_start)
  *
  * The invariant is that, if irq_count != -1, then the IRQ stack is in use.
  */
-.macro ENTER_IRQ_STACK regs=1 old_rsp
+.macro ENTER_IRQ_STACK regs=1 old_rsp save_ret=0
         DEBUG_ENTRY_ASSERT_IRQS_OFF
+
+        .if \save_ret
+        /*
+         * If save_ret is set, the original stack contains one additional
+         * entry -- the return address. Therefore, move the address one
+         * entry below %rsp to \old_rsp.
+         */
+        leaq    8(%rsp), \old_rsp
+        .else
         movq    %rsp, \old_rsp
+        .endif
 
         .if \regs
         UNWIND_HINT_REGS base=\old_rsp
@@ -497,6 +506,15 @@ END(irq_entries_start)
         .if \regs
         UNWIND_HINT_REGS indirect=1
         .endif
+
+        .if \save_ret
+        /*
+         * Push the return address to the stack. This return address can
+         * be found at the "real" original RSP, which was offset by 8 at
+         * the beginning of this macro.
+         */
+        pushq   -8(\old_rsp)
+        .endif
 .endm
 
 /*
@@ -520,27 +538,65 @@ END(irq_entries_start)
 .endm
 
 /*
- * Interrupt entry/exit.
- *
- * Interrupt entry points save only callee clobbered registers in fast path.
+ * Interrupt entry helper function.
  *
- * Entry runs with interrupts off.
+ * Entry runs with interrupts off. Stack layout at entry:
+ * +----------------------------------------------------+
+ * | regs->ss                                           |
+ * | regs->rsp                                          |
+ * | regs->eflags                                       |
+ * | regs->cs                                           |
+ * | regs->ip                                           |
+ * +----------------------------------------------------+
+ * | regs->orig_ax = ~(interrupt number)                |
+ * +----------------------------------------------------+
+ * | return address                                     |
+ * +----------------------------------------------------+
  */
-
-/* 0(%rsp): ~(interrupt number) */
-        .macro interrupt func
+ENTRY(interrupt_entry)
+        UNWIND_HINT_FUNC
+        ASM_CLAC
         cld
 
-        testb   $3, CS-ORIG_RAX(%rsp)
+        testb   $3, CS-ORIG_RAX+8(%rsp)
         jz      1f
         SWAPGS
-        call    switch_to_thread_stack
+
+        /*
+         * Switch to the thread stack. The IRET frame and orig_ax are
+         * on the stack, as well as the return address. RDI..R12 are
+         * not (yet) on the stack and space has not (yet) been
+         * allocated for them.
+         */
+        pushq   %rdi
+
+        /* Need to switch before accessing the thread stack. */
+        SWITCH_TO_KERNEL_CR3 scratch_reg=%rdi
+        movq    %rsp, %rdi
+        movq    PER_CPU_VAR(cpu_current_top_of_stack), %rsp
+
+         /*
+          * We have RDI, return address, and orig_ax on the stack on
+          * top of the IRET frame. That means offset=24
+          */
+        UNWIND_HINT_IRET_REGS base=%rdi offset=24
+
+        pushq   7*8(%rdi)               /* regs->ss */
+        pushq   6*8(%rdi)               /* regs->rsp */
+        pushq   5*8(%rdi)               /* regs->eflags */
+        pushq   4*8(%rdi)               /* regs->cs */
+        pushq   3*8(%rdi)               /* regs->ip */
+        pushq   2*8(%rdi)               /* regs->orig_ax */
+        pushq   8(%rdi)                 /* return address */
+        UNWIND_HINT_FUNC
+
+        movq    (%rdi), %rdi
 1:
 
-        PUSH_AND_CLEAR_REGS
-        ENCODE_FRAME_POINTER
+        PUSH_AND_CLEAR_REGS save_ret=1
+        ENCODE_FRAME_POINTER 8
 
-        testb   $3, CS(%rsp)
+        testb   $3, CS+8(%rsp)
         jz      1f
 
         /*
@@ -548,7 +604,7 @@ END(irq_entries_start)
          *
          * We need to tell lockdep that IRQs are off.  We can't do this until
          * we fix gsbase, and we should do it before enter_from_user_mode
-         * (which can take locks).  Since TRACE_IRQS_OFF idempotent,
+         * (which can take locks).  Since TRACE_IRQS_OFF is idempotent,
          * the simplest way to handle it is to just call it twice if
          * we enter from user mode.  There's no reason to optimize this since
          * TRACE_IRQS_OFF is a no-op if lockdep is off.
@@ -558,12 +614,15 @@ END(irq_entries_start)
         CALL_enter_from_user_mode
 
 1:
-        ENTER_IRQ_STACK old_rsp=%rdi
+        ENTER_IRQ_STACK old_rsp=%rdi save_ret=1
         /* We entered an interrupt context - irqs are off: */
         TRACE_IRQS_OFF
 
-        call    \func   /* rdi points to pt_regs */
-        .endm
+        ret
+END(interrupt_entry)
+
+
+/* Interrupt entry/exit. */
 
         /*
          * The interrupt stubs push (~vector+0x80) onto the stack and
@@ -571,9 +630,10 @@ END(irq_entries_start)
          */
         .p2align CONFIG_X86_L1_CACHE_SHIFT
 common_interrupt:
-        ASM_CLAC
         addq    $-0x80, (%rsp)                  /* Adjust vector to [-256, -1] range */
-        interrupt do_IRQ
+        call    interrupt_entry
+        UNWIND_HINT_REGS indirect=1
+        call    do_IRQ  /* rdi points to pt_regs */
         /* 0(%rsp): old RSP */
 ret_from_intr:
         DISABLE_INTERRUPTS(CLBR_ANY)
@@ -766,10 +826,11 @@ END(common_interrupt)
 .macro apicinterrupt3 num sym do_sym
 ENTRY(\sym)
         UNWIND_HINT_IRET_REGS
-        ASM_CLAC
         pushq   $~(\num)
 .Lcommon_\sym:
-        interrupt \do_sym
+        call    interrupt_entry
+        UNWIND_HINT_REGS indirect=1
+        call    \do_sym /* rdi points to pt_regs */
         jmp     ret_from_intr
 END(\sym)
 .endm
@@ -832,34 +893,6 @@ apicinterrupt IRQ_WORK_VECTOR			irq_work_interrupt		smp_irq_work_interrupt
  */
 #define CPU_TSS_IST(x) PER_CPU_VAR(cpu_tss_rw) + (TSS_ist + ((x) - 1) * 8)
 
-/*
- * Switch to the thread stack.  This is called with the IRET frame and
- * orig_ax on the stack.  (That is, RDI..R12 are not on the stack and
- * space has not been allocated for them.)
- */
-ENTRY(switch_to_thread_stack)
-        UNWIND_HINT_FUNC
-
-        pushq   %rdi
-        /* Need to switch before accessing the thread stack. */
-        SWITCH_TO_KERNEL_CR3 scratch_reg=%rdi
-        movq    %rsp, %rdi
-        movq    PER_CPU_VAR(cpu_current_top_of_stack), %rsp
-        UNWIND_HINT sp_offset=16 sp_reg=ORC_REG_DI
-
-        pushq   7*8(%rdi)               /* regs->ss */
-        pushq   6*8(%rdi)               /* regs->rsp */
-        pushq   5*8(%rdi)               /* regs->eflags */
-        pushq   4*8(%rdi)               /* regs->cs */
-        pushq   3*8(%rdi)               /* regs->ip */
-        pushq   2*8(%rdi)               /* regs->orig_ax */
-        pushq   8(%rdi)                 /* return address */
-        UNWIND_HINT_FUNC
-
-        movq    (%rdi), %rdi
-        ret
-END(switch_to_thread_stack)
-
 .macro idtentry sym do_sym has_error_code:req paranoid=0 shift_ist=-1
 ENTRY(\sym)
         UNWIND_HINT_IRET_REGS offset=\has_error_code*8
@@ -875,12 +908,8 @@ ENTRY(\sym)
         pushq   $-1                             /* ORIG_RAX: no syscall to restart */
         .endif
 
-        /* Save all registers in pt_regs */
-        PUSH_AND_CLEAR_REGS
-        ENCODE_FRAME_POINTER
-
         .if \paranoid < 2
-        testb   $3, CS(%rsp)                    /* If coming from userspace, switch stacks */
+        testb   $3, CS-ORIG_RAX(%rsp)           /* If coming from userspace, switch stacks */
         jnz     .Lfrom_usermode_switch_stack_\@
         .endif
 
@@ -1130,13 +1159,15 @@ idtentry machine_check		do_mce			has_error_code=0	paranoid=1
 #endif
 
 /*
- * Switch gs if needed.
+ * Save all registers in pt_regs, and switch gs if needed.
  * Use slow, but surefire "are we in kernel?" check.
  * Return: ebx=0: need swapgs on exit, ebx=1: otherwise
  */
 ENTRY(paranoid_entry)
         UNWIND_HINT_FUNC
         cld
+        PUSH_AND_CLEAR_REGS save_ret=1
+        ENCODE_FRAME_POINTER 8
         movl    $1, %ebx
         movl    $MSR_GS_BASE, %ecx
         rdmsr
@@ -1181,12 +1212,14 @@ ENTRY(paranoid_exit)
 END(paranoid_exit)
 
 /*
- * Switch gs if needed.
+ * Save all registers in pt_regs, and switch GS if needed.
  * Return: EBX=0: came from user mode; EBX=1: otherwise
  */
 ENTRY(error_entry)
-        UNWIND_HINT_REGS offset=8
+        UNWIND_HINT_FUNC
         cld
+        PUSH_AND_CLEAR_REGS save_ret=1
+        ENCODE_FRAME_POINTER 8
         testb   $3, CS+8(%rsp)
         jz      .Lerror_kernelspace
 
@@ -1577,8 +1610,6 @@ end_repeat_nmi:
          * frame to point back to repeat_nmi.
          */
         pushq   $-1                             /* ORIG_RAX: no syscall to restart */
-        PUSH_AND_CLEAR_REGS
-        ENCODE_FRAME_POINTER
 
         /*
          * Use paranoid_entry to handle SWAPGS, but no need to use paranoid_exit
diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
index fd65e016e413..08425c42f8b7 100644
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -85,25 +85,25 @@ ENTRY(entry_SYSENTER_compat)
         pushq   %rcx                    /* pt_regs->cx */
         pushq   $-ENOSYS                /* pt_regs->ax */
         pushq   $0                      /* pt_regs->r8  = 0 */
-        xorq    %r8, %r8                /* nospec   r8 */
+        xorl    %r8d, %r8d              /* nospec   r8 */
         pushq   $0                      /* pt_regs->r9  = 0 */
-        xorq    %r9, %r9                /* nospec   r9 */
+        xorl    %r9d, %r9d              /* nospec   r9 */
         pushq   $0                      /* pt_regs->r10 = 0 */
-        xorq    %r10, %r10              /* nospec   r10 */
+        xorl    %r10d, %r10d            /* nospec   r10 */
         pushq   $0                      /* pt_regs->r11 = 0 */
-        xorq    %r11, %r11              /* nospec   r11 */
+        xorl    %r11d, %r11d            /* nospec   r11 */
         pushq   %rbx                    /* pt_regs->rbx */
         xorl    %ebx, %ebx              /* nospec   rbx */
         pushq   %rbp                    /* pt_regs->rbp (will be overwritten) */
         xorl    %ebp, %ebp              /* nospec   rbp */
         pushq   $0                      /* pt_regs->r12 = 0 */
-        xorq    %r12, %r12              /* nospec   r12 */
+        xorl    %r12d, %r12d            /* nospec   r12 */
         pushq   $0                      /* pt_regs->r13 = 0 */
-        xorq    %r13, %r13              /* nospec   r13 */
+        xorl    %r13d, %r13d            /* nospec   r13 */
         pushq   $0                      /* pt_regs->r14 = 0 */
-        xorq    %r14, %r14              /* nospec   r14 */
+        xorl    %r14d, %r14d            /* nospec   r14 */
         pushq   $0                      /* pt_regs->r15 = 0 */
-        xorq    %r15, %r15              /* nospec   r15 */
+        xorl    %r15d, %r15d            /* nospec   r15 */
         cld
 
         /*
@@ -224,25 +224,25 @@ GLOBAL(entry_SYSCALL_compat_after_hwframe)
         pushq   %rbp                    /* pt_regs->cx (stashed in bp) */
         pushq   $-ENOSYS                /* pt_regs->ax */
         pushq   $0                      /* pt_regs->r8  = 0 */
-        xorq    %r8, %r8                /* nospec   r8 */
+        xorl    %r8d, %r8d              /* nospec   r8 */
         pushq   $0                      /* pt_regs->r9  = 0 */
-        xorq    %r9, %r9                /* nospec   r9 */
+        xorl    %r9d, %r9d              /* nospec   r9 */
         pushq   $0                      /* pt_regs->r10 = 0 */
-        xorq    %r10, %r10              /* nospec   r10 */
+        xorl    %r10d, %r10d            /* nospec   r10 */
         pushq   $0                      /* pt_regs->r11 = 0 */
-        xorq    %r11, %r11              /* nospec   r11 */
+        xorl    %r11d, %r11d            /* nospec   r11 */
         pushq   %rbx                    /* pt_regs->rbx */
         xorl    %ebx, %ebx              /* nospec   rbx */
         pushq   %rbp                    /* pt_regs->rbp (will be overwritten) */
         xorl    %ebp, %ebp              /* nospec   rbp */
         pushq   $0                      /* pt_regs->r12 = 0 */
-        xorq    %r12, %r12              /* nospec   r12 */
+        xorl    %r12d, %r12d            /* nospec   r12 */
         pushq   $0                      /* pt_regs->r13 = 0 */
-        xorq    %r13, %r13              /* nospec   r13 */
+        xorl    %r13d, %r13d            /* nospec   r13 */
         pushq   $0                      /* pt_regs->r14 = 0 */
-        xorq    %r14, %r14              /* nospec   r14 */
+        xorl    %r14d, %r14d            /* nospec   r14 */
         pushq   $0                      /* pt_regs->r15 = 0 */
-        xorq    %r15, %r15              /* nospec   r15 */
+        xorl    %r15d, %r15d            /* nospec   r15 */
 
         /*
          * User mode is traced as though IRQs are on, and SYSENTER
@@ -298,9 +298,9 @@ sysret32_from_system_call:
          */
         SWITCH_TO_USER_CR3_NOSTACK scratch_reg=%r8 scratch_reg2=%r9
 
-        xorq    %r8, %r8
-        xorq    %r9, %r9
-        xorq    %r10, %r10
+        xorl    %r8d, %r8d
+        xorl    %r9d, %r9d
+        xorl    %r10d, %r10d
         swapgs
         sysretl
 END(entry_SYSCALL_compat)
@@ -347,36 +347,47 @@ ENTRY(entry_INT80_compat)
          */
         movl    %eax, %eax
 
+        /* switch to thread stack expects orig_ax and rdi to be pushed */
         pushq   %rax                    /* pt_regs->orig_ax */
+        pushq   %rdi                    /* pt_regs->di */
 
-        /* switch to thread stack expects orig_ax to be pushed */
-        call    switch_to_thread_stack
+        /* Need to switch before accessing the thread stack. */
+        SWITCH_TO_KERNEL_CR3 scratch_reg=%rdi
+        movq    %rsp, %rdi
+        movq    PER_CPU_VAR(cpu_current_top_of_stack), %rsp
 
-        pushq   %rdi                    /* pt_regs->di */
+        pushq   6*8(%rdi)               /* regs->ss */
+        pushq   5*8(%rdi)               /* regs->rsp */
+        pushq   4*8(%rdi)               /* regs->eflags */
+        pushq   3*8(%rdi)               /* regs->cs */
+        pushq   2*8(%rdi)               /* regs->ip */
+        pushq   1*8(%rdi)               /* regs->orig_ax */
+
+        pushq   (%rdi)                  /* pt_regs->di */
         pushq   %rsi                    /* pt_regs->si */
         pushq   %rdx                    /* pt_regs->dx */
         pushq   %rcx                    /* pt_regs->cx */
         pushq   $-ENOSYS                /* pt_regs->ax */
         pushq   $0                      /* pt_regs->r8  = 0 */
-        xorq    %r8, %r8                /* nospec   r8 */
+        xorl    %r8d, %r8d              /* nospec   r8 */
         pushq   $0                      /* pt_regs->r9  = 0 */
-        xorq    %r9, %r9                /* nospec   r9 */
+        xorl    %r9d, %r9d              /* nospec   r9 */
         pushq   $0                      /* pt_regs->r10 = 0 */
-        xorq    %r10, %r10              /* nospec   r10 */
+        xorl    %r10d, %r10d            /* nospec   r10 */
         pushq   $0                      /* pt_regs->r11 = 0 */
-        xorq    %r11, %r11              /* nospec   r11 */
+        xorl    %r11d, %r11d            /* nospec   r11 */
         pushq   %rbx                    /* pt_regs->rbx */
         xorl    %ebx, %ebx              /* nospec   rbx */
         pushq   %rbp                    /* pt_regs->rbp */
         xorl    %ebp, %ebp              /* nospec   rbp */
         pushq   %r12                    /* pt_regs->r12 */
-        xorq    %r12, %r12              /* nospec   r12 */
+        xorl    %r12d, %r12d            /* nospec   r12 */
         pushq   %r13                    /* pt_regs->r13 */
-        xorq    %r13, %r13              /* nospec   r13 */
+        xorl    %r13d, %r13d            /* nospec   r13 */
         pushq   %r14                    /* pt_regs->r14 */
-        xorq    %r14, %r14              /* nospec   r14 */
+        xorl    %r14d, %r14d            /* nospec   r14 */
         pushq   %r15                    /* pt_regs->r15 */
-        xorq    %r15, %r15              /* nospec   r15 */
+        xorl    %r15d, %r15d            /* nospec   r15 */
         cld
 
         /*
@@ -393,15 +404,3 @@ ENTRY(entry_INT80_compat)
         TRACE_IRQS_ON
         jmp     swapgs_restore_regs_and_return_to_usermode
 END(entry_INT80_compat)
-
-ENTRY(stub32_clone)
-        /*
-         * The 32-bit clone ABI is: clone(..., int tls_val, int *child_tidptr).
-         * The 64-bit clone ABI is: clone(..., int *child_tidptr, int tls_val).
-         *
-         * The native 64-bit kernel's sys_clone() implements the latter,
-         * so we need to swap arguments here before calling it:
-         */
-        xchg    %r8, %rcx
-        jmp     sys_clone
-ENDPROC(stub32_clone)
diff --git a/arch/x86/entry/syscalls/syscall_32.tbl b/arch/x86/entry/syscalls/syscall_32.tbl
index 448ac2161112..2a5e99cff859 100644
--- a/arch/x86/entry/syscalls/syscall_32.tbl
+++ b/arch/x86/entry/syscalls/syscall_32.tbl
@@ -8,12 +8,12 @@
 #
 0       i386    restart_syscall         sys_restart_syscall
 1       i386    exit                    sys_exit
-2       i386    fork                    sys_fork                        sys_fork
+2       i386    fork                    sys_fork
 3       i386    read                    sys_read
 4       i386    write                   sys_write
 5       i386    open                    sys_open                        compat_sys_open
 6       i386    close                   sys_close
-7       i386    waitpid                 sys_waitpid                     sys32_waitpid
+7       i386    waitpid                 sys_waitpid                     compat_sys_x86_waitpid
 8       i386    creat                   sys_creat
 9       i386    link                    sys_link
 10      i386    unlink                  sys_unlink
@@ -78,7 +78,7 @@
 69      i386    ssetmask                sys_ssetmask
 70      i386    setreuid                sys_setreuid16
 71      i386    setregid                sys_setregid16
-72      i386    sigsuspend              sys_sigsuspend                  sys_sigsuspend
+72      i386    sigsuspend              sys_sigsuspend
 73      i386    sigpending              sys_sigpending                  compat_sys_sigpending
 74      i386    sethostname             sys_sethostname
 75      i386    setrlimit               sys_setrlimit                   compat_sys_setrlimit
@@ -96,7 +96,7 @@
 87      i386    swapon                  sys_swapon
 88      i386    reboot                  sys_reboot
 89      i386    readdir                 sys_old_readdir                 compat_sys_old_readdir
-90      i386    mmap                    sys_old_mmap                    sys32_mmap
+90      i386    mmap                    sys_old_mmap                    compat_sys_x86_mmap
 91      i386    munmap                  sys_munmap
 92      i386    truncate                sys_truncate                    compat_sys_truncate
 93      i386    ftruncate               sys_ftruncate                   compat_sys_ftruncate
@@ -126,7 +126,7 @@
 117     i386    ipc                     sys_ipc                         compat_sys_ipc
 118     i386    fsync                   sys_fsync
 119     i386    sigreturn               sys_sigreturn                   sys32_sigreturn
-120     i386    clone                   sys_clone                       stub32_clone
+120     i386    clone                   sys_clone                       compat_sys_x86_clone
 121     i386    setdomainname           sys_setdomainname
 122     i386    uname                   sys_newuname
 123     i386    modify_ldt              sys_modify_ldt
@@ -186,8 +186,8 @@
 177     i386    rt_sigtimedwait         sys_rt_sigtimedwait             compat_sys_rt_sigtimedwait
 178     i386    rt_sigqueueinfo         sys_rt_sigqueueinfo             compat_sys_rt_sigqueueinfo
 179     i386    rt_sigsuspend           sys_rt_sigsuspend
-180     i386    pread64                 sys_pread64                     sys32_pread
-181     i386    pwrite64                sys_pwrite64                    sys32_pwrite
+180     i386    pread64                 sys_pread64                     compat_sys_x86_pread
+181     i386    pwrite64                sys_pwrite64                    compat_sys_x86_pwrite
 182     i386    chown                   sys_chown16
 183     i386    getcwd                  sys_getcwd
 184     i386    capget                  sys_capget
@@ -196,14 +196,14 @@
 187     i386    sendfile                sys_sendfile                    compat_sys_sendfile
 188     i386    getpmsg
 189     i386    putpmsg
-190     i386    vfork                   sys_vfork                       sys_vfork
+190     i386    vfork                   sys_vfork
 191     i386    ugetrlimit              sys_getrlimit                   compat_sys_getrlimit
 192     i386    mmap2                   sys_mmap_pgoff
-193     i386    truncate64              sys_truncate64                  sys32_truncate64
-194     i386    ftruncate64             sys_ftruncate64                 sys32_ftruncate64
-195     i386    stat64                  sys_stat64                      sys32_stat64
-196     i386    lstat64                 sys_lstat64                     sys32_lstat64
-197     i386    fstat64                 sys_fstat64                     sys32_fstat64
+193     i386    truncate64              sys_truncate64                  compat_sys_x86_truncate64
+194     i386    ftruncate64             sys_ftruncate64                 compat_sys_x86_ftruncate64
+195     i386    stat64                  sys_stat64                      compat_sys_x86_stat64
+196     i386    lstat64                 sys_lstat64                     compat_sys_x86_lstat64
+197     i386    fstat64                 sys_fstat64                     compat_sys_x86_fstat64
 198     i386    lchown32                sys_lchown
 199     i386    getuid32                sys_getuid
 200     i386    getgid32                sys_getgid
@@ -231,7 +231,7 @@
 # 222 is unused
 # 223 is unused
 224     i386    gettid                  sys_gettid
-225     i386    readahead               sys_readahead                   sys32_readahead
+225     i386    readahead               sys_readahead                   compat_sys_x86_readahead
 226     i386    setxattr                sys_setxattr
 227     i386    lsetxattr               sys_lsetxattr
 228     i386    fsetxattr               sys_fsetxattr
@@ -256,7 +256,7 @@
 247     i386    io_getevents            sys_io_getevents                compat_sys_io_getevents
 248     i386    io_submit               sys_io_submit                   compat_sys_io_submit
 249     i386    io_cancel               sys_io_cancel
-250     i386    fadvise64               sys_fadvise64                   sys32_fadvise64
+250     i386    fadvise64               sys_fadvise64                   compat_sys_x86_fadvise64
 # 251 is available for reuse (was briefly sys_set_zone_reclaim)
 252     i386    exit_group              sys_exit_group
 253     i386    lookup_dcookie          sys_lookup_dcookie              compat_sys_lookup_dcookie
@@ -278,7 +278,7 @@
 269     i386    fstatfs64               sys_fstatfs64                   compat_sys_fstatfs64
 270     i386    tgkill                  sys_tgkill
 271     i386    utimes                  sys_utimes                      compat_sys_utimes
-272     i386    fadvise64_64            sys_fadvise64_64                sys32_fadvise64_64
+272     i386    fadvise64_64            sys_fadvise64_64                compat_sys_x86_fadvise64_64
 273     i386    vserver
 274     i386    mbind                   sys_mbind
 275     i386    get_mempolicy           sys_get_mempolicy               compat_sys_get_mempolicy
@@ -306,7 +306,7 @@
 297     i386    mknodat                 sys_mknodat
 298     i386    fchownat                sys_fchownat
 299     i386    futimesat               sys_futimesat                   compat_sys_futimesat
-300     i386    fstatat64               sys_fstatat64                   sys32_fstatat
+300     i386    fstatat64               sys_fstatat64                   compat_sys_x86_fstatat
 301     i386    unlinkat                sys_unlinkat
 302     i386    renameat                sys_renameat
 303     i386    linkat                  sys_linkat
@@ -320,7 +320,7 @@
 311     i386    set_robust_list         sys_set_robust_list             compat_sys_set_robust_list
 312     i386    get_robust_list         sys_get_robust_list             compat_sys_get_robust_list
 313     i386    splice                  sys_splice
-314     i386    sync_file_range         sys_sync_file_range             sys32_sync_file_range
+314     i386    sync_file_range         sys_sync_file_range             compat_sys_x86_sync_file_range
 315     i386    tee                     sys_tee
 316     i386    vmsplice                sys_vmsplice                    compat_sys_vmsplice
 317     i386    move_pages              sys_move_pages                  compat_sys_move_pages
@@ -330,7 +330,7 @@
 321     i386    signalfd                sys_signalfd                    compat_sys_signalfd
 322     i386    timerfd_create          sys_timerfd_create
 323     i386    eventfd                 sys_eventfd
-324     i386    fallocate               sys_fallocate                   sys32_fallocate
+324     i386    fallocate               sys_fallocate                   compat_sys_x86_fallocate
 325     i386    timerfd_settime         sys_timerfd_settime             compat_sys_timerfd_settime
 326     i386    timerfd_gettime         sys_timerfd_gettime             compat_sys_timerfd_gettime
 327     i386    signalfd4               sys_signalfd4                   compat_sys_signalfd4
diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
index 577fa8adb785..8560ef68a9d6 100644
--- a/arch/x86/entry/vsyscall/vsyscall_64.c
+++ b/arch/x86/entry/vsyscall/vsyscall_64.c
@@ -42,10 +42,8 @@
 #define CREATE_TRACE_POINTS
 #include "vsyscall_trace.h"
 
-static enum { EMULATE, NATIVE, NONE } vsyscall_mode =
-#if defined(CONFIG_LEGACY_VSYSCALL_NATIVE)
-        NATIVE;
-#elif defined(CONFIG_LEGACY_VSYSCALL_NONE)
+static enum { EMULATE, NONE } vsyscall_mode =
+#ifdef CONFIG_LEGACY_VSYSCALL_NONE
         NONE;
 #else
         EMULATE;
@@ -56,8 +54,6 @@ static int __init vsyscall_setup(char *str)
         if (str) {
                 if (!strcmp("emulate", str))
                         vsyscall_mode = EMULATE;
-                else if (!strcmp("native", str))
-                        vsyscall_mode = NATIVE;
                 else if (!strcmp("none", str))
                         vsyscall_mode = NONE;
                 else
@@ -139,10 +135,6 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
 
         WARN_ON_ONCE(address != regs->ip);
 
-        /* This should be unreachable in NATIVE mode. */
-        if (WARN_ON(vsyscall_mode == NATIVE))
-                return false;
-
         if (vsyscall_mode == NONE) {
                 warn_bad_vsyscall(KERN_INFO, regs,
                                   "vsyscall attempted with vsyscall=none");
@@ -370,9 +362,7 @@ void __init map_vsyscall(void)
 
         if (vsyscall_mode != NONE) {
                 __set_fixmap(VSYSCALL_PAGE, physaddr_vsyscall,
-                             vsyscall_mode == NATIVE
-                             ? PAGE_KERNEL_VSYSCALL
-                             : PAGE_KERNEL_VVAR);
+                             PAGE_KERNEL_VVAR);
                 set_vsyscall_pgtable_user_bits(swapper_pg_dir);
         }
 
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index 6d8044ab1060..22ec65bc033a 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -3606,7 +3606,7 @@ static struct intel_uncore_type skx_uncore_imc = {
 };
 
 static struct attribute *skx_upi_uncore_formats_attr[] = {
-        &format_attr_event_ext.attr,
+        &format_attr_event.attr,
         &format_attr_umask_ext.attr,
         &format_attr_edge.attr,
         &format_attr_inv.attr,
diff --git a/arch/x86/ia32/sys_ia32.c b/arch/x86/ia32/sys_ia32.c
index 96cd33bbfc85..6512498bbef6 100644
--- a/arch/x86/ia32/sys_ia32.c
+++ b/arch/x86/ia32/sys_ia32.c
@@ -51,15 +51,14 @@
 #define AA(__x)         ((unsigned long)(__x))
 
 
-asmlinkage long sys32_truncate64(const char __user *filename,
-                                 unsigned long offset_low,
-                                 unsigned long offset_high)
+COMPAT_SYSCALL_DEFINE3(x86_truncate64, const char __user *, filename,
+                       unsigned long, offset_low, unsigned long, offset_high)
 {
        return sys_truncate(filename, ((loff_t) offset_high << 32) | offset_low);
 }
 
-asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long offset_low,
-                                  unsigned long offset_high)
+COMPAT_SYSCALL_DEFINE3(x86_ftruncate64, unsigned int, fd,
+                       unsigned long, offset_low, unsigned long, offset_high)
 {
        return sys_ftruncate(fd, ((loff_t) offset_high << 32) | offset_low);
 }
@@ -96,8 +95,8 @@ static int cp_stat64(struct stat64 __user *ubuf, struct kstat *stat)
         return 0;
 }
 
-asmlinkage long sys32_stat64(const char __user *filename,
-                             struct stat64 __user *statbuf)
+COMPAT_SYSCALL_DEFINE2(x86_stat64, const char __user *, filename,
+                       struct stat64 __user *, statbuf)
 {
         struct kstat stat;
         int ret = vfs_stat(filename, &stat);
@@ -107,8 +106,8 @@ asmlinkage long sys32_stat64(const char __user *filename,
         return ret;
 }
 
-asmlinkage long sys32_lstat64(const char __user *filename,
-                              struct stat64 __user *statbuf)
+COMPAT_SYSCALL_DEFINE2(x86_lstat64, const char __user *, filename,
+                       struct stat64 __user *, statbuf)
 {
         struct kstat stat;
         int ret = vfs_lstat(filename, &stat);
@@ -117,7 +116,8 @@ asmlinkage long sys32_lstat64(const char __user *filename,
         return ret;
 }
 
-asmlinkage long sys32_fstat64(unsigned int fd, struct stat64 __user *statbuf)
+COMPAT_SYSCALL_DEFINE2(x86_fstat64, unsigned int, fd,
+                       struct stat64 __user *, statbuf)
 {
         struct kstat stat;
         int ret = vfs_fstat(fd, &stat);
@@ -126,8 +126,9 @@ asmlinkage long sys32_fstat64(unsigned int fd, struct stat64 __user *statbuf)
         return ret;
 }
 
-asmlinkage long sys32_fstatat(unsigned int dfd, const char __user *filename,
-                              struct stat64 __user *statbuf, int flag)
+COMPAT_SYSCALL_DEFINE4(x86_fstatat, unsigned int, dfd,
+                       const char __user *, filename,
+                       struct stat64 __user *, statbuf, int, flag)
 {
         struct kstat stat;
         int error;
@@ -153,7 +154,7 @@ struct mmap_arg_struct32 {
         unsigned int offset;
 };
 
-asmlinkage long sys32_mmap(struct mmap_arg_struct32 __user *arg)
+COMPAT_SYSCALL_DEFINE1(x86_mmap, struct mmap_arg_struct32 __user *, arg)
 {
         struct mmap_arg_struct32 a;
 
@@ -167,22 +168,22 @@ asmlinkage long sys32_mmap(struct mmap_arg_struct32 __user *arg)
                                a.offset>>PAGE_SHIFT);
 }
 
-asmlinkage long sys32_waitpid(compat_pid_t pid, unsigned int __user *stat_addr,
-                              int options)
+COMPAT_SYSCALL_DEFINE3(x86_waitpid, compat_pid_t, pid, unsigned int __user *,
+                       stat_addr, int, options)
 {
         return compat_sys_wait4(pid, stat_addr, options, NULL);
 }
 
 /* warning: next two assume little endian */
-asmlinkage long sys32_pread(unsigned int fd, char __user *ubuf, u32 count,
-                            u32 poslo, u32 poshi)
+COMPAT_SYSCALL_DEFINE5(x86_pread, unsigned int, fd, char __user *, ubuf,
+                       u32, count, u32, poslo, u32, poshi)
 {
         return sys_pread64(fd, ubuf, count,
                          ((loff_t)AA(poshi) << 32) | AA(poslo));
 }
 
-asmlinkage long sys32_pwrite(unsigned int fd, const char __user *ubuf,
-                             u32 count, u32 poslo, u32 poshi)
+COMPAT_SYSCALL_DEFINE5(x86_pwrite, unsigned int, fd, const char __user *, ubuf,
+                       u32, count, u32, poslo, u32, poshi)
 {
         return sys_pwrite64(fd, ubuf, count,
                           ((loff_t)AA(poshi) << 32) | AA(poslo));
@@ -193,8 +194,9 @@ asmlinkage long sys32_pwrite(unsigned int fd, const char __user *ubuf,
  * Some system calls that need sign extended arguments. This could be
  * done by a generic wrapper.
  */
-long sys32_fadvise64_64(int fd, __u32 offset_low, __u32 offset_high,
-                        __u32 len_low, __u32 len_high, int advice)
+COMPAT_SYSCALL_DEFINE6(x86_fadvise64_64, int, fd, __u32, offset_low,
+                       __u32, offset_high, __u32, len_low, __u32, len_high,
+                       int, advice)
 {
         return sys_fadvise64_64(fd,
                                (((u64)offset_high)<<32) | offset_low,
@@ -202,31 +204,43 @@ long sys32_fadvise64_64(int fd, __u32 offset_low, __u32 offset_high,
                                 advice);
 }
 
-asmlinkage ssize_t sys32_readahead(int fd, unsigned off_lo, unsigned off_hi,
-                                   size_t count)
+COMPAT_SYSCALL_DEFINE4(x86_readahead, int, fd, unsigned int, off_lo,
+                       unsigned int, off_hi, size_t, count)
 {
         return sys_readahead(fd, ((u64)off_hi << 32) | off_lo, count);
 }
 
-asmlinkage long sys32_sync_file_range(int fd, unsigned off_low, unsigned off_hi,
-                                      unsigned n_low, unsigned n_hi,  int flags)
+COMPAT_SYSCALL_DEFINE6(x86_sync_file_range, int, fd, unsigned int, off_low,
+                       unsigned int, off_hi, unsigned int, n_low,
+                       unsigned int, n_hi, int, flags)
 {
         return sys_sync_file_range(fd,
                                    ((u64)off_hi << 32) | off_low,
                                    ((u64)n_hi << 32) | n_low, flags);
 }
 
-asmlinkage long sys32_fadvise64(int fd, unsigned offset_lo, unsigned offset_hi,
-                                size_t len, int advice)
+COMPAT_SYSCALL_DEFINE5(x86_fadvise64, int, fd, unsigned int, offset_lo,
+                       unsigned int, offset_hi, size_t, len, int, advice)
 {
         return sys_fadvise64_64(fd, ((u64)offset_hi << 32) | offset_lo,
                                 len, advice);
 }
 
-asmlinkage long sys32_fallocate(int fd, int mode, unsigned offset_lo,
-                                unsigned offset_hi, unsigned len_lo,
-                                unsigned len_hi)
+COMPAT_SYSCALL_DEFINE6(x86_fallocate, int, fd, int, mode,
+                       unsigned int, offset_lo, unsigned int, offset_hi,
+                       unsigned int, len_lo, unsigned int, len_hi)
 {
         return sys_fallocate(fd, mode, ((u64)offset_hi << 32) | offset_lo,
                              ((u64)len_hi << 32) | len_lo);
 }
+
+/*
+ * The 32-bit clone ABI is CONFIG_CLONE_BACKWARDS
+ */
+COMPAT_SYSCALL_DEFINE5(x86_clone, unsigned long, clone_flags,
+                       unsigned long, newsp, int __user *, parent_tidptr,
+                       unsigned long, tls_val, int __user *, child_tidptr)
+{
+        return sys_clone(clone_flags, newsp, parent_tidptr, child_tidptr,
+                        tls_val);
+}
diff --git a/arch/x86/include/asm/apm.h b/arch/x86/include/asm/apm.h
index 4d4015ddcf26..c356098b6fb9 100644
--- a/arch/x86/include/asm/apm.h
+++ b/arch/x86/include/asm/apm.h
@@ -7,6 +7,8 @@
 #ifndef _ASM_X86_MACH_DEFAULT_APM_H
 #define _ASM_X86_MACH_DEFAULT_APM_H
 
+#include <asm/nospec-branch.h>
+
 #ifdef APM_ZERO_SEGS
 #       define APM_DO_ZERO_SEGS \
                 "pushl %%ds\n\t" \
@@ -32,6 +34,7 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in,
          * N.B. We do NOT need a cld after the BIOS call
          * because we always save and restore the flags.
          */
+        firmware_restrict_branch_speculation_start();
         __asm__ __volatile__(APM_DO_ZERO_SEGS
                 "pushl %%edi\n\t"
                 "pushl %%ebp\n\t"
@@ -44,6 +47,7 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in,
                   "=S" (*esi)
                 : "a" (func), "b" (ebx_in), "c" (ecx_in)
                 : "memory", "cc");
+        firmware_restrict_branch_speculation_end();
 }
 
 static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in,
@@ -56,6 +60,7 @@ static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in,
          * N.B. We do NOT need a cld after the BIOS call
          * because we always save and restore the flags.
          */
+        firmware_restrict_branch_speculation_start();
         __asm__ __volatile__(APM_DO_ZERO_SEGS
                 "pushl %%edi\n\t"
                 "pushl %%ebp\n\t"
@@ -68,6 +73,7 @@ static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in,
                   "=S" (si)
                 : "a" (func), "b" (ebx_in), "c" (ecx_in)
                 : "memory", "cc");
+        firmware_restrict_branch_speculation_end();
         return error;
 }
 
diff --git a/arch/x86/include/asm/asm-prototypes.h b/arch/x86/include/asm/asm-prototypes.h
index 4d111616524b..1908214b9125 100644
--- a/arch/x86/include/asm/asm-prototypes.h
+++ b/arch/x86/include/asm/asm-prototypes.h
@@ -38,7 +38,4 @@ INDIRECT_THUNK(dx)
 INDIRECT_THUNK(si)
 INDIRECT_THUNK(di)
 INDIRECT_THUNK(bp)
-asmlinkage void __fill_rsb(void);
-asmlinkage void __clear_rsb(void);
-
 #endif /* CONFIG_RETPOLINE */
diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
index 3fa039855b8f..9f645ba57dbb 100644
--- a/arch/x86/include/asm/bitops.h
+++ b/arch/x86/include/asm/bitops.h
@@ -78,7 +78,7 @@ set_bit(long nr, volatile unsigned long *addr)
                         : "iq" ((u8)CONST_MASK(nr))
                         : "memory");
         } else {
-                asm volatile(LOCK_PREFIX "bts %1,%0"
+                asm volatile(LOCK_PREFIX __ASM_SIZE(bts) " %1,%0"
                         : BITOP_ADDR(addr) : "Ir" (nr) : "memory");
         }
 }
@@ -94,7 +94,7 @@ set_bit(long nr, volatile unsigned long *addr)
  */
 static __always_inline void __set_bit(long nr, volatile unsigned long *addr)
 {
-        asm volatile("bts %1,%0" : ADDR : "Ir" (nr) : "memory");
+        asm volatile(__ASM_SIZE(bts) " %1,%0" : ADDR : "Ir" (nr) : "memory");
 }
 
 /**
@@ -115,7 +115,7 @@ clear_bit(long nr, volatile unsigned long *addr)
                         : CONST_MASK_ADDR(nr, addr)
                         : "iq" ((u8)~CONST_MASK(nr)));
         } else {
-                asm volatile(LOCK_PREFIX "btr %1,%0"
+                asm volatile(LOCK_PREFIX __ASM_SIZE(btr) " %1,%0"
                         : BITOP_ADDR(addr)
                         : "Ir" (nr));
         }
@@ -137,7 +137,7 @@ static __always_inline void clear_bit_unlock(long nr, volatile unsigned long *ad
 
 static __always_inline void __clear_bit(long nr, volatile unsigned long *addr)
 {
-        asm volatile("btr %1,%0" : ADDR : "Ir" (nr));
+        asm volatile(__ASM_SIZE(btr) " %1,%0" : ADDR : "Ir" (nr));
 }
 
 static __always_inline bool clear_bit_unlock_is_negative_byte(long nr, volatile unsigned long *addr)
@@ -182,7 +182,7 @@ static __always_inline void __clear_bit_unlock(long nr, volatile unsigned long *
  */
 static __always_inline void __change_bit(long nr, volatile unsigned long *addr)
 {
-        asm volatile("btc %1,%0" : ADDR : "Ir" (nr));
+        asm volatile(__ASM_SIZE(btc) " %1,%0" : ADDR : "Ir" (nr));
 }
 
 /**
@@ -201,7 +201,7 @@ static __always_inline void change_bit(long nr, volatile unsigned long *addr)
                         : CONST_MASK_ADDR(nr, addr)
                         : "iq" ((u8)CONST_MASK(nr)));
         } else {
-                asm volatile(LOCK_PREFIX "btc %1,%0"
+                asm volatile(LOCK_PREFIX __ASM_SIZE(btc) " %1,%0"
                         : BITOP_ADDR(addr)
                         : "Ir" (nr));
         }
@@ -217,7 +217,8 @@ static __always_inline void change_bit(long nr, volatile unsigned long *addr)
  */
 static __always_inline bool test_and_set_bit(long nr, volatile unsigned long *addr)
 {
-        GEN_BINARY_RMWcc(LOCK_PREFIX "bts", *addr, "Ir", nr, "%0", c);
+        GEN_BINARY_RMWcc(LOCK_PREFIX __ASM_SIZE(bts),
+                         *addr, "Ir", nr, "%0", c);
 }
 
 /**
@@ -246,7 +247,7 @@ static __always_inline bool __test_and_set_bit(long nr, volatile unsigned long *
 {
         bool oldbit;
 
-        asm("bts %2,%1"
+        asm(__ASM_SIZE(bts) " %2,%1"
             CC_SET(c)
             : CC_OUT(c) (oldbit), ADDR
             : "Ir" (nr));
@@ -263,7 +264,8 @@ static __always_inline bool __test_and_set_bit(long nr, volatile unsigned long *
  */
 static __always_inline bool test_and_clear_bit(long nr, volatile unsigned long *addr)
 {
-        GEN_BINARY_RMWcc(LOCK_PREFIX "btr", *addr, "Ir", nr, "%0", c);
+        GEN_BINARY_RMWcc(LOCK_PREFIX __ASM_SIZE(btr),
+                         *addr, "Ir", nr, "%0", c);
 }
 
 /**
@@ -286,7 +288,7 @@ static __always_inline bool __test_and_clear_bit(long nr, volatile unsigned long
 {
         bool oldbit;
 
-        asm volatile("btr %2,%1"
+        asm volatile(__ASM_SIZE(btr) " %2,%1"
                      CC_SET(c)
                      : CC_OUT(c) (oldbit), ADDR
                      : "Ir" (nr));
@@ -298,7 +300,7 @@ static __always_inline bool __test_and_change_bit(long nr, volatile unsigned lon
 {
         bool oldbit;
 
-        asm volatile("btc %2,%1"
+        asm volatile(__ASM_SIZE(btc) " %2,%1"
                      CC_SET(c)
                      : CC_OUT(c) (oldbit), ADDR
                      : "Ir" (nr) : "memory");
@@ -316,7 +318,8 @@ static __always_inline bool __test_and_change_bit(long nr, volatile unsigned lon
  */
 static __always_inline bool test_and_change_bit(long nr, volatile unsigned long *addr)
 {
-        GEN_BINARY_RMWcc(LOCK_PREFIX "btc", *addr, "Ir", nr, "%0", c);
+        GEN_BINARY_RMWcc(LOCK_PREFIX __ASM_SIZE(btc),
+                         *addr, "Ir", nr, "%0", c);
 }
 
 static __always_inline bool constant_test_bit(long nr, const volatile unsigned long *addr)
@@ -329,7 +332,7 @@ static __always_inline bool variable_test_bit(long nr, volatile const unsigned l
 {
         bool oldbit;
 
-        asm volatile("bt %2,%1"
+        asm volatile(__ASM_SIZE(bt) " %2,%1"
                      CC_SET(c)
                      : CC_OUT(c) (oldbit)
                      : "m" (*(unsigned long *)addr), "Ir" (nr));
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index 0dfe4d3f74e2..d554c11e01ff 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -213,6 +213,7 @@
 #define X86_FEATURE_SEV                 ( 7*32+20) /* AMD Secure Encrypted Virtualization */
 
 #define X86_FEATURE_USE_IBPB            ( 7*32+21) /* "" Indirect Branch Prediction Barrier enabled */
+#define X86_FEATURE_USE_IBRS_FW         ( 7*32+22) /* "" Use IBRS during runtime firmware calls */
 
 /* Virtualization flags: Linux defined, word 8 */
 #define X86_FEATURE_TPR_SHADOW          ( 8*32+ 0) /* Intel TPR Shadow */
@@ -315,6 +316,7 @@
 #define X86_FEATURE_VPCLMULQDQ          (16*32+10) /* Carry-Less Multiplication Double Quadword */
 #define X86_FEATURE_AVX512_VNNI         (16*32+11) /* Vector Neural Network Instructions */
 #define X86_FEATURE_AVX512_BITALG       (16*32+12) /* Support for VPOPCNT[B,W] and VPSHUF-BITQMB instructions */
+#define X86_FEATURE_TME                 (16*32+13) /* Intel Total Memory Encryption */
 #define X86_FEATURE_AVX512_VPOPCNTDQ    (16*32+14) /* POPCNT for vectors of DW/QW */
 #define X86_FEATURE_LA57                (16*32+16) /* 5-level page tables */
 #define X86_FEATURE_RDPID               (16*32+22) /* RDPID instruction */
@@ -327,6 +329,7 @@
 /* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */
 #define X86_FEATURE_AVX512_4VNNIW       (18*32+ 2) /* AVX-512 Neural Network Instructions */
 #define X86_FEATURE_AVX512_4FMAPS       (18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */
+#define X86_FEATURE_PCONFIG             (18*32+18) /* Intel PCONFIG */
 #define X86_FEATURE_SPEC_CTRL           (18*32+26) /* "" Speculation Control (IBRS + IBPB) */
 #define X86_FEATURE_INTEL_STIBP         (18*32+27) /* "" Single Thread Indirect Branch Predictors */
 #define X86_FEATURE_ARCH_CAPABILITIES   (18*32+29) /* IA32_ARCH_CAPABILITIES MSR (Intel) */
diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
index 85f6ccb80b91..a399c1ebf6f0 100644
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -6,6 +6,7 @@
 #include <asm/pgtable.h>
 #include <asm/processor-flags.h>
 #include <asm/tlb.h>
+#include <asm/nospec-branch.h>
 
 /*
  * We map the EFI regions needed for runtime services non-contiguously,
@@ -36,8 +37,18 @@
 
 extern asmlinkage unsigned long efi_call_phys(void *, ...);
 
-#define arch_efi_call_virt_setup()      kernel_fpu_begin()
-#define arch_efi_call_virt_teardown()   kernel_fpu_end()
+#define arch_efi_call_virt_setup()                                      \
+({                                                                      \
+        kernel_fpu_begin();                                             \
+        firmware_restrict_branch_speculation_start();                   \
+})
+
+#define arch_efi_call_virt_teardown()                                   \
+({                                                                      \
+        firmware_restrict_branch_speculation_end();                     \
+        kernel_fpu_end();                                               \
+})
+
 
 /*
  * Wrap all the virtual calls in a way that forces the parameters on the stack.
@@ -73,6 +84,7 @@ struct efi_scratch {
         efi_sync_low_kernel_mappings();                                 \
         preempt_disable();                                              \
         __kernel_fpu_begin();                                           \
+        firmware_restrict_branch_speculation_start();                   \
                                                                         \
         if (efi_scratch.use_pgd) {                                      \
                 efi_scratch.prev_cr3 = __read_cr3();                    \
@@ -91,6 +103,7 @@ struct efi_scratch {
                 __flush_tlb_all();                                      \
         }                                                               \
                                                                         \
+        firmware_restrict_branch_speculation_end();                     \
         __kernel_fpu_end();                                             \
         preempt_enable();                                               \
 })
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index dd6f57a54a26..b605a5b6a30c 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -507,6 +507,7 @@ struct kvm_vcpu_arch {
         u64 smi_count;
         bool tpr_access_reporting;
         u64 ia32_xss;
+        u64 microcode_version;
 
         /*
          * Paging state of the vcpu
@@ -1095,6 +1096,8 @@ struct kvm_x86_ops {
         int (*mem_enc_op)(struct kvm *kvm, void __user *argp);
         int (*mem_enc_reg_region)(struct kvm *kvm, struct kvm_enc_region *argp);
         int (*mem_enc_unreg_region)(struct kvm *kvm, struct kvm_enc_region *argp);
+
+        int (*get_msr_feature)(struct kvm_msr_entry *entry);
 };
 
 struct kvm_arch_async_pf {
@@ -1464,7 +1467,4 @@ static inline int kvm_cpu_get_apicid(int mps_cpu)
 #define put_smstate(type, buf, offset, val)                      \
         *(type *)((buf) + (offset) - 0x7e00) = val
 
-void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm,
-                unsigned long start, unsigned long end);
-
 #endif /* _ASM_X86_KVM_HOST_H */
diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h
index 55520cec8b27..6cf0e4cb7b97 100644
--- a/arch/x86/include/asm/microcode.h
+++ b/arch/x86/include/asm/microcode.h
@@ -37,7 +37,13 @@ struct cpu_signature {
 
 struct device;
 
-enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
+enum ucode_state {
+        UCODE_OK        = 0,
+        UCODE_NEW,
+        UCODE_UPDATED,
+        UCODE_NFOUND,
+        UCODE_ERROR,
+};
 
 struct microcode_ops {
         enum ucode_state (*request_microcode_user) (int cpu,
@@ -54,7 +60,7 @@ struct microcode_ops {
          * are being called.
          * See also the "Synchronization" section in microcode_core.c.
          */
-        int (*apply_microcode) (int cpu);
+        enum ucode_state (*apply_microcode) (int cpu);
         int (*collect_cpu_info) (int cpu, struct cpu_signature *csig);
 };
 
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
index c931b88982a0..1de72ce514cd 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -74,6 +74,7 @@ static inline void *ldt_slot_va(int slot)
         return (void *)(LDT_BASE_ADDR + LDT_SLOT_STRIDE * slot);
 #else
         BUG();
+        return (void *)fix_to_virt(FIX_HOLE);
 #endif
 }
 
diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
index 81a1be326571..f928ad9b143f 100644
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -8,6 +8,50 @@
 #include <asm/cpufeatures.h>
 #include <asm/msr-index.h>
 
+/*
+ * Fill the CPU return stack buffer.
+ *
+ * Each entry in the RSB, if used for a speculative 'ret', contains an
+ * infinite 'pause; lfence; jmp' loop to capture speculative execution.
+ *
+ * This is required in various cases for retpoline and IBRS-based
+ * mitigations for the Spectre variant 2 vulnerability. Sometimes to
+ * eliminate potentially bogus entries from the RSB, and sometimes
+ * purely to ensure that it doesn't get empty, which on some CPUs would
+ * allow predictions from other (unwanted!) sources to be used.
+ *
+ * We define a CPP macro such that it can be used from both .S files and
+ * inline assembly. It's possible to do a .macro and then include that
+ * from C via asm(".include <asm/nospec-branch.h>") but let's not go there.
+ */
+
+#define RSB_CLEAR_LOOPS         32      /* To forcibly overwrite all entries */
+#define RSB_FILL_LOOPS          16      /* To avoid underflow */
+
+/*
+ * Google experimented with loop-unrolling and this turned out to be
+ * the optimal version — two calls, each with their own speculation
+ * trap should their return address end up getting used, in a loop.
+ */
+#define __FILL_RETURN_BUFFER(reg, nr, sp)       \
+        mov     $(nr/2), reg;                   \
+771:                                            \
+        call    772f;                           \
+773:    /* speculation trap */                  \
+        pause;                                  \
+        lfence;                                 \
+        jmp     773b;                           \
+772:                                            \
+        call    774f;                           \
+775:    /* speculation trap */                  \
+        pause;                                  \
+        lfence;                                 \
+        jmp     775b;                           \
+774:                                            \
+        dec     reg;                            \
+        jnz     771b;                           \
+        add     $(BITS_PER_LONG/8) * nr, sp;
+
 #ifdef __ASSEMBLY__
 
 /*
@@ -24,6 +68,18 @@
 .endm
 
 /*
+ * This should be used immediately before an indirect jump/call. It tells
+ * objtool the subsequent indirect jump/call is vouched safe for retpoline
+ * builds.
+ */
+.macro ANNOTATE_RETPOLINE_SAFE
+        .Lannotate_\@:
+        .pushsection .discard.retpoline_safe
+        _ASM_PTR .Lannotate_\@
+        .popsection
+.endm
+
+/*
  * These are the bare retpoline primitives for indirect jmp and call.
  * Do not use these directly; they only exist to make the ALTERNATIVE
  * invocation below less ugly.
@@ -59,9 +115,9 @@
 .macro JMP_NOSPEC reg:req
 #ifdef CONFIG_RETPOLINE
         ANNOTATE_NOSPEC_ALTERNATIVE
-        ALTERNATIVE_2 __stringify(jmp *\reg),                           \
+        ALTERNATIVE_2 __stringify(ANNOTATE_RETPOLINE_SAFE; jmp *\reg),  \
                 __stringify(RETPOLINE_JMP \reg), X86_FEATURE_RETPOLINE, \
-                __stringify(lfence; jmp *\reg), X86_FEATURE_RETPOLINE_AMD
+                __stringify(lfence; ANNOTATE_RETPOLINE_SAFE; jmp *\reg), X86_FEATURE_RETPOLINE_AMD
 #else
         jmp     *\reg
 #endif
@@ -70,18 +126,25 @@
 .macro CALL_NOSPEC reg:req
 #ifdef CONFIG_RETPOLINE
         ANNOTATE_NOSPEC_ALTERNATIVE
-        ALTERNATIVE_2 __stringify(call *\reg),                          \
+        ALTERNATIVE_2 __stringify(ANNOTATE_RETPOLINE_SAFE; call *\reg), \
                 __stringify(RETPOLINE_CALL \reg), X86_FEATURE_RETPOLINE,\
-                __stringify(lfence; call *\reg), X86_FEATURE_RETPOLINE_AMD
+                __stringify(lfence; ANNOTATE_RETPOLINE_SAFE; call *\reg), X86_FEATURE_RETPOLINE_AMD
 #else
         call    *\reg
 #endif
 .endm
 
-/* This clobbers the BX register */
-.macro FILL_RETURN_BUFFER nr:req ftr:req
+ /*
+  * A simpler FILL_RETURN_BUFFER macro. Don't make people use the CPP
+  * monstrosity above, manually.
+  */
+.macro FILL_RETURN_BUFFER reg:req nr:req ftr:req
 #ifdef CONFIG_RETPOLINE
-        ALTERNATIVE "", "call __clear_rsb", \ftr
+        ANNOTATE_NOSPEC_ALTERNATIVE
+        ALTERNATIVE "jmp .Lskip_rsb_\@",                                \
+                __stringify(__FILL_RETURN_BUFFER(\reg,\nr,%_ASM_SP))    \
+                \ftr
+.Lskip_rsb_\@:
 #endif
 .endm
 
@@ -93,6 +156,12 @@
         ".long 999b - .\n\t"                                    \
         ".popsection\n\t"
 
+#define ANNOTATE_RETPOLINE_SAFE                                 \
+        "999:\n\t"                                              \
+        ".pushsection .discard.retpoline_safe\n\t"              \
+        _ASM_PTR " 999b\n\t"                                    \
+        ".popsection\n\t"
+
 #if defined(CONFIG_X86_64) && defined(RETPOLINE)
 
 /*
@@ -102,6 +171,7 @@
 # define CALL_NOSPEC                                            \
         ANNOTATE_NOSPEC_ALTERNATIVE                             \
         ALTERNATIVE(                                            \
+        ANNOTATE_RETPOLINE_SAFE                                 \
         "call *%[thunk_target]\n",                              \
         "call __x86_indirect_thunk_%V[thunk_target]\n",         \
         X86_FEATURE_RETPOLINE)
@@ -113,7 +183,10 @@
  * otherwise we'll run out of registers. We don't care about CET
  * here, anyway.
  */
-# define CALL_NOSPEC ALTERNATIVE("call *%[thunk_target]\n",     \
+# define CALL_NOSPEC                                            \
+        ALTERNATIVE(                                            \
+        ANNOTATE_RETPOLINE_SAFE                                 \
+        "call *%[thunk_target]\n",                              \
         "       jmp    904f;\n"                                 \
         "       .align 16\n"                                    \
         "901:   call   903f;\n"                                 \
@@ -156,26 +229,54 @@ extern char __indirect_thunk_end[];
 static inline void vmexit_fill_RSB(void)
 {
 #ifdef CONFIG_RETPOLINE
-        alternative_input("",
-                          "call __fill_rsb",
-                          X86_FEATURE_RETPOLINE,
-                          ASM_NO_INPUT_CLOBBER(_ASM_BX, "memory"));
+        unsigned long loops;
+
+        asm volatile (ANNOTATE_NOSPEC_ALTERNATIVE
+                      ALTERNATIVE("jmp 910f",
+                                  __stringify(__FILL_RETURN_BUFFER(%0, RSB_CLEAR_LOOPS, %1)),
+                                  X86_FEATURE_RETPOLINE)
+                      "910:"
+                      : "=r" (loops), ASM_CALL_CONSTRAINT
+                      : : "memory" );
 #endif
 }
 
+#define alternative_msr_write(_msr, _val, _feature)             \
+        asm volatile(ALTERNATIVE("",                            \
+                                 "movl %[msr], %%ecx\n\t"       \
+                                 "movl %[val], %%eax\n\t"       \
+                                 "movl $0, %%edx\n\t"           \
+                                 "wrmsr",                       \
+                                 _feature)                      \
+                     : : [msr] "i" (_msr), [val] "i" (_val)     \
+                     : "eax", "ecx", "edx", "memory")
+
 static inline void indirect_branch_prediction_barrier(void)
 {
-        asm volatile(ALTERNATIVE("",
-                                 "movl %[msr], %%ecx\n\t"
-                                 "movl %[val], %%eax\n\t"
-                                 "movl $0, %%edx\n\t"
-                                 "wrmsr",
-                                 X86_FEATURE_USE_IBPB)
-                     : : [msr] "i" (MSR_IA32_PRED_CMD),
-                         [val] "i" (PRED_CMD_IBPB)
-                     : "eax", "ecx", "edx", "memory");
+        alternative_msr_write(MSR_IA32_PRED_CMD, PRED_CMD_IBPB,
+                              X86_FEATURE_USE_IBPB);
 }
 
+/*
+ * With retpoline, we must use IBRS to restrict branch prediction
+ * before calling into firmware.
+ *
+ * (Implemented as CPP macros due to header hell.)
+ */
+#define firmware_restrict_branch_speculation_start()                    \
+do {                                                                    \
+        preempt_disable();                                              \
+        alternative_msr_write(MSR_IA32_SPEC_CTRL, SPEC_CTRL_IBRS,       \
+                              X86_FEATURE_USE_IBRS_FW);                 \
+} while (0)
+
+#define firmware_restrict_branch_speculation_end()                      \
+do {                                                                    \
+        alternative_msr_write(MSR_IA32_SPEC_CTRL, 0,                    \
+                              X86_FEATURE_USE_IBRS_FW);                 \
+        preempt_enable();                                               \
+} while (0)
+
 #endif /* __ASSEMBLY__ */
 
 /*
diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
index 554841fab717..c83a2f418cea 100644
--- a/arch/x86/include/asm/paravirt.h
+++ b/arch/x86/include/asm/paravirt.h
@@ -7,6 +7,7 @@
 #ifdef CONFIG_PARAVIRT
 #include <asm/pgtable_types.h>
 #include <asm/asm.h>
+#include <asm/nospec-branch.h>
 
 #include <asm/paravirt_types.h>
 
@@ -879,23 +880,27 @@ extern void default_banner(void);
 
 #define INTERRUPT_RETURN                                                \
         PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_iret), CLBR_NONE,       \
-                  jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_iret))
+                  ANNOTATE_RETPOLINE_SAFE;                                      \
+                  jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_iret);)
 
 #define DISABLE_INTERRUPTS(clobbers)                                    \
         PARA_SITE(PARA_PATCH(pv_irq_ops, PV_IRQ_irq_disable), clobbers, \
                   PV_SAVE_REGS(clobbers | CLBR_CALLEE_SAVE);            \
+                  ANNOTATE_RETPOLINE_SAFE;                                      \
                   call PARA_INDIRECT(pv_irq_ops+PV_IRQ_irq_disable);    \
                   PV_RESTORE_REGS(clobbers | CLBR_CALLEE_SAVE);)
 
 #define ENABLE_INTERRUPTS(clobbers)                                     \
         PARA_SITE(PARA_PATCH(pv_irq_ops, PV_IRQ_irq_enable), clobbers,  \
                   PV_SAVE_REGS(clobbers | CLBR_CALLEE_SAVE);            \
+                  ANNOTATE_RETPOLINE_SAFE;                                      \
                   call PARA_INDIRECT(pv_irq_ops+PV_IRQ_irq_enable);     \
                   PV_RESTORE_REGS(clobbers | CLBR_CALLEE_SAVE);)
 
 #ifdef CONFIG_X86_32
 #define GET_CR0_INTO_EAX                                \
         push %ecx; push %edx;                           \
+        ANNOTATE_RETPOLINE_SAFE;                                \
         call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
         pop %edx; pop %ecx
 #else   /* !CONFIG_X86_32 */
@@ -917,21 +922,25 @@ extern void default_banner(void);
  */
 #define SWAPGS                                                          \
         PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_swapgs), CLBR_NONE,     \
-                  call PARA_INDIRECT(pv_cpu_ops+PV_CPU_swapgs)          \
+                  ANNOTATE_RETPOLINE_SAFE;                                      \
+                  call PARA_INDIRECT(pv_cpu_ops+PV_CPU_swapgs);         \
                  )
 
 #define GET_CR2_INTO_RAX                                \
-        call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr2)
+        ANNOTATE_RETPOLINE_SAFE;                                \
+        call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr2);
 
 #define USERGS_SYSRET64                                                 \
         PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_usergs_sysret64),       \
                   CLBR_NONE,                                            \
-                  jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_usergs_sysret64))
+                  ANNOTATE_RETPOLINE_SAFE;                                      \
+                  jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_usergs_sysret64);)
 
 #ifdef CONFIG_DEBUG_ENTRY
 #define SAVE_FLAGS(clobbers)                                        \
         PARA_SITE(PARA_PATCH(pv_irq_ops, PV_IRQ_save_fl), clobbers, \
                   PV_SAVE_REGS(clobbers | CLBR_CALLEE_SAVE);        \
+                  ANNOTATE_RETPOLINE_SAFE;                                  \
                   call PARA_INDIRECT(pv_irq_ops+PV_IRQ_save_fl);    \
                   PV_RESTORE_REGS(clobbers | CLBR_CALLEE_SAVE);)
 #endif
diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
index f624f1f10316..180bc0bff0fb 100644
--- a/arch/x86/include/asm/paravirt_types.h
+++ b/arch/x86/include/asm/paravirt_types.h
@@ -43,6 +43,7 @@
 #include <asm/desc_defs.h>
 #include <asm/kmap_types.h>
 #include <asm/pgtable_types.h>
+#include <asm/nospec-branch.h>
 
 struct page;
 struct thread_struct;
@@ -392,7 +393,9 @@ int paravirt_disable_iospace(void);
  * offset into the paravirt_patch_template structure, and can therefore be
  * freely converted back into a structure offset.
  */
-#define PARAVIRT_CALL   "call *%c[paravirt_opptr];"
+#define PARAVIRT_CALL                                   \
+        ANNOTATE_RETPOLINE_SAFE                         \
+        "call *%c[paravirt_opptr];"
 
 /*
  * These macros are intended to wrap calls through one of the paravirt
diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
index ba3c523aaf16..a06b07399d17 100644
--- a/arch/x86/include/asm/percpu.h
+++ b/arch/x86/include/asm/percpu.h
@@ -526,7 +526,7 @@ static inline bool x86_this_cpu_variable_test_bit(int nr,
 {
         bool oldbit;
 
-        asm volatile("bt "__percpu_arg(2)",%1"
+        asm volatile("btl "__percpu_arg(2)",%1"
                         CC_SET(c)
                         : CC_OUT(c) (oldbit)
                         : "m" (*(unsigned long __percpu *)addr), "Ir" (nr));
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index 63c2552b6b65..b444d83cfc95 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -350,14 +350,14 @@ static inline pmd_t pmd_set_flags(pmd_t pmd, pmdval_t set)
 {
         pmdval_t v = native_pmd_val(pmd);
 
-        return __pmd(v | set);
+        return native_make_pmd(v | set);
 }
 
 static inline pmd_t pmd_clear_flags(pmd_t pmd, pmdval_t clear)
 {
         pmdval_t v = native_pmd_val(pmd);
 
-        return __pmd(v & ~clear);
+        return native_make_pmd(v & ~clear);
 }
 
 static inline pmd_t pmd_mkold(pmd_t pmd)
@@ -409,14 +409,14 @@ static inline pud_t pud_set_flags(pud_t pud, pudval_t set)
 {
         pudval_t v = native_pud_val(pud);
 
-        return __pud(v | set);
+        return native_make_pud(v | set);
 }
 
 static inline pud_t pud_clear_flags(pud_t pud, pudval_t clear)
 {
         pudval_t v = native_pud_val(pud);
 
-        return __pud(v & ~clear);
+        return native_make_pud(v & ~clear);
 }
 
 static inline pud_t pud_mkold(pud_t pud)
diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
index e55466760ff8..b3ec519e3982 100644
--- a/arch/x86/include/asm/pgtable_32.h
+++ b/arch/x86/include/asm/pgtable_32.h
@@ -32,6 +32,7 @@ extern pmd_t initial_pg_pmd[];
 static inline void pgtable_cache_init(void) { }
 static inline void check_pgt_cache(void) { }
 void paging_init(void);
+void sync_initial_page_table(void);
 
 /*
  * Define this if things work differently on an i386 and an i486:
diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
index 81462e9a34f6..1149d2112b2e 100644
--- a/arch/x86/include/asm/pgtable_64.h
+++ b/arch/x86/include/asm/pgtable_64.h
@@ -28,6 +28,7 @@ extern pgd_t init_top_pgt[];
 #define swapper_pg_dir init_top_pgt
 
 extern void paging_init(void);
+static inline void sync_initial_page_table(void) { }
 
 #define pte_ERROR(e)                                    \
         pr_err("%s:%d: bad pte %p(%016lx)\n",           \
diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
index 3696398a9475..acfe755562a6 100644
--- a/arch/x86/include/asm/pgtable_types.h
+++ b/arch/x86/include/asm/pgtable_types.h
@@ -174,7 +174,6 @@ enum page_cache_mode {
 #define __PAGE_KERNEL_RO                (__PAGE_KERNEL & ~_PAGE_RW)
 #define __PAGE_KERNEL_RX                (__PAGE_KERNEL_EXEC & ~_PAGE_RW)
 #define __PAGE_KERNEL_NOCACHE           (__PAGE_KERNEL | _PAGE_NOCACHE)
-#define __PAGE_KERNEL_VSYSCALL          (__PAGE_KERNEL_RX | _PAGE_USER)
 #define __PAGE_KERNEL_VVAR              (__PAGE_KERNEL_RO | _PAGE_USER)
 #define __PAGE_KERNEL_LARGE             (__PAGE_KERNEL | _PAGE_PSE)
 #define __PAGE_KERNEL_LARGE_EXEC        (__PAGE_KERNEL_EXEC | _PAGE_PSE)
@@ -206,7 +205,6 @@ enum page_cache_mode {
 #define PAGE_KERNEL_NOCACHE     __pgprot(__PAGE_KERNEL_NOCACHE | _PAGE_ENC)
 #define PAGE_KERNEL_LARGE       __pgprot(__PAGE_KERNEL_LARGE | _PAGE_ENC)
 #define PAGE_KERNEL_LARGE_EXEC  __pgprot(__PAGE_KERNEL_LARGE_EXEC | _PAGE_ENC)
-#define PAGE_KERNEL_VSYSCALL    __pgprot(__PAGE_KERNEL_VSYSCALL | _PAGE_ENC)
 #define PAGE_KERNEL_VVAR        __pgprot(__PAGE_KERNEL_VVAR | _PAGE_ENC)
 
 #define PAGE_KERNEL_IO          __pgprot(__PAGE_KERNEL_IO)
@@ -323,6 +321,11 @@ static inline pudval_t native_pud_val(pud_t pud)
 #else
 #include <asm-generic/pgtable-nopud.h>
 
+static inline pud_t native_make_pud(pudval_t val)
+{
+        return (pud_t) { .p4d.pgd = native_make_pgd(val) };
+}
+
 static inline pudval_t native_pud_val(pud_t pud)
 {
         return native_pgd_val(pud.p4d.pgd);
@@ -344,6 +347,11 @@ static inline pmdval_t native_pmd_val(pmd_t pmd)
 #else
 #include <asm-generic/pgtable-nopmd.h>
 
+static inline pmd_t native_make_pmd(pmdval_t val)
+{
+        return (pmd_t) { .pud.p4d.pgd = native_make_pgd(val) };
+}
+
 static inline pmdval_t native_pmd_val(pmd_t pmd)
 {
         return native_pgd_val(pmd.pud.p4d.pgd);
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 1bd9ed87606f..b0ccd4847a58 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -977,4 +977,5 @@ bool xen_set_default_idle(void);
 
 void stop_this_cpu(void *dummy);
 void df_debug(struct pt_regs *regs, long error_code);
+void microcode_check(void);
 #endif /* _ASM_X86_PROCESSOR_H */
diff --git a/arch/x86/include/asm/refcount.h b/arch/x86/include/asm/refcount.h
index 4e44250e7d0d..4cf11d88d3b3 100644
--- a/arch/x86/include/asm/refcount.h
+++ b/arch/x86/include/asm/refcount.h
@@ -17,7 +17,7 @@
 #define _REFCOUNT_EXCEPTION                             \
         ".pushsection .text..refcount\n"                \
         "111:\tlea %[counter], %%" _ASM_CX "\n"         \
-        "112:\t" ASM_UD0 "\n"                           \
+        "112:\t" ASM_UD2 "\n"                           \
         ASM_UNREACHABLE                                 \
         ".popsection\n"                                 \
         "113:\n"                                        \
@@ -67,13 +67,13 @@ static __always_inline __must_check
 bool refcount_sub_and_test(unsigned int i, refcount_t *r)
 {
         GEN_BINARY_SUFFIXED_RMWcc(LOCK_PREFIX "subl", REFCOUNT_CHECK_LT_ZERO,
-                                  r->refs.counter, "er", i, "%0", e);
+                                  r->refs.counter, "er", i, "%0", e, "cx");
 }
 
 static __always_inline __must_check bool refcount_dec_and_test(refcount_t *r)
 {
         GEN_UNARY_SUFFIXED_RMWcc(LOCK_PREFIX "decl", REFCOUNT_CHECK_LT_ZERO,
-                                 r->refs.counter, "%0", e);
+                                 r->refs.counter, "%0", e, "cx");
 }
 
 static __always_inline __must_check
diff --git a/arch/x86/include/asm/rmwcc.h b/arch/x86/include/asm/rmwcc.h
index f91c365e57c3..4914a3e7c803 100644
--- a/arch/x86/include/asm/rmwcc.h
+++ b/arch/x86/include/asm/rmwcc.h
@@ -2,8 +2,7 @@
 #ifndef _ASM_X86_RMWcc
 #define _ASM_X86_RMWcc
 
-#define __CLOBBERS_MEM          "memory"
-#define __CLOBBERS_MEM_CC_CX    "memory", "cc", "cx"
+#define __CLOBBERS_MEM(clb...)  "memory", ## clb
 
 #if !defined(__GCC_ASM_FLAG_OUTPUTS__) && defined(CC_HAVE_ASM_GOTO)
 
@@ -40,18 +39,19 @@ do {									\
 #endif /* defined(__GCC_ASM_FLAG_OUTPUTS__) || !defined(CC_HAVE_ASM_GOTO) */
 
 #define GEN_UNARY_RMWcc(op, var, arg0, cc)                              \
-        __GEN_RMWcc(op " " arg0, var, cc, __CLOBBERS_MEM)
+        __GEN_RMWcc(op " " arg0, var, cc, __CLOBBERS_MEM())
 
-#define GEN_UNARY_SUFFIXED_RMWcc(op, suffix, var, arg0, cc)             \
+#define GEN_UNARY_SUFFIXED_RMWcc(op, suffix, var, arg0, cc, clobbers...)\
         __GEN_RMWcc(op " " arg0 "\n\t" suffix, var, cc,                 \
-                    __CLOBBERS_MEM_CC_CX)
+                    __CLOBBERS_MEM(clobbers))
 
 #define GEN_BINARY_RMWcc(op, var, vcon, val, arg0, cc)                  \
         __GEN_RMWcc(op __BINARY_RMWcc_ARG arg0, var, cc,                \
-                    __CLOBBERS_MEM, vcon (val))
+                    __CLOBBERS_MEM(), vcon (val))
 
-#define GEN_BINARY_SUFFIXED_RMWcc(op, suffix, var, vcon, val, arg0, cc) \
+#define GEN_BINARY_SUFFIXED_RMWcc(op, suffix, var, vcon, val, arg0, cc, \
+                                  clobbers...)                          \
         __GEN_RMWcc(op __BINARY_RMWcc_ARG arg0 "\n\t" suffix, var, cc,  \
-                    __CLOBBERS_MEM_CC_CX, vcon (val))
+                    __CLOBBERS_MEM(clobbers), vcon (val))
 
 #endif /* _ASM_X86_RMWcc */
diff --git a/arch/x86/include/asm/sections.h b/arch/x86/include/asm/sections.h
index d6baf23782bc..5c019d23d06b 100644
--- a/arch/x86/include/asm/sections.h
+++ b/arch/x86/include/asm/sections.h
@@ -10,6 +10,7 @@ extern struct exception_table_entry __stop___ex_table[];
 
 #if defined(CONFIG_X86_64)
 extern char __end_rodata_hpage_align[];
+extern char __entry_trampoline_start[], __entry_trampoline_end[];
 #endif
 
 #endif  /* _ASM_X86_SECTIONS_H */
diff --git a/arch/x86/include/asm/sys_ia32.h b/arch/x86/include/asm/sys_ia32.h
index 82c34ee25a65..906794aa034e 100644
--- a/arch/x86/include/asm/sys_ia32.h
+++ b/arch/x86/include/asm/sys_ia32.h
@@ -20,31 +20,43 @@
 #include <asm/ia32.h>
 
 /* ia32/sys_ia32.c */
-asmlinkage long sys32_truncate64(const char __user *, unsigned long, unsigned long);
-asmlinkage long sys32_ftruncate64(unsigned int, unsigned long, unsigned long);
+asmlinkage long compat_sys_x86_truncate64(const char __user *, unsigned long,
+                                          unsigned long);
+asmlinkage long compat_sys_x86_ftruncate64(unsigned int, unsigned long,
+                                           unsigned long);
 
-asmlinkage long sys32_stat64(const char __user *, struct stat64 __user *);
-asmlinkage long sys32_lstat64(const char __user *, struct stat64 __user *);
-asmlinkage long sys32_fstat64(unsigned int, struct stat64 __user *);
-asmlinkage long sys32_fstatat(unsigned int, const char __user *,
+asmlinkage long compat_sys_x86_stat64(const char __user *,
+                                      struct stat64 __user *);
+asmlinkage long compat_sys_x86_lstat64(const char __user *,
+                                       struct stat64 __user *);
+asmlinkage long compat_sys_x86_fstat64(unsigned int, struct stat64 __user *);
+asmlinkage long compat_sys_x86_fstatat(unsigned int, const char __user *,
                               struct stat64 __user *, int);
 struct mmap_arg_struct32;
-asmlinkage long sys32_mmap(struct mmap_arg_struct32 __user *);
+asmlinkage long compat_sys_x86_mmap(struct mmap_arg_struct32 __user *);
 
-asmlinkage long sys32_waitpid(compat_pid_t, unsigned int __user *, int);
+asmlinkage long compat_sys_x86_waitpid(compat_pid_t, unsigned int __user *,
+                                       int);
 
-asmlinkage long sys32_pread(unsigned int, char __user *, u32, u32, u32);
-asmlinkage long sys32_pwrite(unsigned int, const char __user *, u32, u32, u32);
+asmlinkage long compat_sys_x86_pread(unsigned int, char __user *, u32, u32,
+                                     u32);
+asmlinkage long compat_sys_x86_pwrite(unsigned int, const char __user *, u32,
+                                      u32, u32);
 
-long sys32_fadvise64_64(int, __u32, __u32, __u32, __u32, int);
-long sys32_vm86_warning(void);
+asmlinkage long compat_sys_x86_fadvise64_64(int, __u32, __u32, __u32, __u32,
+                                            int);
 
-asmlinkage ssize_t sys32_readahead(int, unsigned, unsigned, size_t);
-asmlinkage long sys32_sync_file_range(int, unsigned, unsigned,
-                                      unsigned, unsigned, int);
-asmlinkage long sys32_fadvise64(int, unsigned, unsigned, size_t, int);
-asmlinkage long sys32_fallocate(int, int, unsigned,
-                                unsigned, unsigned, unsigned);
+asmlinkage ssize_t compat_sys_x86_readahead(int, unsigned int, unsigned int,
+                                            size_t);
+asmlinkage long compat_sys_x86_sync_file_range(int, unsigned int, unsigned int,
+                                               unsigned int, unsigned int,
+                                               int);
+asmlinkage long compat_sys_x86_fadvise64(int, unsigned int, unsigned int,
+                                         size_t, int);
+asmlinkage long compat_sys_x86_fallocate(int, int, unsigned int, unsigned int,
+                                         unsigned int, unsigned int);
+asmlinkage long compat_sys_x86_clone(unsigned long, unsigned long, int __user *,
+                                     unsigned long, int __user *);
 
 /* ia32/ia32_signal.c */
 asmlinkage long sys32_sigreturn(void);
diff --git a/arch/x86/include/uapi/asm/kvm_para.h b/arch/x86/include/uapi/asm/kvm_para.h
index 7a2ade4aa235..6cfa9c8cb7d6 100644
--- a/arch/x86/include/uapi/asm/kvm_para.h
+++ b/arch/x86/include/uapi/asm/kvm_para.h
@@ -26,6 +26,7 @@
 #define KVM_FEATURE_PV_EOI              6
 #define KVM_FEATURE_PV_UNHALT           7
 #define KVM_FEATURE_PV_TLB_FLUSH        9
+#define KVM_FEATURE_ASYNC_PF_VMEXIT     10
 
 /* The last 8 bits are used to indicate how to interpret the flags field
  * in pvclock structure. If no bits are set, all flags are ignored.
diff --git a/arch/x86/include/uapi/asm/mce.h b/arch/x86/include/uapi/asm/mce.h
index 91723461dc1f..435db58a7bad 100644
--- a/arch/x86/include/uapi/asm/mce.h
+++ b/arch/x86/include/uapi/asm/mce.h
@@ -30,6 +30,7 @@ struct mce {
         __u64 synd;     /* MCA_SYND MSR: only valid on SMCA systems */
         __u64 ipid;     /* MCA_IPID MSR: only valid on SMCA systems */
         __u64 ppin;     /* Protected Processor Inventory Number */
+        __u32 microcode;/* Microcode revision */
 };
 
 #define MCE_GET_RECORD_LEN   _IOR('M', 1, int)
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 8ad2e410974f..7c5538769f7e 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -1603,7 +1603,7 @@ static void __init delay_with_tsc(void)
         do {
                 rep_nop();
                 now = rdtsc();
-        } while ((now - start) < 40000000000UL / HZ &&
+        } while ((now - start) < 40000000000ULL / HZ &&
                 time_before_eq(jiffies, end));
 }
 
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index d71c8b54b696..bfca937bdcc3 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -300,6 +300,15 @@ retpoline_auto:
                 setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
                 pr_info("Spectre v2 mitigation: Enabling Indirect Branch Prediction Barrier\n");
         }
+
+        /*
+         * Retpoline means the kernel is safe because it has no indirect
+         * branches. But firmware isn't, so use IBRS to protect that.
+         */
+        if (boot_cpu_has(X86_FEATURE_IBRS)) {
+                setup_force_cpu_cap(X86_FEATURE_USE_IBRS_FW);
+                pr_info("Enabling Restricted Speculation for firmware calls\n");
+        }
 }
 
 #undef pr_fmt
@@ -326,8 +335,9 @@ ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, c
         if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
                 return sprintf(buf, "Not affected\n");
 
-        return sprintf(buf, "%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
+        return sprintf(buf, "%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
                        boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "",
+                       boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
                        spectre_v2_module_string());
 }
 #endif
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 824aee0117bb..348cf4821240 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1749,3 +1749,33 @@ static int __init init_cpu_syscore(void)
         return 0;
 }
 core_initcall(init_cpu_syscore);
+
+/*
+ * The microcode loader calls this upon late microcode load to recheck features,
+ * only when microcode has been updated. Caller holds microcode_mutex and CPU
+ * hotplug lock.
+ */
+void microcode_check(void)
+{
+        struct cpuinfo_x86 info;
+
+        perf_check_microcode();
+
+        /* Reload CPUID max function as it might've changed. */
+        info.cpuid_level = cpuid_eax(0);
+
+        /*
+         * Copy all capability leafs to pick up the synthetic ones so that
+         * memcmp() below doesn't fail on that. The ones coming from CPUID will
+         * get overwritten in get_cpu_cap().
+         */
+        memcpy(&info.x86_capability, &boot_cpu_data.x86_capability, sizeof(info.x86_capability));
+
+        get_cpu_cap(&info);
+
+        if (!memcmp(&info.x86_capability, &boot_cpu_data.x86_capability, sizeof(info.x86_capability)))
+                return;
+
+        pr_warn("x86/CPU: CPU features have changed after loading microcode, but might not take effect.\n");
+        pr_warn("x86/CPU: Please consider either early loading through initrd/built-in or a potential BIOS update.\n");
+}
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index d19e903214b4..c3af167d0a70 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -105,7 +105,7 @@ static void probe_xeon_phi_r3mwait(struct cpuinfo_x86 *c)
 /*
  * Early microcode releases for the Spectre v2 mitigation were broken.
  * Information taken from;
- * - https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/microcode-update-guidance.pdf
+ * - https://newsroom.intel.com/wp-content/uploads/sites/11/2018/03/microcode-update-guidance.pdf
  * - https://kb.vmware.com/s/article/52345
  * - Microcode revisions observed in the wild
  * - Release note from 20180108 microcode release
@@ -123,7 +123,6 @@ static const struct sku_microcode spectre_bad_microcodes[] = {
         { INTEL_FAM6_KABYLAKE_MOBILE,   0x09,   0x80 },
         { INTEL_FAM6_SKYLAKE_X,         0x03,   0x0100013e },
         { INTEL_FAM6_SKYLAKE_X,         0x04,   0x0200003c },
-        { INTEL_FAM6_SKYLAKE_DESKTOP,   0x03,   0xc2 },
         { INTEL_FAM6_BROADWELL_CORE,    0x04,   0x28 },
         { INTEL_FAM6_BROADWELL_GT3E,    0x01,   0x1b },
         { INTEL_FAM6_BROADWELL_XEON_D,  0x02,   0x14 },
@@ -144,6 +143,13 @@ static bool bad_spectre_microcode(struct cpuinfo_x86 *c)
 {
         int i;
 
+        /*
+         * We know that the hypervisor lie to us on the microcode version so
+         * we may as well hope that it is running the correct version.
+         */
+        if (cpu_has(c, X86_FEATURE_HYPERVISOR))
+                return false;
+
         for (i = 0; i < ARRAY_SIZE(spectre_bad_microcodes); i++) {
                 if (c->x86_model == spectre_bad_microcodes[i].model &&
                     c->x86_stepping == spectre_bad_microcodes[i].stepping)
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 8ff94d1e2dce..466f47301334 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -56,6 +56,9 @@
 
 static DEFINE_MUTEX(mce_log_mutex);
 
+/* sysfs synchronization */
+static DEFINE_MUTEX(mce_sysfs_mutex);
+
 #define CREATE_TRACE_POINTS
 #include <trace/events/mce.h>
 
@@ -130,6 +133,8 @@ void mce_setup(struct mce *m)
 
         if (this_cpu_has(X86_FEATURE_INTEL_PPIN))
                 rdmsrl(MSR_PPIN, m->ppin);
+
+        m->microcode = boot_cpu_data.microcode;
 }
 
 DEFINE_PER_CPU(struct mce, injectm);
@@ -262,7 +267,7 @@ static void __print_mce(struct mce *m)
          */
         pr_emerg(HW_ERR "PROCESSOR %u:%x TIME %llu SOCKET %u APIC %x microcode %x\n",
                 m->cpuvendor, m->cpuid, m->time, m->socketid, m->apicid,
-                cpu_data(m->extcpu).microcode);
+                m->microcode);
 }
 
 static void print_mce(struct mce *m)
@@ -2086,6 +2091,7 @@ static ssize_t set_ignore_ce(struct device *s,
         if (kstrtou64(buf, 0, &new) < 0)
                 return -EINVAL;
 
+        mutex_lock(&mce_sysfs_mutex);
         if (mca_cfg.ignore_ce ^ !!new) {
                 if (new) {
                         /* disable ce features */
@@ -2098,6 +2104,8 @@ static ssize_t set_ignore_ce(struct device *s,
                         on_each_cpu(mce_enable_ce, (void *)1, 1);
                 }
         }
+        mutex_unlock(&mce_sysfs_mutex);
+
         return size;
 }
 
@@ -2110,6 +2118,7 @@ static ssize_t set_cmci_disabled(struct device *s,
         if (kstrtou64(buf, 0, &new) < 0)
                 return -EINVAL;
 
+        mutex_lock(&mce_sysfs_mutex);
         if (mca_cfg.cmci_disabled ^ !!new) {
                 if (new) {
                         /* disable cmci */
@@ -2121,6 +2130,8 @@ static ssize_t set_cmci_disabled(struct device *s,
                         on_each_cpu(mce_enable_ce, NULL, 1);
                 }
         }
+        mutex_unlock(&mce_sysfs_mutex);
+
         return size;
 }
 
@@ -2128,8 +2139,19 @@ static ssize_t store_int_with_restart(struct device *s,
                                       struct device_attribute *attr,
                                       const char *buf, size_t size)
 {
-        ssize_t ret = device_store_int(s, attr, buf, size);
+        unsigned long old_check_interval = check_interval;
+        ssize_t ret = device_store_ulong(s, attr, buf, size);
+
+        if (check_interval == old_check_interval)
+                return ret;
+
+        if (check_interval < 1)
+                check_interval = 1;
+
+        mutex_lock(&mce_sysfs_mutex);
         mce_restart();
+        mutex_unlock(&mce_sysfs_mutex);
+
         return ret;
 }
 
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index 330b8462d426..48179928ff38 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -339,7 +339,7 @@ int __init save_microcode_in_initrd_amd(unsigned int cpuid_1_eax)
                 return -EINVAL;
 
         ret = load_microcode_amd(true, x86_family(cpuid_1_eax), desc.data, desc.size);
-        if (ret != UCODE_OK)
+        if (ret > UCODE_UPDATED)
                 return -EINVAL;
 
         return 0;
@@ -498,7 +498,7 @@ static unsigned int verify_patch_size(u8 family, u32 patch_size,
         return patch_size;
 }
 
-static int apply_microcode_amd(int cpu)
+static enum ucode_state apply_microcode_amd(int cpu)
 {
         struct cpuinfo_x86 *c = &cpu_data(cpu);
         struct microcode_amd *mc_amd;
@@ -512,7 +512,7 @@ static int apply_microcode_amd(int cpu)
 
         p = find_patch(cpu);
         if (!p)
-                return 0;
+                return UCODE_NFOUND;
 
         mc_amd  = p->data;
         uci->mc = p->data;
@@ -523,13 +523,13 @@ static int apply_microcode_amd(int cpu)
         if (rev >= mc_amd->hdr.patch_id) {
                 c->microcode = rev;
                 uci->cpu_sig.rev = rev;
-                return 0;
+                return UCODE_OK;
         }
 
         if (__apply_microcode_amd(mc_amd)) {
                 pr_err("CPU%d: update failed for patch_level=0x%08x\n",
                         cpu, mc_amd->hdr.patch_id);
-                return -1;
+                return UCODE_ERROR;
         }
         pr_info("CPU%d: new patch_level=0x%08x\n", cpu,
                 mc_amd->hdr.patch_id);
@@ -537,7 +537,7 @@ static int apply_microcode_amd(int cpu)
         uci->cpu_sig.rev = mc_amd->hdr.patch_id;
         c->microcode = mc_amd->hdr.patch_id;
 
-        return 0;
+        return UCODE_UPDATED;
 }
 
 static int install_equiv_cpu_table(const u8 *buf)
@@ -683,27 +683,35 @@ static enum ucode_state __load_microcode_amd(u8 family, const u8 *data,
 static enum ucode_state
 load_microcode_amd(bool save, u8 family, const u8 *data, size_t size)
 {
+        struct ucode_patch *p;
         enum ucode_state ret;
 
         /* free old equiv table */
         free_equiv_cpu_table();
 
         ret = __load_microcode_amd(family, data, size);
-
-        if (ret != UCODE_OK)
+        if (ret != UCODE_OK) {
                 cleanup();
+                return ret;
+        }
 
-#ifdef CONFIG_X86_32
-        /* save BSP's matching patch for early load */
-        if (save) {
-                struct ucode_patch *p = find_patch(0);
-                if (p) {
-                        memset(amd_ucode_patch, 0, PATCH_MAX_SIZE);
-                        memcpy(amd_ucode_patch, p->data, min_t(u32, ksize(p->data),
-                                                               PATCH_MAX_SIZE));
-                }
+        p = find_patch(0);
+        if (!p) {
+                return ret;
+        } else {
+                if (boot_cpu_data.microcode == p->patch_id)
+                        return ret;
+
+                ret = UCODE_NEW;
         }
-#endif
+
+        /* save BSP's matching patch for early load */
+        if (!save)
+                return ret;
+
+        memset(amd_ucode_patch, 0, PATCH_MAX_SIZE);
+        memcpy(amd_ucode_patch, p->data, min_t(u32, ksize(p->data), PATCH_MAX_SIZE));
+
         return ret;
 }
 
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index 319dd65f98a2..10c4fc2c91f8 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -22,13 +22,16 @@
 #define pr_fmt(fmt) "microcode: " fmt
 
 #include <linux/platform_device.h>
+#include <linux/stop_machine.h>
 #include <linux/syscore_ops.h>
 #include <linux/miscdevice.h>
 #include <linux/capability.h>
 #include <linux/firmware.h>
 #include <linux/kernel.h>
+#include <linux/delay.h>
 #include <linux/mutex.h>
 #include <linux/cpu.h>
+#include <linux/nmi.h>
 #include <linux/fs.h>
 #include <linux/mm.h>
 
@@ -64,6 +67,11 @@ LIST_HEAD(microcode_cache);
  */
 static DEFINE_MUTEX(microcode_mutex);
 
+/*
+ * Serialize late loading so that CPUs get updated one-by-one.
+ */
+static DEFINE_SPINLOCK(update_lock);
+
 struct ucode_cpu_info           ucode_cpu_info[NR_CPUS];
 
 struct cpu_info_ctx {
@@ -373,26 +381,23 @@ static int collect_cpu_info(int cpu)
         return ret;
 }
 
-struct apply_microcode_ctx {
-        int err;
-};
-
 static void apply_microcode_local(void *arg)
 {
-        struct apply_microcode_ctx *ctx = arg;
+        enum ucode_state *err = arg;
 
-        ctx->err = microcode_ops->apply_microcode(smp_processor_id());
+        *err = microcode_ops->apply_microcode(smp_processor_id());
 }
 
 static int apply_microcode_on_target(int cpu)
 {
-        struct apply_microcode_ctx ctx = { .err = 0 };
+        enum ucode_state err;
         int ret;
 
-        ret = smp_call_function_single(cpu, apply_microcode_local, &ctx, 1);
-        if (!ret)
-                ret = ctx.err;
-
+        ret = smp_call_function_single(cpu, apply_microcode_local, &err, 1);
+        if (!ret) {
+                if (err == UCODE_ERROR)
+                        ret = 1;
+        }
         return ret;
 }
 
@@ -489,31 +494,124 @@ static void __exit microcode_dev_exit(void)
 /* fake device for request_firmware */
 static struct platform_device   *microcode_pdev;
 
-static int reload_for_cpu(int cpu)
+/*
+ * Late loading dance. Why the heavy-handed stomp_machine effort?
+ *
+ * - HT siblings must be idle and not execute other code while the other sibling
+ *   is loading microcode in order to avoid any negative interactions caused by
+ *   the loading.
+ *
+ * - In addition, microcode update on the cores must be serialized until this
+ *   requirement can be relaxed in the future. Right now, this is conservative
+ *   and good.
+ */
+#define SPINUNIT 100 /* 100 nsec */
+
+static int check_online_cpus(void)
 {
-        struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
-        enum ucode_state ustate;
-        int err = 0;
+        if (num_online_cpus() == num_present_cpus())
+                return 0;
 
-        if (!uci->valid)
-                return err;
+        pr_err("Not all CPUs online, aborting microcode update.\n");
 
-        ustate = microcode_ops->request_microcode_fw(cpu, &microcode_pdev->dev, true);
-        if (ustate == UCODE_OK)
-                apply_microcode_on_target(cpu);
-        else
-                if (ustate == UCODE_ERROR)
-                        err = -EINVAL;
-        return err;
+        return -EINVAL;
+}
+
+static atomic_t late_cpus_in;
+static atomic_t late_cpus_out;
+
+static int __wait_for_cpus(atomic_t *t, long long timeout)
+{
+        int all_cpus = num_online_cpus();
+
+        atomic_inc(t);
+
+        while (atomic_read(t) < all_cpus) {
+                if (timeout < SPINUNIT) {
+                        pr_err("Timeout while waiting for CPUs rendezvous, remaining: %d\n",
+                                all_cpus - atomic_read(t));
+                        return 1;
+                }
+
+                ndelay(SPINUNIT);
+                timeout -= SPINUNIT;
+
+                touch_nmi_watchdog();
+        }
+        return 0;
+}
+
+/*
+ * Returns:
+ * < 0 - on error
+ *   0 - no update done
+ *   1 - microcode was updated
+ */
+static int __reload_late(void *info)
+{
+        int cpu = smp_processor_id();
+        enum ucode_state err;
+        int ret = 0;
+
+        /*
+         * Wait for all CPUs to arrive. A load will not be attempted unless all
+         * CPUs show up.
+         * */
+        if (__wait_for_cpus(&late_cpus_in, NSEC_PER_SEC))
+                return -1;
+
+        spin_lock(&update_lock);
+        apply_microcode_local(&err);
+        spin_unlock(&update_lock);
+
+        if (err > UCODE_NFOUND) {
+                pr_warn("Error reloading microcode on CPU %d\n", cpu);
+                return -1;
+        /* siblings return UCODE_OK because their engine got updated already */
+        } else if (err == UCODE_UPDATED || err == UCODE_OK) {
+                ret = 1;
+        } else {
+                return ret;
+        }
+
+        /*
+         * Increase the wait timeout to a safe value here since we're
+         * serializing the microcode update and that could take a while on a
+         * large number of CPUs. And that is fine as the *actual* timeout will
+         * be determined by the last CPU finished updating and thus cut short.
+         */
+        if (__wait_for_cpus(&late_cpus_out, NSEC_PER_SEC * num_online_cpus()))
+                panic("Timeout during microcode update!\n");
+
+        return ret;
+}
+
+/*
+ * Reload microcode late on all CPUs. Wait for a sec until they
+ * all gather together.
+ */
+static int microcode_reload_late(void)
+{
+        int ret;
+
+        atomic_set(&late_cpus_in,  0);
+        atomic_set(&late_cpus_out, 0);
+
+        ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask);
+        if (ret > 0)
+                microcode_check();
+
+        return ret;
 }
 
 static ssize_t reload_store(struct device *dev,
                             struct device_attribute *attr,
                             const char *buf, size_t size)
 {
+        enum ucode_state tmp_ret = UCODE_OK;
+        int bsp = boot_cpu_data.cpu_index;
         unsigned long val;
-        int cpu;
-        ssize_t ret = 0, tmp_ret;
+        ssize_t ret = 0;
 
         ret = kstrtoul(buf, 0, &val);
         if (ret)
@@ -522,23 +620,24 @@ static ssize_t reload_store(struct device *dev,
         if (val != 1)
                 return size;
 
+        tmp_ret = microcode_ops->request_microcode_fw(bsp, &microcode_pdev->dev, true);
+        if (tmp_ret != UCODE_NEW)
+                return size;
+
         get_online_cpus();
-        mutex_lock(&microcode_mutex);
-        for_each_online_cpu(cpu) {
-                tmp_ret = reload_for_cpu(cpu);
-                if (tmp_ret != 0)
-                        pr_warn("Error reloading microcode on CPU %d\n", cpu);
 
-                /* save retval of the first encountered reload error */
-                if (!ret)
-                        ret = tmp_ret;
-        }
-        if (!ret)
-                perf_check_microcode();
+        ret = check_online_cpus();
+        if (ret)
+                goto put;
+
+        mutex_lock(&microcode_mutex);
+        ret = microcode_reload_late();
         mutex_unlock(&microcode_mutex);
+
+put:
         put_online_cpus();
 
-        if (!ret)
+        if (ret >= 0)
                 ret = size;
 
         return ret;
@@ -606,10 +705,8 @@ static enum ucode_state microcode_init_cpu(int cpu, bool refresh_fw)
         if (system_state != SYSTEM_RUNNING)
                 return UCODE_NFOUND;
 
-        ustate = microcode_ops->request_microcode_fw(cpu, &microcode_pdev->dev,
-                                                     refresh_fw);
-
-        if (ustate == UCODE_OK) {
+        ustate = microcode_ops->request_microcode_fw(cpu, &microcode_pdev->dev, refresh_fw);
+        if (ustate == UCODE_NEW) {
                 pr_debug("CPU%d updated upon init\n", cpu);
                 apply_microcode_on_target(cpu);
         }
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index a15db2b4e0d6..32b8e5724f96 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -589,6 +589,23 @@ static int apply_microcode_early(struct ucode_cpu_info *uci, bool early)
         if (!mc)
                 return 0;
 
+        /*
+         * Save us the MSR write below - which is a particular expensive
+         * operation - when the other hyperthread has updated the microcode
+         * already.
+         */
+        rev = intel_get_microcode_revision();
+        if (rev >= mc->hdr.rev) {
+                uci->cpu_sig.rev = rev;
+                return UCODE_OK;
+        }
+
+        /*
+         * Writeback and invalidate caches before updating microcode to avoid
+         * internal issues depending on what the microcode is updating.
+         */
+        native_wbinvd();
+
         /* write microcode via MSR 0x79 */
         native_wrmsrl(MSR_IA32_UCODE_WRITE, (unsigned long)mc->bits);
 
@@ -772,27 +789,44 @@ static int collect_cpu_info(int cpu_num, struct cpu_signature *csig)
         return 0;
 }
 
-static int apply_microcode_intel(int cpu)
+static enum ucode_state apply_microcode_intel(int cpu)
 {
+        struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
+        struct cpuinfo_x86 *c = &cpu_data(cpu);
         struct microcode_intel *mc;
-        struct ucode_cpu_info *uci;
-        struct cpuinfo_x86 *c;
         static int prev_rev;
         u32 rev;
 
         /* We should bind the task to the CPU */
         if (WARN_ON(raw_smp_processor_id() != cpu))
-                return -1;
+                return UCODE_ERROR;
 
-        uci = ucode_cpu_info + cpu;
-        mc = uci->mc;
+        /* Look for a newer patch in our cache: */
+        mc = find_patch(uci);
         if (!mc) {
-                /* Look for a newer patch in our cache: */
-                mc = find_patch(uci);
+                mc = uci->mc;
                 if (!mc)
-                        return 0;
+                        return UCODE_NFOUND;
         }
 
+        /*
+         * Save us the MSR write below - which is a particular expensive
+         * operation - when the other hyperthread has updated the microcode
+         * already.
+         */
+        rev = intel_get_microcode_revision();
+        if (rev >= mc->hdr.rev) {
+                uci->cpu_sig.rev = rev;
+                c->microcode = rev;
+                return UCODE_OK;
+        }
+
+        /*
+         * Writeback and invalidate caches before updating microcode to avoid
+         * internal issues depending on what the microcode is updating.
+         */
+        native_wbinvd();
+
         /* write microcode via MSR 0x79 */
         wrmsrl(MSR_IA32_UCODE_WRITE, (unsigned long)mc->bits);
 
@@ -801,7 +835,7 @@ static int apply_microcode_intel(int cpu)
         if (rev != mc->hdr.rev) {
                 pr_err("CPU%d update to revision 0x%x failed\n",
                        cpu, mc->hdr.rev);
-                return -1;
+                return UCODE_ERROR;
         }
 
         if (rev != prev_rev) {
@@ -813,12 +847,10 @@ static int apply_microcode_intel(int cpu)
                 prev_rev = rev;
         }
 
-        c = &cpu_data(cpu);
-
         uci->cpu_sig.rev = rev;
         c->microcode = rev;
 
-        return 0;
+        return UCODE_UPDATED;
 }
 
 static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size,
@@ -830,6 +862,7 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size,
         unsigned int leftover = size;
         unsigned int curr_mc_size = 0, new_mc_size = 0;
         unsigned int csig, cpf;
+        enum ucode_state ret = UCODE_OK;
 
         while (leftover) {
                 struct microcode_header_intel mc_header;
@@ -871,6 +904,7 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size,
                         new_mc  = mc;
                         new_mc_size = mc_size;
                         mc = NULL;      /* trigger new vmalloc */
+                        ret = UCODE_NEW;
                 }
 
                 ucode_ptr += mc_size;
@@ -900,7 +934,7 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size,
         pr_debug("CPU%d found a matching microcode update with version 0x%x (current=0x%x)\n",
                  cpu, new_rev, uci->cpu_sig.rev);
 
-        return UCODE_OK;
+        return ret;
 }
 
 static int get_ucode_fw(void *to, const void *from, size_t n)
diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
index 04a625f0fcda..0f545b3cf926 100644
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -23,6 +23,7 @@
 #include <asm/nops.h>
 #include "../entry/calling.h"
 #include <asm/export.h>
+#include <asm/nospec-branch.h>
 
 #ifdef CONFIG_PARAVIRT
 #include <asm/asm-offsets.h>
@@ -134,6 +135,7 @@ ENTRY(secondary_startup_64)
 
         /* Ensure I am executing from virtual addresses */
         movq    $1f, %rax
+        ANNOTATE_RETPOLINE_SAFE
         jmp     *%rax
 1:
         UNWIND_HINT_EMPTY
diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c
index 2f723301eb58..38deafebb21b 100644
--- a/arch/x86/kernel/ioport.c
+++ b/arch/x86/kernel/ioport.c
@@ -23,7 +23,7 @@
 /*
  * this changes the io permissions bitmap in the current task.
  */
-asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
+SYSCALL_DEFINE3(ioperm, unsigned long, from, unsigned long, num, int, turn_on)
 {
         struct thread_struct *t = &current->thread;
         struct tss_struct *tss;
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index bd36f3c33cd0..0715f827607c 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -1168,10 +1168,18 @@ NOKPROBE_SYMBOL(longjmp_break_handler);
 
 bool arch_within_kprobe_blacklist(unsigned long addr)
 {
+        bool is_in_entry_trampoline_section = false;
+
+#ifdef CONFIG_X86_64
+        is_in_entry_trampoline_section =
+                (addr >= (unsigned long)__entry_trampoline_start &&
+                 addr < (unsigned long)__entry_trampoline_end);
+#endif
         return  (addr >= (unsigned long)__kprobes_text_start &&
                  addr < (unsigned long)__kprobes_text_end) ||
                 (addr >= (unsigned long)__entry_text_start &&
-                 addr < (unsigned long)__entry_text_end);
+                 addr < (unsigned long)__entry_text_end) ||
+                is_in_entry_trampoline_section;
 }
 
 int __init arch_init_kprobes(void)
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index 4e37d1a851a6..bc1a27280c4b 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -49,7 +49,7 @@
 
 static int kvmapf = 1;
 
-static int parse_no_kvmapf(char *arg)
+static int __init parse_no_kvmapf(char *arg)
 {
         kvmapf = 0;
         return 0;
@@ -58,7 +58,7 @@ static int parse_no_kvmapf(char *arg)
 early_param("no-kvmapf", parse_no_kvmapf);
 
 static int steal_acc = 1;
-static int parse_no_stealacc(char *arg)
+static int __init parse_no_stealacc(char *arg)
 {
         steal_acc = 0;
         return 0;
@@ -67,7 +67,7 @@ static int parse_no_stealacc(char *arg)
 early_param("no-steal-acc", parse_no_stealacc);
 
 static int kvmclock_vsyscall = 1;
-static int parse_no_kvmclock_vsyscall(char *arg)
+static int __init parse_no_kvmclock_vsyscall(char *arg)
 {
         kvmclock_vsyscall = 0;
         return 0;
@@ -341,10 +341,10 @@ static void kvm_guest_cpu_init(void)
 #endif
                 pa |= KVM_ASYNC_PF_ENABLED;
 
-                /* Async page fault support for L1 hypervisor is optional */
-                if (wrmsr_safe(MSR_KVM_ASYNC_PF_EN,
-                        (pa | KVM_ASYNC_PF_DELIVERY_AS_PF_VMEXIT) & 0xffffffff, pa >> 32) < 0)
-                        wrmsrl(MSR_KVM_ASYNC_PF_EN, pa);
+                if (kvm_para_has_feature(KVM_FEATURE_ASYNC_PF_VMEXIT))
+                        pa |= KVM_ASYNC_PF_DELIVERY_AS_PF_VMEXIT;
+
+                wrmsrl(MSR_KVM_ASYNC_PF_EN, pa);
                 __this_cpu_write(apf_reason.enabled, 1);
                 printk(KERN_INFO"KVM setup async PF for cpu %d\n",
                        smp_processor_id());
@@ -545,7 +545,8 @@ static void __init kvm_guest_init(void)
                 pv_time_ops.steal_clock = kvm_steal_clock;
         }
 
-        if (kvm_para_has_feature(KVM_FEATURE_PV_TLB_FLUSH))
+        if (kvm_para_has_feature(KVM_FEATURE_PV_TLB_FLUSH) &&
+            !kvm_para_has_feature(KVM_FEATURE_STEAL_TIME))
                 pv_mmu_ops.flush_tlb_others = kvm_flush_tlb_others;
 
         if (kvm_para_has_feature(KVM_FEATURE_PV_EOI))
@@ -633,7 +634,8 @@ static __init int kvm_setup_pv_tlb_flush(void)
 {
         int cpu;
 
-        if (kvm_para_has_feature(KVM_FEATURE_PV_TLB_FLUSH)) {
+        if (kvm_para_has_feature(KVM_FEATURE_PV_TLB_FLUSH) &&
+            !kvm_para_has_feature(KVM_FEATURE_STEAL_TIME)) {
                 for_each_possible_cpu(cpu) {
                         zalloc_cpumask_var_node(per_cpu_ptr(&__pv_tlb_mask, cpu),
                                 GFP_KERNEL, cpu_to_node(cpu));
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 1ae67e982af7..4c616be28506 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1204,20 +1204,13 @@ void __init setup_arch(char **cmdline_p)
 
         kasan_init();
 
-#ifdef CONFIG_X86_32
-        /* sync back kernel address range */
-        clone_pgd_range(initial_page_table + KERNEL_PGD_BOUNDARY,
-                        swapper_pg_dir     + KERNEL_PGD_BOUNDARY,
-                        KERNEL_PGD_PTRS);
-
         /*
-         * sync back low identity map too.  It is used for example
-         * in the 32-bit EFI stub.
+         * Sync back kernel address range.
+         *
+         * FIXME: Can the later sync in setup_cpu_entry_areas() replace
+         * this call?
          */
-        clone_pgd_range(initial_page_table,
-                        swapper_pg_dir     + KERNEL_PGD_BOUNDARY,
-                        min(KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
-#endif
+        sync_initial_page_table();
 
         tboot_probe();
 
diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
index 497aa766fab3..ea554f812ee1 100644
--- a/arch/x86/kernel/setup_percpu.c
+++ b/arch/x86/kernel/setup_percpu.c
@@ -287,24 +287,15 @@ void __init setup_per_cpu_areas(void)
         /* Setup cpu initialized, callin, callout masks */
         setup_cpu_local_masks();
 
-#ifdef CONFIG_X86_32
         /*
          * Sync back kernel address range again.  We already did this in
          * setup_arch(), but percpu data also needs to be available in
          * the smpboot asm.  We can't reliably pick up percpu mappings
          * using vmalloc_fault(), because exception dispatch needs
          * percpu data.
+         *
+         * FIXME: Can the later sync in setup_cpu_entry_areas() replace
+         * this call?
          */
-        clone_pgd_range(initial_page_table + KERNEL_PGD_BOUNDARY,
-                        swapper_pg_dir     + KERNEL_PGD_BOUNDARY,
-                        KERNEL_PGD_PTRS);
-
-        /*
-         * sync back low identity map too.  It is used for example
-         * in the 32-bit EFI stub.
-         */
-        clone_pgd_range(initial_page_table,
-                        swapper_pg_dir     + KERNEL_PGD_BOUNDARY,
-                        min(KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
-#endif
+        sync_initial_page_table();
 }
diff --git a/arch/x86/kernel/signal_compat.c b/arch/x86/kernel/signal_compat.c
index ac057f9b0763..0d930d8987cc 100644
--- a/arch/x86/kernel/signal_compat.c
+++ b/arch/x86/kernel/signal_compat.c
@@ -43,6 +43,13 @@ static inline void signal_compat_build_tests(void)
         BUILD_BUG_ON(offsetof(compat_siginfo_t, _sifields) != 3 * sizeof(int));
 #define CHECK_CSI_OFFSET(name)    BUILD_BUG_ON(_sifields_offset != offsetof(compat_siginfo_t, _sifields.name))
 
+        BUILD_BUG_ON(offsetof(siginfo_t, si_signo) != 0);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_errno) != 4);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_code)  != 8);
+
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_signo) != 0);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_errno) != 4);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_code)  != 8);
          /*
          * Ensure that the size of each si_field never changes.
          * If it does, it is a sign that the
@@ -63,36 +70,94 @@ static inline void signal_compat_build_tests(void)
         CHECK_CSI_SIZE  (_kill, 2*sizeof(int));
         CHECK_SI_SIZE   (_kill, 2*sizeof(int));
 
+        BUILD_BUG_ON(offsetof(siginfo_t, si_pid) != 0x10);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_uid) != 0x14);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_pid) != 0xC);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_uid) != 0x10);
+
         CHECK_CSI_OFFSET(_timer);
         CHECK_CSI_SIZE  (_timer, 3*sizeof(int));
         CHECK_SI_SIZE   (_timer, 6*sizeof(int));
 
+        BUILD_BUG_ON(offsetof(siginfo_t, si_tid)     != 0x10);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_overrun) != 0x14);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_value)   != 0x18);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_tid)     != 0x0C);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_overrun) != 0x10);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_value)   != 0x14);
+
         CHECK_CSI_OFFSET(_rt);
         CHECK_CSI_SIZE  (_rt, 3*sizeof(int));
         CHECK_SI_SIZE   (_rt, 4*sizeof(int));
 
+        BUILD_BUG_ON(offsetof(siginfo_t, si_pid)   != 0x10);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_uid)   != 0x14);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_value) != 0x18);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_pid)   != 0x0C);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_uid)   != 0x10);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_value) != 0x14);
+
         CHECK_CSI_OFFSET(_sigchld);
         CHECK_CSI_SIZE  (_sigchld, 5*sizeof(int));
         CHECK_SI_SIZE   (_sigchld, 8*sizeof(int));
 
+        BUILD_BUG_ON(offsetof(siginfo_t, si_pid)    != 0x10);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_uid)    != 0x14);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_status) != 0x18);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_utime)  != 0x20);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_stime)  != 0x28);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_pid)    != 0x0C);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_uid)    != 0x10);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_status) != 0x14);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_utime)  != 0x18);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_stime)  != 0x1C);
+
 #ifdef CONFIG_X86_X32_ABI
         CHECK_CSI_OFFSET(_sigchld_x32);
         CHECK_CSI_SIZE  (_sigchld_x32, 7*sizeof(int));
         /* no _sigchld_x32 in the generic siginfo_t */
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, _sifields._sigchld_x32._utime)  != 0x18);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, _sifields._sigchld_x32._stime)  != 0x20);
 #endif
 
         CHECK_CSI_OFFSET(_sigfault);
         CHECK_CSI_SIZE  (_sigfault, 4*sizeof(int));
         CHECK_SI_SIZE   (_sigfault, 8*sizeof(int));
 
+        BUILD_BUG_ON(offsetof(siginfo_t, si_addr) != 0x10);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_addr) != 0x0C);
+
+        BUILD_BUG_ON(offsetof(siginfo_t, si_addr_lsb) != 0x18);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_addr_lsb) != 0x10);
+
+        BUILD_BUG_ON(offsetof(siginfo_t, si_lower) != 0x20);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_upper) != 0x28);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_lower) != 0x14);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_upper) != 0x18);
+
+        BUILD_BUG_ON(offsetof(siginfo_t, si_pkey) != 0x20);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_pkey) != 0x14);
+
         CHECK_CSI_OFFSET(_sigpoll);
         CHECK_CSI_SIZE  (_sigpoll, 2*sizeof(int));
         CHECK_SI_SIZE   (_sigpoll, 4*sizeof(int));
 
+        BUILD_BUG_ON(offsetof(siginfo_t, si_band)   != 0x10);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_fd)     != 0x18);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_band) != 0x0C);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_fd)   != 0x10);
+
         CHECK_CSI_OFFSET(_sigsys);
         CHECK_CSI_SIZE  (_sigsys, 3*sizeof(int));
         CHECK_SI_SIZE   (_sigsys, 4*sizeof(int));
 
+        BUILD_BUG_ON(offsetof(siginfo_t, si_call_addr) != 0x10);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_syscall)   != 0x18);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_arch)      != 0x1C);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_call_addr) != 0x0C);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_syscall)   != 0x10);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_arch)      != 0x14);
+
         /* any new si_fields should be added here */
 }
 
diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
index 1f9188f5357c..feb28fee6cea 100644
--- a/arch/x86/kernel/unwind_orc.c
+++ b/arch/x86/kernel/unwind_orc.c
@@ -5,7 +5,6 @@
 #include <asm/unwind.h>
 #include <asm/orc_types.h>
 #include <asm/orc_lookup.h>
-#include <asm/sections.h>
 
 #define orc_warn(fmt, ...) \
         printk_deferred_once(KERN_WARNING pr_fmt("WARNING: " fmt), ##__VA_ARGS__)
@@ -148,7 +147,7 @@ static struct orc_entry *orc_find(unsigned long ip)
         }
 
         /* vmlinux .init slow lookup: */
-        if (ip >= (unsigned long)_sinittext && ip < (unsigned long)_einittext)
+        if (init_kernel_text(ip))
                 return __orc_find(__start_orc_unwind_ip, __start_orc_unwind,
                                   __stop_orc_unwind_ip - __start_orc_unwind_ip, ip);
 
diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
index 5edb27f1a2c4..9d0b5af7db91 100644
--- a/arch/x86/kernel/vm86_32.c
+++ b/arch/x86/kernel/vm86_32.c
@@ -727,7 +727,8 @@ void handle_vm86_fault(struct kernel_vm86_regs *regs, long error_code)
         return;
 
 check_vip:
-        if (VEFLAGS & X86_EFLAGS_VIP) {
+        if ((VEFLAGS & (X86_EFLAGS_VIP | X86_EFLAGS_VIF)) ==
+            (X86_EFLAGS_VIP | X86_EFLAGS_VIF)) {
                 save_v86_state(regs, VM86_STI);
                 return;
         }
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 9b138a06c1a4..b854ebf5851b 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -118,9 +118,11 @@ SECTIONS
 
 #ifdef CONFIG_X86_64
                 . = ALIGN(PAGE_SIZE);
+                VMLINUX_SYMBOL(__entry_trampoline_start) = .;
                 _entry_trampoline = .;
                 *(.entry_trampoline)
                 . = ALIGN(PAGE_SIZE);
+                VMLINUX_SYMBOL(__entry_trampoline_end) = .;
                 ASSERT(. - _entry_trampoline == PAGE_SIZE, "entry trampoline is too big");
 #endif
 
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index a0c5a69bc7c4..b671fc2d0422 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -607,7 +607,8 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
                              (1 << KVM_FEATURE_PV_EOI) |
                              (1 << KVM_FEATURE_CLOCKSOURCE_STABLE_BIT) |
                              (1 << KVM_FEATURE_PV_UNHALT) |
-                             (1 << KVM_FEATURE_PV_TLB_FLUSH);
+                             (1 << KVM_FEATURE_PV_TLB_FLUSH) |
+                             (1 << KVM_FEATURE_ASYNC_PF_VMEXIT);
 
                 if (sched_info_on())
                         entry->eax |= (1 << KVM_FEATURE_STEAL_TIME);
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 924ac8ce9d50..391dda8d43b7 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -2002,14 +2002,13 @@ void kvm_lapic_set_base(struct kvm_vcpu *vcpu, u64 value)
 
 void kvm_lapic_reset(struct kvm_vcpu *vcpu, bool init_event)
 {
-        struct kvm_lapic *apic;
+        struct kvm_lapic *apic = vcpu->arch.apic;
         int i;
 
-        apic_debug("%s\n", __func__);
+        if (!apic)
+                return;
 
-        ASSERT(vcpu);
-        apic = vcpu->arch.apic;
-        ASSERT(apic != NULL);
+        apic_debug("%s\n", __func__);
 
         /* Stop the timer in case it's a reset to an active apic */
         hrtimer_cancel(&apic->lapic_timer.timer);
@@ -2165,7 +2164,6 @@ int kvm_create_lapic(struct kvm_vcpu *vcpu)
          */
         vcpu->arch.apic_base = MSR_IA32_APICBASE_ENABLE;
         static_key_slow_inc(&apic_sw_disabled.key); /* sw disabled at reset */
-        kvm_lapic_reset(vcpu, false);
         kvm_iodevice_init(&apic->dev, &apic_mmio_ops);
 
         return 0;
@@ -2569,7 +2567,6 @@ void kvm_apic_accept_events(struct kvm_vcpu *vcpu)
 
         pe = xchg(&apic->pending_events, 0);
         if (test_bit(KVM_APIC_INIT, &pe)) {
-                kvm_lapic_reset(vcpu, true);
                 kvm_vcpu_reset(vcpu, true);
                 if (kvm_vcpu_is_bsp(apic->vcpu))
                         vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE;
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 46ff304140c7..763bb3bade63 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -2770,8 +2770,10 @@ static int set_spte(struct kvm_vcpu *vcpu, u64 *sptep,
         else
                 pte_access &= ~ACC_WRITE_MASK;
 
+        if (!kvm_is_mmio_pfn(pfn))
+                spte |= shadow_me_mask;
+
         spte |= (u64)pfn << PAGE_SHIFT;
-        spte |= shadow_me_mask;
 
         if (pte_access & ACC_WRITE_MASK) {
 
@@ -3029,7 +3031,7 @@ static int kvm_handle_bad_page(struct kvm_vcpu *vcpu, gfn_t gfn, kvm_pfn_t pfn)
                 return RET_PF_RETRY;
         }
 
-        return -EFAULT;
+        return RET_PF_EMULATE;
 }
 
 static void transparent_hugepage_adjust(struct kvm_vcpu *vcpu,
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index b3e488a74828..be9c839e2c89 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -49,6 +49,7 @@
 #include <asm/debugreg.h>
 #include <asm/kvm_para.h>
 #include <asm/irq_remapping.h>
+#include <asm/microcode.h>
 #include <asm/nospec-branch.h>
 
 #include <asm/virtext.h>
@@ -178,6 +179,8 @@ struct vcpu_svm {
         uint64_t sysenter_eip;
         uint64_t tsc_aux;
 
+        u64 msr_decfg;
+
         u64 next_rip;
 
         u64 host_user_msrs[NR_HOST_SAVE_USER_MSRS];
@@ -300,6 +303,8 @@ module_param(vgif, int, 0444);
 static int sev = IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT);
 module_param(sev, int, 0444);
 
+static u8 rsm_ins_bytes[] = "\x0f\xaa";
+
 static void svm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0);
 static void svm_flush_tlb(struct kvm_vcpu *vcpu, bool invalidate_gpa);
 static void svm_complete_interrupts(struct vcpu_svm *svm);
@@ -1383,6 +1388,7 @@ static void init_vmcb(struct vcpu_svm *svm)
         set_intercept(svm, INTERCEPT_SKINIT);
         set_intercept(svm, INTERCEPT_WBINVD);
         set_intercept(svm, INTERCEPT_XSETBV);
+        set_intercept(svm, INTERCEPT_RSM);
 
         if (!kvm_mwait_in_guest()) {
                 set_intercept(svm, INTERCEPT_MONITOR);
@@ -1902,6 +1908,7 @@ static void svm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
         u32 dummy;
         u32 eax = 1;
 
+        vcpu->arch.microcode_version = 0x01000065;
         svm->spec_ctrl = 0;
 
         if (!init_event) {
@@ -3699,6 +3706,12 @@ static int emulate_on_interception(struct vcpu_svm *svm)
         return emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE;
 }
 
+static int rsm_interception(struct vcpu_svm *svm)
+{
+        return x86_emulate_instruction(&svm->vcpu, 0, 0,
+                                       rsm_ins_bytes, 2) == EMULATE_DONE;
+}
+
 static int rdpmc_interception(struct vcpu_svm *svm)
 {
         int err;
@@ -3860,6 +3873,22 @@ static int cr8_write_interception(struct vcpu_svm *svm)
         return 0;
 }
 
+static int svm_get_msr_feature(struct kvm_msr_entry *msr)
+{
+        msr->data = 0;
+
+        switch (msr->index) {
+        case MSR_F10H_DECFG:
+                if (boot_cpu_has(X86_FEATURE_LFENCE_RDTSC))
+                        msr->data |= MSR_F10H_DECFG_LFENCE_SERIALIZE;
+                break;
+        default:
+                return 1;
+        }
+
+        return 0;
+}
+
 static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 {
         struct vcpu_svm *svm = to_svm(vcpu);
@@ -3935,9 +3964,6 @@ static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 
                 msr_info->data = svm->spec_ctrl;
                 break;
-        case MSR_IA32_UCODE_REV:
-                msr_info->data = 0x01000065;
-                break;
         case MSR_F15H_IC_CFG: {
 
                 int family, model;
@@ -3955,6 +3981,9 @@ static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                         msr_info->data = 0x1E;
                 }
                 break;
+        case MSR_F10H_DECFG:
+                msr_info->data = svm->msr_decfg;
+                break;
         default:
                 return kvm_get_msr_common(vcpu, msr_info);
         }
@@ -4133,6 +4162,24 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
         case MSR_VM_IGNNE:
                 vcpu_unimpl(vcpu, "unimplemented wrmsr: 0x%x data 0x%llx\n", ecx, data);
                 break;
+        case MSR_F10H_DECFG: {
+                struct kvm_msr_entry msr_entry;
+
+                msr_entry.index = msr->index;
+                if (svm_get_msr_feature(&msr_entry))
+                        return 1;
+
+                /* Check the supported bits */
+                if (data & ~msr_entry.data)
+                        return 1;
+
+                /* Don't allow the guest to change a bit, #GP */
+                if (!msr->host_initiated && (data ^ msr_entry.data))
+                        return 1;
+
+                svm->msr_decfg = data;
+                break;
+        }
         case MSR_IA32_APICBASE:
                 if (kvm_vcpu_apicv_active(vcpu))
                         avic_update_vapic_bar(to_svm(vcpu), data);
@@ -4541,7 +4588,7 @@ static int (*const svm_exit_handlers[])(struct vcpu_svm *svm) = {
         [SVM_EXIT_MWAIT]                        = mwait_interception,
         [SVM_EXIT_XSETBV]                       = xsetbv_interception,
         [SVM_EXIT_NPF]                          = npf_interception,
-        [SVM_EXIT_RSM]                          = emulate_on_interception,
+        [SVM_EXIT_RSM]                          = rsm_interception,
         [SVM_EXIT_AVIC_INCOMPLETE_IPI]          = avic_incomplete_ipi_interception,
         [SVM_EXIT_AVIC_UNACCELERATED_ACCESS]    = avic_unaccelerated_access_interception,
 };
@@ -5355,7 +5402,7 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
          * being speculatively taken.
          */
         if (svm->spec_ctrl)
-                wrmsrl(MSR_IA32_SPEC_CTRL, svm->spec_ctrl);
+                native_wrmsrl(MSR_IA32_SPEC_CTRL, svm->spec_ctrl);
 
         asm volatile (
                 "push %%" _ASM_BP "; \n\t"
@@ -5464,11 +5511,11 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
          * If the L02 MSR bitmap does not intercept the MSR, then we need to
          * save it.
          */
-        if (!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL))
-                rdmsrl(MSR_IA32_SPEC_CTRL, svm->spec_ctrl);
+        if (unlikely(!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL)))
+                svm->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL);
 
         if (svm->spec_ctrl)
-                wrmsrl(MSR_IA32_SPEC_CTRL, 0);
+                native_wrmsrl(MSR_IA32_SPEC_CTRL, 0);
 
         /* Eliminate branch target predictions from guest mode */
         vmexit_fill_RSB();
@@ -6236,16 +6283,18 @@ e_free:
 
 static int sev_launch_measure(struct kvm *kvm, struct kvm_sev_cmd *argp)
 {
+        void __user *measure = (void __user *)(uintptr_t)argp->data;
         struct kvm_sev_info *sev = &kvm->arch.sev_info;
         struct sev_data_launch_measure *data;
         struct kvm_sev_launch_measure params;
+        void __user *p = NULL;
         void *blob = NULL;
         int ret;
 
         if (!sev_guest(kvm))
                 return -ENOTTY;
 
-        if (copy_from_user(&params, (void __user *)(uintptr_t)argp->data, sizeof(params)))
+        if (copy_from_user(&params, measure, sizeof(params)))
                 return -EFAULT;
 
         data = kzalloc(sizeof(*data), GFP_KERNEL);
@@ -6256,17 +6305,13 @@ static int sev_launch_measure(struct kvm *kvm, struct kvm_sev_cmd *argp)
         if (!params.len)
                 goto cmd;
 
-        if (params.uaddr) {
+        p = (void __user *)(uintptr_t)params.uaddr;
+        if (p) {
                 if (params.len > SEV_FW_BLOB_MAX_SIZE) {
                         ret = -EINVAL;
                         goto e_free;
                 }
 
-                if (!access_ok(VERIFY_WRITE, params.uaddr, params.len)) {
-                        ret = -EFAULT;
-                        goto e_free;
-                }
-
                 ret = -ENOMEM;
                 blob = kmalloc(params.len, GFP_KERNEL);
                 if (!blob)
@@ -6290,13 +6335,13 @@ cmd:
                 goto e_free_blob;
 
         if (blob) {
-                if (copy_to_user((void __user *)(uintptr_t)params.uaddr, blob, params.len))
+                if (copy_to_user(p, blob, params.len))
                         ret = -EFAULT;
         }
 
 done:
         params.len = data->len;
-        if (copy_to_user((void __user *)(uintptr_t)argp->data, &params, sizeof(params)))
+        if (copy_to_user(measure, &params, sizeof(params)))
                 ret = -EFAULT;
 e_free_blob:
         kfree(blob);
@@ -6597,7 +6642,7 @@ static int sev_launch_secret(struct kvm *kvm, struct kvm_sev_cmd *argp)
         struct page **pages;
         void *blob, *hdr;
         unsigned long n;
-        int ret;
+        int ret, offset;
 
         if (!sev_guest(kvm))
                 return -ENOTTY;
@@ -6623,6 +6668,10 @@ static int sev_launch_secret(struct kvm *kvm, struct kvm_sev_cmd *argp)
         if (!data)
                 goto e_unpin_memory;
 
+        offset = params.guest_uaddr & (PAGE_SIZE - 1);
+        data->guest_address = __sme_page_pa(pages[0]) + offset;
+        data->guest_len = params.guest_len;
+
         blob = psp_copy_user_blob(params.trans_uaddr, params.trans_len);
         if (IS_ERR(blob)) {
                 ret = PTR_ERR(blob);
@@ -6637,8 +6686,8 @@ static int sev_launch_secret(struct kvm *kvm, struct kvm_sev_cmd *argp)
                 ret = PTR_ERR(hdr);
                 goto e_free_blob;
         }
-        data->trans_address = __psp_pa(blob);
-        data->trans_len = params.trans_len;
+        data->hdr_address = __psp_pa(hdr);
+        data->hdr_len = params.hdr_len;
 
         data->handle = sev->handle;
         ret = sev_issue_cmd(kvm, SEV_CMD_LAUNCH_UPDATE_SECRET, data, &argp->error);
@@ -6821,6 +6870,7 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = {
         .vcpu_unblocking = svm_vcpu_unblocking,
 
         .update_bp_intercept = update_bp_intercept,
+        .get_msr_feature = svm_get_msr_feature,
         .get_msr = svm_get_msr,
         .set_msr = svm_set_msr,
         .get_segment_base = svm_get_segment_base,
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 3dec126aa302..051dab74e4e9 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -51,6 +51,7 @@
 #include <asm/apic.h>
 #include <asm/irq_remapping.h>
 #include <asm/mmu_context.h>
+#include <asm/microcode.h>
 #include <asm/nospec-branch.h>
 
 #include "trace.h"
@@ -3226,6 +3227,11 @@ static inline bool vmx_feature_control_msr_valid(struct kvm_vcpu *vcpu,
         return !(val & ~valid_bits);
 }
 
+static int vmx_get_msr_feature(struct kvm_msr_entry *msr)
+{
+        return 1;
+}
+
 /*
  * Reads an msr value (of 'msr_index') into 'pdata'.
  * Returns 0 on success, non-0 otherwise.
@@ -4485,7 +4491,8 @@ static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
                 vmcs_set_bits(SECONDARY_VM_EXEC_CONTROL,
                               SECONDARY_EXEC_DESC);
                 hw_cr4 &= ~X86_CR4_UMIP;
-        } else
+        } else if (!is_guest_mode(vcpu) ||
+                   !nested_cpu_has2(get_vmcs12(vcpu), SECONDARY_EXEC_DESC))
                 vmcs_clear_bits(SECONDARY_VM_EXEC_CONTROL,
                                 SECONDARY_EXEC_DESC);
 
@@ -5765,6 +5772,7 @@ static void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
         vmx->rmode.vm86_active = 0;
         vmx->spec_ctrl = 0;
 
+        vcpu->arch.microcode_version = 0x100000000ULL;
         vmx->vcpu.arch.regs[VCPU_REGS_RDX] = get_rdx_init_val();
         kvm_set_cr8(vcpu, 0);
 
@@ -9452,7 +9460,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
          * being speculatively taken.
          */
         if (vmx->spec_ctrl)
-                wrmsrl(MSR_IA32_SPEC_CTRL, vmx->spec_ctrl);
+                native_wrmsrl(MSR_IA32_SPEC_CTRL, vmx->spec_ctrl);
 
         vmx->__launched = vmx->loaded_vmcs->launched;
         asm(
@@ -9587,11 +9595,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
          * If the L02 MSR bitmap does not intercept the MSR, then we need to
          * save it.
          */
-        if (!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL))
-                rdmsrl(MSR_IA32_SPEC_CTRL, vmx->spec_ctrl);
+        if (unlikely(!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL)))
+                vmx->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL);
 
         if (vmx->spec_ctrl)
-                wrmsrl(MSR_IA32_SPEC_CTRL, 0);
+                native_wrmsrl(MSR_IA32_SPEC_CTRL, 0);
 
         /* Eliminate branch target predictions from guest mode */
         vmexit_fill_RSB();
@@ -11199,7 +11207,12 @@ static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch)
         if (ret)
                 return ret;
 
-        if (vmcs12->guest_activity_state == GUEST_ACTIVITY_HLT)
+        /*
+         * If we're entering a halted L2 vcpu and the L2 vcpu won't be woken
+         * by event injection, halt vcpu.
+         */
+        if ((vmcs12->guest_activity_state == GUEST_ACTIVITY_HLT) &&
+            !(vmcs12->vm_entry_intr_info_field & INTR_INFO_VALID_MASK))
                 return kvm_vcpu_halt(vcpu);
 
         vmx->nested.nested_run_pending = 1;
@@ -12290,6 +12303,7 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = {
         .vcpu_put = vmx_vcpu_put,
 
         .update_bp_intercept = update_exception_bitmap,
+        .get_msr_feature = vmx_get_msr_feature,
         .get_msr = vmx_get_msr,
         .set_msr = vmx_set_msr,
         .get_segment_base = vmx_get_segment_base,
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index c8a0b545ac20..18b5ca7a3197 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1049,6 +1049,45 @@ static u32 emulated_msrs[] = {
 
 static unsigned num_emulated_msrs;
 
+/*
+ * List of msr numbers which are used to expose MSR-based features that
+ * can be used by a hypervisor to validate requested CPU features.
+ */
+static u32 msr_based_features[] = {
+        MSR_F10H_DECFG,
+        MSR_IA32_UCODE_REV,
+};
+
+static unsigned int num_msr_based_features;
+
+static int kvm_get_msr_feature(struct kvm_msr_entry *msr)
+{
+        switch (msr->index) {
+        case MSR_IA32_UCODE_REV:
+                rdmsrl(msr->index, msr->data);
+                break;
+        default:
+                if (kvm_x86_ops->get_msr_feature(msr))
+                        return 1;
+        }
+        return 0;
+}
+
+static int do_get_msr_feature(struct kvm_vcpu *vcpu, unsigned index, u64 *data)
+{
+        struct kvm_msr_entry msr;
+        int r;
+
+        msr.index = index;
+        r = kvm_get_msr_feature(&msr);
+        if (r)
+                return r;
+
+        *data = msr.data;
+
+        return 0;
+}
+
 bool kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer)
 {
         if (efer & efer_reserved_bits)
@@ -2222,7 +2261,6 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 
         switch (msr) {
         case MSR_AMD64_NB_CFG:
-        case MSR_IA32_UCODE_REV:
         case MSR_IA32_UCODE_WRITE:
         case MSR_VM_HSAVE_PA:
         case MSR_AMD64_PATCH_LOADER:
@@ -2230,6 +2268,10 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
         case MSR_AMD64_DC_CFG:
                 break;
 
+        case MSR_IA32_UCODE_REV:
+                if (msr_info->host_initiated)
+                        vcpu->arch.microcode_version = data;
+                break;
         case MSR_EFER:
                 return set_efer(vcpu, data);
         case MSR_K7_HWCR:
@@ -2525,7 +2567,7 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                 msr_info->data = 0;
                 break;
         case MSR_IA32_UCODE_REV:
-                msr_info->data = 0x100000000ULL;
+                msr_info->data = vcpu->arch.microcode_version;
                 break;
         case MSR_MTRRcap:
         case 0x200 ... 0x2ff:
@@ -2680,13 +2722,11 @@ static int __msr_io(struct kvm_vcpu *vcpu, struct kvm_msrs *msrs,
                     int (*do_msr)(struct kvm_vcpu *vcpu,
                                   unsigned index, u64 *data))
 {
-        int i, idx;
+        int i;
 
-        idx = srcu_read_lock(&vcpu->kvm->srcu);
         for (i = 0; i < msrs->nmsrs; ++i)
                 if (do_msr(vcpu, entries[i].index, &entries[i].data))
                         break;
-        srcu_read_unlock(&vcpu->kvm->srcu, idx);
 
         return i;
 }
@@ -2785,6 +2825,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
         case KVM_CAP_SET_BOOT_CPU_ID:
         case KVM_CAP_SPLIT_IRQCHIP:
         case KVM_CAP_IMMEDIATE_EXIT:
+        case KVM_CAP_GET_MSR_FEATURES:
                 r = 1;
                 break;
         case KVM_CAP_ADJUST_CLOCK:
@@ -2899,6 +2940,31 @@ long kvm_arch_dev_ioctl(struct file *filp,
                         goto out;
                 r = 0;
                 break;
+        case KVM_GET_MSR_FEATURE_INDEX_LIST: {
+                struct kvm_msr_list __user *user_msr_list = argp;
+                struct kvm_msr_list msr_list;
+                unsigned int n;
+
+                r = -EFAULT;
+                if (copy_from_user(&msr_list, user_msr_list, sizeof(msr_list)))
+                        goto out;
+                n = msr_list.nmsrs;
+                msr_list.nmsrs = num_msr_based_features;
+                if (copy_to_user(user_msr_list, &msr_list, sizeof(msr_list)))
+                        goto out;
+                r = -E2BIG;
+                if (n < msr_list.nmsrs)
+                        goto out;
+                r = -EFAULT;
+                if (copy_to_user(user_msr_list->indices, &msr_based_features,
+                                 num_msr_based_features * sizeof(u32)))
+                        goto out;
+                r = 0;
+                break;
+        }
+        case KVM_GET_MSRS:
+                r = msr_io(NULL, argp, do_get_msr_feature, 1);
+                break;
         }
         default:
                 r = -EINVAL;
@@ -3636,12 +3702,18 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
                 r = 0;
                 break;
         }
-        case KVM_GET_MSRS:
+        case KVM_GET_MSRS: {
+                int idx = srcu_read_lock(&vcpu->kvm->srcu);
                 r = msr_io(vcpu, argp, do_get_msr, 1);
+                srcu_read_unlock(&vcpu->kvm->srcu, idx);
                 break;
-        case KVM_SET_MSRS:
+        }
+        case KVM_SET_MSRS: {
+                int idx = srcu_read_lock(&vcpu->kvm->srcu);
                 r = msr_io(vcpu, argp, do_set_msr, 0);
+                srcu_read_unlock(&vcpu->kvm->srcu, idx);
                 break;
+        }
         case KVM_TPR_ACCESS_REPORTING: {
                 struct kvm_tpr_access_ctl tac;
 
@@ -4464,6 +4536,19 @@ static void kvm_init_msr_list(void)
                 j++;
         }
         num_emulated_msrs = j;
+
+        for (i = j = 0; i < ARRAY_SIZE(msr_based_features); i++) {
+                struct kvm_msr_entry msr;
+
+                msr.index = msr_based_features[i];
+                if (kvm_get_msr_feature(&msr))
+                        continue;
+
+                if (j < i)
+                        msr_based_features[j] = msr_based_features[i];
+                j++;
+        }
+        num_msr_based_features = j;
 }
 
 static int vcpu_mmio_write(struct kvm_vcpu *vcpu, gpa_t addr, int len,
@@ -8017,6 +8102,8 @@ void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu)
 
 void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
 {
+        kvm_lapic_reset(vcpu, init_event);
+
         vcpu->arch.hflags = 0;
 
         vcpu->arch.smi_pending = 0;
@@ -8460,10 +8547,8 @@ int __x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size)
                         return r;
         }
 
-        if (!size) {
-                r = vm_munmap(old.userspace_addr, old.npages * PAGE_SIZE);
-                WARN_ON(r < 0);
-        }
+        if (!size)
+                vm_munmap(old.userspace_addr, old.npages * PAGE_SIZE);
 
         return 0;
 }
diff --git a/arch/x86/lib/Makefile b/arch/x86/lib/Makefile
index 91e9700cc6dc..25a972c61b0a 100644
--- a/arch/x86/lib/Makefile
+++ b/arch/x86/lib/Makefile
@@ -28,7 +28,6 @@ lib-$(CONFIG_INSTRUCTION_DECODER) += insn.o inat.o insn-eval.o
 lib-$(CONFIG_RANDOMIZE_BASE) += kaslr.o
 lib-$(CONFIG_FUNCTION_ERROR_INJECTION)  += error-inject.o
 lib-$(CONFIG_RETPOLINE) += retpoline.o
-OBJECT_FILES_NON_STANDARD_retpoline.o :=y
 
 obj-y += msr.o msr-reg.o msr-reg-export.o hweight.o
 
diff --git a/arch/x86/lib/retpoline.S b/arch/x86/lib/retpoline.S
index 480edc3a5e03..c909961e678a 100644
--- a/arch/x86/lib/retpoline.S
+++ b/arch/x86/lib/retpoline.S
@@ -7,7 +7,6 @@
 #include <asm/alternative-asm.h>
 #include <asm/export.h>
 #include <asm/nospec-branch.h>
-#include <asm/bitsperlong.h>
 
 .macro THUNK reg
         .section .text.__x86.indirect_thunk
@@ -47,58 +46,3 @@ GENERATE_THUNK(r13)
 GENERATE_THUNK(r14)
 GENERATE_THUNK(r15)
 #endif
-
-/*
- * Fill the CPU return stack buffer.
- *
- * Each entry in the RSB, if used for a speculative 'ret', contains an
- * infinite 'pause; lfence; jmp' loop to capture speculative execution.
- *
- * This is required in various cases for retpoline and IBRS-based
- * mitigations for the Spectre variant 2 vulnerability. Sometimes to
- * eliminate potentially bogus entries from the RSB, and sometimes
- * purely to ensure that it doesn't get empty, which on some CPUs would
- * allow predictions from other (unwanted!) sources to be used.
- *
- * Google experimented with loop-unrolling and this turned out to be
- * the optimal version - two calls, each with their own speculation
- * trap should their return address end up getting used, in a loop.
- */
-.macro STUFF_RSB nr:req sp:req
-        mov     $(\nr / 2), %_ASM_BX
-        .align 16
-771:
-        call    772f
-773:                                            /* speculation trap */
-        pause
-        lfence
-        jmp     773b
-        .align 16
-772:
-        call    774f
-775:                                            /* speculation trap */
-        pause
-        lfence
-        jmp     775b
-        .align 16
-774:
-        dec     %_ASM_BX
-        jnz     771b
-        add     $((BITS_PER_LONG/8) * \nr), \sp
-.endm
-
-#define RSB_FILL_LOOPS          16      /* To avoid underflow */
-
-ENTRY(__fill_rsb)
-        STUFF_RSB RSB_FILL_LOOPS, %_ASM_SP
-        ret
-END(__fill_rsb)
-EXPORT_SYMBOL_GPL(__fill_rsb)
-
-#define RSB_CLEAR_LOOPS         32      /* To forcibly overwrite all entries */
-
-ENTRY(__clear_rsb)
-        STUFF_RSB RSB_CLEAR_LOOPS, %_ASM_SP
-        ret
-END(__clear_rsb)
-EXPORT_SYMBOL_GPL(__clear_rsb)
diff --git a/arch/x86/mm/cpu_entry_area.c b/arch/x86/mm/cpu_entry_area.c
index b9283cc27622..476d810639a8 100644
--- a/arch/x86/mm/cpu_entry_area.c
+++ b/arch/x86/mm/cpu_entry_area.c
@@ -163,4 +163,10 @@ void __init setup_cpu_entry_areas(void)
 
         for_each_possible_cpu(cpu)
                 setup_cpu_entry_area(cpu);
+
+        /*
+         * This is the last essential update to swapper_pgdir which needs
+         * to be synchronized to initial_page_table on 32bit.
+         */
+        sync_initial_page_table();
 }
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 800de815519c..25a30b5d6582 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -330,7 +330,7 @@ static noinline int vmalloc_fault(unsigned long address)
         if (!pmd_k)
                 return -1;
 
-        if (pmd_huge(*pmd_k))
+        if (pmd_large(*pmd_k))
                 return 0;
 
         pte_k = pte_offset_kernel(pmd_k, address);
@@ -475,7 +475,7 @@ static noinline int vmalloc_fault(unsigned long address)
         if (pud_none(*pud) || pud_pfn(*pud) != pud_pfn(*pud_ref))
                 BUG();
 
-        if (pud_huge(*pud))
+        if (pud_large(*pud))
                 return 0;
 
         pmd = pmd_offset(pud, address);
@@ -486,7 +486,7 @@ static noinline int vmalloc_fault(unsigned long address)
         if (pmd_none(*pmd) || pmd_pfn(*pmd) != pmd_pfn(*pmd_ref))
                 BUG();
 
-        if (pmd_huge(*pmd))
+        if (pmd_large(*pmd))
                 return 0;
 
         pte_ref = pte_offset_kernel(pmd_ref, address);
@@ -1248,10 +1248,6 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code,
         tsk = current;
         mm = tsk->mm;
 
-        /*
-         * Detect and handle instructions that would cause a page fault for
-         * both a tracked kernel page and a userspace page.
-         */
         prefetchw(&mm->mmap_sem);
 
         if (unlikely(kmmio_fault(regs, address)))
diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
index 79cb066f40c0..396e1f0151ac 100644
--- a/arch/x86/mm/init_32.c
+++ b/arch/x86/mm/init_32.c
@@ -453,6 +453,21 @@ static inline void permanent_kmaps_init(pgd_t *pgd_base)
 }
 #endif /* CONFIG_HIGHMEM */
 
+void __init sync_initial_page_table(void)
+{
+        clone_pgd_range(initial_page_table + KERNEL_PGD_BOUNDARY,
+                        swapper_pg_dir     + KERNEL_PGD_BOUNDARY,
+                        KERNEL_PGD_PTRS);
+
+        /*
+         * sync back low identity map too.  It is used for example
+         * in the 32-bit EFI stub.
+         */
+        clone_pgd_range(initial_page_table,
+                        swapper_pg_dir     + KERNEL_PGD_BOUNDARY,
+                        min(KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
+}
+
 void __init native_pagetable_init(void)
 {
         unsigned long pfn, va;
diff --git a/arch/x86/mm/mem_encrypt_boot.S b/arch/x86/mm/mem_encrypt_boot.S
index 01f682cf77a8..40a6085063d6 100644
--- a/arch/x86/mm/mem_encrypt_boot.S
+++ b/arch/x86/mm/mem_encrypt_boot.S
@@ -15,6 +15,7 @@
 #include <asm/page.h>
 #include <asm/processor-flags.h>
 #include <asm/msr-index.h>
+#include <asm/nospec-branch.h>
 
         .text
         .code64
@@ -59,6 +60,7 @@ ENTRY(sme_encrypt_execute)
         movq    %rax, %r8               /* Workarea encryption routine */
         addq    $PAGE_SIZE, %r8         /* Workarea intermediate copy buffer */
 
+        ANNOTATE_RETPOLINE_SAFE
         call    *%rax                   /* Call the encryption routine */
 
         pop     %r12
diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
index ce38f165489b..631507f0c198 100644
--- a/arch/x86/mm/pti.c
+++ b/arch/x86/mm/pti.c
@@ -332,7 +332,7 @@ static void __init pti_clone_user_shared(void)
 }
 
 /*
- * Clone the ESPFIX P4D into the user space visinble page table
+ * Clone the ESPFIX P4D into the user space visible page table
  */
 static void __init pti_setup_espfix64(void)
 {
diff --git a/arch/x86/platform/intel-mid/intel-mid.c b/arch/x86/platform/intel-mid/intel-mid.c
index 2c67bae6bb53..fb1df9488e98 100644
--- a/arch/x86/platform/intel-mid/intel-mid.c
+++ b/arch/x86/platform/intel-mid/intel-mid.c
@@ -79,7 +79,7 @@ static void intel_mid_power_off(void)
 
 static void intel_mid_reboot(void)
 {
-        intel_scu_ipc_simple_command(IPCMSG_COLD_BOOT, 0);
+        intel_scu_ipc_simple_command(IPCMSG_COLD_RESET, 0);
 }
 
 static unsigned long __init intel_mid_calibrate_tsc(void)
diff --git a/arch/x86/realmode/rm/trampoline_64.S b/arch/x86/realmode/rm/trampoline_64.S
index de53bd15df5a..24bb7598774e 100644
--- a/arch/x86/realmode/rm/trampoline_64.S
+++ b/arch/x86/realmode/rm/trampoline_64.S
@@ -102,7 +102,7 @@ ENTRY(startup_32)
          * don't we'll eventually crash trying to execute encrypted
          * instructions.
          */
-        bt      $TH_FLAGS_SME_ACTIVE_BIT, pa_tr_flags
+        btl     $TH_FLAGS_SME_ACTIVE_BIT, pa_tr_flags
         jnc     .Ldone
         movl    $MSR_K8_SYSCFG, %ecx
         rdmsr
diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
index c047f42552e1..3c2c2530737e 100644
--- a/arch/x86/xen/enlighten_pv.c
+++ b/arch/x86/xen/enlighten_pv.c
@@ -1376,8 +1376,6 @@ asmlinkage __visible void __init xen_start_kernel(void)
 
         if (!xen_initial_domain()) {
                 add_preferred_console("xenboot", 0, NULL);
-                add_preferred_console("tty", 0, NULL);
-                add_preferred_console("hvc", 0, NULL);
                 if (pci_xen)
                         x86_init.pci.arch_init = pci_xen_init;
         } else {
@@ -1410,6 +1408,10 @@ asmlinkage __visible void __init xen_start_kernel(void)
 
                 xen_boot_params_init_edd();
         }
+
+        add_preferred_console("tty", 0, NULL);
+        add_preferred_console("hvc", 0, NULL);
+
 #ifdef CONFIG_PCI
         /* PCI BIOS service won't work from a PV guest. */
         pci_probe &= ~PCI_PROBE_BIOS;
diff --git a/arch/x86/xen/suspend.c b/arch/x86/xen/suspend.c
index d9f96cc5d743..1d83152c761b 100644
--- a/arch/x86/xen/suspend.c
+++ b/arch/x86/xen/suspend.c
@@ -1,12 +1,15 @@
 // SPDX-License-Identifier: GPL-2.0
 #include <linux/types.h>
 #include <linux/tick.h>
+#include <linux/percpu-defs.h>
 
 #include <xen/xen.h>
 #include <xen/interface/xen.h>
 #include <xen/grant_table.h>
 #include <xen/events.h>
 
+#include <asm/cpufeatures.h>
+#include <asm/msr-index.h>
 #include <asm/xen/hypercall.h>
 #include <asm/xen/page.h>
 #include <asm/fixmap.h>
@@ -15,6 +18,8 @@
 #include "mmu.h"
 #include "pmu.h"
 
+static DEFINE_PER_CPU(u64, spec_ctrl);
+
 void xen_arch_pre_suspend(void)
 {
         xen_save_time_memory_area();
@@ -35,6 +40,9 @@ void xen_arch_post_suspend(int cancelled)
 
 static void xen_vcpu_notify_restore(void *data)
 {
+        if (xen_pv_domain() && boot_cpu_has(X86_FEATURE_SPEC_CTRL))
+                wrmsrl(MSR_IA32_SPEC_CTRL, this_cpu_read(spec_ctrl));
+
         /* Boot processor notified via generic timekeeping_resume() */
         if (smp_processor_id() == 0)
                 return;
@@ -44,7 +52,15 @@ static void xen_vcpu_notify_restore(void *data)
 
 static void xen_vcpu_notify_suspend(void *data)
 {
+        u64 tmp;
+
         tick_suspend_local();
+
+        if (xen_pv_domain() && boot_cpu_has(X86_FEATURE_SPEC_CTRL)) {
+                rdmsrl(MSR_IA32_SPEC_CTRL, tmp);
+                this_cpu_write(spec_ctrl, tmp);
+                wrmsrl(MSR_IA32_SPEC_CTRL, 0);
+        }
 }
 
 void xen_arch_resume(void)
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 4117524ca45b..c2033a232a44 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -812,7 +812,6 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
         struct gendisk *disk;
         struct request_queue *q;
         struct blkcg_gq *blkg;
-        struct module *owner;
         unsigned int major, minor;
         int key_len, part, ret;
         char *body;
@@ -904,9 +903,7 @@ fail_unlock:
         spin_unlock_irq(q->queue_lock);
         rcu_read_unlock();
 fail:
-        owner = disk->fops->owner;
-        put_disk(disk);
-        module_put(owner);
+        put_disk_and_module(disk);
         /*
          * If queue was bypassing, we should retry.  Do so after a
          * short msleep().  It isn't strictly necessary but queue
@@ -931,13 +928,9 @@ EXPORT_SYMBOL_GPL(blkg_conf_prep);
 void blkg_conf_finish(struct blkg_conf_ctx *ctx)
         __releases(ctx->disk->queue->queue_lock) __releases(rcu)
 {
-        struct module *owner;
-
         spin_unlock_irq(ctx->disk->queue->queue_lock);
         rcu_read_unlock();
-        owner = ctx->disk->fops->owner;
-        put_disk(ctx->disk);
-        module_put(owner);
+        put_disk_and_module(ctx->disk);
 }
 EXPORT_SYMBOL_GPL(blkg_conf_finish);
 
diff --git a/block/blk-core.c b/block/blk-core.c
index 2d1a7bbe0634..6d82c4f7fadd 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -2434,7 +2434,7 @@ blk_qc_t submit_bio(struct bio *bio)
                 unsigned int count;
 
                 if (unlikely(bio_op(bio) == REQ_OP_WRITE_SAME))
-                        count = queue_logical_block_size(bio->bi_disk->queue);
+                        count = queue_logical_block_size(bio->bi_disk->queue) >> 9;
                 else
                         count = bio_sectors(bio);
 
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 357492712b0e..16e83e6df404 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -712,7 +712,6 @@ static void __blk_mq_requeue_request(struct request *rq)
 
         trace_block_rq_requeue(q, rq);
         wbt_requeue(q->rq_wb, &rq->issue_stat);
-        blk_mq_sched_requeue_request(rq);
 
         if (blk_mq_rq_state(rq) != MQ_RQ_IDLE) {
                 blk_mq_rq_update_state(rq, MQ_RQ_IDLE);
@@ -725,6 +724,9 @@ void blk_mq_requeue_request(struct request *rq, bool kick_requeue_list)
 {
         __blk_mq_requeue_request(rq);
 
+        /* this request will be re-inserted to io scheduler queue */
+        blk_mq_sched_requeue_request(rq);
+
         BUG_ON(blk_queued_rq(rq));
         blk_mq_add_to_requeue_list(rq, true, kick_requeue_list);
 }
diff --git a/block/genhd.c b/block/genhd.c
index 88a53c188cb7..9656f9e9f99e 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -547,7 +547,7 @@ static int exact_lock(dev_t devt, void *data)
 {
         struct gendisk *p = data;
 
-        if (!get_disk(p))
+        if (!get_disk_and_module(p))
                 return -1;
         return 0;
 }
@@ -717,6 +717,11 @@ void del_gendisk(struct gendisk *disk)
         blk_integrity_del(disk);
         disk_del_events(disk);
 
+        /*
+         * Block lookups of the disk until all bdevs are unhashed and the
+         * disk is marked as dead (GENHD_FL_UP cleared).
+         */
+        down_write(&disk->lookup_sem);
         /* invalidate stuff */
         disk_part_iter_init(&piter, disk,
                              DISK_PITER_INCL_EMPTY | DISK_PITER_REVERSE);
@@ -731,6 +736,7 @@ void del_gendisk(struct gendisk *disk)
         bdev_unhash_inode(disk_devt(disk));
         set_capacity(disk, 0);
         disk->flags &= ~GENHD_FL_UP;
+        up_write(&disk->lookup_sem);
 
         if (!(disk->flags & GENHD_FL_HIDDEN))
                 sysfs_remove_link(&disk_to_dev(disk)->kobj, "bdi");
@@ -809,16 +815,28 @@ struct gendisk *get_gendisk(dev_t devt, int *partno)
 
                 spin_lock_bh(&ext_devt_lock);
                 part = idr_find(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
-                if (part && get_disk(part_to_disk(part))) {
+                if (part && get_disk_and_module(part_to_disk(part))) {
                         *partno = part->partno;
                         disk = part_to_disk(part);
                 }
                 spin_unlock_bh(&ext_devt_lock);
         }
 
-        if (disk && unlikely(disk->flags & GENHD_FL_HIDDEN)) {
-                put_disk(disk);
+        if (!disk)
+                return NULL;
+
+        /*
+         * Synchronize with del_gendisk() to not return disk that is being
+         * destroyed.
+         */
+        down_read(&disk->lookup_sem);
+        if (unlikely((disk->flags & GENHD_FL_HIDDEN) ||
+                     !(disk->flags & GENHD_FL_UP))) {
+                up_read(&disk->lookup_sem);
+                put_disk_and_module(disk);
                 disk = NULL;
+        } else {
+                up_read(&disk->lookup_sem);
         }
         return disk;
 }
@@ -1418,6 +1436,7 @@ struct gendisk *__alloc_disk_node(int minors, int node_id)
                         kfree(disk);
                         return NULL;
                 }
+                init_rwsem(&disk->lookup_sem);
                 disk->node_id = node_id;
                 if (disk_expand_part_tbl(disk, 0)) {
                         free_part_stats(&disk->part0);
@@ -1453,7 +1472,7 @@ struct gendisk *__alloc_disk_node(int minors, int node_id)
 }
 EXPORT_SYMBOL(__alloc_disk_node);
 
-struct kobject *get_disk(struct gendisk *disk)
+struct kobject *get_disk_and_module(struct gendisk *disk)
 {
         struct module *owner;
         struct kobject *kobj;
@@ -1471,17 +1490,30 @@ struct kobject *get_disk(struct gendisk *disk)
         return kobj;
 
 }
-
-EXPORT_SYMBOL(get_disk);
+EXPORT_SYMBOL(get_disk_and_module);
 
 void put_disk(struct gendisk *disk)
 {
         if (disk)
                 kobject_put(&disk_to_dev(disk)->kobj);
 }
-
 EXPORT_SYMBOL(put_disk);
 
+/*
+ * This is a counterpart of get_disk_and_module() and thus also of
+ * get_gendisk().
+ */
+void put_disk_and_module(struct gendisk *disk)
+{
+        if (disk) {
+                struct module *owner = disk->fops->owner;
+
+                put_disk(disk);
+                module_put(owner);
+        }
+}
+EXPORT_SYMBOL(put_disk_and_module);
+
 static void set_disk_ro_uevent(struct gendisk *gd, int ro)
 {
         char event[] = "DISK_RO=1";
diff --git a/block/ioctl.c b/block/ioctl.c
index 1668506d8ed8..3884d810efd2 100644
--- a/block/ioctl.c
+++ b/block/ioctl.c
@@ -225,7 +225,7 @@ static int blk_ioctl_discard(struct block_device *bdev, fmode_t mode,
 
         if (start + len > i_size_read(bdev->bd_inode))
                 return -EINVAL;
-        truncate_inode_pages_range(mapping, start, start + len);
+        truncate_inode_pages_range(mapping, start, start + len - 1);
         return blkdev_issue_discard(bdev, start >> 9, len >> 9,
                                     GFP_KERNEL, flags);
 }
diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c
index f95c60774ce8..0d6d25e32e1f 100644
--- a/block/kyber-iosched.c
+++ b/block/kyber-iosched.c
@@ -833,6 +833,7 @@ static struct elevator_type kyber_sched = {
                 .limit_depth = kyber_limit_depth,
                 .prepare_request = kyber_prepare_request,
                 .finish_request = kyber_finish_request,
+                .requeue_request = kyber_finish_request,
                 .completed_request = kyber_completed_request,
                 .dispatch_request = kyber_dispatch_request,
                 .has_work = kyber_has_work,
diff --git a/block/mq-deadline.c b/block/mq-deadline.c
index c56f211c8440..8ec0ba9f5386 100644
--- a/block/mq-deadline.c
+++ b/block/mq-deadline.c
@@ -536,12 +536,21 @@ static void dd_insert_requests(struct blk_mq_hw_ctx *hctx,
 }
 
 /*
+ * Nothing to do here. This is defined only to ensure that .finish_request
+ * method is called upon request completion.
+ */
+static void dd_prepare_request(struct request *rq, struct bio *bio)
+{
+}
+
+/*
  * For zoned block devices, write unlock the target zone of
  * completed write requests. Do this while holding the zone lock
  * spinlock so that the zone is never unlocked while deadline_fifo_request()
- * while deadline_next_request() are executing.
+ * or deadline_next_request() are executing. This function is called for
+ * all requests, whether or not these requests complete successfully.
  */
-static void dd_completed_request(struct request *rq)
+static void dd_finish_request(struct request *rq)
 {
         struct request_queue *q = rq->q;
 
@@ -756,7 +765,8 @@ static struct elevator_type mq_deadline = {
         .ops.mq = {
                 .insert_requests        = dd_insert_requests,
                 .dispatch_request       = dd_dispatch_request,
-                .completed_request      = dd_completed_request,
+                .prepare_request        = dd_prepare_request,
+                .finish_request         = dd_finish_request,
                 .next_request           = elv_rb_latter_request,
                 .former_request         = elv_rb_former_request,
                 .bio_merge              = dd_bio_merge,
diff --git a/block/partition-generic.c b/block/partition-generic.c
index 91622db9aedf..08dabcd8b6ae 100644
--- a/block/partition-generic.c
+++ b/block/partition-generic.c
@@ -51,6 +51,12 @@ const char *bdevname(struct block_device *bdev, char *buf)
 
 EXPORT_SYMBOL(bdevname);
 
+const char *bio_devname(struct bio *bio, char *buf)
+{
+        return disk_name(bio->bi_disk, bio->bi_partno, buf);
+}
+EXPORT_SYMBOL(bio_devname);
+
 /*
  * There's very little reason to use this, you should really
  * have a struct block_device just about everywhere and use
diff --git a/drivers/auxdisplay/img-ascii-lcd.c b/drivers/auxdisplay/img-ascii-lcd.c
index 9180b9bd5821..834509506ef6 100644
--- a/drivers/auxdisplay/img-ascii-lcd.c
+++ b/drivers/auxdisplay/img-ascii-lcd.c
@@ -97,7 +97,7 @@ static struct img_ascii_lcd_config boston_config = {
 static void malta_update(struct img_ascii_lcd_ctx *ctx)
 {
         unsigned int i;
-        int err;
+        int err = 0;
 
         for (i = 0; i < ctx->cfg->num_chars; i++) {
                 err = regmap_write(ctx->regmap,
@@ -180,7 +180,7 @@ static int sead3_wait_lcd_idle(struct img_ascii_lcd_ctx *ctx)
 static void sead3_update(struct img_ascii_lcd_ctx *ctx)
 {
         unsigned int i;
-        int err;
+        int err = 0;
 
         for (i = 0; i < ctx->cfg->num_chars; i++) {
                 err = sead3_wait_lcd_idle(ctx);
@@ -224,7 +224,7 @@ MODULE_DEVICE_TABLE(of, img_ascii_lcd_matches);
 
 /**
  * img_ascii_lcd_scroll() - scroll the display by a character
- * @arg: really a pointer to the private data structure
+ * @t: really a pointer to the private data structure
  *
  * Scroll the current message along the LCD by one character, rearming the
  * timer if required.
diff --git a/drivers/auxdisplay/panel.c b/drivers/auxdisplay/panel.c
index ea7869c0d7f9..ec5e8800f8ad 100644
--- a/drivers/auxdisplay/panel.c
+++ b/drivers/auxdisplay/panel.c
@@ -1372,7 +1372,7 @@ static void panel_process_inputs(void)
                                 break;
                         input->rise_timer = 0;
                         input->state = INPUT_ST_RISING;
-                        /* no break here, fall through */
+                        /* fall through */
                 case INPUT_ST_RISING:
                         if ((phys_curr & input->mask) != input->value) {
                                 input->state = INPUT_ST_LOW;
@@ -1385,11 +1385,11 @@ static void panel_process_inputs(void)
                         }
                         input->high_timer = 0;
                         input->state = INPUT_ST_HIGH;
-                        /* no break here, fall through */
+                        /* fall through */
                 case INPUT_ST_HIGH:
                         if (input_state_high(input))
                                 break;
-                        /* no break here, fall through */
+                        /* fall through */
                 case INPUT_ST_FALLING:
                         input_state_falling(input);
                 }
diff --git a/drivers/block/amiflop.c b/drivers/block/amiflop.c
index e5aa62fcf5a8..3aaf6af3ec23 100644
--- a/drivers/block/amiflop.c
+++ b/drivers/block/amiflop.c
@@ -1758,7 +1758,7 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
         if (unit[drive].type->code == FD_NODRIVE)
                 return NULL;
         *part = 0;
-        return get_disk(unit[drive].gendisk);
+        return get_disk_and_module(unit[drive].gendisk);
 }
 
 static int __init amiga_floppy_probe(struct platform_device *pdev)
diff --git a/drivers/block/ataflop.c b/drivers/block/ataflop.c
index 8bc3b9fd8dd2..dfb2c2622e5a 100644
--- a/drivers/block/ataflop.c
+++ b/drivers/block/ataflop.c
@@ -1917,7 +1917,7 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
         if (drive >= FD_MAX_UNITS || type > NUM_DISK_MINORS)
                 return NULL;
         *part = 0;
-        return get_disk(unit[drive].disk);
+        return get_disk_and_module(unit[drive].disk);
 }
 
 static int __init atari_floppy_init (void)
diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index 8028a3a7e7fd..deea78e485da 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -456,7 +456,7 @@ static struct kobject *brd_probe(dev_t dev, int *part, void *data)
 
         mutex_lock(&brd_devices_mutex);
         brd = brd_init_one(MINOR(dev) / max_part, &new);
-        kobj = brd ? get_disk(brd->brd_disk) : NULL;
+        kobj = brd ? get_disk_and_module(brd->brd_disk) : NULL;
         mutex_unlock(&brd_devices_mutex);
 
         if (new)
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index eae484acfbbc..8ec7235fc93b 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -4505,7 +4505,7 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
         if (((*part >> 2) & 0x1f) >= ARRAY_SIZE(floppy_type))
                 return NULL;
         *part = 0;
-        return get_disk(disks[drive]);
+        return get_disk_and_module(disks[drive]);
 }
 
 static int __init do_floppy_init(void)
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index d5fe720cf149..ee62d2d517bf 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -266,7 +266,7 @@ static int lo_write_bvec(struct file *file, struct bio_vec *bvec, loff_t *ppos)
         struct iov_iter i;
         ssize_t bw;
 
-        iov_iter_bvec(&i, ITER_BVEC, bvec, 1, bvec->bv_len);
+        iov_iter_bvec(&i, ITER_BVEC | WRITE, bvec, 1, bvec->bv_len);
 
         file_start_write(file);
         bw = vfs_iter_write(file, &i, ppos, 0);
@@ -1922,7 +1922,7 @@ static struct kobject *loop_probe(dev_t dev, int *part, void *data)
         if (err < 0)
                 kobj = NULL;
         else
-                kobj = get_disk(lo->lo_disk);
+                kobj = get_disk_and_module(lo->lo_disk);
         mutex_unlock(&loop_index_mutex);
 
         *part = 0;
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 5f2a4240a204..86258b00a1d4 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1591,7 +1591,7 @@ again:
                         if (new_index < 0) {
                                 mutex_unlock(&nbd_index_mutex);
                                 printk(KERN_ERR "nbd: failed to add new device\n");
-                                return ret;
+                                return new_index;
                         }
                         nbd = idr_find(&nbd_index_idr, new_index);
                 }
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index 531a0915066b..c61d20c9f3f8 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -1122,7 +1122,7 @@ static int pkt_start_recovery(struct packet_data *pkt)
         pkt->sector = new_sector;
 
         bio_reset(pkt->bio);
-        bio_set_set(pkt->bio, pd->bdev);
+        bio_set_dev(pkt->bio, pd->bdev);
         bio_set_op_attrs(pkt->bio, REQ_OP_WRITE, 0);
         pkt->bio->bi_iter.bi_sector = new_sector;
         pkt->bio->bi_iter.bi_size = pkt->frames * CD_FRAMESIZE;
diff --git a/drivers/block/swim.c b/drivers/block/swim.c
index 84434d3ea19b..64e066eba72e 100644
--- a/drivers/block/swim.c
+++ b/drivers/block/swim.c
@@ -799,7 +799,7 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
                 return NULL;
 
         *part = 0;
-        return get_disk(swd->unit[drive].disk);
+        return get_disk_and_module(swd->unit[drive].disk);
 }
 
 static int swim_add_floppy(struct swim_priv *swd, enum drive_location location)
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index e126e4cac2ca..92ec1bbece51 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -262,6 +262,7 @@ static DEFINE_SPINLOCK(minor_lock);
 
 static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo);
 static void blkfront_gather_backend_features(struct blkfront_info *info);
+static int negotiate_mq(struct blkfront_info *info);
 
 static int get_id_from_freelist(struct blkfront_ring_info *rinfo)
 {
@@ -1774,11 +1775,18 @@ static int talk_to_blkback(struct xenbus_device *dev,
         unsigned int i, max_page_order;
         unsigned int ring_page_order;
 
+        if (!info)
+                return -ENODEV;
+
         max_page_order = xenbus_read_unsigned(info->xbdev->otherend,
                                               "max-ring-page-order", 0);
         ring_page_order = min(xen_blkif_max_ring_order, max_page_order);
         info->nr_ring_pages = 1 << ring_page_order;
 
+        err = negotiate_mq(info);
+        if (err)
+                goto destroy_blkring;
+
         for (i = 0; i < info->nr_rings; i++) {
                 struct blkfront_ring_info *rinfo = &info->rinfo[i];
 
@@ -1978,11 +1986,6 @@ static int blkfront_probe(struct xenbus_device *dev,
         }
 
         info->xbdev = dev;
-        err = negotiate_mq(info);
-        if (err) {
-                kfree(info);
-                return err;
-        }
 
         mutex_init(&info->mutex);
         info->vdevice = vdevice;
@@ -2099,10 +2102,6 @@ static int blkfront_resume(struct xenbus_device *dev)
 
         blkif_free(info, info->connected == BLKIF_STATE_CONNECTED);
 
-        err = negotiate_mq(info);
-        if (err)
-                return err;
-
         err = talk_to_blkback(dev, info);
         if (!err)
                 blk_mq_update_nr_hw_queues(&info->tag_set, info->nr_rings);
diff --git a/drivers/block/z2ram.c b/drivers/block/z2ram.c
index 41c95c9b2ab4..8f9130ab5887 100644
--- a/drivers/block/z2ram.c
+++ b/drivers/block/z2ram.c
@@ -332,7 +332,7 @@ static const struct block_device_operations z2_fops =
 static struct kobject *z2_find(dev_t dev, int *part, void *data)
 {
         *part = 0;
-        return get_disk(z2ram_gendisk);
+        return get_disk_and_module(z2ram_gendisk);
 }
 
 static struct request_queue *z2_queue;
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 2a55380ad730..60bf04b8f103 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -21,6 +21,7 @@
  *
  */
 
+#include <linux/dmi.h>
 #include <linux/module.h>
 #include <linux/usb.h>
 #include <linux/usb/quirks.h>
@@ -379,6 +380,21 @@ static const struct usb_device_id blacklist_table[] = {
         { }     /* Terminating entry */
 };
 
+/* The Bluetooth USB module build into some devices needs to be reset on resume,
+ * this is a problem with the platform (likely shutting off all power) not with
+ * the module itself. So we use a DMI list to match known broken platforms.
+ */
+static const struct dmi_system_id btusb_needs_reset_resume_table[] = {
+        {
+                /* Lenovo Yoga 920 (QCA Rome device 0cf3:e300) */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 920"),
+                },
+        },
+        {}
+};
+
 #define BTUSB_MAX_ISOC_FRAMES   10
 
 #define BTUSB_INTR_RUNNING      0
@@ -2945,6 +2961,9 @@ static int btusb_probe(struct usb_interface *intf,
         hdev->send   = btusb_send_frame;
         hdev->notify = btusb_notify;
 
+        if (dmi_check_system(btusb_needs_reset_resume_table))
+                interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
+
 #ifdef CONFIG_PM
         err = btusb_config_oob_wake(hdev);
         if (err)
@@ -3031,12 +3050,6 @@ static int btusb_probe(struct usb_interface *intf,
         if (id->driver_info & BTUSB_QCA_ROME) {
                 data->setup_on_usb = btusb_setup_qca;
                 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
-
-                /* QCA Rome devices lose their updated firmware over suspend,
-                 * but the USB hub doesn't notice any status change.
-                 * explicitly request a device reset on resume.
-                 */
-                interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
         }
 
 #ifdef CONFIG_BT_HCIBTUSB_RTL
diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
index 0438a64b8185..6314dfb02969 100644
--- a/drivers/bluetooth/hci_bcm.c
+++ b/drivers/bluetooth/hci_bcm.c
@@ -922,12 +922,13 @@ static int bcm_get_resources(struct bcm_device *dev)
 
         dev->clk = devm_clk_get(dev->dev, NULL);
 
-        dev->device_wakeup = devm_gpiod_get(dev->dev, "device-wakeup",
-                                            GPIOD_OUT_LOW);
+        dev->device_wakeup = devm_gpiod_get_optional(dev->dev, "device-wakeup",
+                                                     GPIOD_OUT_LOW);
         if (IS_ERR(dev->device_wakeup))
                 return PTR_ERR(dev->device_wakeup);
 
-        dev->shutdown = devm_gpiod_get(dev->dev, "shutdown", GPIOD_OUT_LOW);
+        dev->shutdown = devm_gpiod_get_optional(dev->dev, "shutdown",
+                                                GPIOD_OUT_LOW);
         if (IS_ERR(dev->shutdown))
                 return PTR_ERR(dev->shutdown);
 
diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index 4d46003c46cf..cdaeeea7999c 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -630,7 +630,7 @@ static int sysc_init_dts_quirks(struct sysc *ddata)
         for (i = 0; i < ARRAY_SIZE(sysc_dts_quirks); i++) {
                 prop = of_get_property(np, sysc_dts_quirks[i].name, &len);
                 if (!prop)
-                        break;
+                        continue;
 
                 ddata->cfg.quirks |= sysc_dts_quirks[i].mask;
         }
diff --git a/drivers/char/tpm/st33zp24/st33zp24.c b/drivers/char/tpm/st33zp24/st33zp24.c
index 4d1dc8b46877..f95b9c75175b 100644
--- a/drivers/char/tpm/st33zp24/st33zp24.c
+++ b/drivers/char/tpm/st33zp24/st33zp24.c
@@ -457,7 +457,7 @@ static int st33zp24_recv(struct tpm_chip *chip, unsigned char *buf,
                             size_t count)
 {
         int size = 0;
-        int expected;
+        u32 expected;
 
         if (!chip)
                 return -EBUSY;
@@ -474,7 +474,7 @@ static int st33zp24_recv(struct tpm_chip *chip, unsigned char *buf,
         }
 
         expected = be32_to_cpu(*(__be32 *)(buf + 2));
-        if (expected > count) {
+        if (expected > count || expected < TPM_HEADER_SIZE) {
                 size = -EIO;
                 goto out;
         }
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index 76df4fbcf089..9e80a953d693 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -1190,6 +1190,10 @@ int tpm_get_random(struct tpm_chip *chip, u8 *out, size_t max)
                         break;
 
                 recd = be32_to_cpu(tpm_cmd.params.getrandom_out.rng_data_len);
+                if (recd > num_bytes) {
+                        total = -EFAULT;
+                        break;
+                }
 
                 rlength = be32_to_cpu(tpm_cmd.header.out.length);
                 if (rlength < offsetof(struct tpm_getrandom_out, rng_data) +
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index c17e75348a99..a700f8f9ead7 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -683,6 +683,10 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip,
         if (!rc) {
                 data_len = be16_to_cpup(
                         (__be16 *) &buf.data[TPM_HEADER_SIZE + 4]);
+                if (data_len < MIN_KEY_SIZE ||  data_len > MAX_KEY_SIZE + 1) {
+                        rc = -EFAULT;
+                        goto out;
+                }
 
                 rlength = be32_to_cpu(((struct tpm2_cmd *)&buf)
                                         ->header.out.length);
diff --git a/drivers/char/tpm/tpm_i2c_infineon.c b/drivers/char/tpm/tpm_i2c_infineon.c
index c1dd39eaaeeb..6116cd05e228 100644
--- a/drivers/char/tpm/tpm_i2c_infineon.c
+++ b/drivers/char/tpm/tpm_i2c_infineon.c
@@ -473,7 +473,8 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
 static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count)
 {
         int size = 0;
-        int expected, status;
+        int status;
+        u32 expected;
 
         if (count < TPM_HEADER_SIZE) {
                 size = -EIO;
@@ -488,7 +489,7 @@ static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count)
         }
 
         expected = be32_to_cpu(*(__be32 *)(buf + 2));
-        if ((size_t) expected > count) {
+        if (((size_t) expected > count) || (expected < TPM_HEADER_SIZE)) {
                 size = -EIO;
                 goto out;
         }
diff --git a/drivers/char/tpm/tpm_i2c_nuvoton.c b/drivers/char/tpm/tpm_i2c_nuvoton.c
index c6428771841f..caa86b19c76d 100644
--- a/drivers/char/tpm/tpm_i2c_nuvoton.c
+++ b/drivers/char/tpm/tpm_i2c_nuvoton.c
@@ -281,7 +281,11 @@ static int i2c_nuvoton_recv(struct tpm_chip *chip, u8 *buf, size_t count)
         struct device *dev = chip->dev.parent;
         struct i2c_client *client = to_i2c_client(dev);
         s32 rc;
-        int expected, status, burst_count, retries, size = 0;
+        int status;
+        int burst_count;
+        int retries;
+        int size = 0;
+        u32 expected;
 
         if (count < TPM_HEADER_SIZE) {
                 i2c_nuvoton_ready(chip);    /* return to idle */
@@ -323,7 +327,7 @@ static int i2c_nuvoton_recv(struct tpm_chip *chip, u8 *buf, size_t count)
                  * to machine native
                  */
                 expected = be32_to_cpu(*(__be32 *) (buf + 2));
-                if (expected > count) {
+                if (expected > count || expected < size) {
                         dev_err(dev, "%s() expected > count\n", __func__);
                         size = -EIO;
                         continue;
diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
index 183a5f54d875..da074e3db19b 100644
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -270,7 +270,8 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
 {
         struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
         int size = 0;
-        int expected, status;
+        int status;
+        u32 expected;
 
         if (count < TPM_HEADER_SIZE) {
                 size = -EIO;
@@ -285,7 +286,7 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
         }
 
         expected = be32_to_cpu(*(__be32 *) (buf + 2));
-        if (expected > count) {
+        if (expected > count || expected < TPM_HEADER_SIZE) {
                 size = -EIO;
                 goto out;
         }
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index b3b4ed9b6874..d2e5382821a4 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -386,6 +386,7 @@ config ATMEL_PIT
 
 config ATMEL_ST
         bool "Atmel ST timer support" if COMPILE_TEST
+        depends on HAS_IOMEM
         select TIMER_OF
         select MFD_SYSCON
         help
diff --git a/drivers/clocksource/arc_timer.c b/drivers/clocksource/arc_timer.c
index 4927355f9cbe..471b428d8034 100644
--- a/drivers/clocksource/arc_timer.c
+++ b/drivers/clocksource/arc_timer.c
@@ -251,9 +251,14 @@ static irqreturn_t timer_irq_handler(int irq, void *dev_id)
         int irq_reenable = clockevent_state_periodic(evt);
 
         /*
-         * Any write to CTRL reg ACks the interrupt, we rewrite the
-         * Count when [N]ot [H]alted bit.
-         * And re-arm it if perioid by [I]nterrupt [E]nable bit
+         * 1. ACK the interrupt
+         *    - For ARC700, any write to CTRL reg ACKs it, so just rewrite
+         *      Count when [N]ot [H]alted bit.
+         *    - For HS3x, it is a bit subtle. On taken count-down interrupt,
+         *      IP bit [3] is set, which needs to be cleared for ACK'ing.
+         *      The write below can only update the other two bits, hence
+         *      explicitly clears IP bit
+         * 2. Re-arm interrupt if periodic by writing to IE bit [0]
          */
         write_aux_reg(ARC_REG_TIMER0_CTRL, irq_reenable | TIMER_CTRL_NH);
 
diff --git a/drivers/clocksource/fsl_ftm_timer.c b/drivers/clocksource/fsl_ftm_timer.c
index 3ee7e6fea621..846d18daf893 100644
--- a/drivers/clocksource/fsl_ftm_timer.c
+++ b/drivers/clocksource/fsl_ftm_timer.c
@@ -281,7 +281,7 @@ static int __init __ftm_clk_init(struct device_node *np, char *cnt_name,
 
 static unsigned long __init ftm_clk_init(struct device_node *np)
 {
-        unsigned long freq;
+        long freq;
 
         freq = __ftm_clk_init(np, "ftm-evt-counter-en", "ftm-evt");
         if (freq <= 0)
diff --git a/drivers/clocksource/mips-gic-timer.c b/drivers/clocksource/mips-gic-timer.c
index 65e18c86d9b9..986b6796b631 100644
--- a/drivers/clocksource/mips-gic-timer.c
+++ b/drivers/clocksource/mips-gic-timer.c
@@ -166,7 +166,7 @@ static int __init __gic_clocksource_init(void)
 
         /* Set clocksource mask. */
         count_width = read_gic_config() & GIC_CONFIG_COUNTBITS;
-        count_width >>= __fls(GIC_CONFIG_COUNTBITS);
+        count_width >>= __ffs(GIC_CONFIG_COUNTBITS);
         count_width *= 4;
         count_width += 32;
         gic_clocksource.mask = CLOCKSOURCE_MASK(count_width);
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 3a88e33b0cfe..fb586e09682d 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -44,10 +44,10 @@ config ARM_DT_BL_CPUFREQ
 
 config ARM_SCPI_CPUFREQ
         tristate "SCPI based CPUfreq driver"
-        depends on ARM_BIG_LITTLE_CPUFREQ && ARM_SCPI_PROTOCOL && COMMON_CLK_SCPI
+        depends on ARM_SCPI_PROTOCOL && COMMON_CLK_SCPI
         help
-          This adds the CPUfreq driver support for ARM big.LITTLE platforms
-          using SCPI protocol for CPU power management.
+          This adds the CPUfreq driver support for ARM platforms using SCPI
+          protocol for CPU power management.
 
           This driver uses SCPI Message Protocol driver to interact with the
           firmware providing the CPU DVFS functionality.
diff --git a/drivers/cpufreq/s3c24xx-cpufreq.c b/drivers/cpufreq/s3c24xx-cpufreq.c
index 7b596fa38ad2..6bebc1f9f55a 100644
--- a/drivers/cpufreq/s3c24xx-cpufreq.c
+++ b/drivers/cpufreq/s3c24xx-cpufreq.c
@@ -351,7 +351,13 @@ struct clk *s3c_cpufreq_clk_get(struct device *dev, const char *name)
 static int s3c_cpufreq_init(struct cpufreq_policy *policy)
 {
         policy->clk = clk_arm;
-        return cpufreq_generic_init(policy, ftab, cpu_cur.info->latency);
+
+        policy->cpuinfo.transition_latency = cpu_cur.info->latency;
+
+        if (ftab)
+                return cpufreq_table_validate_and_show(policy, ftab);
+
+        return 0;
 }
 
 static int __init s3c_cpufreq_initclks(void)
diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c
index c32a833e1b00..d300a163945f 100644
--- a/drivers/cpufreq/scpi-cpufreq.c
+++ b/drivers/cpufreq/scpi-cpufreq.c
@@ -51,15 +51,23 @@ static unsigned int scpi_cpufreq_get_rate(unsigned int cpu)
 static int
 scpi_cpufreq_set_target(struct cpufreq_policy *policy, unsigned int index)
 {
+        unsigned long freq = policy->freq_table[index].frequency;
         struct scpi_data *priv = policy->driver_data;
-        u64 rate = policy->freq_table[index].frequency * 1000;
+        u64 rate = freq * 1000;
         int ret;
 
         ret = clk_set_rate(priv->clk, rate);
-        if (!ret && (clk_get_rate(priv->clk) != rate))
-                ret = -EIO;
 
-        return ret;
+        if (ret)
+                return ret;
+
+        if (clk_get_rate(priv->clk) != rate)
+                return -EIO;
+
+        arch_set_freq_scale(policy->related_cpus, freq,
+                            policy->cpuinfo.max_freq);
+
+        return 0;
 }
 
 static int
diff --git a/drivers/crypto/ccp/psp-dev.c b/drivers/crypto/ccp/psp-dev.c
index fcfa5b1eae61..b3afb6cc9d72 100644
--- a/drivers/crypto/ccp/psp-dev.c
+++ b/drivers/crypto/ccp/psp-dev.c
@@ -211,7 +211,7 @@ static int __sev_platform_shutdown_locked(int *error)
 {
         int ret;
 
-        ret = __sev_do_cmd_locked(SEV_CMD_SHUTDOWN, 0, error);
+        ret = __sev_do_cmd_locked(SEV_CMD_SHUTDOWN, NULL, error);
         if (ret)
                 return ret;
 
@@ -271,7 +271,7 @@ static int sev_ioctl_do_reset(struct sev_issue_cmd *argp)
                         return rc;
         }
 
-        return __sev_do_cmd_locked(SEV_CMD_FACTORY_RESET, 0, &argp->error);
+        return __sev_do_cmd_locked(SEV_CMD_FACTORY_RESET, NULL, &argp->error);
 }
 
 static int sev_ioctl_do_platform_status(struct sev_issue_cmd *argp)
@@ -299,7 +299,7 @@ static int sev_ioctl_do_pek_pdh_gen(int cmd, struct sev_issue_cmd *argp)
                         return rc;
         }
 
-        return __sev_do_cmd_locked(cmd, 0, &argp->error);
+        return __sev_do_cmd_locked(cmd, NULL, &argp->error);
 }
 
 static int sev_ioctl_do_pek_csr(struct sev_issue_cmd *argp)
@@ -624,7 +624,7 @@ EXPORT_SYMBOL_GPL(sev_guest_decommission);
 
 int sev_guest_df_flush(int *error)
 {
-        return sev_do_cmd(SEV_CMD_DF_FLUSH, 0, error);
+        return sev_do_cmd(SEV_CMD_DF_FLUSH, NULL, error);
 }
 EXPORT_SYMBOL_GPL(sev_guest_df_flush);
 
diff --git a/drivers/dax/super.c b/drivers/dax/super.c
index 473af694ad1c..ecdc292aa4e4 100644
--- a/drivers/dax/super.c
+++ b/drivers/dax/super.c
@@ -246,12 +246,6 @@ long dax_direct_access(struct dax_device *dax_dev, pgoff_t pgoff, long nr_pages,
 {
         long avail;
 
-        /*
-         * The device driver is allowed to sleep, in order to make the
-         * memory directly accessible.
-         */
-        might_sleep();
-
         if (!dax_dev)
                 return -EOPNOTSUPP;
 
diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
index f652a0e0f5a2..3548caa9e933 100644
--- a/drivers/dma/mv_xor_v2.c
+++ b/drivers/dma/mv_xor_v2.c
@@ -163,6 +163,7 @@ struct mv_xor_v2_device {
         void __iomem *dma_base;
         void __iomem *glob_base;
         struct clk *clk;
+        struct clk *reg_clk;
         struct tasklet_struct irq_tasklet;
         struct list_head free_sw_desc;
         struct dma_device dmadev;
@@ -749,13 +750,26 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
         if (ret)
                 return ret;
 
+        xor_dev->reg_clk = devm_clk_get(&pdev->dev, "reg");
+        if (PTR_ERR(xor_dev->reg_clk) != -ENOENT) {
+                if (!IS_ERR(xor_dev->reg_clk)) {
+                        ret = clk_prepare_enable(xor_dev->reg_clk);
+                        if (ret)
+                                return ret;
+                } else {
+                        return PTR_ERR(xor_dev->reg_clk);
+                }
+        }
+
         xor_dev->clk = devm_clk_get(&pdev->dev, NULL);
-        if (IS_ERR(xor_dev->clk) && PTR_ERR(xor_dev->clk) == -EPROBE_DEFER)
-                return -EPROBE_DEFER;
+        if (IS_ERR(xor_dev->clk) && PTR_ERR(xor_dev->clk) == -EPROBE_DEFER) {
+                ret = EPROBE_DEFER;
+                goto disable_reg_clk;
+        }
         if (!IS_ERR(xor_dev->clk)) {
                 ret = clk_prepare_enable(xor_dev->clk);
                 if (ret)
-                        return ret;
+                        goto disable_reg_clk;
         }
 
         ret = platform_msi_domain_alloc_irqs(&pdev->dev, 1,
@@ -866,8 +880,9 @@ free_hw_desq:
 free_msi_irqs:
         platform_msi_domain_free_irqs(&pdev->dev);
 disable_clk:
-        if (!IS_ERR(xor_dev->clk))
-                clk_disable_unprepare(xor_dev->clk);
+        clk_disable_unprepare(xor_dev->clk);
+disable_reg_clk:
+        clk_disable_unprepare(xor_dev->reg_clk);
         return ret;
 }
 
diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
index e3ff162c03fc..d0cacdb0713e 100644
--- a/drivers/dma/sh/rcar-dmac.c
+++ b/drivers/dma/sh/rcar-dmac.c
@@ -917,7 +917,7 @@ rcar_dmac_chan_prep_sg(struct rcar_dmac_chan *chan, struct scatterlist *sgl,
 
         rcar_dmac_chan_configure_desc(chan, desc);
 
-        max_chunk_size = (RCAR_DMATCR_MASK + 1) << desc->xfer_shift;
+        max_chunk_size = RCAR_DMATCR_MASK << desc->xfer_shift;
 
         /*
          * Allocate and fill the transfer chunk descriptors. We own the only
diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
index f34430f99fd8..872100215ca0 100644
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -279,7 +279,7 @@ static const u32 correrrthrsld[] = {
  * sbridge structs
  */
 
-#define NUM_CHANNELS            4       /* Max channels per MC */
+#define NUM_CHANNELS            6       /* Max channels per MC */
 #define MAX_DIMMS               3       /* Max DIMMS per channel */
 #define KNL_MAX_CHAS            38      /* KNL max num. of Cache Home Agents */
 #define KNL_MAX_CHANNELS        6       /* KNL max num. of PCI channels */
diff --git a/drivers/firmware/dcdbas.c b/drivers/firmware/dcdbas.c
index c16600f30611..0bdea60c65dd 100644
--- a/drivers/firmware/dcdbas.c
+++ b/drivers/firmware/dcdbas.c
@@ -639,7 +639,7 @@ static void __exit dcdbas_exit(void)
         platform_driver_unregister(&dcdbas_driver);
 }
 
-module_init(dcdbas_init);
+subsys_initcall_sync(dcdbas_init);
 module_exit(dcdbas_exit);
 
 MODULE_DESCRIPTION(DRIVER_DESCRIPTION " (version " DRIVER_VERSION ")");
diff --git a/drivers/firmware/efi/libstub/tpm.c b/drivers/firmware/efi/libstub/tpm.c
index da661bf8cb96..13c1edd37e96 100644
--- a/drivers/firmware/efi/libstub/tpm.c
+++ b/drivers/firmware/efi/libstub/tpm.c
@@ -68,11 +68,11 @@ void efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg)
         efi_guid_t linux_eventlog_guid = LINUX_EFI_TPM_EVENT_LOG_GUID;
         efi_status_t status;
         efi_physical_addr_t log_location, log_last_entry;
-        struct linux_efi_tpm_eventlog *log_tbl;
+        struct linux_efi_tpm_eventlog *log_tbl = NULL;
         unsigned long first_entry_addr, last_entry_addr;
         size_t log_size, last_entry_size;
         efi_bool_t truncated;
-        void *tcg2_protocol;
+        void *tcg2_protocol = NULL;
 
         status = efi_call_early(locate_protocol, &tcg2_guid, NULL,
                                 &tcg2_protocol);
diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c
index e76de57dd617..ebaea8b1594b 100644
--- a/drivers/gpio/gpio-rcar.c
+++ b/drivers/gpio/gpio-rcar.c
@@ -14,7 +14,6 @@
  * GNU General Public License for more details.
  */
 
-#include <linux/clk.h>
 #include <linux/err.h>
 #include <linux/gpio.h>
 #include <linux/init.h>
@@ -37,10 +36,9 @@ struct gpio_rcar_priv {
         struct platform_device *pdev;
         struct gpio_chip gpio_chip;
         struct irq_chip irq_chip;
-        struct clk *clk;
         unsigned int irq_parent;
+        atomic_t wakeup_path;
         bool has_both_edge_trigger;
-        bool needs_clk;
 };
 
 #define IOINTSEL 0x00   /* General IO/Interrupt Switching Register */
@@ -186,13 +184,10 @@ static int gpio_rcar_irq_set_wake(struct irq_data *d, unsigned int on)
                 }
         }
 
-        if (!p->clk)
-                return 0;
-
         if (on)
-                clk_enable(p->clk);
+                atomic_inc(&p->wakeup_path);
         else
-                clk_disable(p->clk);
+                atomic_dec(&p->wakeup_path);
 
         return 0;
 }
@@ -330,17 +325,14 @@ static int gpio_rcar_direction_output(struct gpio_chip *chip, unsigned offset,
 
 struct gpio_rcar_info {
         bool has_both_edge_trigger;
-        bool needs_clk;
 };
 
 static const struct gpio_rcar_info gpio_rcar_info_gen1 = {
         .has_both_edge_trigger = false,
-        .needs_clk = false,
 };
 
 static const struct gpio_rcar_info gpio_rcar_info_gen2 = {
         .has_both_edge_trigger = true,
-        .needs_clk = true,
 };
 
 static const struct of_device_id gpio_rcar_of_table[] = {
@@ -403,7 +395,6 @@ static int gpio_rcar_parse_dt(struct gpio_rcar_priv *p, unsigned int *npins)
         ret = of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3, 0, &args);
         *npins = ret == 0 ? args.args[2] : RCAR_MAX_GPIO_PER_BANK;
         p->has_both_edge_trigger = info->has_both_edge_trigger;
-        p->needs_clk = info->needs_clk;
 
         if (*npins == 0 || *npins > RCAR_MAX_GPIO_PER_BANK) {
                 dev_warn(&p->pdev->dev,
@@ -440,16 +431,6 @@ static int gpio_rcar_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, p);
 
-        p->clk = devm_clk_get(dev, NULL);
-        if (IS_ERR(p->clk)) {
-                if (p->needs_clk) {
-                        dev_err(dev, "unable to get clock\n");
-                        ret = PTR_ERR(p->clk);
-                        goto err0;
-                }
-                p->clk = NULL;
-        }
-
         pm_runtime_enable(dev);
 
         irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
@@ -531,11 +512,24 @@ static int gpio_rcar_remove(struct platform_device *pdev)
         return 0;
 }
 
+static int __maybe_unused gpio_rcar_suspend(struct device *dev)
+{
+        struct gpio_rcar_priv *p = dev_get_drvdata(dev);
+
+        if (atomic_read(&p->wakeup_path))
+                device_set_wakeup_path(dev);
+
+        return 0;
+}
+
+static SIMPLE_DEV_PM_OPS(gpio_rcar_pm_ops, gpio_rcar_suspend, NULL);
+
 static struct platform_driver gpio_rcar_device_driver = {
         .probe          = gpio_rcar_probe,
         .remove         = gpio_rcar_remove,
         .driver         = {
                 .name   = "gpio_rcar",
+                .pm     = &gpio_rcar_pm_ops,
                 .of_match_table = of_match_ptr(gpio_rcar_of_table),
         }
 };
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index 564bb7a31da4..84e5a9df2344 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -241,6 +241,19 @@ struct gpio_desc *of_find_gpio(struct device *dev, const char *con_id,
 
                 desc = of_get_named_gpiod_flags(dev->of_node, prop_name, idx,
                                                 &of_flags);
+                /*
+                 * -EPROBE_DEFER in our case means that we found a
+                 * valid GPIO property, but no controller has been
+                 * registered so far.
+                 *
+                 * This means we don't need to look any further for
+                 * alternate name conventions, and we should really
+                 * preserve the return code for our user to be able to
+                 * retry probing later.
+                 */
+                if (IS_ERR(desc) && PTR_ERR(desc) == -EPROBE_DEFER)
+                        return desc;
+
                 if (!IS_ERR(desc) || (PTR_ERR(desc) != -ENOENT))
                         break;
         }
@@ -250,7 +263,7 @@ struct gpio_desc *of_find_gpio(struct device *dev, const char *con_id,
                 desc = of_find_spi_gpio(dev, con_id, &of_flags);
 
         /* Special handling for regulator GPIOs if used */
-        if (IS_ERR(desc))
+        if (IS_ERR(desc) && PTR_ERR(desc) != -EPROBE_DEFER)
                 desc = of_find_regulator_gpio(dev, con_id, &of_flags);
 
         if (IS_ERR(desc))
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index d5a2eefd6c3e..74edba18b159 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -1156,7 +1156,7 @@ static inline void amdgpu_set_ib_value(struct amdgpu_cs_parser *p,
 /*
  * Writeback
  */
-#define AMDGPU_MAX_WB 512       /* Reserve at most 512 WB slots for amdgpu-owned rings. */
+#define AMDGPU_MAX_WB 128       /* Reserve at most 128 WB slots for amdgpu-owned rings. */
 
 struct amdgpu_wb {
         struct amdgpu_bo        *wb_obj;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index 57afad79f55d..8fa850a070e0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -540,6 +540,9 @@ int amdgpu_acpi_pcie_performance_request(struct amdgpu_device *adev,
         size_t size;
         u32 retry = 3;
 
+        if (amdgpu_acpi_pcie_notify_device_ready(adev))
+                return -EINVAL;
+
         /* Get the device handle */
         handle = ACPI_HANDLE(&adev->pdev->dev);
         if (!handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
index 74d2efaec52f..7a073ac5f9c6 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
@@ -69,25 +69,18 @@ void amdgpu_connector_hotplug(struct drm_connector *connector)
                 /* don't do anything if sink is not display port, i.e.,
                  * passive dp->(dvi|hdmi) adaptor
                  */
-                if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) {
-                        int saved_dpms = connector->dpms;
-                        /* Only turn off the display if it's physically disconnected */
-                        if (!amdgpu_display_hpd_sense(adev, amdgpu_connector->hpd.hpd)) {
-                                drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
-                        } else if (amdgpu_atombios_dp_needs_link_train(amdgpu_connector)) {
-                                /* Don't try to start link training before we
-                                 * have the dpcd */
-                                if (amdgpu_atombios_dp_get_dpcd(amdgpu_connector))
-                                        return;
-
-                                /* set it to OFF so that drm_helper_connector_dpms()
-                                 * won't return immediately since the current state
-                                 * is ON at this point.
-                                 */
-                                connector->dpms = DRM_MODE_DPMS_OFF;
-                                drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
-                        }
-                        connector->dpms = saved_dpms;
+                if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT &&
+                    amdgpu_display_hpd_sense(adev, amdgpu_connector->hpd.hpd) &&
+                    amdgpu_atombios_dp_needs_link_train(amdgpu_connector)) {
+                        /* Don't start link training before we have the DPCD */
+                        if (amdgpu_atombios_dp_get_dpcd(amdgpu_connector))
+                                return;
+
+                        /* Turn the connector off and back on immediately, which
+                         * will trigger link training
+                         */
+                        drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
+                        drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
                 }
         }
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 00a50cc5ec9a..af1b879a9ee9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -492,7 +492,7 @@ static int amdgpu_device_wb_init(struct amdgpu_device *adev)
                 memset(&adev->wb.used, 0, sizeof(adev->wb.used));
 
                 /* clear wb memory */
-                memset((char *)adev->wb.wb, 0, AMDGPU_MAX_WB * sizeof(uint32_t));
+                memset((char *)adev->wb.wb, 0, AMDGPU_MAX_WB * sizeof(uint32_t) * 8);
         }
 
         return 0;
@@ -530,8 +530,9 @@ int amdgpu_device_wb_get(struct amdgpu_device *adev, u32 *wb)
  */
 void amdgpu_device_wb_free(struct amdgpu_device *adev, u32 wb)
 {
+        wb >>= 3;
         if (wb < adev->wb.num_wb)
-                __clear_bit(wb >> 3, adev->wb.used);
+                __clear_bit(wb, adev->wb.used);
 }
 
 /**
@@ -1455,11 +1456,6 @@ static int amdgpu_device_ip_fini(struct amdgpu_device *adev)
         for (i = adev->num_ip_blocks - 1; i >= 0; i--) {
                 if (!adev->ip_blocks[i].status.hw)
                         continue;
-                if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_GMC) {
-                        amdgpu_free_static_csa(adev);
-                        amdgpu_device_wb_fini(adev);
-                        amdgpu_device_vram_scratch_fini(adev);
-                }
 
                 if (adev->ip_blocks[i].version->type != AMD_IP_BLOCK_TYPE_UVD &&
                         adev->ip_blocks[i].version->type != AMD_IP_BLOCK_TYPE_VCE) {
@@ -1486,6 +1482,13 @@ static int amdgpu_device_ip_fini(struct amdgpu_device *adev)
         for (i = adev->num_ip_blocks - 1; i >= 0; i--) {
                 if (!adev->ip_blocks[i].status.sw)
                         continue;
+
+                if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_GMC) {
+                        amdgpu_free_static_csa(adev);
+                        amdgpu_device_wb_fini(adev);
+                        amdgpu_device_vram_scratch_fini(adev);
+                }
+
                 r = adev->ip_blocks[i].version->funcs->sw_fini((void *)adev);
                 /* XXX handle errors */
                 if (r) {
@@ -2284,14 +2287,6 @@ int amdgpu_device_resume(struct drm_device *dev, bool resume, bool fbcon)
                                 drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
                         }
                         drm_modeset_unlock_all(dev);
-                } else {
-                        /*
-                         * There is no equivalent atomic helper to turn on
-                         * display, so we defined our own function for this,
-                         * once suspend resume is supported by the atomic
-                         * framework this will be reworked
-                         */
-                        amdgpu_dm_display_resume(adev);
                 }
         }
 
@@ -2726,7 +2721,6 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev,
         if (amdgpu_device_has_dc_support(adev)) {
                 if (drm_atomic_helper_resume(adev->ddev, state))
                         dev_info(adev->dev, "drm resume failed:%d\n", r);
-                amdgpu_dm_display_resume(adev);
         } else {
                 drm_helper_resume_force_mode(adev->ddev);
         }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index e48b4ec88c8c..ca6c931dabfa 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -36,8 +36,6 @@ void amdgpu_gem_object_free(struct drm_gem_object *gobj)
         struct amdgpu_bo *robj = gem_to_amdgpu_bo(gobj);
 
         if (robj) {
-                if (robj->gem_base.import_attach)
-                        drm_prime_gem_destroy(&robj->gem_base, robj->tbo.sg);
                 amdgpu_mn_unregister(robj);
                 amdgpu_bo_unref(&robj);
         }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c
index e14ab34d8262..7c2be32c5aea 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c
@@ -75,7 +75,7 @@ static int amdgpu_gtt_mgr_init(struct ttm_mem_type_manager *man,
 static int amdgpu_gtt_mgr_fini(struct ttm_mem_type_manager *man)
 {
         struct amdgpu_gtt_mgr *mgr = man->priv;
-
+        spin_lock(&mgr->lock);
         drm_mm_takedown(&mgr->mm);
         spin_unlock(&mgr->lock);
         kfree(mgr);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
index 56bcd59c3399..36483e0d3c97 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
@@ -257,7 +257,8 @@ int amdgpu_irq_init(struct amdgpu_device *adev)
         r = drm_irq_install(adev->ddev, adev->ddev->pdev->irq);
         if (r) {
                 adev->irq.installed = false;
-                flush_work(&adev->hotplug_work);
+                if (!amdgpu_device_has_dc_support(adev))
+                        flush_work(&adev->hotplug_work);
                 cancel_work_sync(&adev->reset_work);
                 return r;
         }
@@ -282,7 +283,8 @@ void amdgpu_irq_fini(struct amdgpu_device *adev)
                 adev->irq.installed = false;
                 if (adev->irq.msi_enabled)
                         pci_disable_msi(adev->pdev);
-                flush_work(&adev->hotplug_work);
+                if (!amdgpu_device_has_dc_support(adev))
+                        flush_work(&adev->hotplug_work);
                 cancel_work_sync(&adev->reset_work);
         }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
index 54f06c959340..2264c5c97009 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
@@ -352,6 +352,7 @@ struct amdgpu_mode_info {
         u16 firmware_flags;
         /* pointer to backlight encoder */
         struct amdgpu_encoder *bl_encoder;
+        u8 bl_level; /* saved backlight level */
         struct amdgpu_audio     audio; /* audio stuff */
         int                     num_crtc; /* number of crtcs */
         int                     num_hpd; /* number of hpd pins */
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
index 5c4c3e0d527b..1220322c1680 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
@@ -56,6 +56,8 @@ static void amdgpu_ttm_bo_destroy(struct ttm_buffer_object *tbo)
 
         amdgpu_bo_kunmap(bo);
 
+        if (bo->gem_base.import_attach)
+                drm_prime_gem_destroy(&bo->gem_base, bo->tbo.sg);
         drm_gem_object_release(&bo->gem_base);
         amdgpu_bo_unref(&bo->parent);
         if (!list_empty(&bo->shadow_list)) {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
index 13044e66dcaf..561d3312af32 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
@@ -481,7 +481,7 @@ static ssize_t amdgpu_debugfs_ring_read(struct file *f, char __user *buf,
         result = 0;
 
         if (*pos < 12) {
-                early[0] = amdgpu_ring_get_rptr(ring);
+                early[0] = amdgpu_ring_get_rptr(ring) & ring->buf_mask;
                 early[1] = amdgpu_ring_get_wptr(ring) & ring->buf_mask;
                 early[2] = ring->wptr & ring->buf_mask;
                 for (i = *pos / 4; i < 3 && size; i++) {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
index b2eae86bf906..5c26a8e806b9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
@@ -299,12 +299,15 @@ int amdgpu_uvd_suspend(struct amdgpu_device *adev)
 
         cancel_delayed_work_sync(&adev->uvd.idle_work);
 
-        for (i = 0; i < adev->uvd.max_handles; ++i)
-                if (atomic_read(&adev->uvd.handles[i]))
-                        break;
+        /* only valid for physical mode */
+        if (adev->asic_type < CHIP_POLARIS10) {
+                for (i = 0; i < adev->uvd.max_handles; ++i)
+                        if (atomic_read(&adev->uvd.handles[i]))
+                                break;
 
-        if (i == AMDGPU_MAX_UVD_HANDLES)
-                return 0;
+                if (i == adev->uvd.max_handles)
+                        return 0;
+        }
 
         size = amdgpu_bo_size(adev->uvd.vcpu_bo);
         ptr = adev->uvd.cpu_addr;
diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
index 2af26d2da127..d702fb8e3427 100644
--- a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
+++ b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
@@ -34,7 +34,7 @@
 #include <linux/backlight.h>
 #include "bif/bif_4_1_d.h"
 
-static u8
+u8
 amdgpu_atombios_encoder_get_backlight_level_from_reg(struct amdgpu_device *adev)
 {
         u8 backlight_level;
@@ -48,7 +48,7 @@ amdgpu_atombios_encoder_get_backlight_level_from_reg(struct amdgpu_device *adev)
         return backlight_level;
 }
 
-static void
+void
 amdgpu_atombios_encoder_set_backlight_level_to_reg(struct amdgpu_device *adev,
                                             u8 backlight_level)
 {
diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.h b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.h
index 2bdec40515ce..f77cbdef679e 100644
--- a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.h
+++ b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.h
@@ -25,6 +25,11 @@
 #define __ATOMBIOS_ENCODER_H__
 
 u8
+amdgpu_atombios_encoder_get_backlight_level_from_reg(struct amdgpu_device *adev);
+void
+amdgpu_atombios_encoder_set_backlight_level_to_reg(struct amdgpu_device *adev,
+                                                   u8 backlight_level);
+u8
 amdgpu_atombios_encoder_get_backlight_level(struct amdgpu_encoder *amdgpu_encoder);
 void
 amdgpu_atombios_encoder_set_backlight_level(struct amdgpu_encoder *amdgpu_encoder,
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
index f34bc68aadfb..022f303463fc 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
@@ -2921,6 +2921,11 @@ static int dce_v10_0_hw_fini(void *handle)
 
 static int dce_v10_0_suspend(void *handle)
 {
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+        adev->mode_info.bl_level =
+                amdgpu_atombios_encoder_get_backlight_level_from_reg(adev);
+
         return dce_v10_0_hw_fini(handle);
 }
 
@@ -2929,6 +2934,9 @@ static int dce_v10_0_resume(void *handle)
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
         int ret;
 
+        amdgpu_atombios_encoder_set_backlight_level_to_reg(adev,
+                                                           adev->mode_info.bl_level);
+
         ret = dce_v10_0_hw_init(handle);
 
         /* turn on the BL */
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
index 26378bd6aba4..800a9f36ab4f 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@@ -3047,6 +3047,11 @@ static int dce_v11_0_hw_fini(void *handle)
 
 static int dce_v11_0_suspend(void *handle)
 {
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+        adev->mode_info.bl_level =
+                amdgpu_atombios_encoder_get_backlight_level_from_reg(adev);
+
         return dce_v11_0_hw_fini(handle);
 }
 
@@ -3055,6 +3060,9 @@ static int dce_v11_0_resume(void *handle)
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
         int ret;
 
+        amdgpu_atombios_encoder_set_backlight_level_to_reg(adev,
+                                                           adev->mode_info.bl_level);
+
         ret = dce_v11_0_hw_init(handle);
 
         /* turn on the BL */
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
index bd2c4f727df6..b8368f69ce1f 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
@@ -2787,6 +2787,11 @@ static int dce_v6_0_hw_fini(void *handle)
 
 static int dce_v6_0_suspend(void *handle)
 {
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+        adev->mode_info.bl_level =
+                amdgpu_atombios_encoder_get_backlight_level_from_reg(adev);
+
         return dce_v6_0_hw_fini(handle);
 }
 
@@ -2795,6 +2800,9 @@ static int dce_v6_0_resume(void *handle)
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
         int ret;
 
+        amdgpu_atombios_encoder_set_backlight_level_to_reg(adev,
+                                                           adev->mode_info.bl_level);
+
         ret = dce_v6_0_hw_init(handle);
 
         /* turn on the BL */
@@ -3093,7 +3101,7 @@ static int dce_v6_0_hpd_irq(struct amdgpu_device *adev,
                 tmp |= DC_HPD1_INT_CONTROL__DC_HPD1_INT_ACK_MASK;
                 WREG32(mmDC_HPD1_INT_CONTROL + hpd_offsets[hpd], tmp);
                 schedule_work(&adev->hotplug_work);
-                DRM_INFO("IH: HPD%d\n", hpd + 1);
+                DRM_DEBUG("IH: HPD%d\n", hpd + 1);
         }
 
         return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
index c008dc030687..012e0a9ae0ff 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
@@ -2819,6 +2819,11 @@ static int dce_v8_0_hw_fini(void *handle)
 
 static int dce_v8_0_suspend(void *handle)
 {
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+        adev->mode_info.bl_level =
+                amdgpu_atombios_encoder_get_backlight_level_from_reg(adev);
+
         return dce_v8_0_hw_fini(handle);
 }
 
@@ -2827,6 +2832,9 @@ static int dce_v8_0_resume(void *handle)
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
         int ret;
 
+        amdgpu_atombios_encoder_set_backlight_level_to_reg(adev,
+                                                           adev->mode_info.bl_level);
+
         ret = dce_v8_0_hw_init(handle);
 
         /* turn on the BL */
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
index a066c5eda135..a4309698e76c 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
@@ -4384,34 +4384,8 @@ static void gfx_v7_0_gpu_early_init(struct amdgpu_device *adev)
         case CHIP_KAVERI:
                 adev->gfx.config.max_shader_engines = 1;
                 adev->gfx.config.max_tile_pipes = 4;
-                if ((adev->pdev->device == 0x1304) ||
-                    (adev->pdev->device == 0x1305) ||
-                    (adev->pdev->device == 0x130C) ||
-                    (adev->pdev->device == 0x130F) ||
-                    (adev->pdev->device == 0x1310) ||
-                    (adev->pdev->device == 0x1311) ||
-                    (adev->pdev->device == 0x131C)) {
-                        adev->gfx.config.max_cu_per_sh = 8;
-                        adev->gfx.config.max_backends_per_se = 2;
-                } else if ((adev->pdev->device == 0x1309) ||
-                           (adev->pdev->device == 0x130A) ||
-                           (adev->pdev->device == 0x130D) ||
-                           (adev->pdev->device == 0x1313) ||
-                           (adev->pdev->device == 0x131D)) {
-                        adev->gfx.config.max_cu_per_sh = 6;
-                        adev->gfx.config.max_backends_per_se = 2;
-                } else if ((adev->pdev->device == 0x1306) ||
-                           (adev->pdev->device == 0x1307) ||
-                           (adev->pdev->device == 0x130B) ||
-                           (adev->pdev->device == 0x130E) ||
-                           (adev->pdev->device == 0x1315) ||
-                           (adev->pdev->device == 0x131B)) {
-                        adev->gfx.config.max_cu_per_sh = 4;
-                        adev->gfx.config.max_backends_per_se = 1;
-                } else {
-                        adev->gfx.config.max_cu_per_sh = 3;
-                        adev->gfx.config.max_backends_per_se = 1;
-                }
+                adev->gfx.config.max_cu_per_sh = 8;
+                adev->gfx.config.max_backends_per_se = 2;
                 adev->gfx.config.max_sh_per_se = 1;
                 adev->gfx.config.max_texture_channel_caches = 4;
                 adev->gfx.config.max_gprs = 256;
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
index 2719937e09d6..3b7e7af09ead 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
@@ -634,7 +634,7 @@ static int gmc_v9_0_late_init(void *handle)
         for(i = 0; i < AMDGPU_MAX_VMHUBS; ++i)
                 BUG_ON(vm_inv_eng[i] > 16);
 
-        if (adev->asic_type == CHIP_VEGA10) {
+        if (adev->asic_type == CHIP_VEGA10 && !amdgpu_sriov_vf(adev)) {
                 r = gmc_v9_0_ecc_available(adev);
                 if (r == 1) {
                         DRM_INFO("ECC is active.\n");
@@ -682,7 +682,10 @@ static int gmc_v9_0_mc_init(struct amdgpu_device *adev)
         adev->mc.vram_width = amdgpu_atomfirmware_get_vram_width(adev);
         if (!adev->mc.vram_width) {
                 /* hbm memory channel size */
-                chansize = 128;
+                if (adev->flags & AMD_IS_APU)
+                        chansize = 64;
+                else
+                        chansize = 128;
 
                 tmp = RREG32_SOC15(DF, 0, mmDF_CS_AON0_DramBaseAddress0);
                 tmp &= DF_CS_AON0_DramBaseAddress0__IntLvNumChan_MASK;
diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
index e92fb372bc99..91cf95a8c39c 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
@@ -238,31 +238,27 @@ static uint64_t sdma_v4_0_ring_get_rptr(struct amdgpu_ring *ring)
 static uint64_t sdma_v4_0_ring_get_wptr(struct amdgpu_ring *ring)
 {
         struct amdgpu_device *adev = ring->adev;
-        u64 *wptr = NULL;
-        uint64_t local_wptr = 0;
+        u64 wptr;
 
         if (ring->use_doorbell) {
                 /* XXX check if swapping is necessary on BE */
-                wptr = ((u64 *)&adev->wb.wb[ring->wptr_offs]);
-                DRM_DEBUG("wptr/doorbell before shift == 0x%016llx\n", *wptr);
-                *wptr = (*wptr) >> 2;
-                DRM_DEBUG("wptr/doorbell after shift == 0x%016llx\n", *wptr);
+                wptr = READ_ONCE(*((u64 *)&adev->wb.wb[ring->wptr_offs]));
+                DRM_DEBUG("wptr/doorbell before shift == 0x%016llx\n", wptr);
         } else {
                 u32 lowbit, highbit;
                 int me = (ring == &adev->sdma.instance[0].ring) ? 0 : 1;
 
-                wptr = &local_wptr;
                 lowbit = RREG32(sdma_v4_0_get_reg_offset(adev, me, mmSDMA0_GFX_RB_WPTR)) >> 2;
                 highbit = RREG32(sdma_v4_0_get_reg_offset(adev, me, mmSDMA0_GFX_RB_WPTR_HI)) >> 2;
 
                 DRM_DEBUG("wptr [%i]high== 0x%08x low==0x%08x\n",
                                 me, highbit, lowbit);
-                *wptr = highbit;
-                *wptr = (*wptr) << 32;
-                *wptr |= lowbit;
+                wptr = highbit;
+                wptr = wptr << 32;
+                wptr |= lowbit;
         }
 
-        return *wptr;
+        return wptr >> 2;
 }
 
 /**
diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c
index 543101d5a5ed..2095173aaabf 100644
--- a/drivers/gpu/drm/amd/amdgpu/si.c
+++ b/drivers/gpu/drm/amd/amdgpu/si.c
@@ -31,6 +31,7 @@
 #include "amdgpu_uvd.h"
 #include "amdgpu_vce.h"
 #include "atom.h"
+#include "amd_pcie.h"
 #include "amdgpu_powerplay.h"
 #include "sid.h"
 #include "si_ih.h"
@@ -1461,8 +1462,8 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
 {
         struct pci_dev *root = adev->pdev->bus->self;
         int bridge_pos, gpu_pos;
-        u32 speed_cntl, mask, current_data_rate;
-        int ret, i;
+        u32 speed_cntl, current_data_rate;
+        int i;
         u16 tmp16;
 
         if (pci_is_root_bus(adev->pdev->bus))
@@ -1474,23 +1475,20 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
         if (adev->flags & AMD_IS_APU)
                 return;
 
-        ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask);
-        if (ret != 0)
-                return;
-
-        if (!(mask & (DRM_PCIE_SPEED_50 | DRM_PCIE_SPEED_80)))
+        if (!(adev->pm.pcie_gen_mask & (CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2 |
+                                        CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3)))
                 return;
 
         speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL);
         current_data_rate = (speed_cntl & LC_CURRENT_DATA_RATE_MASK) >>
                 LC_CURRENT_DATA_RATE_SHIFT;
-        if (mask & DRM_PCIE_SPEED_80) {
+        if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) {
                 if (current_data_rate == 2) {
                         DRM_INFO("PCIE gen 3 link speeds already enabled\n");
                         return;
                 }
                 DRM_INFO("enabling PCIE gen 3 link speeds, disable with amdgpu.pcie_gen2=0\n");
-        } else if (mask & DRM_PCIE_SPEED_50) {
+        } else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2) {
                 if (current_data_rate == 1) {
                         DRM_INFO("PCIE gen 2 link speeds already enabled\n");
                         return;
@@ -1506,7 +1504,7 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
         if (!gpu_pos)
                 return;
 
-        if (mask & DRM_PCIE_SPEED_80) {
+        if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) {
                 if (current_data_rate != 2) {
                         u16 bridge_cfg, gpu_cfg;
                         u16 bridge_cfg2, gpu_cfg2;
@@ -1589,9 +1587,9 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
 
         pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
         tmp16 &= ~0xf;
-        if (mask & DRM_PCIE_SPEED_80)
+        if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3)
                 tmp16 |= 3;
-        else if (mask & DRM_PCIE_SPEED_50)
+        else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2)
                 tmp16 |= 2;
         else
                 tmp16 |= 1;
diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
index ce675a7f179a..22f0b7ff3ac9 100644
--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
@@ -26,6 +26,7 @@
 #include "amdgpu_pm.h"
 #include "amdgpu_dpm.h"
 #include "amdgpu_atombios.h"
+#include "amd_pcie.h"
 #include "sid.h"
 #include "r600_dpm.h"
 #include "si_dpm.h"
@@ -3331,29 +3332,6 @@ static void btc_apply_voltage_delta_rules(struct amdgpu_device *adev,
         }
 }
 
-static enum amdgpu_pcie_gen r600_get_pcie_gen_support(struct amdgpu_device *adev,
-                                               u32 sys_mask,
-                                               enum amdgpu_pcie_gen asic_gen,
-                                               enum amdgpu_pcie_gen default_gen)
-{
-        switch (asic_gen) {
-        case AMDGPU_PCIE_GEN1:
-                return AMDGPU_PCIE_GEN1;
-        case AMDGPU_PCIE_GEN2:
-                return AMDGPU_PCIE_GEN2;
-        case AMDGPU_PCIE_GEN3:
-                return AMDGPU_PCIE_GEN3;
-        default:
-                if ((sys_mask & DRM_PCIE_SPEED_80) && (default_gen == AMDGPU_PCIE_GEN3))
-                        return AMDGPU_PCIE_GEN3;
-                else if ((sys_mask & DRM_PCIE_SPEED_50) && (default_gen == AMDGPU_PCIE_GEN2))
-                        return AMDGPU_PCIE_GEN2;
-                else
-                        return AMDGPU_PCIE_GEN1;
-        }
-        return AMDGPU_PCIE_GEN1;
-}
-
 static void r600_calculate_u_and_p(u32 i, u32 r_c, u32 p_b,
                             u32 *p, u32 *u)
 {
@@ -5028,10 +5006,11 @@ static int si_populate_smc_acpi_state(struct amdgpu_device *adev,
                                                               table->ACPIState.levels[0].vddc.index,
                                                               &table->ACPIState.levels[0].std_vddc);
                 }
-                table->ACPIState.levels[0].gen2PCIE = (u8)r600_get_pcie_gen_support(adev,
-                                                                                    si_pi->sys_pcie_mask,
-                                                                                    si_pi->boot_pcie_gen,
-                                                                                    AMDGPU_PCIE_GEN1);
+                table->ACPIState.levels[0].gen2PCIE =
+                        (u8)amdgpu_get_pcie_gen_support(adev,
+                                                        si_pi->sys_pcie_mask,
+                                                        si_pi->boot_pcie_gen,
+                                                        AMDGPU_PCIE_GEN1);
 
                 if (si_pi->vddc_phase_shed_control)
                         si_populate_phase_shedding_value(adev,
@@ -7168,10 +7147,10 @@ static void si_parse_pplib_clock_info(struct amdgpu_device *adev,
         pl->vddc = le16_to_cpu(clock_info->si.usVDDC);
         pl->vddci = le16_to_cpu(clock_info->si.usVDDCI);
         pl->flags = le32_to_cpu(clock_info->si.ulFlags);
-        pl->pcie_gen = r600_get_pcie_gen_support(adev,
-                                                 si_pi->sys_pcie_mask,
-                                                 si_pi->boot_pcie_gen,
-                                                 clock_info->si.ucPCIEGen);
+        pl->pcie_gen = amdgpu_get_pcie_gen_support(adev,
+                                                   si_pi->sys_pcie_mask,
+                                                   si_pi->boot_pcie_gen,
+                                                   clock_info->si.ucPCIEGen);
 
         /* patch up vddc if necessary */
         ret = si_get_leakage_voltage_from_leakage_index(adev, pl->vddc,
@@ -7326,7 +7305,6 @@ static int si_dpm_init(struct amdgpu_device *adev)
         struct si_power_info *si_pi;
         struct atom_clock_dividers dividers;
         int ret;
-        u32 mask;
 
         si_pi = kzalloc(sizeof(struct si_power_info), GFP_KERNEL);
         if (si_pi == NULL)
@@ -7336,11 +7314,9 @@ static int si_dpm_init(struct amdgpu_device *adev)
         eg_pi = &ni_pi->eg;
         pi = &eg_pi->rv7xx;
 
-        ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask);
-        if (ret)
-                si_pi->sys_pcie_mask = 0;
-        else
-                si_pi->sys_pcie_mask = mask;
+        si_pi->sys_pcie_mask =
+                (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_MASK) >>
+                CAIL_PCIE_LINK_SPEED_SUPPORT_SHIFT;
         si_pi->force_pcie_gen = AMDGPU_PCIE_GEN_INVALID;
         si_pi->boot_pcie_gen = si_get_current_pcie_speed(adev);
 
diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
index b2bfedaf57f1..9bab4842cd44 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
@@ -1618,7 +1618,7 @@ static const struct amdgpu_ring_funcs uvd_v6_0_enc_ring_vm_funcs = {
         .set_wptr = uvd_v6_0_enc_ring_set_wptr,
         .emit_frame_size =
                 4 + /* uvd_v6_0_enc_ring_emit_pipeline_sync */
-                6 + /* uvd_v6_0_enc_ring_emit_vm_flush */
+                5 + /* uvd_v6_0_enc_ring_emit_vm_flush */
                 5 + 5 + /* uvd_v6_0_enc_ring_emit_fence x2 vm fence */
                 1, /* uvd_v6_0_enc_ring_insert_end */
         .emit_ib_size = 5, /* uvd_v6_0_enc_ring_emit_ib */
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 1ce4c98385e3..c345e645f1d7 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -629,11 +629,13 @@ static int dm_resume(void *handle)
 {
         struct amdgpu_device *adev = handle;
         struct amdgpu_display_manager *dm = &adev->dm;
+        int ret = 0;
 
         /* power on hardware */
         dc_set_power_state(dm->dc, DC_ACPI_CM_POWER_STATE_D0);
 
-        return 0;
+        ret = amdgpu_dm_display_resume(adev);
+        return ret;
 }
 
 int amdgpu_dm_display_resume(struct amdgpu_device *adev)
@@ -1035,6 +1037,10 @@ static void handle_hpd_rx_irq(void *param)
                         !is_mst_root_connector) {
                 /* Downstream Port status changed. */
                 if (dc_link_detect(dc_link, DETECT_REASON_HPDRX)) {
+
+                        if (aconnector->fake_enable)
+                                aconnector->fake_enable = false;
+
                         amdgpu_dm_update_connector_after_detect(aconnector);
 
 
@@ -2010,30 +2016,32 @@ static void update_stream_scaling_settings(const struct drm_display_mode *mode,
         dst.width = stream->timing.h_addressable;
         dst.height = stream->timing.v_addressable;
 
-        rmx_type = dm_state->scaling;
-        if (rmx_type == RMX_ASPECT || rmx_type == RMX_OFF) {
-                if (src.width * dst.height <
-                                src.height * dst.width) {
-                        /* height needs less upscaling/more downscaling */
-                        dst.width = src.width *
-                                        dst.height / src.height;
-                } else {
-                        /* width needs less upscaling/more downscaling */
-                        dst.height = src.height *
-                                        dst.width / src.width;
+        if (dm_state) {
+                rmx_type = dm_state->scaling;
+                if (rmx_type == RMX_ASPECT || rmx_type == RMX_OFF) {
+                        if (src.width * dst.height <
+                                        src.height * dst.width) {
+                                /* height needs less upscaling/more downscaling */
+                                dst.width = src.width *
+                                                dst.height / src.height;
+                        } else {
+                                /* width needs less upscaling/more downscaling */
+                                dst.height = src.height *
+                                                dst.width / src.width;
+                        }
+                } else if (rmx_type == RMX_CENTER) {
+                        dst = src;
                 }
-        } else if (rmx_type == RMX_CENTER) {
-                dst = src;
-        }
 
-        dst.x = (stream->timing.h_addressable - dst.width) / 2;
-        dst.y = (stream->timing.v_addressable - dst.height) / 2;
+                dst.x = (stream->timing.h_addressable - dst.width) / 2;
+                dst.y = (stream->timing.v_addressable - dst.height) / 2;
 
-        if (dm_state->underscan_enable) {
-                dst.x += dm_state->underscan_hborder / 2;
-                dst.y += dm_state->underscan_vborder / 2;
-                dst.width -= dm_state->underscan_hborder;
-                dst.height -= dm_state->underscan_vborder;
+                if (dm_state->underscan_enable) {
+                        dst.x += dm_state->underscan_hborder / 2;
+                        dst.y += dm_state->underscan_vborder / 2;
+                        dst.width -= dm_state->underscan_hborder;
+                        dst.height -= dm_state->underscan_vborder;
+                }
         }
 
         stream->src = src;
@@ -2358,12 +2366,7 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
 
         if (aconnector == NULL) {
                 DRM_ERROR("aconnector is NULL!\n");
-                goto drm_connector_null;
-        }
-
-        if (dm_state == NULL) {
-                DRM_ERROR("dm_state is NULL!\n");
-                goto dm_state_null;
+                return stream;
         }
 
         drm_connector = &aconnector->base;
@@ -2375,18 +2378,18 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
                  */
                 if (aconnector->mst_port) {
                         dm_dp_mst_dc_sink_create(drm_connector);
-                        goto mst_dc_sink_create_done;
+                        return stream;
                 }
 
                 if (create_fake_sink(aconnector))
-                        goto stream_create_fail;
+                        return stream;
         }
 
         stream = dc_create_stream_for_sink(aconnector->dc_sink);
 
         if (stream == NULL) {
                 DRM_ERROR("Failed to create stream for sink!\n");
-                goto stream_create_fail;
+                return stream;
         }
 
         list_for_each_entry(preferred_mode, &aconnector->base.modes, head) {
@@ -2412,9 +2415,12 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
         } else {
                 decide_crtc_timing_for_drm_display_mode(
                                 &mode, preferred_mode,
-                                dm_state->scaling != RMX_OFF);
+                                dm_state ? (dm_state->scaling != RMX_OFF) : false);
         }
 
+        if (!dm_state)
+                drm_mode_set_crtcinfo(&mode, 0);
+
         fill_stream_properties_from_drm_display_mode(stream,
                         &mode, &aconnector->base);
         update_stream_scaling_settings(&mode, dm_state, stream);
@@ -2424,10 +2430,8 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
                 drm_connector,
                 aconnector->dc_sink);
 
-stream_create_fail:
-dm_state_null:
-drm_connector_null:
-mst_dc_sink_create_done:
+        update_stream_signal(stream);
+
         return stream;
 }
 
@@ -2495,6 +2499,27 @@ dm_crtc_duplicate_state(struct drm_crtc *crtc)
         return &state->base;
 }
 
+
+static inline int dm_set_vblank(struct drm_crtc *crtc, bool enable)
+{
+        enum dc_irq_source irq_source;
+        struct amdgpu_crtc *acrtc = to_amdgpu_crtc(crtc);
+        struct amdgpu_device *adev = crtc->dev->dev_private;
+
+        irq_source = IRQ_TYPE_VBLANK + acrtc->otg_inst;
+        return dc_interrupt_set(adev->dm.dc, irq_source, enable) ? 0 : -EBUSY;
+}
+
+static int dm_enable_vblank(struct drm_crtc *crtc)
+{
+        return dm_set_vblank(crtc, true);
+}
+
+static void dm_disable_vblank(struct drm_crtc *crtc)
+{
+        dm_set_vblank(crtc, false);
+}
+
 /* Implemented only the options currently availible for the driver */
 static const struct drm_crtc_funcs amdgpu_dm_crtc_funcs = {
         .reset = dm_crtc_reset_state,
@@ -2504,6 +2529,8 @@ static const struct drm_crtc_funcs amdgpu_dm_crtc_funcs = {
         .page_flip = drm_atomic_helper_page_flip,
         .atomic_duplicate_state = dm_crtc_duplicate_state,
         .atomic_destroy_state = dm_crtc_destroy_state,
+        .enable_vblank = dm_enable_vblank,
+        .disable_vblank = dm_disable_vblank,
 };
 
 static enum drm_connector_status
@@ -2798,7 +2825,7 @@ int amdgpu_dm_connector_mode_valid(struct drm_connector *connector,
                 goto fail;
         }
 
-        stream = dc_create_stream_for_sink(dc_sink);
+        stream = create_stream_for_sink(aconnector, mode, NULL);
         if (stream == NULL) {
                 DRM_ERROR("Failed to create stream for sink!\n");
                 goto fail;
@@ -3058,6 +3085,9 @@ static int dm_plane_atomic_check(struct drm_plane *plane,
         if (!dm_plane_state->dc_state)
                 return 0;
 
+        if (!fill_rects_from_plane_state(state, dm_plane_state->dc_state))
+                return -EINVAL;
+
         if (dc_validate_plane(dc, dm_plane_state->dc_state) == DC_OK)
                 return 0;
 
@@ -4630,8 +4660,6 @@ static int dm_update_planes_state(struct dc *dc,
         bool pflip_needed  = !state->allow_modeset;
         int ret = 0;
 
-        if (pflip_needed)
-                return ret;
 
         /* Add new planes */
         for_each_oldnew_plane_in_state(state, plane, old_plane_state, new_plane_state, i) {
@@ -4646,6 +4674,8 @@ static int dm_update_planes_state(struct dc *dc,
 
                 /* Remove any changed/removed planes */
                 if (!enable) {
+                        if (pflip_needed)
+                                continue;
 
                         if (!old_plane_crtc)
                                 continue;
@@ -4677,6 +4707,7 @@ static int dm_update_planes_state(struct dc *dc,
                         *lock_and_validation_needed = true;
 
                 } else { /* Add new planes */
+                        struct dc_plane_state *dc_new_plane_state;
 
                         if (drm_atomic_plane_disabling(plane->state, new_plane_state))
                                 continue;
@@ -4690,38 +4721,50 @@ static int dm_update_planes_state(struct dc *dc,
                         if (!dm_new_crtc_state->stream)
                                 continue;
 
+                        if (pflip_needed)
+                                continue;
 
                         WARN_ON(dm_new_plane_state->dc_state);
 
-                        dm_new_plane_state->dc_state = dc_create_plane_state(dc);
-
-                        DRM_DEBUG_DRIVER("Enabling DRM plane: %d on DRM crtc %d\n",
-                                        plane->base.id, new_plane_crtc->base.id);
-
-                        if (!dm_new_plane_state->dc_state) {
+                        dc_new_plane_state = dc_create_plane_state(dc);
+                        if (!dc_new_plane_state) {
                                 ret = -EINVAL;
                                 return ret;
                         }
 
+                        DRM_DEBUG_DRIVER("Enabling DRM plane: %d on DRM crtc %d\n",
+                                        plane->base.id, new_plane_crtc->base.id);
+
                         ret = fill_plane_attributes(
                                 new_plane_crtc->dev->dev_private,
-                                dm_new_plane_state->dc_state,
+                                dc_new_plane_state,
                                 new_plane_state,
                                 new_crtc_state);
-                        if (ret)
+                        if (ret) {
+                                dc_plane_state_release(dc_new_plane_state);
                                 return ret;
+                        }
 
-
+                        /*
+                         * Any atomic check errors that occur after this will
+                         * not need a release. The plane state will be attached
+                         * to the stream, and therefore part of the atomic
+                         * state. It'll be released when the atomic state is
+                         * cleaned.
+                         */
                         if (!dc_add_plane_to_context(
                                         dc,
                                         dm_new_crtc_state->stream,
-                                        dm_new_plane_state->dc_state,
+                                        dc_new_plane_state,
                                         dm_state->context)) {
 
+                                dc_plane_state_release(dc_new_plane_state);
                                 ret = -EINVAL;
                                 return ret;
                         }
 
+                        dm_new_plane_state->dc_state = dc_new_plane_state;
+
                         /* Tell DC to do a full surface update every time there
                          * is a plane change. Inefficient, but works for now.
                          */
@@ -4735,6 +4778,30 @@ static int dm_update_planes_state(struct dc *dc,
         return ret;
 }
 
+static int dm_atomic_check_plane_state_fb(struct drm_atomic_state *state,
+                                          struct drm_crtc *crtc)
+{
+        struct drm_plane *plane;
+        struct drm_crtc_state *crtc_state;
+
+        WARN_ON(!drm_atomic_get_new_crtc_state(state, crtc));
+
+        drm_for_each_plane_mask(plane, state->dev, crtc->state->plane_mask) {
+                struct drm_plane_state *plane_state =
+                        drm_atomic_get_plane_state(state, plane);
+
+                if (IS_ERR(plane_state))
+                        return -EDEADLK;
+
+                crtc_state = drm_atomic_get_crtc_state(plane_state->state, crtc);
+                if (crtc->primary == plane && crtc_state->active) {
+                        if (!plane_state->fb)
+                                return -EINVAL;
+                }
+        }
+        return 0;
+}
+
 static int amdgpu_dm_atomic_check(struct drm_device *dev,
                                   struct drm_atomic_state *state)
 {
@@ -4758,6 +4825,10 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev,
                 goto fail;
 
         for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) {
+                ret = dm_atomic_check_plane_state_fb(state, crtc);
+                if (ret)
+                        goto fail;
+
                 if (!drm_atomic_crtc_needs_modeset(new_crtc_state) &&
                     !new_crtc_state->color_mgmt_changed)
                         continue;
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
index 1874b6cee6af..422055080df4 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
@@ -683,10 +683,8 @@ static const struct amdgpu_irq_src_funcs dm_hpd_irq_funcs = {
 
 void amdgpu_dm_set_irq_funcs(struct amdgpu_device *adev)
 {
-        if (adev->mode_info.num_crtc > 0)
-                adev->crtc_irq.num_types = AMDGPU_CRTC_IRQ_VLINE1 + adev->mode_info.num_crtc;
-        else
-                adev->crtc_irq.num_types = 0;
+
+        adev->crtc_irq.num_types = adev->mode_info.num_crtc;
         adev->crtc_irq.funcs = &dm_crtc_irq_funcs;
 
         adev->pageflip_irq.num_types = adev->mode_info.num_crtc;
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
index f3d87f418d2e..93421dad21bd 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
@@ -189,6 +189,12 @@ void dm_dp_mst_dc_sink_create(struct drm_connector *connector)
                         .link = aconnector->dc_link,
                         .sink_signal = SIGNAL_TYPE_DISPLAY_PORT_MST };
 
+        /*
+         * TODO: Need to further figure out why ddc.algo is NULL while MST port exists
+         */
+        if (!aconnector->port || !aconnector->port->aux.ddc.algo)
+                return;
+
         edid = drm_dp_mst_get_edid(connector, &aconnector->mst_port->mst_mgr, aconnector->port);
 
         if (!edid) {
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 35e84ed031de..12868c769606 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -1358,13 +1358,13 @@ enum dc_irq_source dc_interrupt_to_irq_source(
         return dal_irq_service_to_irq_source(dc->res_pool->irqs, src_id, ext_id);
 }
 
-void dc_interrupt_set(struct dc *dc, enum dc_irq_source src, bool enable)
+bool dc_interrupt_set(struct dc *dc, enum dc_irq_source src, bool enable)
 {
 
         if (dc == NULL)
-                return;
+                return false;
 
-        dal_irq_service_set(dc->res_pool->irqs, src, enable);
+        return dal_irq_service_set(dc->res_pool->irqs, src, enable);
 }
 
 void dc_interrupt_ack(struct dc *dc, enum dc_irq_source src)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index a37428271573..be5546181fa8 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -1749,8 +1749,7 @@ static void enable_link_hdmi(struct pipe_ctx *pipe_ctx)
                         link->link_enc,
                         pipe_ctx->clock_source->id,
                         display_color_depth,
-                        pipe_ctx->stream->signal == SIGNAL_TYPE_HDMI_TYPE_A,
-                        pipe_ctx->stream->signal == SIGNAL_TYPE_DVI_DUAL_LINK,
+                        pipe_ctx->stream->signal,
                         stream->phy_pix_clk);
 
         if (pipe_ctx->stream->signal == SIGNAL_TYPE_HDMI_TYPE_A)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
index 33d91e4474ea..639421a00ab6 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
@@ -1465,7 +1465,7 @@ void decide_link_settings(struct dc_stream_state *stream,
         /* MST doesn't perform link training for now
          * TODO: add MST specific link training routine
          */
-        if (is_mst_supported(link)) {
+        if (stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST) {
                 *link_setting = link->verified_link_cap;
                 return;
         }
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
index 95b8dd0e53c6..4d07ffebfd31 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
@@ -1360,9 +1360,6 @@ bool dc_is_stream_scaling_unchanged(
         return true;
 }
 
-/* Maximum TMDS single link pixel clock 165MHz */
-#define TMDS_MAX_PIXEL_CLOCK_IN_KHZ 165000
-
 static void update_stream_engine_usage(
                 struct resource_context *res_ctx,
                 const struct resource_pool *pool,
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index 261811e0c094..cd5819789d76 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -33,8 +33,7 @@
 /*******************************************************************************
  * Private functions
  ******************************************************************************/
-#define TMDS_MAX_PIXEL_CLOCK_IN_KHZ_UPMOST 297000
-static void update_stream_signal(struct dc_stream_state *stream)
+void update_stream_signal(struct dc_stream_state *stream)
 {
 
         struct dc_sink *dc_sink = stream->sink;
@@ -45,8 +44,9 @@ static void update_stream_signal(struct dc_stream_state *stream)
                 stream->signal = dc_sink->sink_signal;
 
         if (dc_is_dvi_signal(stream->signal)) {
-                if (stream->timing.pix_clk_khz > TMDS_MAX_PIXEL_CLOCK_IN_KHZ_UPMOST &&
-                        stream->sink->sink_signal != SIGNAL_TYPE_DVI_SINGLE_LINK)
+                if (stream->ctx->dc->caps.dual_link_dvi &&
+                    stream->timing.pix_clk_khz > TMDS_MAX_PIXEL_CLOCK &&
+                    stream->sink->sink_signal != SIGNAL_TYPE_DVI_SINGLE_LINK)
                         stream->signal = SIGNAL_TYPE_DVI_DUAL_LINK;
                 else
                         stream->signal = SIGNAL_TYPE_DVI_SINGLE_LINK;
@@ -193,44 +193,20 @@ bool dc_stream_set_cursor_attributes(
 
         core_dc = stream->ctx->dc;
         res_ctx = &core_dc->current_state->res_ctx;
+        stream->cursor_attributes = *attributes;
 
         for (i = 0; i < MAX_PIPES; i++) {
                 struct pipe_ctx *pipe_ctx = &res_ctx->pipe_ctx[i];
 
-                if (pipe_ctx->stream != stream || (!pipe_ctx->plane_res.xfm && !pipe_ctx->plane_res.dpp))
+                if (pipe_ctx->stream != stream || (!pipe_ctx->plane_res.xfm &&
+                    !pipe_ctx->plane_res.dpp) || !pipe_ctx->plane_res.ipp)
                         continue;
                 if (pipe_ctx->top_pipe && pipe_ctx->plane_state != pipe_ctx->top_pipe->plane_state)
                         continue;
 
 
-                if (pipe_ctx->plane_res.ipp->funcs->ipp_cursor_set_attributes != NULL)
-                        pipe_ctx->plane_res.ipp->funcs->ipp_cursor_set_attributes(
-                                                pipe_ctx->plane_res.ipp, attributes);
-
-                if (pipe_ctx->plane_res.hubp != NULL &&
-                                pipe_ctx->plane_res.hubp->funcs->set_cursor_attributes != NULL)
-                        pipe_ctx->plane_res.hubp->funcs->set_cursor_attributes(
-                                        pipe_ctx->plane_res.hubp, attributes);
-
-                if (pipe_ctx->plane_res.mi != NULL &&
-                                pipe_ctx->plane_res.mi->funcs->set_cursor_attributes != NULL)
-                        pipe_ctx->plane_res.mi->funcs->set_cursor_attributes(
-                                        pipe_ctx->plane_res.mi, attributes);
-
-
-                if (pipe_ctx->plane_res.xfm != NULL &&
-                                pipe_ctx->plane_res.xfm->funcs->set_cursor_attributes != NULL)
-                        pipe_ctx->plane_res.xfm->funcs->set_cursor_attributes(
-                                pipe_ctx->plane_res.xfm, attributes);
-
-                if (pipe_ctx->plane_res.dpp != NULL &&
-                                pipe_ctx->plane_res.dpp->funcs->set_cursor_attributes != NULL)
-                        pipe_ctx->plane_res.dpp->funcs->set_cursor_attributes(
-                                pipe_ctx->plane_res.dpp, attributes->color_format);
+                core_dc->hwss.set_cursor_attribute(pipe_ctx);
         }
-
-        stream->cursor_attributes = *attributes;
-
         return true;
 }
 
@@ -254,55 +230,21 @@ bool dc_stream_set_cursor_position(
 
         core_dc = stream->ctx->dc;
         res_ctx = &core_dc->current_state->res_ctx;
+        stream->cursor_position = *position;
 
         for (i = 0; i < MAX_PIPES; i++) {
                 struct pipe_ctx *pipe_ctx = &res_ctx->pipe_ctx[i];
-                struct input_pixel_processor *ipp = pipe_ctx->plane_res.ipp;
-                struct mem_input *mi = pipe_ctx->plane_res.mi;
-                struct hubp *hubp = pipe_ctx->plane_res.hubp;
-                struct dpp *dpp = pipe_ctx->plane_res.dpp;
-                struct dc_cursor_position pos_cpy = *position;
-                struct dc_cursor_mi_param param = {
-                        .pixel_clk_khz = stream->timing.pix_clk_khz,
-                        .ref_clk_khz = core_dc->res_pool->ref_clock_inKhz,
-                        .viewport_x_start = pipe_ctx->plane_res.scl_data.viewport.x,
-                        .viewport_width = pipe_ctx->plane_res.scl_data.viewport.width,
-                        .h_scale_ratio = pipe_ctx->plane_res.scl_data.ratios.horz
-                };
 
                 if (pipe_ctx->stream != stream ||
                                 (!pipe_ctx->plane_res.mi  && !pipe_ctx->plane_res.hubp) ||
                                 !pipe_ctx->plane_state ||
-                                (!pipe_ctx->plane_res.xfm && !pipe_ctx->plane_res.dpp))
-                        continue;
-
-                if (pipe_ctx->plane_state->address.type
-                                == PLN_ADDR_TYPE_VIDEO_PROGRESSIVE)
-                        pos_cpy.enable = false;
-
-                if (pipe_ctx->top_pipe && pipe_ctx->plane_state != pipe_ctx->top_pipe->plane_state)
-                        pos_cpy.enable = false;
-
-
-                if (ipp != NULL && ipp->funcs->ipp_cursor_set_position != NULL)
-                        ipp->funcs->ipp_cursor_set_position(ipp, &pos_cpy, &param);
-
-                if (mi != NULL && mi->funcs->set_cursor_position != NULL)
-                        mi->funcs->set_cursor_position(mi, &pos_cpy, &param);
-
-                if (!hubp)
+                                (!pipe_ctx->plane_res.xfm && !pipe_ctx->plane_res.dpp) ||
+                                !pipe_ctx->plane_res.ipp)
                         continue;
 
-                if (hubp->funcs->set_cursor_position != NULL)
-                        hubp->funcs->set_cursor_position(hubp, &pos_cpy, &param);
-
-                if (dpp != NULL && dpp->funcs->set_cursor_position != NULL)
-                        dpp->funcs->set_cursor_position(dpp, &pos_cpy, &param, hubp->curs_attr.width);
-
+                core_dc->hwss.set_cursor_position(pipe_ctx);
         }
 
-        stream->cursor_position = *position;
-
         return true;
 }
 
diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h
index e2e3c9df79ea..d6d56611604e 100644
--- a/drivers/gpu/drm/amd/display/dc/dc.h
+++ b/drivers/gpu/drm/amd/display/dc/dc.h
@@ -62,6 +62,7 @@ struct dc_caps {
         bool dcc_const_color;
         bool dynamic_audio;
         bool is_apu;
+        bool dual_link_dvi;
 };
 
 struct dc_dcc_surface_param {
@@ -672,7 +673,7 @@ enum dc_irq_source dc_interrupt_to_irq_source(
                 struct dc *dc,
                 uint32_t src_id,
                 uint32_t ext_id);
-void dc_interrupt_set(struct dc *dc, enum dc_irq_source src, bool enable);
+bool dc_interrupt_set(struct dc *dc, enum dc_irq_source src, bool enable);
 void dc_interrupt_ack(struct dc *dc, enum dc_irq_source src);
 enum dc_irq_source dc_get_hpd_irq_source_at_index(
                 struct dc *dc, uint32_t link_index);
diff --git a/drivers/gpu/drm/amd/display/dc/dc_stream.h b/drivers/gpu/drm/amd/display/dc/dc_stream.h
index 01c60f11b2bd..456e4d29eadd 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_stream.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_stream.h
@@ -237,6 +237,8 @@ enum surface_update_type dc_check_update_surfaces_for_stream(
  */
 struct dc_stream_state *dc_create_stream_for_sink(struct dc_sink *dc_sink);
 
+void update_stream_signal(struct dc_stream_state *stream);
+
 void dc_stream_retain(struct dc_stream_state *dc_stream);
 void dc_stream_release(struct dc_stream_state *dc_stream);
 
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_hwseq.h b/drivers/gpu/drm/amd/display/dc/dce/dce_hwseq.h
index b73db9e78437..a993279a8f2d 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_hwseq.h
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_hwseq.h
@@ -236,6 +236,7 @@
         SR(D2VGA_CONTROL), \
         SR(D3VGA_CONTROL), \
         SR(D4VGA_CONTROL), \
+        SR(VGA_TEST_CONTROL), \
         SR(DC_IP_REQUEST_CNTL), \
         BL_REG_LIST()
 
@@ -337,6 +338,7 @@ struct dce_hwseq_registers {
         uint32_t D2VGA_CONTROL;
         uint32_t D3VGA_CONTROL;
         uint32_t D4VGA_CONTROL;
+        uint32_t VGA_TEST_CONTROL;
         /* MMHUB registers. read only. temporary hack */
         uint32_t VM_CONTEXT0_PAGE_TABLE_BASE_ADDR_HI32;
         uint32_t VM_CONTEXT0_PAGE_TABLE_BASE_ADDR_LO32;
@@ -493,6 +495,9 @@ struct dce_hwseq_registers {
         HWS_SF(, DOMAIN6_PG_STATUS, DOMAIN6_PGFSM_PWR_STATUS, mask_sh), \
         HWS_SF(, DOMAIN7_PG_STATUS, DOMAIN7_PGFSM_PWR_STATUS, mask_sh), \
         HWS_SF(, DC_IP_REQUEST_CNTL, IP_REQUEST_EN, mask_sh), \
+        HWS_SF(, D1VGA_CONTROL, D1VGA_MODE_ENABLE, mask_sh),\
+        HWS_SF(, VGA_TEST_CONTROL, VGA_TEST_ENABLE, mask_sh),\
+        HWS_SF(, VGA_TEST_CONTROL, VGA_TEST_RENDER_START, mask_sh),\
         HWS_SF(, LVTMA_PWRSEQ_CNTL, LVTMA_BLON, mask_sh), \
         HWS_SF(, LVTMA_PWRSEQ_STATE, LVTMA_PWRSEQ_TARGET_STATE_R, mask_sh)
 
@@ -583,7 +588,10 @@ struct dce_hwseq_registers {
         type DCFCLK_GATE_DIS; \
         type DCHUBBUB_GLOBAL_TIMER_REFDIV; \
         type DENTIST_DPPCLK_WDIVIDER; \
-        type DENTIST_DISPCLK_WDIVIDER;
+        type DENTIST_DISPCLK_WDIVIDER; \
+        type VGA_TEST_ENABLE; \
+        type VGA_TEST_RENDER_START; \
+        type D1VGA_MODE_ENABLE;
 
 struct dce_hwseq_shift {
         HWSEQ_REG_FIELD_LIST(uint8_t)
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
index a266e3f5e75f..e4741f1a2b01 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
@@ -82,13 +82,6 @@
 #define DCE110_DIG_FE_SOURCE_SELECT_DIGF 0x20
 #define DCE110_DIG_FE_SOURCE_SELECT_DIGG 0x40
 
-/* Minimum pixel clock, in KHz. For TMDS signal is 25.00 MHz */
-#define TMDS_MIN_PIXEL_CLOCK 25000
-/* Maximum pixel clock, in KHz. For TMDS signal is 165.00 MHz */
-#define TMDS_MAX_PIXEL_CLOCK 165000
-/* For current ASICs pixel clock - 600MHz */
-#define MAX_ENCODER_CLOCK 600000
-
 enum {
         DP_MST_UPDATE_MAX_RETRY = 50
 };
@@ -683,6 +676,7 @@ void dce110_link_encoder_construct(
 {
         struct bp_encoder_cap_info bp_cap_info = {0};
         const struct dc_vbios_funcs *bp_funcs = init_data->ctx->dc_bios->funcs;
+        enum bp_result result = BP_RESULT_OK;
 
         enc110->base.funcs = &dce110_lnk_enc_funcs;
         enc110->base.ctx = init_data->ctx;
@@ -757,15 +751,24 @@ void dce110_link_encoder_construct(
                 enc110->base.preferred_engine = ENGINE_ID_UNKNOWN;
         }
 
+        /* default to one to mirror Windows behavior */
+        enc110->base.features.flags.bits.HDMI_6GB_EN = 1;
+
+        result = bp_funcs->get_encoder_cap_info(enc110->base.ctx->dc_bios,
+                                                enc110->base.id, &bp_cap_info);
+
         /* Override features with DCE-specific values */
-        if (BP_RESULT_OK == bp_funcs->get_encoder_cap_info(
-                        enc110->base.ctx->dc_bios, enc110->base.id,
-                        &bp_cap_info)) {
+        if (BP_RESULT_OK == result) {
                 enc110->base.features.flags.bits.IS_HBR2_CAPABLE =
                                 bp_cap_info.DP_HBR2_EN;
                 enc110->base.features.flags.bits.IS_HBR3_CAPABLE =
                                 bp_cap_info.DP_HBR3_EN;
                 enc110->base.features.flags.bits.HDMI_6GB_EN = bp_cap_info.HDMI_6GB_EN;
+        } else {
+                dm_logger_write(enc110->base.ctx->logger, LOG_WARNING,
+                                "%s: Failed to get encoder_cap_info from VBIOS with error code %d!\n",
+                                __func__,
+                                result);
         }
 }
 
@@ -904,8 +907,7 @@ void dce110_link_encoder_enable_tmds_output(
         struct link_encoder *enc,
         enum clock_source_id clock_source,
         enum dc_color_depth color_depth,
-        bool hdmi,
-        bool dual_link,
+        enum signal_type signal,
         uint32_t pixel_clock)
 {
         struct dce110_link_encoder *enc110 = TO_DCE110_LINK_ENC(enc);
@@ -919,16 +921,12 @@ void dce110_link_encoder_enable_tmds_output(
         cntl.engine_id = enc->preferred_engine;
         cntl.transmitter = enc110->base.transmitter;
         cntl.pll_id = clock_source;
-        if (hdmi) {
-                cntl.signal = SIGNAL_TYPE_HDMI_TYPE_A;
-                cntl.lanes_number = 4;
-        } else if (dual_link) {
-                cntl.signal = SIGNAL_TYPE_DVI_DUAL_LINK;
+        cntl.signal = signal;
+        if (cntl.signal == SIGNAL_TYPE_DVI_DUAL_LINK)
                 cntl.lanes_number = 8;
-        } else {
-                cntl.signal = SIGNAL_TYPE_DVI_SINGLE_LINK;
+        else
                 cntl.lanes_number = 4;
-        }
+
         cntl.hpd_sel = enc110->base.hpd_source;
 
         cntl.pixel_clock = pixel_clock;
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h
index 8ca9afe47a2b..0ec3433d34b6 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h
@@ -210,8 +210,7 @@ void dce110_link_encoder_enable_tmds_output(
         struct link_encoder *enc,
         enum clock_source_id clock_source,
         enum dc_color_depth color_depth,
-        bool hdmi,
-        bool dual_link,
+        enum signal_type signal,
         uint32_t pixel_clock);
 
 /* enables DP PHY output */
diff --git a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
index 3ea43e2a9450..442dd2d93618 100644
--- a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
@@ -852,6 +852,7 @@ static bool construct(
         dc->caps.max_downscale_ratio = 200;
         dc->caps.i2c_speed_in_khz = 40;
         dc->caps.max_cursor_size = 128;
+        dc->caps.dual_link_dvi = true;
 
         for (i = 0; i < pool->base.pipe_count; i++) {
                 pool->base.timing_generators[i] =
diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
index 86cdd7b4811f..6f382a3ac90f 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
@@ -688,15 +688,22 @@ void dce110_enable_stream(struct pipe_ctx *pipe_ctx)
         struct dc_crtc_timing *timing = &pipe_ctx->stream->timing;
         struct dc_link *link = pipe_ctx->stream->sink->link;
 
-        /* 1. update AVI info frame (HDMI, DP)
-         * we always need to update info frame
-        */
+
         uint32_t active_total_with_borders;
         uint32_t early_control = 0;
         struct timing_generator *tg = pipe_ctx->stream_res.tg;
 
-        /* TODOFPGA may change to hwss.update_info_frame */
+        /* For MST, there are multiply stream go to only one link.
+         * connect DIG back_end to front_end while enable_stream and
+         * disconnect them during disable_stream
+         * BY this, it is logic clean to separate stream and link */
+        link->link_enc->funcs->connect_dig_be_to_fe(link->link_enc,
+                                                    pipe_ctx->stream_res.stream_enc->id, true);
+
+        /* update AVI info frame (HDMI, DP)*/
+        /* TODO: FPGA may change to hwss.update_info_frame */
         dce110_update_info_frame(pipe_ctx);
+
         /* enable early control to avoid corruption on DP monitor*/
         active_total_with_borders =
                         timing->h_addressable
@@ -717,12 +724,8 @@ void dce110_enable_stream(struct pipe_ctx *pipe_ctx)
                         pipe_ctx->stream_res.stream_enc->funcs->dp_audio_enable(pipe_ctx->stream_res.stream_enc);
         }
 
-        /* For MST, there are multiply stream go to only one link.
-         * connect DIG back_end to front_end while enable_stream and
-         * disconnect them during disable_stream
-         * BY this, it is logic clean to separate stream and link */
-        link->link_enc->funcs->connect_dig_be_to_fe(link->link_enc,
-                                                    pipe_ctx->stream_res.stream_enc->id, true);
+
+
 
 }
 
@@ -1690,9 +1693,13 @@ static void apply_min_clocks(
  *  Check if FBC can be enabled
  */
 static bool should_enable_fbc(struct dc *dc,
-                              struct dc_state *context)
+                              struct dc_state *context,
+                              uint32_t *pipe_idx)
 {
-        struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[0];
+        uint32_t i;
+        struct pipe_ctx *pipe_ctx = NULL;
+        struct resource_context *res_ctx = &context->res_ctx;
+
 
         ASSERT(dc->fbc_compressor);
 
@@ -1704,6 +1711,14 @@ static bool should_enable_fbc(struct dc *dc,
         if (context->stream_count != 1)
                 return false;
 
+        for (i = 0; i < dc->res_pool->pipe_count; i++) {
+                if (res_ctx->pipe_ctx[i].stream) {
+                        pipe_ctx = &res_ctx->pipe_ctx[i];
+                        *pipe_idx = i;
+                        break;
+                }
+        }
+
         /* Only supports eDP */
         if (pipe_ctx->stream->sink->link->connector_signal != SIGNAL_TYPE_EDP)
                 return false;
@@ -1729,11 +1744,14 @@ static bool should_enable_fbc(struct dc *dc,
 static void enable_fbc(struct dc *dc,
                        struct dc_state *context)
 {
-        if (should_enable_fbc(dc, context)) {
+        uint32_t pipe_idx = 0;
+
+        if (should_enable_fbc(dc, context, &pipe_idx)) {
                 /* Program GRPH COMPRESSED ADDRESS and PITCH */
                 struct compr_addr_and_pitch_params params = {0, 0, 0};
                 struct compressor *compr = dc->fbc_compressor;
-                struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[0];
+                struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[pipe_idx];
+
 
                 params.source_view_width = pipe_ctx->stream->timing.h_addressable;
                 params.source_view_height = pipe_ctx->stream->timing.v_addressable;
@@ -2915,6 +2933,49 @@ static void program_csc_matrix(struct pipe_ctx *pipe_ctx,
         }
 }
 
+void dce110_set_cursor_position(struct pipe_ctx *pipe_ctx)
+{
+        struct dc_cursor_position pos_cpy = pipe_ctx->stream->cursor_position;
+        struct input_pixel_processor *ipp = pipe_ctx->plane_res.ipp;
+        struct mem_input *mi = pipe_ctx->plane_res.mi;
+        struct dc_cursor_mi_param param = {
+                .pixel_clk_khz = pipe_ctx->stream->timing.pix_clk_khz,
+                .ref_clk_khz = pipe_ctx->stream->ctx->dc->res_pool->ref_clock_inKhz,
+                .viewport_x_start = pipe_ctx->plane_res.scl_data.viewport.x,
+                .viewport_width = pipe_ctx->plane_res.scl_data.viewport.width,
+                .h_scale_ratio = pipe_ctx->plane_res.scl_data.ratios.horz
+        };
+
+        if (pipe_ctx->plane_state->address.type
+                        == PLN_ADDR_TYPE_VIDEO_PROGRESSIVE)
+                pos_cpy.enable = false;
+
+        if (pipe_ctx->top_pipe && pipe_ctx->plane_state != pipe_ctx->top_pipe->plane_state)
+                pos_cpy.enable = false;
+
+        if (ipp->funcs->ipp_cursor_set_position)
+                ipp->funcs->ipp_cursor_set_position(ipp, &pos_cpy, &param);
+        if (mi->funcs->set_cursor_position)
+                mi->funcs->set_cursor_position(mi, &pos_cpy, &param);
+}
+
+void dce110_set_cursor_attribute(struct pipe_ctx *pipe_ctx)
+{
+        struct dc_cursor_attributes *attributes = &pipe_ctx->stream->cursor_attributes;
+
+        if (pipe_ctx->plane_res.ipp->funcs->ipp_cursor_set_attributes)
+                pipe_ctx->plane_res.ipp->funcs->ipp_cursor_set_attributes(
+                                pipe_ctx->plane_res.ipp, attributes);
+
+        if (pipe_ctx->plane_res.mi->funcs->set_cursor_attributes)
+                pipe_ctx->plane_res.mi->funcs->set_cursor_attributes(
+                                pipe_ctx->plane_res.mi, attributes);
+
+        if (pipe_ctx->plane_res.xfm->funcs->set_cursor_attributes)
+                pipe_ctx->plane_res.xfm->funcs->set_cursor_attributes(
+                                pipe_ctx->plane_res.xfm, attributes);
+}
+
 static void ready_shared_resources(struct dc *dc, struct dc_state *context) {}
 
 static void optimize_shared_resources(struct dc *dc) {}
@@ -2957,6 +3018,8 @@ static const struct hw_sequencer_funcs dce110_funcs = {
         .edp_backlight_control = hwss_edp_backlight_control,
         .edp_power_control = hwss_edp_power_control,
         .edp_wait_for_hpd_ready = hwss_edp_wait_for_hpd_ready,
+        .set_cursor_position = dce110_set_cursor_position,
+        .set_cursor_attribute = dce110_set_cursor_attribute
 };
 
 void dce110_hw_sequencer_construct(struct dc *dc)
diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
index 7c4779578fb7..00f18c485e1e 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
@@ -846,6 +846,16 @@ static bool dce110_validate_bandwidth(
         return result;
 }
 
+enum dc_status dce110_validate_plane(const struct dc_plane_state *plane_state,
+                                     struct dc_caps *caps)
+{
+        if (((plane_state->dst_rect.width * 2) < plane_state->src_rect.width) ||
+            ((plane_state->dst_rect.height * 2) < plane_state->src_rect.height))
+                return DC_FAIL_SURFACE_VALIDATE;
+
+        return DC_OK;
+}
+
 static bool dce110_validate_surface_sets(
                 struct dc_state *context)
 {
@@ -869,6 +879,13 @@ static bool dce110_validate_surface_sets(
                                         plane->src_rect.height > 1080))
                                         return false;
 
+                                /* we don't have the logic to support underlay
+                                 * only yet so block the use case where we get
+                                 * NV12 plane as top layer
+                                 */
+                                if (j == 0)
+                                        return false;
+
                                 /* irrespective of plane format,
                                  * stream should be RGB encoded
                                  */
@@ -1021,6 +1038,7 @@ static const struct resource_funcs dce110_res_pool_funcs = {
         .link_enc_create = dce110_link_encoder_create,
         .validate_guaranteed = dce110_validate_guaranteed,
         .validate_bandwidth = dce110_validate_bandwidth,
+        .validate_plane = dce110_validate_plane,
         .acquire_idle_pipe_for_layer = dce110_acquire_underlay,
         .add_stream_to_ctx = dce110_add_stream_to_ctx,
         .validate_global = dce110_validate_global
diff --git a/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c b/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c
index 663e0a047a4b..98d9cd0109e1 100644
--- a/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c
@@ -1103,6 +1103,8 @@ static bool construct(
         dc->caps.max_downscale_ratio = 200;
         dc->caps.i2c_speed_in_khz = 100;
         dc->caps.max_cursor_size = 128;
+        dc->caps.dual_link_dvi = true;
+
 
         /*************************************************
          *  Create resources                             *
diff --git a/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c b/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c
index 57cd67359567..5aab01db28ee 100644
--- a/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c
@@ -835,6 +835,8 @@ static bool construct(
         dc->caps.max_downscale_ratio = 200;
         dc->caps.i2c_speed_in_khz = 100;
         dc->caps.max_cursor_size = 128;
+        dc->caps.dual_link_dvi = true;
+
         dc->debug = debug_defaults;
 
         /*************************************************
diff --git a/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c b/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c
index 8f2bd56f3461..25d7eb1567ae 100644
--- a/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c
@@ -793,6 +793,7 @@ static bool dce80_construct(
         dc->caps.max_downscale_ratio = 200;
         dc->caps.i2c_speed_in_khz = 40;
         dc->caps.max_cursor_size = 128;
+        dc->caps.dual_link_dvi = true;
 
         /*************************************************
          *  Create resources                             *
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index 82572863acab..072e4485e85e 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -238,10 +238,24 @@ static void enable_power_gating_plane(
 static void disable_vga(
         struct dce_hwseq *hws)
 {
+        unsigned int in_vga_mode = 0;
+
+        REG_GET(D1VGA_CONTROL, D1VGA_MODE_ENABLE, &in_vga_mode);
+
+        if (in_vga_mode == 0)
+                return;
+
         REG_WRITE(D1VGA_CONTROL, 0);
-        REG_WRITE(D2VGA_CONTROL, 0);
-        REG_WRITE(D3VGA_CONTROL, 0);
-        REG_WRITE(D4VGA_CONTROL, 0);
+
+        /* HW Engineer's Notes:
+         *  During switch from vga->extended, if we set the VGA_TEST_ENABLE and
+         *  then hit the VGA_TEST_RENDER_START, then the DCHUBP timing gets updated correctly.
+         *
+         *  Then vBIOS will have it poll for the VGA_TEST_RENDER_DONE and unset
+         *  VGA_TEST_ENABLE, to leave it in the same state as before.
+         */
+        REG_UPDATE(VGA_TEST_CONTROL, VGA_TEST_ENABLE, 1);
+        REG_UPDATE(VGA_TEST_CONTROL, VGA_TEST_RENDER_START, 1);
 }
 
 static void dpp_pg_control(
@@ -1761,6 +1775,11 @@ static void update_dchubp_dpp(
                         &pipe_ctx->plane_res.scl_data.viewport_c);
         }
 
+        if (pipe_ctx->stream->cursor_attributes.address.quad_part != 0) {
+                dc->hwss.set_cursor_position(pipe_ctx);
+                dc->hwss.set_cursor_attribute(pipe_ctx);
+        }
+
         if (plane_state->update_flags.bits.full_update) {
                 /*gamut remap*/
                 program_gamut_remap(pipe_ctx);
@@ -2296,7 +2315,7 @@ static bool dcn10_dummy_display_power_gating(
         return true;
 }
 
-void dcn10_update_pending_status(struct pipe_ctx *pipe_ctx)
+static void dcn10_update_pending_status(struct pipe_ctx *pipe_ctx)
 {
         struct dc_plane_state *plane_state = pipe_ctx->plane_state;
         struct timing_generator *tg = pipe_ctx->stream_res.tg;
@@ -2316,12 +2335,46 @@ void dcn10_update_pending_status(struct pipe_ctx *pipe_ctx)
         }
 }
 
-void dcn10_update_dchub(struct dce_hwseq *hws, struct dchub_init_data *dh_data)
+static void dcn10_update_dchub(struct dce_hwseq *hws, struct dchub_init_data *dh_data)
 {
         if (hws->ctx->dc->res_pool->hubbub != NULL)
                 hubbub1_update_dchub(hws->ctx->dc->res_pool->hubbub, dh_data);
 }
 
+static void dcn10_set_cursor_position(struct pipe_ctx *pipe_ctx)
+{
+        struct dc_cursor_position pos_cpy = pipe_ctx->stream->cursor_position;
+        struct hubp *hubp = pipe_ctx->plane_res.hubp;
+        struct dpp *dpp = pipe_ctx->plane_res.dpp;
+        struct dc_cursor_mi_param param = {
+                .pixel_clk_khz = pipe_ctx->stream->timing.pix_clk_khz,
+                .ref_clk_khz = pipe_ctx->stream->ctx->dc->res_pool->ref_clock_inKhz,
+                .viewport_x_start = pipe_ctx->plane_res.scl_data.viewport.x,
+                .viewport_width = pipe_ctx->plane_res.scl_data.viewport.width,
+                .h_scale_ratio = pipe_ctx->plane_res.scl_data.ratios.horz
+        };
+
+        if (pipe_ctx->plane_state->address.type
+                        == PLN_ADDR_TYPE_VIDEO_PROGRESSIVE)
+                pos_cpy.enable = false;
+
+        if (pipe_ctx->top_pipe && pipe_ctx->plane_state != pipe_ctx->top_pipe->plane_state)
+                pos_cpy.enable = false;
+
+        hubp->funcs->set_cursor_position(hubp, &pos_cpy, &param);
+        dpp->funcs->set_cursor_position(dpp, &pos_cpy, &param, hubp->curs_attr.width);
+}
+
+static void dcn10_set_cursor_attribute(struct pipe_ctx *pipe_ctx)
+{
+        struct dc_cursor_attributes *attributes = &pipe_ctx->stream->cursor_attributes;
+
+        pipe_ctx->plane_res.hubp->funcs->set_cursor_attributes(
+                        pipe_ctx->plane_res.hubp, attributes);
+        pipe_ctx->plane_res.dpp->funcs->set_cursor_attributes(
+                pipe_ctx->plane_res.dpp, attributes->color_format);
+}
+
 static const struct hw_sequencer_funcs dcn10_funcs = {
         .program_gamut_remap = program_gamut_remap,
         .program_csc_matrix = program_csc_matrix,
@@ -2362,6 +2415,8 @@ static const struct hw_sequencer_funcs dcn10_funcs = {
         .edp_backlight_control = hwss_edp_backlight_control,
         .edp_power_control = hwss_edp_power_control,
         .edp_wait_for_hpd_ready = hwss_edp_wait_for_hpd_ready,
+        .set_cursor_position = dcn10_set_cursor_position,
+        .set_cursor_attribute = dcn10_set_cursor_attribute
 };
 
 
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/link_encoder.h b/drivers/gpu/drm/amd/display/dc/inc/hw/link_encoder.h
index 0fd329deacd8..54d8a1386142 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw/link_encoder.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/link_encoder.h
@@ -123,8 +123,7 @@ struct link_encoder_funcs {
         void (*enable_tmds_output)(struct link_encoder *enc,
                 enum clock_source_id clock_source,
                 enum dc_color_depth color_depth,
-                bool hdmi,
-                bool dual_link,
+                enum signal_type signal,
                 uint32_t pixel_clock);
         void (*enable_dp_output)(struct link_encoder *enc,
                 const struct dc_link_settings *link_settings,
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h b/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h
index 4c0aa56f7bae..379c6ecd271a 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h
@@ -198,6 +198,9 @@ struct hw_sequencer_funcs {
                         bool enable);
         void (*edp_wait_for_hpd_ready)(struct dc_link *link, bool power_up);
 
+        void (*set_cursor_position)(struct pipe_ctx *pipe);
+        void (*set_cursor_attribute)(struct pipe_ctx *pipe);
+
 };
 
 void color_space_to_black_color(
diff --git a/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c b/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c
index f7e40b292dfb..d3e1923b01a8 100644
--- a/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c
+++ b/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c
@@ -217,7 +217,7 @@ bool dce110_vblank_set(
                         core_dc->current_state->res_ctx.pipe_ctx[pipe_offset].stream_res.tg;
 
         if (enable) {
-                if (!tg->funcs->arm_vert_intr(tg, 2)) {
+                if (!tg || !tg->funcs->arm_vert_intr(tg, 2)) {
                         DC_ERROR("Failed to get VBLANK!\n");
                         return false;
                 }
diff --git a/drivers/gpu/drm/amd/display/dc/virtual/virtual_link_encoder.c b/drivers/gpu/drm/amd/display/dc/virtual/virtual_link_encoder.c
index 57a54a7b89e5..1c079ba37c30 100644
--- a/drivers/gpu/drm/amd/display/dc/virtual/virtual_link_encoder.c
+++ b/drivers/gpu/drm/amd/display/dc/virtual/virtual_link_encoder.c
@@ -42,8 +42,7 @@ static void virtual_link_encoder_enable_tmds_output(
         struct link_encoder *enc,
         enum clock_source_id clock_source,
         enum dc_color_depth color_depth,
-        bool hdmi,
-        bool dual_link,
+        enum signal_type signal,
         uint32_t pixel_clock) {}
 
 static void virtual_link_encoder_enable_dp_output(
diff --git a/drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h b/drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h
index 7a9b43f84a31..36bbad594267 100644
--- a/drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h
+++ b/drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h
@@ -419,11 +419,6 @@ struct bios_event_info {
         bool backlight_changed;
 };
 
-enum {
-        HDMI_PIXEL_CLOCK_IN_KHZ_297 = 297000,
-        TMDS_PIXEL_CLOCK_IN_KHZ_165 = 165000
-};
-
 /*
  * DFS-bypass flag
  */
diff --git a/drivers/gpu/drm/amd/display/include/signal_types.h b/drivers/gpu/drm/amd/display/include/signal_types.h
index b5ebde642207..199c5db67cbc 100644
--- a/drivers/gpu/drm/amd/display/include/signal_types.h
+++ b/drivers/gpu/drm/amd/display/include/signal_types.h
@@ -26,6 +26,11 @@
 #ifndef __DC_SIGNAL_TYPES_H__
 #define __DC_SIGNAL_TYPES_H__
 
+/* Minimum pixel clock, in KHz. For TMDS signal is 25.00 MHz */
+#define TMDS_MIN_PIXEL_CLOCK 25000
+/* Maximum pixel clock, in KHz. For TMDS signal is 165.00 MHz */
+#define TMDS_MAX_PIXEL_CLOCK 165000
+
 enum signal_type {
         SIGNAL_TYPE_NONE                = 0L,           /* no signal */
         SIGNAL_TYPE_DVI_SINGLE_LINK     = (1 << 0),
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
index 41e42beff213..08e8a793714f 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -2756,10 +2756,13 @@ static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
                                     PHM_PlatformCaps_DisableMclkSwitchingForFrameLock);
 
 
-        disable_mclk_switching = ((1 < info.display_count) ||
-                                  disable_mclk_switching_for_frame_lock ||
-                                  smu7_vblank_too_short(hwmgr, mode_info.vblank_time_us) ||
-                                  (mode_info.refresh_rate > 120));
+        if (info.display_count == 0)
+                disable_mclk_switching = false;
+        else
+                disable_mclk_switching = ((1 < info.display_count) ||
+                                          disable_mclk_switching_for_frame_lock ||
+                                          smu7_vblank_too_short(hwmgr, mode_info.vblank_time_us) ||
+                                          (mode_info.refresh_rate > 120));
 
         sclk = smu7_ps->performance_levels[0].engine_clock;
         mclk = smu7_ps->performance_levels[0].memory_clock;
@@ -4534,13 +4537,6 @@ static int smu7_set_power_profile_state(struct pp_hwmgr *hwmgr,
         int tmp_result, result = 0;
         uint32_t sclk_mask = 0, mclk_mask = 0;
 
-        if (hwmgr->chip_id == CHIP_FIJI) {
-                if (request->type == AMD_PP_GFX_PROFILE)
-                        smu7_enable_power_containment(hwmgr);
-                else if (request->type == AMD_PP_COMPUTE_PROFILE)
-                        smu7_disable_power_containment(hwmgr);
-        }
-
         if (hwmgr->dpm_level != AMD_DPM_FORCED_LEVEL_AUTO)
                 return -EINVAL;
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
index 2d55dabc77d4..5f9c3efb532f 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
@@ -3168,10 +3168,13 @@ static int vega10_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
         disable_mclk_switching_for_vr = PP_CAP(PHM_PlatformCaps_DisableMclkSwitchForVR);
         force_mclk_high = PP_CAP(PHM_PlatformCaps_ForceMclkHigh);
 
-        disable_mclk_switching = (info.display_count > 1) ||
-                                    disable_mclk_switching_for_frame_lock ||
-                                    disable_mclk_switching_for_vr ||
-                                    force_mclk_high;
+        if (info.display_count == 0)
+                disable_mclk_switching = false;
+        else
+                disable_mclk_switching = (info.display_count > 1) ||
+                        disable_mclk_switching_for_frame_lock ||
+                        disable_mclk_switching_for_vr ||
+                        force_mclk_high;
 
         sclk = vega10_ps->performance_levels[0].gfx_clock;
         mclk = vega10_ps->performance_levels[0].mem_clock;
diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
index 5a13ff29f4f0..c0530a1af5e3 100644
--- a/drivers/gpu/drm/drm_framebuffer.c
+++ b/drivers/gpu/drm/drm_framebuffer.c
@@ -121,6 +121,10 @@ int drm_mode_addfb(struct drm_device *dev,
         r.pixel_format = drm_mode_legacy_fb_format(or->bpp, or->depth);
         r.handles[0] = or->handle;
 
+        if (r.pixel_format == DRM_FORMAT_XRGB2101010 &&
+            dev->driver->driver_features & DRIVER_PREFER_XBGR_30BPP)
+                r.pixel_format = DRM_FORMAT_XBGR2101010;
+
         ret = drm_mode_addfb2(dev, &r, file_priv);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c
index c8454ac43fae..db6b94dda5df 100644
--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c
+++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c
@@ -471,6 +471,7 @@ struct parser_exec_state {
          * used when ret from 2nd level batch buffer
          */
         int saved_buf_addr_type;
+        bool is_ctx_wa;
 
         struct cmd_info *info;
 
@@ -1715,6 +1716,11 @@ static int perform_bb_shadow(struct parser_exec_state *s)
         bb->accessing = true;
         bb->bb_start_cmd_va = s->ip_va;
 
+        if ((s->buf_type == BATCH_BUFFER_INSTRUCTION) && (!s->is_ctx_wa))
+                bb->bb_offset = s->ip_va - s->rb_va;
+        else
+                bb->bb_offset = 0;
+
         /*
          * ip_va saves the virtual address of the shadow batch buffer, while
          * ip_gma saves the graphics address of the original batch buffer.
@@ -2571,6 +2577,7 @@ static int scan_workload(struct intel_vgpu_workload *workload)
         s.ring_tail = gma_tail;
         s.rb_va = workload->shadow_ring_buffer_va;
         s.workload = workload;
+        s.is_ctx_wa = false;
 
         if ((bypass_scan_mask & (1 << workload->ring_id)) ||
                 gma_head == gma_tail)
@@ -2624,6 +2631,7 @@ static int scan_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
         s.ring_tail = gma_tail;
         s.rb_va = wa_ctx->indirect_ctx.shadow_va;
         s.workload = workload;
+        s.is_ctx_wa = true;
 
         if (!intel_gvt_ggtt_validate_range(s.vgpu, s.ring_start, s.ring_size)) {
                 ret = -EINVAL;
diff --git a/drivers/gpu/drm/i915/gvt/mmio_context.c b/drivers/gpu/drm/i915/gvt/mmio_context.c
index 256f1bb522b7..152df3d0291e 100644
--- a/drivers/gpu/drm/i915/gvt/mmio_context.c
+++ b/drivers/gpu/drm/i915/gvt/mmio_context.c
@@ -394,9 +394,11 @@ void intel_gvt_switch_mmio(struct intel_vgpu *pre,
          * performace for batch mmio read/write, so we need
          * handle forcewake mannually.
          */
+        intel_runtime_pm_get(dev_priv);
         intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
         switch_mmio(pre, next, ring_id);
         intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
+        intel_runtime_pm_put(dev_priv);
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index b55b3580ca1d..d74d6f05c62c 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -52,6 +52,54 @@ static void set_context_pdp_root_pointer(
                 pdp_pair[i].val = pdp[7 - i];
 }
 
+/*
+ * when populating shadow ctx from guest, we should not overrride oa related
+ * registers, so that they will not be overlapped by guest oa configs. Thus
+ * made it possible to capture oa data from host for both host and guests.
+ */
+static void sr_oa_regs(struct intel_vgpu_workload *workload,
+                u32 *reg_state, bool save)
+{
+        struct drm_i915_private *dev_priv = workload->vgpu->gvt->dev_priv;
+        u32 ctx_oactxctrl = dev_priv->perf.oa.ctx_oactxctrl_offset;
+        u32 ctx_flexeu0 = dev_priv->perf.oa.ctx_flexeu0_offset;
+        int i = 0;
+        u32 flex_mmio[] = {
+                i915_mmio_reg_offset(EU_PERF_CNTL0),
+                i915_mmio_reg_offset(EU_PERF_CNTL1),
+                i915_mmio_reg_offset(EU_PERF_CNTL2),
+                i915_mmio_reg_offset(EU_PERF_CNTL3),
+                i915_mmio_reg_offset(EU_PERF_CNTL4),
+                i915_mmio_reg_offset(EU_PERF_CNTL5),
+                i915_mmio_reg_offset(EU_PERF_CNTL6),
+        };
+
+        if (!workload || !reg_state || workload->ring_id != RCS)
+                return;
+
+        if (save) {
+                workload->oactxctrl = reg_state[ctx_oactxctrl + 1];
+
+                for (i = 0; i < ARRAY_SIZE(workload->flex_mmio); i++) {
+                        u32 state_offset = ctx_flexeu0 + i * 2;
+
+                        workload->flex_mmio[i] = reg_state[state_offset + 1];
+                }
+        } else {
+                reg_state[ctx_oactxctrl] =
+                        i915_mmio_reg_offset(GEN8_OACTXCONTROL);
+                reg_state[ctx_oactxctrl + 1] = workload->oactxctrl;
+
+                for (i = 0; i < ARRAY_SIZE(workload->flex_mmio); i++) {
+                        u32 state_offset = ctx_flexeu0 + i * 2;
+                        u32 mmio = flex_mmio[i];
+
+                        reg_state[state_offset] = mmio;
+                        reg_state[state_offset + 1] = workload->flex_mmio[i];
+                }
+        }
+}
+
 static int populate_shadow_context(struct intel_vgpu_workload *workload)
 {
         struct intel_vgpu *vgpu = workload->vgpu;
@@ -98,6 +146,7 @@ static int populate_shadow_context(struct intel_vgpu_workload *workload)
         page = i915_gem_object_get_page(ctx_obj, LRC_STATE_PN);
         shadow_ring_context = kmap(page);
 
+        sr_oa_regs(workload, (u32 *)shadow_ring_context, true);
 #define COPY_REG(name) \
         intel_gvt_hypervisor_read_gpa(vgpu, workload->ring_context_gpa \
                 + RING_CTX_OFF(name.val), &shadow_ring_context->name.val, 4)
@@ -122,6 +171,7 @@ static int populate_shadow_context(struct intel_vgpu_workload *workload)
                         sizeof(*shadow_ring_context),
                         I915_GTT_PAGE_SIZE - sizeof(*shadow_ring_context));
 
+        sr_oa_regs(workload, (u32 *)shadow_ring_context, false);
         kunmap(page);
         return 0;
 }
@@ -376,6 +426,17 @@ static int prepare_shadow_batch_buffer(struct intel_vgpu_workload *workload)
                         goto err;
                 }
 
+                /* For privilge batch buffer and not wa_ctx, the bb_start_cmd_va
+                 * is only updated into ring_scan_buffer, not real ring address
+                 * allocated in later copy_workload_to_ring_buffer. pls be noted
+                 * shadow_ring_buffer_va is now pointed to real ring buffer va
+                 * in copy_workload_to_ring_buffer.
+                 */
+
+                if (bb->bb_offset)
+                        bb->bb_start_cmd_va = workload->shadow_ring_buffer_va
+                                + bb->bb_offset;
+
                 /* relocate shadow batch buffer */
                 bb->bb_start_cmd_va[1] = i915_ggtt_offset(bb->vma);
                 if (gmadr_bytes == 8)
@@ -1044,10 +1105,12 @@ int intel_vgpu_setup_submission(struct intel_vgpu *vgpu)
 
         bitmap_zero(s->shadow_ctx_desc_updated, I915_NUM_ENGINES);
 
-        s->workloads = kmem_cache_create("gvt-g_vgpu_workload",
-                        sizeof(struct intel_vgpu_workload), 0,
-                        SLAB_HWCACHE_ALIGN,
-                        NULL);
+        s->workloads = kmem_cache_create_usercopy("gvt-g_vgpu_workload",
+                                                  sizeof(struct intel_vgpu_workload), 0,
+                                                  SLAB_HWCACHE_ALIGN,
+                                                  offsetof(struct intel_vgpu_workload, rb_tail),
+                                                  sizeof_field(struct intel_vgpu_workload, rb_tail),
+                                                  NULL);
 
         if (!s->workloads) {
                 ret = -ENOMEM;
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.h b/drivers/gpu/drm/i915/gvt/scheduler.h
index ff175a98b19e..a79a4f60637e 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.h
+++ b/drivers/gpu/drm/i915/gvt/scheduler.h
@@ -110,6 +110,10 @@ struct intel_vgpu_workload {
         /* shadow batch buffer */
         struct list_head shadow_bb;
         struct intel_shadow_wa_ctx wa_ctx;
+
+        /* oa registers */
+        u32 oactxctrl;
+        u32 flex_mmio[7];
 };
 
 struct intel_vgpu_shadow_bb {
@@ -120,6 +124,7 @@ struct intel_vgpu_shadow_bb {
         u32 *bb_start_cmd_va;
         unsigned int clflush;
         bool accessing;
+        unsigned long bb_offset;
 };
 
 #define workload_q_head(vgpu, ring_id) \
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index dd89abd2263d..6ff5d655c202 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -434,20 +434,28 @@ i915_gem_object_wait_reservation(struct reservation_object *resv,
                         dma_fence_put(shared[i]);
                 kfree(shared);
 
+                /*
+                 * If both shared fences and an exclusive fence exist,
+                 * then by construction the shared fences must be later
+                 * than the exclusive fence. If we successfully wait for
+                 * all the shared fences, we know that the exclusive fence
+                 * must all be signaled. If all the shared fences are
+                 * signaled, we can prune the array and recover the
+                 * floating references on the fences/requests.
+                 */
                 prune_fences = count && timeout >= 0;
         } else {
                 excl = reservation_object_get_excl_rcu(resv);
         }
 
-        if (excl && timeout >= 0) {
+        if (excl && timeout >= 0)
                 timeout = i915_gem_object_wait_fence(excl, flags, timeout,
                                                      rps_client);
-                prune_fences = timeout >= 0;
-        }
 
         dma_fence_put(excl);
 
-        /* Oportunistically prune the fences iff we know they have *all* been
+        /*
+         * Opportunistically prune the fences iff we know they have *all* been
          * signaled and that the reservation object has not been changed (i.e.
          * no new fences have been added).
          */
@@ -3205,8 +3213,10 @@ void i915_gem_set_wedged(struct drm_i915_private *i915)
          * rolling the global seqno forward (since this would complete requests
          * for which we haven't set the fence error to EIO yet).
          */
-        for_each_engine(engine, i915, id)
+        for_each_engine(engine, i915, id) {
+                i915_gem_reset_prepare_engine(engine);
                 engine->submit_request = nop_submit_request;
+        }
 
         /*
          * Make sure no one is running the old callback before we proceed with
@@ -3244,6 +3254,8 @@ void i915_gem_set_wedged(struct drm_i915_private *i915)
                 intel_engine_init_global_seqno(engine,
                                                intel_engine_last_submit(engine));
                 spin_unlock_irqrestore(&engine->timeline->lock, flags);
+
+                i915_gem_reset_finish_engine(engine);
         }
 
         set_bit(I915_WEDGED, &i915->gpu_error.flags);
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 4401068ff468..3ab1ace2a6bd 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -505,6 +505,8 @@ eb_add_vma(struct i915_execbuffer *eb, unsigned int i, struct i915_vma *vma)
                 list_add_tail(&vma->exec_link, &eb->unbound);
                 if (drm_mm_node_allocated(&vma->node))
                         err = i915_vma_unbind(vma);
+                if (unlikely(err))
+                        vma->exec_flags = NULL;
         }
         return err;
 }
@@ -2410,7 +2412,7 @@ err_request:
         if (out_fence) {
                 if (err == 0) {
                         fd_install(out_fence_fd, out_fence->file);
-                        args->rsvd2 &= GENMASK_ULL(0, 31); /* keep in-fence */
+                        args->rsvd2 &= GENMASK_ULL(31, 0); /* keep in-fence */
                         args->rsvd2 |= (u64)out_fence_fd << 32;
                         out_fence_fd = -1;
                 } else {
diff --git a/drivers/gpu/drm/i915/i915_gem_request.c b/drivers/gpu/drm/i915/i915_gem_request.c
index e09d18df8b7f..a3e93d46316a 100644
--- a/drivers/gpu/drm/i915/i915_gem_request.c
+++ b/drivers/gpu/drm/i915/i915_gem_request.c
@@ -476,8 +476,6 @@ void __i915_gem_request_submit(struct drm_i915_gem_request *request)
         GEM_BUG_ON(!irqs_disabled());
         lockdep_assert_held(&engine->timeline->lock);
 
-        trace_i915_gem_request_execute(request);
-
         /* Transfer from per-context onto the global per-engine timeline */
         timeline = engine->timeline;
         GEM_BUG_ON(timeline == request->timeline);
@@ -501,6 +499,8 @@ void __i915_gem_request_submit(struct drm_i915_gem_request *request)
         list_move_tail(&request->link, &timeline->requests);
         spin_unlock(&request->timeline->lock);
 
+        trace_i915_gem_request_execute(request);
+
         wake_up_all(&request->execute);
 }
 
diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c
index 0be50e43507d..f8fe5ffcdcff 100644
--- a/drivers/gpu/drm/i915/i915_perf.c
+++ b/drivers/gpu/drm/i915/i915_perf.c
@@ -1303,9 +1303,8 @@ static void i915_oa_stream_destroy(struct i915_perf_stream *stream)
          */
         mutex_lock(&dev_priv->drm.struct_mutex);
         dev_priv->perf.oa.exclusive_stream = NULL;
-        mutex_unlock(&dev_priv->drm.struct_mutex);
-
         dev_priv->perf.oa.ops.disable_metric_set(dev_priv);
+        mutex_unlock(&dev_priv->drm.struct_mutex);
 
         free_oa_buffer(dev_priv);
 
@@ -1756,22 +1755,13 @@ static int gen8_switch_to_updated_kernel_context(struct drm_i915_private *dev_pr
  * Note: it's only the RCS/Render context that has any OA state.
  */
 static int gen8_configure_all_contexts(struct drm_i915_private *dev_priv,
-                                       const struct i915_oa_config *oa_config,
-                                       bool interruptible)
+                                       const struct i915_oa_config *oa_config)
 {
         struct i915_gem_context *ctx;
         int ret;
         unsigned int wait_flags = I915_WAIT_LOCKED;
 
-        if (interruptible) {
-                ret = i915_mutex_lock_interruptible(&dev_priv->drm);
-                if (ret)
-                        return ret;
-
-                wait_flags |= I915_WAIT_INTERRUPTIBLE;
-        } else {
-                mutex_lock(&dev_priv->drm.struct_mutex);
-        }
+        lockdep_assert_held(&dev_priv->drm.struct_mutex);
 
         /* Switch away from any user context. */
         ret = gen8_switch_to_updated_kernel_context(dev_priv, oa_config);
@@ -1819,8 +1809,6 @@ static int gen8_configure_all_contexts(struct drm_i915_private *dev_priv,
         }
 
  out:
-        mutex_unlock(&dev_priv->drm.struct_mutex);
-
         return ret;
 }
 
@@ -1863,7 +1851,7 @@ static int gen8_enable_metric_set(struct drm_i915_private *dev_priv,
          * to make sure all slices/subslices are ON before writing to NOA
          * registers.
          */
-        ret = gen8_configure_all_contexts(dev_priv, oa_config, true);
+        ret = gen8_configure_all_contexts(dev_priv, oa_config);
         if (ret)
                 return ret;
 
@@ -1878,7 +1866,7 @@ static int gen8_enable_metric_set(struct drm_i915_private *dev_priv,
 static void gen8_disable_metric_set(struct drm_i915_private *dev_priv)
 {
         /* Reset all contexts' slices/subslices configurations. */
-        gen8_configure_all_contexts(dev_priv, NULL, false);
+        gen8_configure_all_contexts(dev_priv, NULL);
 
         I915_WRITE(GDT_CHICKEN_BITS, (I915_READ(GDT_CHICKEN_BITS) &
                                       ~GT_NOA_ENABLE));
@@ -1888,7 +1876,7 @@ static void gen8_disable_metric_set(struct drm_i915_private *dev_priv)
 static void gen10_disable_metric_set(struct drm_i915_private *dev_priv)
 {
         /* Reset all contexts' slices/subslices configurations. */
-        gen8_configure_all_contexts(dev_priv, NULL, false);
+        gen8_configure_all_contexts(dev_priv, NULL);
 
         /* Make sure we disable noa to save power. */
         I915_WRITE(RPM_CONFIG1,
@@ -2138,6 +2126,10 @@ static int i915_oa_stream_init(struct i915_perf_stream *stream,
         if (ret)
                 goto err_oa_buf_alloc;
 
+        ret = i915_mutex_lock_interruptible(&dev_priv->drm);
+        if (ret)
+                goto err_lock;
+
         ret = dev_priv->perf.oa.ops.enable_metric_set(dev_priv,
                                                       stream->oa_config);
         if (ret)
@@ -2145,23 +2137,17 @@ static int i915_oa_stream_init(struct i915_perf_stream *stream,
 
         stream->ops = &i915_oa_stream_ops;
 
-        /* Lock device for exclusive_stream access late because
-         * enable_metric_set() might lock as well on gen8+.
-         */
-        ret = i915_mutex_lock_interruptible(&dev_priv->drm);
-        if (ret)
-                goto err_lock;
-
         dev_priv->perf.oa.exclusive_stream = stream;
 
         mutex_unlock(&dev_priv->drm.struct_mutex);
 
         return 0;
 
-err_lock:
+err_enable:
         dev_priv->perf.oa.ops.disable_metric_set(dev_priv);
+        mutex_unlock(&dev_priv->drm.struct_mutex);
 
-err_enable:
+err_lock:
         free_oa_buffer(dev_priv);
 
 err_oa_buf_alloc:
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index a2108e35c599..33eb0c5b1d32 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -2027,7 +2027,7 @@ enum i915_power_well_id {
 #define _CNL_PORT_TX_DW5_LN0_AE         0x162454
 #define _CNL_PORT_TX_DW5_LN0_B          0x162654
 #define _CNL_PORT_TX_DW5_LN0_C          0x162C54
-#define _CNL_PORT_TX_DW5_LN0_D          0x162ED4
+#define _CNL_PORT_TX_DW5_LN0_D          0x162E54
 #define _CNL_PORT_TX_DW5_LN0_F          0x162854
 #define CNL_PORT_TX_DW5_GRP(port)       _MMIO_PORT6(port, \
                                                     _CNL_PORT_TX_DW5_GRP_AE, \
@@ -2058,7 +2058,7 @@ enum i915_power_well_id {
 #define _CNL_PORT_TX_DW7_LN0_AE         0x16245C
 #define _CNL_PORT_TX_DW7_LN0_B          0x16265C
 #define _CNL_PORT_TX_DW7_LN0_C          0x162C5C
-#define _CNL_PORT_TX_DW7_LN0_D          0x162EDC
+#define _CNL_PORT_TX_DW7_LN0_D          0x162E5C
 #define _CNL_PORT_TX_DW7_LN0_F          0x16285C
 #define CNL_PORT_TX_DW7_GRP(port)       _MMIO_PORT6(port, \
                                                     _CNL_PORT_TX_DW7_GRP_AE, \
diff --git a/drivers/gpu/drm/i915/i915_sysfs.c b/drivers/gpu/drm/i915/i915_sysfs.c
index b33d2158c234..e5e6f6bb2b05 100644
--- a/drivers/gpu/drm/i915/i915_sysfs.c
+++ b/drivers/gpu/drm/i915/i915_sysfs.c
@@ -304,8 +304,9 @@ static ssize_t gt_boost_freq_mhz_store(struct device *kdev,
 {
         struct drm_i915_private *dev_priv = kdev_minor_to_i915(kdev);
         struct intel_rps *rps = &dev_priv->gt_pm.rps;
-        u32 val;
+        bool boost = false;
         ssize_t ret;
+        u32 val;
 
         ret = kstrtou32(buf, 0, &val);
         if (ret)
@@ -317,8 +318,13 @@ static ssize_t gt_boost_freq_mhz_store(struct device *kdev,
                 return -EINVAL;
 
         mutex_lock(&dev_priv->pcu_lock);
-        rps->boost_freq = val;
+        if (val != rps->boost_freq) {
+                rps->boost_freq = val;
+                boost = atomic_read(&rps->num_waiters);
+        }
         mutex_unlock(&dev_priv->pcu_lock);
+        if (boost)
+                schedule_work(&rps->work);
 
         return count;
 }
diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c
index 522d54fecb53..4a01f62a392d 100644
--- a/drivers/gpu/drm/i915/intel_audio.c
+++ b/drivers/gpu/drm/i915/intel_audio.c
@@ -779,11 +779,11 @@ static struct intel_encoder *get_saved_enc(struct drm_i915_private *dev_priv,
 {
         struct intel_encoder *encoder;
 
-        if (WARN_ON(pipe >= ARRAY_SIZE(dev_priv->av_enc_map)))
-                return NULL;
-
         /* MST */
         if (pipe >= 0) {
+                if (WARN_ON(pipe >= ARRAY_SIZE(dev_priv->av_enc_map)))
+                        return NULL;
+
                 encoder = dev_priv->av_enc_map[pipe];
                 /*
                  * when bootup, audio driver may not know it is
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 35c5299feab6..a29868cd30c7 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -620,19 +620,15 @@ static int
 bxt_power_sequencer_idx(struct intel_dp *intel_dp)
 {
         struct drm_i915_private *dev_priv = to_i915(intel_dp_to_dev(intel_dp));
+        int backlight_controller = dev_priv->vbt.backlight.controller;
 
         lockdep_assert_held(&dev_priv->pps_mutex);
 
         /* We should never land here with regular DP ports */
         WARN_ON(!intel_dp_is_edp(intel_dp));
 
-        /*
-         * TODO: BXT has 2 PPS instances. The correct port->PPS instance
-         * mapping needs to be retrieved from VBT, for now just hard-code to
-         * use instance #0 always.
-         */
         if (!intel_dp->pps_reset)
-                return 0;
+                return backlight_controller;
 
         intel_dp->pps_reset = false;
 
@@ -642,7 +638,7 @@ bxt_power_sequencer_idx(struct intel_dp *intel_dp)
          */
         intel_dp_init_panel_power_sequencer_registers(intel_dp, false);
 
-        return 0;
+        return backlight_controller;
 }
 
 typedef bool (*vlv_pipe_check)(struct drm_i915_private *dev_priv,
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 7ece2f061b9e..e0fca035ff78 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -719,6 +719,8 @@ static void execlists_cancel_requests(struct intel_engine_cs *engine)
         struct rb_node *rb;
         unsigned long flags;
 
+        GEM_TRACE("%s\n", engine->name);
+
         spin_lock_irqsave(&engine->timeline->lock, flags);
 
         /* Cancel the requests on the HW and clear the ELSP tracker. */
@@ -765,6 +767,9 @@ static void execlists_cancel_requests(struct intel_engine_cs *engine)
          */
         clear_bit(ENGINE_IRQ_EXECLIST, &engine->irq_posted);
 
+        /* Mark all CS interrupts as complete */
+        execlists->active = 0;
+
         spin_unlock_irqrestore(&engine->timeline->lock, flags);
 }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c
index 380f340204e8..debbbf0fd4bd 100644
--- a/drivers/gpu/drm/nouveau/nouveau_backlight.c
+++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c
@@ -134,7 +134,7 @@ nv50_get_intensity(struct backlight_device *bd)
         struct nouveau_encoder *nv_encoder = bl_get_data(bd);
         struct nouveau_drm *drm = nouveau_drm(nv_encoder->base.base.dev);
         struct nvif_object *device = &drm->client.device.object;
-        int or = nv_encoder->or;
+        int or = ffs(nv_encoder->dcb->or) - 1;
         u32 div = 1025;
         u32 val;
 
@@ -149,7 +149,7 @@ nv50_set_intensity(struct backlight_device *bd)
         struct nouveau_encoder *nv_encoder = bl_get_data(bd);
         struct nouveau_drm *drm = nouveau_drm(nv_encoder->base.base.dev);
         struct nvif_object *device = &drm->client.device.object;
-        int or = nv_encoder->or;
+        int or = ffs(nv_encoder->dcb->or) - 1;
         u32 div = 1025;
         u32 val = (bd->props.brightness * div) / 100;
 
@@ -170,7 +170,7 @@ nva3_get_intensity(struct backlight_device *bd)
         struct nouveau_encoder *nv_encoder = bl_get_data(bd);
         struct nouveau_drm *drm = nouveau_drm(nv_encoder->base.base.dev);
         struct nvif_object *device = &drm->client.device.object;
-        int or = nv_encoder->or;
+        int or = ffs(nv_encoder->dcb->or) - 1;
         u32 div, val;
 
         div  = nvif_rd32(device, NV50_PDISP_SOR_PWM_DIV(or));
@@ -188,7 +188,7 @@ nva3_set_intensity(struct backlight_device *bd)
         struct nouveau_encoder *nv_encoder = bl_get_data(bd);
         struct nouveau_drm *drm = nouveau_drm(nv_encoder->base.base.dev);
         struct nvif_object *device = &drm->client.device.object;
-        int or = nv_encoder->or;
+        int or = ffs(nv_encoder->dcb->or) - 1;
         u32 div, val;
 
         div = nvif_rd32(device, NV50_PDISP_SOR_PWM_DIV(or));
@@ -228,7 +228,7 @@ nv50_backlight_init(struct drm_connector *connector)
                         return -ENODEV;
         }
 
-        if (!nvif_rd32(device, NV50_PDISP_SOR_PWM_CTL(nv_encoder->or)))
+        if (!nvif_rd32(device, NV50_PDISP_SOR_PWM_CTL(ffs(nv_encoder->dcb->or) - 1)))
                 return 0;
 
         if (drm->client.device.info.chipset <= 0xa0 ||
@@ -268,13 +268,13 @@ nouveau_backlight_init(struct drm_device *dev)
         struct nvif_device *device = &drm->client.device;
         struct drm_connector *connector;
 
+        INIT_LIST_HEAD(&drm->bl_connectors);
+
         if (apple_gmux_present()) {
                 NV_INFO(drm, "Apple GMUX detected: not registering Nouveau backlight interface\n");
                 return 0;
         }
 
-        INIT_LIST_HEAD(&drm->bl_connectors);
-
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                 if (connector->connector_type != DRM_MODE_CONNECTOR_LVDS &&
                     connector->connector_type != DRM_MODE_CONNECTOR_eDP)
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index dd8d4352ed99..caddce88d2d8 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -4477,6 +4477,7 @@ nv50_display_create(struct drm_device *dev)
         nouveau_display(dev)->fini = nv50_display_fini;
         disp->disp = &nouveau_display(dev)->disp;
         dev->mode_config.funcs = &nv50_disp_func;
+        dev->driver->driver_features |= DRIVER_PREFER_XBGR_30BPP;
         if (nouveau_atomic)
                 dev->driver->driver_features |= DRIVER_ATOMIC;
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
index 93946dcee319..1c12e58f44c2 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
@@ -1354,7 +1354,7 @@ nvkm_vmm_get_locked(struct nvkm_vmm *vmm, bool getref, bool mapref, bool sparse,
 
                 tail = this->addr + this->size;
                 if (vmm->func->page_block && next && next->page != p)
-                        tail = ALIGN_DOWN(addr, vmm->func->page_block);
+                        tail = ALIGN_DOWN(tail, vmm->func->page_block);
 
                 if (addr <= tail && tail - addr >= size) {
                         rb_erase(&this->tree, &vmm->free);
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index d3045a371a55..7c73bc7e2f85 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -3221,35 +3221,8 @@ static void cik_gpu_init(struct radeon_device *rdev)
         case CHIP_KAVERI:
                 rdev->config.cik.max_shader_engines = 1;
                 rdev->config.cik.max_tile_pipes = 4;
-                if ((rdev->pdev->device == 0x1304) ||
-                    (rdev->pdev->device == 0x1305) ||
-                    (rdev->pdev->device == 0x130C) ||
-                    (rdev->pdev->device == 0x130F) ||
-                    (rdev->pdev->device == 0x1310) ||
-                    (rdev->pdev->device == 0x1311) ||
-                    (rdev->pdev->device == 0x131C)) {
-                        rdev->config.cik.max_cu_per_sh = 8;
-                        rdev->config.cik.max_backends_per_se = 2;
-                } else if ((rdev->pdev->device == 0x1309) ||
-                           (rdev->pdev->device == 0x130A) ||
-                           (rdev->pdev->device == 0x130D) ||
-                           (rdev->pdev->device == 0x1313) ||
-                           (rdev->pdev->device == 0x131D)) {
-                        rdev->config.cik.max_cu_per_sh = 6;
-                        rdev->config.cik.max_backends_per_se = 2;
-                } else if ((rdev->pdev->device == 0x1306) ||
-                           (rdev->pdev->device == 0x1307) ||
-                           (rdev->pdev->device == 0x130B) ||
-                           (rdev->pdev->device == 0x130E) ||
-                           (rdev->pdev->device == 0x1315) ||
-                           (rdev->pdev->device == 0x1318) ||
-                           (rdev->pdev->device == 0x131B)) {
-                        rdev->config.cik.max_cu_per_sh = 4;
-                        rdev->config.cik.max_backends_per_se = 1;
-                } else {
-                        rdev->config.cik.max_cu_per_sh = 3;
-                        rdev->config.cik.max_backends_per_se = 1;
-                }
+                rdev->config.cik.max_cu_per_sh = 8;
+                rdev->config.cik.max_backends_per_se = 2;
                 rdev->config.cik.max_sh_per_se = 1;
                 rdev->config.cik.max_texture_channel_caches = 4;
                 rdev->config.cik.max_gprs = 256;
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 8d3e3d2e0090..7828a5e10629 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1365,6 +1365,10 @@ int radeon_device_init(struct radeon_device *rdev,
         if ((rdev->flags & RADEON_IS_PCI) &&
             (rdev->family <= CHIP_RS740))
                 rdev->need_dma32 = true;
+#ifdef CONFIG_PPC64
+        if (rdev->family == CHIP_CEDAR)
+                rdev->need_dma32 = true;
+#endif
 
         dma_bits = rdev->need_dma32 ? 32 : 40;
         r = pci_set_dma_mask(rdev->pdev, DMA_BIT_MASK(dma_bits));
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index a9962ffba720..27d8e7dd2d06 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -34,8 +34,6 @@ void radeon_gem_object_free(struct drm_gem_object *gobj)
         struct radeon_bo *robj = gem_to_radeon_bo(gobj);
 
         if (robj) {
-                if (robj->gem_base.import_attach)
-                        drm_prime_gem_destroy(&robj->gem_base, robj->tbo.sg);
                 radeon_mn_unregister(robj);
                 radeon_bo_unref(&robj);
         }
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 15404af9d740..31f5ad605e59 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -82,6 +82,8 @@ static void radeon_ttm_bo_destroy(struct ttm_buffer_object *tbo)
         mutex_unlock(&bo->rdev->gem.mutex);
         radeon_bo_clear_surface_reg(bo);
         WARN_ON_ONCE(!list_empty(&bo->va));
+        if (bo->gem_base.import_attach)
+                drm_prime_gem_destroy(&bo->gem_base, bo->tbo.sg);
         drm_gem_object_release(&bo->gem_base);
         kfree(bo);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 326ad068c15a..4b6542538ff9 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -47,7 +47,6 @@ static bool radeon_pm_in_vbl(struct radeon_device *rdev);
 static bool radeon_pm_debug_check_in_vbl(struct radeon_device *rdev, bool finish);
 static void radeon_pm_update_profile(struct radeon_device *rdev);
 static void radeon_pm_set_clocks(struct radeon_device *rdev);
-static void radeon_pm_compute_clocks_dpm(struct radeon_device *rdev);
 
 int radeon_pm_get_type_index(struct radeon_device *rdev,
                              enum radeon_pm_state_type ps_type,
@@ -80,8 +79,6 @@ void radeon_pm_acpi_event_handler(struct radeon_device *rdev)
                                 radeon_dpm_enable_bapm(rdev, rdev->pm.dpm.ac_power);
                 }
                 mutex_unlock(&rdev->pm.mutex);
-                /* allow new DPM state to be picked */
-                radeon_pm_compute_clocks_dpm(rdev);
         } else if (rdev->pm.pm_method == PM_METHOD_PROFILE) {
                 if (rdev->pm.profile == PM_PROFILE_AUTO) {
                         mutex_lock(&rdev->pm.mutex);
@@ -885,8 +882,7 @@ static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev,
                 dpm_state = POWER_STATE_TYPE_INTERNAL_3DPERF;
         /* balanced states don't exist at the moment */
         if (dpm_state == POWER_STATE_TYPE_BALANCED)
-                dpm_state = rdev->pm.dpm.ac_power ?
-                        POWER_STATE_TYPE_PERFORMANCE : POWER_STATE_TYPE_BATTERY;
+                dpm_state = POWER_STATE_TYPE_PERFORMANCE;
 
 restart_search:
         /* Pick the best power state based on current conditions */
diff --git a/drivers/gpu/drm/sun4i/sun4i_crtc.c b/drivers/gpu/drm/sun4i/sun4i_crtc.c
index 5decae0069d0..78cbc3145e44 100644
--- a/drivers/gpu/drm/sun4i/sun4i_crtc.c
+++ b/drivers/gpu/drm/sun4i/sun4i_crtc.c
@@ -93,6 +93,8 @@ static void sun4i_crtc_atomic_disable(struct drm_crtc *crtc,
 
         DRM_DEBUG_DRIVER("Disabling the CRTC\n");
 
+        drm_crtc_vblank_off(crtc);
+
         sun4i_tcon_set_status(scrtc->tcon, encoder, false);
 
         if (crtc->state->event && !crtc->state->active) {
@@ -113,6 +115,8 @@ static void sun4i_crtc_atomic_enable(struct drm_crtc *crtc,
         DRM_DEBUG_DRIVER("Enabling the CRTC\n");
 
         sun4i_tcon_set_status(scrtc->tcon, encoder, true);
+
+        drm_crtc_vblank_on(crtc);
 }
 
 static void sun4i_crtc_mode_set_nofb(struct drm_crtc *crtc)
diff --git a/drivers/gpu/drm/sun4i/sun4i_dotclock.c b/drivers/gpu/drm/sun4i/sun4i_dotclock.c
index 023f39bda633..e36004fbe453 100644
--- a/drivers/gpu/drm/sun4i/sun4i_dotclock.c
+++ b/drivers/gpu/drm/sun4i/sun4i_dotclock.c
@@ -132,10 +132,13 @@ static int sun4i_dclk_get_phase(struct clk_hw *hw)
 static int sun4i_dclk_set_phase(struct clk_hw *hw, int degrees)
 {
         struct sun4i_dclk *dclk = hw_to_dclk(hw);
+        u32 val = degrees / 120;
+
+        val <<= 28;
 
         regmap_update_bits(dclk->regmap, SUN4I_TCON0_IO_POL_REG,
                            GENMASK(29, 28),
-                           degrees / 120);
+                           val);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/sun4i/sun4i_rgb.c b/drivers/gpu/drm/sun4i/sun4i_rgb.c
index 832f8f9bc47f..b8da5a50a61d 100644
--- a/drivers/gpu/drm/sun4i/sun4i_rgb.c
+++ b/drivers/gpu/drm/sun4i/sun4i_rgb.c
@@ -92,6 +92,8 @@ static int sun4i_rgb_mode_valid(struct drm_connector *connector,
 
         DRM_DEBUG_DRIVER("Vertical parameters OK\n");
 
+        tcon->dclk_min_div = 6;
+        tcon->dclk_max_div = 127;
         rounded_rate = clk_round_rate(tcon->dclk, rate);
         if (rounded_rate < rate)
                 return MODE_CLOCK_LOW;
diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
index 3c15cf24b503..2de586b7c98b 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
@@ -101,10 +101,12 @@ static void sun4i_tcon_channel_set_status(struct sun4i_tcon *tcon, int channel,
                 return;
         }
 
-        if (enabled)
+        if (enabled) {
                 clk_prepare_enable(clk);
-        else
+        } else {
+                clk_rate_exclusive_put(clk);
                 clk_disable_unprepare(clk);
+        }
 }
 
 static void sun4i_tcon_lvds_set_status(struct sun4i_tcon *tcon,
@@ -260,7 +262,7 @@ static void sun4i_tcon0_mode_set_common(struct sun4i_tcon *tcon,
                                         const struct drm_display_mode *mode)
 {
         /* Configure the dot clock */
-        clk_set_rate(tcon->dclk, mode->crtc_clock * 1000);
+        clk_set_rate_exclusive(tcon->dclk, mode->crtc_clock * 1000);
 
         /* Set the resolution */
         regmap_write(tcon->regs, SUN4I_TCON0_BASIC0_REG,
@@ -335,6 +337,9 @@ static void sun4i_tcon0_mode_set_lvds(struct sun4i_tcon *tcon,
         regmap_update_bits(tcon->regs, SUN4I_TCON_GCTL_REG,
                            SUN4I_TCON_GCTL_IOMAP_MASK,
                            SUN4I_TCON_GCTL_IOMAP_TCON0);
+
+        /* Enable the output on the pins */
+        regmap_write(tcon->regs, SUN4I_TCON0_IO_TRI_REG, 0xe0000000);
 }
 
 static void sun4i_tcon0_mode_set_rgb(struct sun4i_tcon *tcon,
@@ -418,7 +423,7 @@ static void sun4i_tcon1_mode_set(struct sun4i_tcon *tcon,
         WARN_ON(!tcon->quirks->has_channel_1);
 
         /* Configure the dot clock */
-        clk_set_rate(tcon->sclk1, mode->crtc_clock * 1000);
+        clk_set_rate_exclusive(tcon->sclk1, mode->crtc_clock * 1000);
 
         /* Adjust clock delay */
         clk_delay = sun4i_tcon_get_clk_delay(mode, 1);
@@ -870,52 +875,56 @@ static int sun4i_tcon_bind(struct device *dev, struct device *master,
                 return ret;
         }
 
-        /*
-         * This can only be made optional since we've had DT nodes
-         * without the LVDS reset properties.
-         *
-         * If the property is missing, just disable LVDS, and print a
-         * warning.
-         */
-        tcon->lvds_rst = devm_reset_control_get_optional(dev, "lvds");
-        if (IS_ERR(tcon->lvds_rst)) {
-                dev_err(dev, "Couldn't get our reset line\n");
-                return PTR_ERR(tcon->lvds_rst);
-        } else if (tcon->lvds_rst) {
-                has_lvds_rst = true;
-                reset_control_reset(tcon->lvds_rst);
-        } else {
-                has_lvds_rst = false;
-        }
+        if (tcon->quirks->supports_lvds) {
+                /*
+                 * This can only be made optional since we've had DT
+                 * nodes without the LVDS reset properties.
+                 *
+                 * If the property is missing, just disable LVDS, and
+                 * print a warning.
+                 */
+                tcon->lvds_rst = devm_reset_control_get_optional(dev, "lvds");
+                if (IS_ERR(tcon->lvds_rst)) {
+                        dev_err(dev, "Couldn't get our reset line\n");
+                        return PTR_ERR(tcon->lvds_rst);
+                } else if (tcon->lvds_rst) {
+                        has_lvds_rst = true;
+                        reset_control_reset(tcon->lvds_rst);
+                } else {
+                        has_lvds_rst = false;
+                }
 
-        /*
-         * This can only be made optional since we've had DT nodes
-         * without the LVDS reset properties.
-         *
-         * If the property is missing, just disable LVDS, and print a
-         * warning.
-         */
-        if (tcon->quirks->has_lvds_alt) {
-                tcon->lvds_pll = devm_clk_get(dev, "lvds-alt");
-                if (IS_ERR(tcon->lvds_pll)) {
-                        if (PTR_ERR(tcon->lvds_pll) == -ENOENT) {
-                                has_lvds_alt = false;
+                /*
+                 * This can only be made optional since we've had DT
+                 * nodes without the LVDS reset properties.
+                 *
+                 * If the property is missing, just disable LVDS, and
+                 * print a warning.
+                 */
+                if (tcon->quirks->has_lvds_alt) {
+                        tcon->lvds_pll = devm_clk_get(dev, "lvds-alt");
+                        if (IS_ERR(tcon->lvds_pll)) {
+                                if (PTR_ERR(tcon->lvds_pll) == -ENOENT) {
+                                        has_lvds_alt = false;
+                                } else {
+                                        dev_err(dev, "Couldn't get the LVDS PLL\n");
+                                        return PTR_ERR(tcon->lvds_pll);
+                                }
                         } else {
-                                dev_err(dev, "Couldn't get the LVDS PLL\n");
-                                return PTR_ERR(tcon->lvds_pll);
+                                has_lvds_alt = true;
                         }
-                } else {
-                        has_lvds_alt = true;
                 }
-        }
 
-        if (!has_lvds_rst || (tcon->quirks->has_lvds_alt && !has_lvds_alt)) {
-                dev_warn(dev,
-                         "Missing LVDS properties, Please upgrade your DT\n");
-                dev_warn(dev, "LVDS output disabled\n");
-                can_lvds = false;
+                if (!has_lvds_rst ||
+                    (tcon->quirks->has_lvds_alt && !has_lvds_alt)) {
+                        dev_warn(dev, "Missing LVDS properties, Please upgrade your DT\n");
+                        dev_warn(dev, "LVDS output disabled\n");
+                        can_lvds = false;
+                } else {
+                        can_lvds = true;
+                }
         } else {
-                can_lvds = true;
+                can_lvds = false;
         }
 
         ret = sun4i_tcon_init_clocks(dev, tcon);
@@ -1134,7 +1143,7 @@ static const struct sun4i_tcon_quirks sun8i_a33_quirks = {
 };
 
 static const struct sun4i_tcon_quirks sun8i_a83t_lcd_quirks = {
-        /* nothing is supported */
+        .supports_lvds          = true,
 };
 
 static const struct sun4i_tcon_quirks sun8i_v3s_quirks = {
diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.h b/drivers/gpu/drm/sun4i/sun4i_tcon.h
index b761c7b823c5..278700c7bf9f 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.h
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.h
@@ -175,6 +175,7 @@ struct sun4i_tcon_quirks {
         bool    has_channel_1;  /* a33 does not have channel 1 */
         bool    has_lvds_alt;   /* Does the LVDS clock have a parent other than the TCON clock? */
         bool    needs_de_be_mux; /* sun6i needs mux to select backend */
+        bool    supports_lvds;   /* Does the TCON support an LVDS output? */
 
         /* callback to handle tcon muxing options */
         int     (*set_mux)(struct sun4i_tcon *, const struct drm_encoder *);
diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
index 5720a0d4ac0a..677ac16c8a6d 100644
--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
@@ -197,6 +197,9 @@ static int virtio_gpu_getparam_ioctl(struct drm_device *dev, void *data,
         case VIRTGPU_PARAM_3D_FEATURES:
                 value = vgdev->has_virgl_3d == true ? 1 : 0;
                 break;
+        case VIRTGPU_PARAM_CAPSET_QUERY_FIX:
+                value = 1;
+                break;
         default:
                 return -EINVAL;
         }
@@ -472,7 +475,7 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev,
 {
         struct virtio_gpu_device *vgdev = dev->dev_private;
         struct drm_virtgpu_get_caps *args = data;
-        int size;
+        unsigned size, host_caps_size;
         int i;
         int found_valid = -1;
         int ret;
@@ -481,6 +484,10 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev,
         if (vgdev->num_capsets == 0)
                 return -ENOSYS;
 
+        /* don't allow userspace to pass 0 */
+        if (args->size == 0)
+                return -EINVAL;
+
         spin_lock(&vgdev->display_info_lock);
         for (i = 0; i < vgdev->num_capsets; i++) {
                 if (vgdev->capsets[i].id == args->cap_set_id) {
@@ -496,11 +503,9 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev,
                 return -EINVAL;
         }
 
-        size = vgdev->capsets[found_valid].max_size;
-        if (args->size > size) {
-                spin_unlock(&vgdev->display_info_lock);
-                return -EINVAL;
-        }
+        host_caps_size = vgdev->capsets[found_valid].max_size;
+        /* only copy to user the minimum of the host caps size or the guest caps size */
+        size = min(args->size, host_caps_size);
 
         list_for_each_entry(cache_ent, &vgdev->cap_cache, head) {
                 if (cache_ent->id == args->cap_set_id &&
diff --git a/drivers/i2c/busses/i2c-octeon-core.c b/drivers/i2c/busses/i2c-octeon-core.c
index 1d8775799056..d9607905dc2f 100644
--- a/drivers/i2c/busses/i2c-octeon-core.c
+++ b/drivers/i2c/busses/i2c-octeon-core.c
@@ -233,6 +233,7 @@ static int octeon_i2c_check_status(struct octeon_i2c *i2c, int final_read)
                 return -EOPNOTSUPP;
 
         case STAT_TXDATA_NAK:
+        case STAT_BUS_ERROR:
                 return -EIO;
         case STAT_TXADDR_NAK:
         case STAT_RXADDR_NAK:
diff --git a/drivers/i2c/busses/i2c-octeon-core.h b/drivers/i2c/busses/i2c-octeon-core.h
index a7ef19855bb8..9bb9f64fdda0 100644
--- a/drivers/i2c/busses/i2c-octeon-core.h
+++ b/drivers/i2c/busses/i2c-octeon-core.h
@@ -43,7 +43,7 @@
 #define TWSI_CTL_AAK            0x04    /* Assert ACK */
 
 /* Status values */
-#define STAT_ERROR              0x00
+#define STAT_BUS_ERROR          0x00
 #define STAT_START              0x08
 #define STAT_REP_START          0x10
 #define STAT_TXADDR_ACK         0x18
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 17fd55af4d92..caa20eb5f26b 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -928,7 +928,7 @@ static int exact_lock(dev_t dev, void *data)
 {
         struct gendisk *p = data;
 
-        if (!get_disk(p))
+        if (!get_disk_and_module(p))
                 return -1;
         return 0;
 }
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index a5b4cf030c11..9183d148d644 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -550,18 +550,13 @@ static int addr_resolve(struct sockaddr *src_in,
                 dst_release(dst);
         }
 
-        if (ndev->flags & IFF_LOOPBACK) {
-                ret = rdma_translate_ip(dst_in, addr);
-                /*
-                 * Put the loopback device and get the translated
-                 * device instead.
-                 */
+        if (ndev) {
+                if (ndev->flags & IFF_LOOPBACK)
+                        ret = rdma_translate_ip(dst_in, addr);
+                else
+                        addr->bound_dev_if = ndev->ifindex;
                 dev_put(ndev);
-                ndev = dev_get_by_index(addr->net, addr->bound_dev_if);
-        } else {
-                addr->bound_dev_if = ndev->ifindex;
         }
-        dev_put(ndev);
 
         return ret;
 }
diff --git a/drivers/infiniband/core/cq.c b/drivers/infiniband/core/cq.c
index bc79ca8215d7..af5ad6a56ae4 100644
--- a/drivers/infiniband/core/cq.c
+++ b/drivers/infiniband/core/cq.c
@@ -17,6 +17,7 @@
 
 /* # of WCs to poll for with a single call to ib_poll_cq */
 #define IB_POLL_BATCH                   16
+#define IB_POLL_BATCH_DIRECT            8
 
 /* # of WCs to iterate over before yielding */
 #define IB_POLL_BUDGET_IRQ              256
@@ -25,18 +26,18 @@
 #define IB_POLL_FLAGS \
         (IB_CQ_NEXT_COMP | IB_CQ_REPORT_MISSED_EVENTS)
 
-static int __ib_process_cq(struct ib_cq *cq, int budget, struct ib_wc *poll_wc)
+static int __ib_process_cq(struct ib_cq *cq, int budget, struct ib_wc *wcs,
+                           int batch)
 {
         int i, n, completed = 0;
-        struct ib_wc *wcs = poll_wc ? : cq->wc;
 
         /*
          * budget might be (-1) if the caller does not
          * want to bound this call, thus we need unsigned
          * minimum here.
          */
-        while ((n = ib_poll_cq(cq, min_t(u32, IB_POLL_BATCH,
-                        budget - completed), wcs)) > 0) {
+        while ((n = ib_poll_cq(cq, min_t(u32, batch,
+                                         budget - completed), wcs)) > 0) {
                 for (i = 0; i < n; i++) {
                         struct ib_wc *wc = &wcs[i];
 
@@ -48,8 +49,7 @@ static int __ib_process_cq(struct ib_cq *cq, int budget, struct ib_wc *poll_wc)
 
                 completed += n;
 
-                if (n != IB_POLL_BATCH ||
-                    (budget != -1 && completed >= budget))
+                if (n != batch || (budget != -1 && completed >= budget))
                         break;
         }
 
@@ -72,9 +72,9 @@ static int __ib_process_cq(struct ib_cq *cq, int budget, struct ib_wc *poll_wc)
  */
 int ib_process_cq_direct(struct ib_cq *cq, int budget)
 {
-        struct ib_wc wcs[IB_POLL_BATCH];
+        struct ib_wc wcs[IB_POLL_BATCH_DIRECT];
 
-        return __ib_process_cq(cq, budget, wcs);
+        return __ib_process_cq(cq, budget, wcs, IB_POLL_BATCH_DIRECT);
 }
 EXPORT_SYMBOL(ib_process_cq_direct);
 
@@ -88,7 +88,7 @@ static int ib_poll_handler(struct irq_poll *iop, int budget)
         struct ib_cq *cq = container_of(iop, struct ib_cq, iop);
         int completed;
 
-        completed = __ib_process_cq(cq, budget, NULL);
+        completed = __ib_process_cq(cq, budget, cq->wc, IB_POLL_BATCH);
         if (completed < budget) {
                 irq_poll_complete(&cq->iop);
                 if (ib_req_notify_cq(cq, IB_POLL_FLAGS) > 0)
@@ -108,7 +108,8 @@ static void ib_cq_poll_work(struct work_struct *work)
         struct ib_cq *cq = container_of(work, struct ib_cq, work);
         int completed;
 
-        completed = __ib_process_cq(cq, IB_POLL_BUDGET_WORKQUEUE, NULL);
+        completed = __ib_process_cq(cq, IB_POLL_BUDGET_WORKQUEUE, cq->wc,
+                                    IB_POLL_BATCH);
         if (completed >= IB_POLL_BUDGET_WORKQUEUE ||
             ib_req_notify_cq(cq, IB_POLL_FLAGS) > 0)
                 queue_work(ib_comp_wq, &cq->work);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index e8010e73a1cf..bb065c9449be 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -536,14 +536,14 @@ int ib_register_device(struct ib_device *device,
         ret = device->query_device(device, &device->attrs, &uhw);
         if (ret) {
                 pr_warn("Couldn't query the device attributes\n");
-                goto cache_cleanup;
+                goto cg_cleanup;
         }
 
         ret = ib_device_register_sysfs(device, port_callback);
         if (ret) {
                 pr_warn("Couldn't register device %s with driver model\n",
                         device->name);
-                goto cache_cleanup;
+                goto cg_cleanup;
         }
 
         device->reg_state = IB_DEV_REGISTERED;
@@ -559,6 +559,8 @@ int ib_register_device(struct ib_device *device,
         mutex_unlock(&device_mutex);
         return 0;
 
+cg_cleanup:
+        ib_device_unregister_rdmacg(device);
 cache_cleanup:
         ib_cache_cleanup_one(device);
         ib_cache_release_one(device);
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 8cf15d4a8ac4..9f029a1ca5ea 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -1291,10 +1291,9 @@ int ib_init_ah_attr_from_path(struct ib_device *device, u8 port_num,
 
                 resolved_dev = dev_get_by_index(dev_addr.net,
                                                 dev_addr.bound_dev_if);
-                if (resolved_dev->flags & IFF_LOOPBACK) {
-                        dev_put(resolved_dev);
-                        resolved_dev = idev;
-                        dev_hold(resolved_dev);
+                if (!resolved_dev) {
+                        dev_put(idev);
+                        return -ENODEV;
                 }
                 ndev = ib_get_ndev_from_path(rec);
                 rcu_read_lock();
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index f015f1bf88c9..3a9d0f5b5881 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1149,6 +1149,9 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file,
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
+        if (cmd.qp_state > IB_QPS_ERR)
+                return -EINVAL;
+
         ctx = ucma_get_ctx(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
@@ -1294,6 +1297,9 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf,
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
+        if (unlikely(cmd.optval > KMALLOC_MAX_SIZE))
+                return -EINVAL;
+
         optval = memdup_user((void __user *) (unsigned long) cmd.optval,
                              cmd.optlen);
         if (IS_ERR(optval)) {
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 643174d949a8..0dd75f449872 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -785,7 +785,7 @@ int bnxt_re_query_ah(struct ib_ah *ib_ah, struct rdma_ah_attr *ah_attr)
         return 0;
 }
 
-static unsigned long bnxt_re_lock_cqs(struct bnxt_re_qp *qp)
+unsigned long bnxt_re_lock_cqs(struct bnxt_re_qp *qp)
         __acquires(&qp->scq->cq_lock) __acquires(&qp->rcq->cq_lock)
 {
         unsigned long flags;
@@ -799,8 +799,8 @@ static unsigned long bnxt_re_lock_cqs(struct bnxt_re_qp *qp)
         return flags;
 }
 
-static void bnxt_re_unlock_cqs(struct bnxt_re_qp *qp,
-                               unsigned long flags)
+void bnxt_re_unlock_cqs(struct bnxt_re_qp *qp,
+                        unsigned long flags)
         __releases(&qp->scq->cq_lock) __releases(&qp->rcq->cq_lock)
 {
         if (qp->rcq != qp->scq)
@@ -1606,6 +1606,7 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
         int status;
         union ib_gid sgid;
         struct ib_gid_attr sgid_attr;
+        unsigned int flags;
         u8 nw_type;
 
         qp->qplib_qp.modify_flags = 0;
@@ -1634,14 +1635,18 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
                         dev_dbg(rdev_to_dev(rdev),
                                 "Move QP = %p to flush list\n",
                                 qp);
+                        flags = bnxt_re_lock_cqs(qp);
                         bnxt_qplib_add_flush_qp(&qp->qplib_qp);
+                        bnxt_re_unlock_cqs(qp, flags);
                 }
                 if (!qp->sumem &&
                     qp->qplib_qp.state == CMDQ_MODIFY_QP_NEW_STATE_RESET) {
                         dev_dbg(rdev_to_dev(rdev),
                                 "Move QP = %p out of flush list\n",
                                 qp);
+                        flags = bnxt_re_lock_cqs(qp);
                         bnxt_qplib_clean_qp(&qp->qplib_qp);
+                        bnxt_re_unlock_cqs(qp, flags);
                 }
         }
         if (qp_attr_mask & IB_QP_EN_SQD_ASYNC_NOTIFY) {
@@ -2227,10 +2232,13 @@ static int bnxt_re_build_inv_wqe(struct ib_send_wr *wr,
         wqe->type = BNXT_QPLIB_SWQE_TYPE_LOCAL_INV;
         wqe->local_inv.inv_l_key = wr->ex.invalidate_rkey;
 
+        /* Need unconditional fence for local invalidate
+         * opcode to work as expected.
+         */
+        wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;
+
         if (wr->send_flags & IB_SEND_SIGNALED)
                 wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_SIGNAL_COMP;
-        if (wr->send_flags & IB_SEND_FENCE)
-                wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;
         if (wr->send_flags & IB_SEND_SOLICITED)
                 wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_SOLICIT_EVENT;
 
@@ -2251,8 +2259,12 @@ static int bnxt_re_build_reg_wqe(struct ib_reg_wr *wr,
         wqe->frmr.levels = qplib_frpl->hwq.level + 1;
         wqe->type = BNXT_QPLIB_SWQE_TYPE_REG_MR;
 
-        if (wr->wr.send_flags & IB_SEND_FENCE)
-                wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;
+        /* Need unconditional fence for reg_mr
+         * opcode to function as expected.
+         */
+
+        wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;
+
         if (wr->wr.send_flags & IB_SEND_SIGNALED)
                 wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_SIGNAL_COMP;
 
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.h b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
index b88a48d43a9d..e62b7c2c7da6 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.h
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
@@ -222,4 +222,7 @@ struct ib_ucontext *bnxt_re_alloc_ucontext(struct ib_device *ibdev,
                                            struct ib_udata *udata);
 int bnxt_re_dealloc_ucontext(struct ib_ucontext *context);
 int bnxt_re_mmap(struct ib_ucontext *context, struct vm_area_struct *vma);
+
+unsigned long bnxt_re_lock_cqs(struct bnxt_re_qp *qp);
+void bnxt_re_unlock_cqs(struct bnxt_re_qp *qp, unsigned long flags);
 #endif /* __BNXT_RE_IB_VERBS_H__ */
diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
index 33a448036c2e..f6e361750466 100644
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -730,6 +730,13 @@ static int bnxt_re_handle_qp_async_event(struct creq_qp_event *qp_event,
                                          struct bnxt_re_qp *qp)
 {
         struct ib_event event;
+        unsigned int flags;
+
+        if (qp->qplib_qp.state == CMDQ_MODIFY_QP_NEW_STATE_ERR) {
+                flags = bnxt_re_lock_cqs(qp);
+                bnxt_qplib_add_flush_qp(&qp->qplib_qp);
+                bnxt_re_unlock_cqs(qp, flags);
+        }
 
         memset(&event, 0, sizeof(event));
         if (qp->qplib_qp.srq) {
@@ -1416,9 +1423,12 @@ static void bnxt_re_task(struct work_struct *work)
         switch (re_work->event) {
         case NETDEV_REGISTER:
                 rc = bnxt_re_ib_reg(rdev);
-                if (rc)
+                if (rc) {
                         dev_err(rdev_to_dev(rdev),
                                 "Failed to register with IB: %#x", rc);
+                        bnxt_re_remove_one(rdev);
+                        bnxt_re_dev_unreg(rdev);
+                }
                 break;
         case NETDEV_UP:
                 bnxt_re_dispatch_event(&rdev->ibdev, NULL, 1,
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index 3ea5b9624f6b..06b42c880fd4 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -88,75 +88,35 @@ static void __bnxt_qplib_add_flush_qp(struct bnxt_qplib_qp *qp)
         }
 }
 
-void bnxt_qplib_acquire_cq_locks(struct bnxt_qplib_qp *qp,
-                                 unsigned long *flags)
-        __acquires(&qp->scq->hwq.lock) __acquires(&qp->rcq->hwq.lock)
+static void bnxt_qplib_acquire_cq_flush_locks(struct bnxt_qplib_qp *qp,
+                                       unsigned long *flags)
+        __acquires(&qp->scq->flush_lock) __acquires(&qp->rcq->flush_lock)
 {
-        spin_lock_irqsave(&qp->scq->hwq.lock, *flags);
+        spin_lock_irqsave(&qp->scq->flush_lock, *flags);
         if (qp->scq == qp->rcq)
-                __acquire(&qp->rcq->hwq.lock);
+                __acquire(&qp->rcq->flush_lock);
         else
-                spin_lock(&qp->rcq->hwq.lock);
+                spin_lock(&qp->rcq->flush_lock);
 }
 
-void bnxt_qplib_release_cq_locks(struct bnxt_qplib_qp *qp,
-                                 unsigned long *flags)
-        __releases(&qp->scq->hwq.lock) __releases(&qp->rcq->hwq.lock)
+static void bnxt_qplib_release_cq_flush_locks(struct bnxt_qplib_qp *qp,
+                                       unsigned long *flags)
+        __releases(&qp->scq->flush_lock) __releases(&qp->rcq->flush_lock)
 {
         if (qp->scq == qp->rcq)
-                __release(&qp->rcq->hwq.lock);
+                __release(&qp->rcq->flush_lock);
         else
-                spin_unlock(&qp->rcq->hwq.lock);
-        spin_unlock_irqrestore(&qp->scq->hwq.lock, *flags);
-}
-
-static struct bnxt_qplib_cq *bnxt_qplib_find_buddy_cq(struct bnxt_qplib_qp *qp,
-                                                      struct bnxt_qplib_cq *cq)
-{
-        struct bnxt_qplib_cq *buddy_cq = NULL;
-
-        if (qp->scq == qp->rcq)
-                buddy_cq = NULL;
-        else if (qp->scq == cq)
-                buddy_cq = qp->rcq;
-        else
-                buddy_cq = qp->scq;
-        return buddy_cq;
-}
-
-static void bnxt_qplib_lock_buddy_cq(struct bnxt_qplib_qp *qp,
-                                     struct bnxt_qplib_cq *cq)
-        __acquires(&buddy_cq->hwq.lock)
-{
-        struct bnxt_qplib_cq *buddy_cq = NULL;
-
-        buddy_cq = bnxt_qplib_find_buddy_cq(qp, cq);
-        if (!buddy_cq)
-                __acquire(&cq->hwq.lock);
-        else
-                spin_lock(&buddy_cq->hwq.lock);
-}
-
-static void bnxt_qplib_unlock_buddy_cq(struct bnxt_qplib_qp *qp,
-                                       struct bnxt_qplib_cq *cq)
-        __releases(&buddy_cq->hwq.lock)
-{
-        struct bnxt_qplib_cq *buddy_cq = NULL;
-
-        buddy_cq = bnxt_qplib_find_buddy_cq(qp, cq);
-        if (!buddy_cq)
-                __release(&cq->hwq.lock);
-        else
-                spin_unlock(&buddy_cq->hwq.lock);
+                spin_unlock(&qp->rcq->flush_lock);
+        spin_unlock_irqrestore(&qp->scq->flush_lock, *flags);
 }
 
 void bnxt_qplib_add_flush_qp(struct bnxt_qplib_qp *qp)
 {
         unsigned long flags;
 
-        bnxt_qplib_acquire_cq_locks(qp, &flags);
+        bnxt_qplib_acquire_cq_flush_locks(qp, &flags);
         __bnxt_qplib_add_flush_qp(qp);
-        bnxt_qplib_release_cq_locks(qp, &flags);
+        bnxt_qplib_release_cq_flush_locks(qp, &flags);
 }
 
 static void __bnxt_qplib_del_flush_qp(struct bnxt_qplib_qp *qp)
@@ -177,7 +137,7 @@ void bnxt_qplib_clean_qp(struct bnxt_qplib_qp *qp)
 {
         unsigned long flags;
 
-        bnxt_qplib_acquire_cq_locks(qp, &flags);
+        bnxt_qplib_acquire_cq_flush_locks(qp, &flags);
         __clean_cq(qp->scq, (u64)(unsigned long)qp);
         qp->sq.hwq.prod = 0;
         qp->sq.hwq.cons = 0;
@@ -186,7 +146,7 @@ void bnxt_qplib_clean_qp(struct bnxt_qplib_qp *qp)
         qp->rq.hwq.cons = 0;
 
         __bnxt_qplib_del_flush_qp(qp);
-        bnxt_qplib_release_cq_locks(qp, &flags);
+        bnxt_qplib_release_cq_flush_locks(qp, &flags);
 }
 
 static void bnxt_qpn_cqn_sched_task(struct work_struct *work)
@@ -2107,9 +2067,6 @@ void bnxt_qplib_mark_qp_error(void *qp_handle)
         /* Must block new posting of SQ and RQ */
         qp->state = CMDQ_MODIFY_QP_NEW_STATE_ERR;
         bnxt_qplib_cancel_phantom_processing(qp);
-
-        /* Add qp to flush list of the CQ */
-        __bnxt_qplib_add_flush_qp(qp);
 }
 
 /* Note: SQE is valid from sw_sq_cons up to cqe_sq_cons (exclusive)
@@ -2285,9 +2242,9 @@ static int bnxt_qplib_cq_process_req(struct bnxt_qplib_cq *cq,
                                 sw_sq_cons, cqe->wr_id, cqe->status);
                         cqe++;
                         (*budget)--;
-                        bnxt_qplib_lock_buddy_cq(qp, cq);
                         bnxt_qplib_mark_qp_error(qp);
-                        bnxt_qplib_unlock_buddy_cq(qp, cq);
+                        /* Add qp to flush list of the CQ */
+                        bnxt_qplib_add_flush_qp(qp);
                 } else {
                         if (swq->flags & SQ_SEND_FLAGS_SIGNAL_COMP) {
                                 /* Before we complete, do WA 9060 */
@@ -2403,9 +2360,7 @@ static int bnxt_qplib_cq_process_res_rc(struct bnxt_qplib_cq *cq,
                 if (hwcqe->status != CQ_RES_RC_STATUS_OK) {
                         qp->state = CMDQ_MODIFY_QP_NEW_STATE_ERR;
                         /* Add qp to flush list of the CQ */
-                        bnxt_qplib_lock_buddy_cq(qp, cq);
-                        __bnxt_qplib_add_flush_qp(qp);
-                        bnxt_qplib_unlock_buddy_cq(qp, cq);
+                        bnxt_qplib_add_flush_qp(qp);
                 }
         }
 
@@ -2489,9 +2444,7 @@ static int bnxt_qplib_cq_process_res_ud(struct bnxt_qplib_cq *cq,
                 if (hwcqe->status != CQ_RES_RC_STATUS_OK) {
                         qp->state = CMDQ_MODIFY_QP_NEW_STATE_ERR;
                         /* Add qp to flush list of the CQ */
-                        bnxt_qplib_lock_buddy_cq(qp, cq);
-                        __bnxt_qplib_add_flush_qp(qp);
-                        bnxt_qplib_unlock_buddy_cq(qp, cq);
+                        bnxt_qplib_add_flush_qp(qp);
                 }
         }
 done:
@@ -2501,11 +2454,9 @@ done:
 bool bnxt_qplib_is_cq_empty(struct bnxt_qplib_cq *cq)
 {
         struct cq_base *hw_cqe, **hw_cqe_ptr;
-        unsigned long flags;
         u32 sw_cons, raw_cons;
         bool rc = true;
 
-        spin_lock_irqsave(&cq->hwq.lock, flags);
         raw_cons = cq->hwq.cons;
         sw_cons = HWQ_CMP(raw_cons, &cq->hwq);
         hw_cqe_ptr = (struct cq_base **)cq->hwq.pbl_ptr;
@@ -2513,7 +2464,6 @@ bool bnxt_qplib_is_cq_empty(struct bnxt_qplib_cq *cq)
 
          /* Check for Valid bit. If the CQE is valid, return false */
         rc = !CQE_CMP_VALID(hw_cqe, raw_cons, cq->hwq.max_elements);
-        spin_unlock_irqrestore(&cq->hwq.lock, flags);
         return rc;
 }
 
@@ -2602,9 +2552,7 @@ static int bnxt_qplib_cq_process_res_raweth_qp1(struct bnxt_qplib_cq *cq,
                 if (hwcqe->status != CQ_RES_RC_STATUS_OK) {
                         qp->state = CMDQ_MODIFY_QP_NEW_STATE_ERR;
                         /* Add qp to flush list of the CQ */
-                        bnxt_qplib_lock_buddy_cq(qp, cq);
-                        __bnxt_qplib_add_flush_qp(qp);
-                        bnxt_qplib_unlock_buddy_cq(qp, cq);
+                        bnxt_qplib_add_flush_qp(qp);
                 }
         }
 
@@ -2719,9 +2667,7 @@ do_rq:
          */
 
         /* Add qp to flush list of the CQ */
-        bnxt_qplib_lock_buddy_cq(qp, cq);
-        __bnxt_qplib_add_flush_qp(qp);
-        bnxt_qplib_unlock_buddy_cq(qp, cq);
+        bnxt_qplib_add_flush_qp(qp);
 done:
         return rc;
 }
@@ -2750,7 +2696,7 @@ int bnxt_qplib_process_flush_list(struct bnxt_qplib_cq *cq,
         u32 budget = num_cqes;
         unsigned long flags;
 
-        spin_lock_irqsave(&cq->hwq.lock, flags);
+        spin_lock_irqsave(&cq->flush_lock, flags);
         list_for_each_entry(qp, &cq->sqf_head, sq_flush) {
                 dev_dbg(&cq->hwq.pdev->dev,
                         "QPLIB: FP: Flushing SQ QP= %p",
@@ -2764,7 +2710,7 @@ int bnxt_qplib_process_flush_list(struct bnxt_qplib_cq *cq,
                         qp);
                 __flush_rq(&qp->rq, qp, &cqe, &budget);
         }
-        spin_unlock_irqrestore(&cq->hwq.lock, flags);
+        spin_unlock_irqrestore(&cq->flush_lock, flags);
 
         return num_cqes - budget;
 }
@@ -2773,11 +2719,9 @@ int bnxt_qplib_poll_cq(struct bnxt_qplib_cq *cq, struct bnxt_qplib_cqe *cqe,
                        int num_cqes, struct bnxt_qplib_qp **lib_qp)
 {
         struct cq_base *hw_cqe, **hw_cqe_ptr;
-        unsigned long flags;
         u32 sw_cons, raw_cons;
         int budget, rc = 0;
 
-        spin_lock_irqsave(&cq->hwq.lock, flags);
         raw_cons = cq->hwq.cons;
         budget = num_cqes;
 
@@ -2853,20 +2797,15 @@ int bnxt_qplib_poll_cq(struct bnxt_qplib_cq *cq, struct bnxt_qplib_cqe *cqe,
                 bnxt_qplib_arm_cq(cq, DBR_DBR_TYPE_CQ);
         }
 exit:
-        spin_unlock_irqrestore(&cq->hwq.lock, flags);
         return num_cqes - budget;
 }
 
 void bnxt_qplib_req_notify_cq(struct bnxt_qplib_cq *cq, u32 arm_type)
 {
-        unsigned long flags;
-
-        spin_lock_irqsave(&cq->hwq.lock, flags);
         if (arm_type)
                 bnxt_qplib_arm_cq(cq, arm_type);
         /* Using cq->arm_state variable to track whether to issue cq handler */
         atomic_set(&cq->arm_state, 1);
-        spin_unlock_irqrestore(&cq->hwq.lock, flags);
 }
 
 void bnxt_qplib_flush_cqn_wq(struct bnxt_qplib_qp *qp)
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
index ca0a2ffa3509..ade9f13c0fd1 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
@@ -389,6 +389,18 @@ struct bnxt_qplib_cq {
         struct list_head                sqf_head, rqf_head;
         atomic_t                        arm_state;
         spinlock_t                      compl_lock; /* synch CQ handlers */
+/* Locking Notes:
+ * QP can move to error state from modify_qp, async error event or error
+ * CQE as part of poll_cq. When QP is moved to error state, it gets added
+ * to two flush lists, one each for SQ and RQ.
+ * Each flush list is protected by qplib_cq->flush_lock. Both scq and rcq
+ * flush_locks should be acquired when QP is moved to error. The control path
+ * operations(modify_qp and async error events) are synchronized with poll_cq
+ * using upper level CQ locks (bnxt_re_cq->cq_lock) of both SCQ and RCQ.
+ * The qplib_cq->flush_lock is required to synchronize two instances of poll_cq
+ * of the same QP while manipulating the flush list.
+ */
+        spinlock_t                      flush_lock; /* QP flush management */
 };
 
 #define BNXT_QPLIB_MAX_IRRQE_ENTRY_SIZE sizeof(struct xrrq_irrq)
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
index 8329ec6a7946..80027a494730 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -305,9 +305,8 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
                         err_event->res_err_state_reason);
                 if (!qp)
                         break;
-                bnxt_qplib_acquire_cq_locks(qp, &flags);
                 bnxt_qplib_mark_qp_error(qp);
-                bnxt_qplib_release_cq_locks(qp, &flags);
+                rcfw->aeq_handler(rcfw, qp_event, qp);
                 break;
         default:
                 /* Command Response */
@@ -460,7 +459,11 @@ int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw,
         int rc;
 
         RCFW_CMD_PREP(req, INITIALIZE_FW, cmd_flags);
-
+        /* Supply (log-base-2-of-host-page-size - base-page-shift)
+         * to bono to adjust the doorbell page sizes.
+         */
+        req.log2_dbr_pg_size = cpu_to_le16(PAGE_SHIFT -
+                                           RCFW_DBR_BASE_PAGE_SHIFT);
         /*
          * VFs need not setup the HW context area, PF
          * shall setup this area for VF. Skipping the
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
index 6bee6e3636ea..c7cce2e4185e 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
@@ -49,6 +49,7 @@
 #define RCFW_COMM_SIZE                  0x104
 
 #define RCFW_DBR_PCI_BAR_REGION         2
+#define RCFW_DBR_BASE_PAGE_SHIFT        12
 
 #define RCFW_CMD_PREP(req, CMD, cmd_flags)                              \
         do {                                                            \
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
index 03057983341f..ee98e5efef84 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
@@ -139,7 +139,8 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw,
         attr->max_pkey = le32_to_cpu(sb->max_pkeys);
 
         attr->max_inline_data = le32_to_cpu(sb->max_inline_data);
-        attr->l2_db_size = (sb->l2_db_space_size + 1) * PAGE_SIZE;
+        attr->l2_db_size = (sb->l2_db_space_size + 1) *
+                            (0x01 << RCFW_DBR_BASE_PAGE_SHIFT);
         attr->max_sgid = le32_to_cpu(sb->max_gid);
 
         bnxt_qplib_query_version(rcfw, attr->fw_ver);
diff --git a/drivers/infiniband/hw/bnxt_re/roce_hsi.h b/drivers/infiniband/hw/bnxt_re/roce_hsi.h
index 2d7ea096a247..3e5a4f760d0e 100644
--- a/drivers/infiniband/hw/bnxt_re/roce_hsi.h
+++ b/drivers/infiniband/hw/bnxt_re/roce_hsi.h
@@ -1761,7 +1761,30 @@ struct cmdq_initialize_fw {
         #define CMDQ_INITIALIZE_FW_TIM_PG_SIZE_PG_2M               (0x3UL << 4)
         #define CMDQ_INITIALIZE_FW_TIM_PG_SIZE_PG_8M               (0x4UL << 4)
         #define CMDQ_INITIALIZE_FW_TIM_PG_SIZE_PG_1G               (0x5UL << 4)
-        __le16 reserved16;
+        /* This value is (log-base-2-of-DBR-page-size - 12).
+         * 0 for 4KB. HW supported values are enumerated below.
+         */
+        __le16  log2_dbr_pg_size;
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_MASK        0xfUL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_SFT         0
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_4K       0x0UL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_8K       0x1UL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_16K      0x2UL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_32K      0x3UL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_64K      0x4UL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_128K     0x5UL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_256K     0x6UL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_512K     0x7UL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_1M       0x8UL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_2M       0x9UL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_4M       0xaUL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_8M       0xbUL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_16M      0xcUL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_32M      0xdUL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_64M      0xeUL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_128M     0xfUL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_LAST                \
+                        CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_128M
         __le64 qpc_page_dir;
         __le64 mrw_page_dir;
         __le64 srq_page_dir;
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index 9a566ee3ceff..82adc0d1d30e 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -601,6 +601,7 @@ static void use_tunnel_data(struct mlx4_ib_qp *qp, struct mlx4_ib_cq *cq, struct
         wc->dlid_path_bits = 0;
 
         if (is_eth) {
+                wc->slid = 0;
                 wc->vlan_id = be16_to_cpu(hdr->tun.sl_vid);
                 memcpy(&(wc->smac[0]), (char *)&hdr->tun.mac_31_0, 4);
                 memcpy(&(wc->smac[4]), (char *)&hdr->tun.slid_mac_47_32, 2);
@@ -851,7 +852,6 @@ repoll:
                         }
                 }
 
-                wc->slid           = be16_to_cpu(cqe->rlid);
                 g_mlpath_rqpn      = be32_to_cpu(cqe->g_mlpath_rqpn);
                 wc->src_qp         = g_mlpath_rqpn & 0xffffff;
                 wc->dlid_path_bits = (g_mlpath_rqpn >> 24) & 0x7f;
@@ -860,6 +860,7 @@ repoll:
                 wc->wc_flags      |= mlx4_ib_ipoib_csum_ok(cqe->status,
                                         cqe->checksum) ? IB_WC_IP_CSUM_OK : 0;
                 if (is_eth) {
+                        wc->slid = 0;
                         wc->sl  = be16_to_cpu(cqe->sl_vid) >> 13;
                         if (be32_to_cpu(cqe->vlan_my_qpn) &
                                         MLX4_CQE_CVLAN_PRESENT_MASK) {
@@ -871,6 +872,7 @@ repoll:
                         memcpy(wc->smac, cqe->smac, ETH_ALEN);
                         wc->wc_flags |= (IB_WC_WITH_VLAN | IB_WC_WITH_SMAC);
                 } else {
+                        wc->slid = be16_to_cpu(cqe->rlid);
                         wc->sl  = be16_to_cpu(cqe->sl_vid) >> 12;
                         wc->vlan_id = 0xffff;
                 }
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 8d2ee9322f2e..5a0e4fc4785a 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -219,8 +219,6 @@ static int mlx4_ib_update_gids_v1_v2(struct gid_entry *gids,
                         gid_tbl[i].version = 2;
                         if (!ipv6_addr_v4mapped((struct in6_addr *)&gids[i].gid))
                                 gid_tbl[i].type = 1;
-                        else
-                                memset(&gid_tbl[i].gid, 0, 12);
                 }
         }
 
@@ -366,8 +364,13 @@ static int mlx4_ib_del_gid(struct ib_device *device,
                 if (!gids) {
                         ret = -ENOMEM;
                 } else {
-                        for (i = 0; i < MLX4_MAX_PORT_GIDS; i++)
-                                memcpy(&gids[i].gid, &port_gid_table->gids[i].gid, sizeof(union ib_gid));
+                        for (i = 0; i < MLX4_MAX_PORT_GIDS; i++) {
+                                memcpy(&gids[i].gid,
+                                       &port_gid_table->gids[i].gid,
+                                       sizeof(union ib_gid));
+                                gids[i].gid_type =
+                                    port_gid_table->gids[i].gid_type;
+                        }
                 }
         }
         spin_unlock_bh(&iboe->lock);
diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index 5b974fb97611..15457c9569a7 100644
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -226,7 +226,6 @@ static void handle_responder(struct ib_wc *wc, struct mlx5_cqe64 *cqe,
                 wc->ex.invalidate_rkey = be32_to_cpu(cqe->imm_inval_pkey);
                 break;
         }
-        wc->slid           = be16_to_cpu(cqe->slid);
         wc->src_qp         = be32_to_cpu(cqe->flags_rqpn) & 0xffffff;
         wc->dlid_path_bits = cqe->ml_path;
         g = (be32_to_cpu(cqe->flags_rqpn) >> 28) & 3;
@@ -241,10 +240,12 @@ static void handle_responder(struct ib_wc *wc, struct mlx5_cqe64 *cqe,
         }
 
         if (ll != IB_LINK_LAYER_ETHERNET) {
+                wc->slid = be16_to_cpu(cqe->slid);
                 wc->sl = (be32_to_cpu(cqe->flags_rqpn) >> 24) & 0xf;
                 return;
         }
 
+        wc->slid = 0;
         vlan_present = cqe->l4_l3_hdr_type & 0x1;
         roce_packet_type   = (be32_to_cpu(cqe->flags_rqpn) >> 24) & 0x3;
         if (vlan_present) {
@@ -1177,7 +1178,12 @@ static int resize_user(struct mlx5_ib_dev *dev, struct mlx5_ib_cq *cq,
         if (ucmd.reserved0 || ucmd.reserved1)
                 return -EINVAL;
 
-        umem = ib_umem_get(context, ucmd.buf_addr, entries * ucmd.cqe_size,
+        /* check multiplication overflow */
+        if (ucmd.cqe_size && SIZE_MAX / ucmd.cqe_size <= entries - 1)
+                return -EINVAL;
+
+        umem = ib_umem_get(context, ucmd.buf_addr,
+                           (size_t)ucmd.cqe_size * entries,
                            IB_ACCESS_LOCAL_WRITE, 1);
         if (IS_ERR(umem)) {
                 err = PTR_ERR(umem);
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 4236c8086820..033b6af90de9 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -245,12 +245,16 @@ struct mlx5_core_dev *mlx5_ib_get_native_port_mdev(struct mlx5_ib_dev *ibdev,
         struct mlx5_ib_multiport_info *mpi;
         struct mlx5_ib_port *port;
 
+        if (!mlx5_core_mp_enabled(ibdev->mdev) ||
+            ll != IB_LINK_LAYER_ETHERNET) {
+                if (native_port_num)
+                        *native_port_num = ib_port_num;
+                return ibdev->mdev;
+        }
+
         if (native_port_num)
                 *native_port_num = 1;
 
-        if (!mlx5_core_mp_enabled(ibdev->mdev) || ll != IB_LINK_LAYER_ETHERNET)
-                return ibdev->mdev;
-
         port = &ibdev->port[ib_port_num - 1];
         if (!port)
                 return NULL;
@@ -3263,7 +3267,7 @@ static void mlx5_ib_handle_event(struct work_struct *_work)
         struct mlx5_ib_dev *ibdev;
         struct ib_event ibev;
         bool fatal = false;
-        u8 port = 0;
+        u8 port = (u8)work->param;
 
         if (mlx5_core_is_mp_slave(work->dev)) {
                 ibdev = mlx5_ib_get_ibdev_from_mpi(work->context);
@@ -3283,8 +3287,6 @@ static void mlx5_ib_handle_event(struct work_struct *_work)
         case MLX5_DEV_EVENT_PORT_UP:
         case MLX5_DEV_EVENT_PORT_DOWN:
         case MLX5_DEV_EVENT_PORT_INITIALIZED:
-                port = (u8)work->param;
-
                 /* In RoCE, port up/down events are handled in
                  * mlx5_netdev_event().
                  */
@@ -3298,24 +3300,19 @@ static void mlx5_ib_handle_event(struct work_struct *_work)
 
         case MLX5_DEV_EVENT_LID_CHANGE:
                 ibev.event = IB_EVENT_LID_CHANGE;
-                port = (u8)work->param;
                 break;
 
         case MLX5_DEV_EVENT_PKEY_CHANGE:
                 ibev.event = IB_EVENT_PKEY_CHANGE;
-                port = (u8)work->param;
-
                 schedule_work(&ibdev->devr.ports[port - 1].pkey_change_work);
                 break;
 
         case MLX5_DEV_EVENT_GUID_CHANGE:
                 ibev.event = IB_EVENT_GID_CHANGE;
-                port = (u8)work->param;
                 break;
 
         case MLX5_DEV_EVENT_CLIENT_REREG:
                 ibev.event = IB_EVENT_CLIENT_REREGISTER;
-                port = (u8)work->param;
                 break;
         case MLX5_DEV_EVENT_DELAY_DROP_TIMEOUT:
                 schedule_work(&ibdev->delay_drop.delay_drop_work);
@@ -3327,7 +3324,7 @@ static void mlx5_ib_handle_event(struct work_struct *_work)
         ibev.device           = &ibdev->ib_dev;
         ibev.element.port_num = port;
 
-        if (port < 1 || port > ibdev->num_ports) {
+        if (!rdma_is_port_valid(&ibdev->ib_dev, port)) {
                 mlx5_ib_warn(ibdev, "warning: event on port %d\n", port);
                 goto out;
         }
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 556e015678de..1961c6a45437 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -1816,7 +1816,6 @@ mlx5_ib_sg_to_klms(struct mlx5_ib_mr *mr,
 
         mr->ibmr.iova = sg_dma_address(sg) + sg_offset;
         mr->ibmr.length = 0;
-        mr->ndescs = sg_nents;
 
         for_each_sg(sgl, sg, sg_nents, i) {
                 if (unlikely(i >= mr->max_descs))
@@ -1828,6 +1827,7 @@ mlx5_ib_sg_to_klms(struct mlx5_ib_mr *mr,
 
                 sg_offset = 0;
         }
+        mr->ndescs = i;
 
         if (sg_offset_p)
                 *sg_offset_p = sg_offset;
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 39d24bf694a8..36197fbac63a 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1584,6 +1584,7 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
         u32 uidx = MLX5_IB_DEFAULT_UIDX;
         struct mlx5_ib_create_qp ucmd;
         struct mlx5_ib_qp_base *base;
+        int mlx5_st;
         void *qpc;
         u32 *in;
         int err;
@@ -1592,6 +1593,10 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
         spin_lock_init(&qp->sq.lock);
         spin_lock_init(&qp->rq.lock);
 
+        mlx5_st = to_mlx5_st(init_attr->qp_type);
+        if (mlx5_st < 0)
+                return -EINVAL;
+
         if (init_attr->rwq_ind_tbl) {
                 if (!udata)
                         return -ENOSYS;
@@ -1753,7 +1758,7 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
 
         qpc = MLX5_ADDR_OF(create_qp_in, in, qpc);
 
-        MLX5_SET(qpc, qpc, st, to_mlx5_st(init_attr->qp_type));
+        MLX5_SET(qpc, qpc, st, mlx5_st);
         MLX5_SET(qpc, qpc, pm_state, MLX5_QP_PM_MIGRATED);
 
         if (init_attr->qp_type != MLX5_IB_QPT_REG_UMR)
@@ -3095,8 +3100,10 @@ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp,
                 goto out;
 
         if (mlx5_cur >= MLX5_QP_NUM_STATE || mlx5_new >= MLX5_QP_NUM_STATE ||
-            !optab[mlx5_cur][mlx5_new])
+            !optab[mlx5_cur][mlx5_new]) {
+                err = -EINVAL;
                 goto out;
+        }
 
         op = optab[mlx5_cur][mlx5_new];
         optpar = ib_mask_to_mlx5_opt(attr_mask);
diff --git a/drivers/infiniband/hw/qedr/qedr_iw_cm.c b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
index 478b7317b80a..26dc374787f7 100644
--- a/drivers/infiniband/hw/qedr/qedr_iw_cm.c
+++ b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
@@ -458,8 +458,7 @@ qedr_addr6_resolve(struct qedr_dev *dev,
                 }
                 return -EINVAL;
         }
-        neigh = dst_neigh_lookup(dst, &dst_in);
-
+        neigh = dst_neigh_lookup(dst, &fl6.daddr);
         if (neigh) {
                 rcu_read_lock();
                 if (neigh->nud_state & NUD_VALID) {
@@ -494,10 +493,14 @@ int qedr_iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
 
         qp = idr_find(&dev->qpidr, conn_param->qpn);
 
-        laddr = (struct sockaddr_in *)&cm_id->local_addr;
-        raddr = (struct sockaddr_in *)&cm_id->remote_addr;
-        laddr6 = (struct sockaddr_in6 *)&cm_id->local_addr;
-        raddr6 = (struct sockaddr_in6 *)&cm_id->remote_addr;
+        laddr = (struct sockaddr_in *)&cm_id->m_local_addr;
+        raddr = (struct sockaddr_in *)&cm_id->m_remote_addr;
+        laddr6 = (struct sockaddr_in6 *)&cm_id->m_local_addr;
+        raddr6 = (struct sockaddr_in6 *)&cm_id->m_remote_addr;
+
+        DP_DEBUG(dev, QEDR_MSG_IWARP, "MAPPED %d %d\n",
+                 ntohs(((struct sockaddr_in *)&cm_id->remote_addr)->sin_port),
+                 ntohs(raddr->sin_port));
 
         DP_DEBUG(dev, QEDR_MSG_IWARP,
                  "Connect source address: %pISpc, remote address: %pISpc\n",
@@ -599,8 +602,8 @@ int qedr_iw_create_listen(struct iw_cm_id *cm_id, int backlog)
         int rc;
         int i;
 
-        laddr = (struct sockaddr_in *)&cm_id->local_addr;
-        laddr6 = (struct sockaddr_in6 *)&cm_id->local_addr;
+        laddr = (struct sockaddr_in *)&cm_id->m_local_addr;
+        laddr6 = (struct sockaddr_in6 *)&cm_id->m_local_addr;
 
         DP_DEBUG(dev, QEDR_MSG_IWARP,
                  "Create Listener address: %pISpc\n", &cm_id->local_addr);
diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 53f00dbf313f..875b17272d65 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -3034,6 +3034,11 @@ static int __qedr_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 
         switch (wr->opcode) {
         case IB_WR_SEND_WITH_IMM:
+                if (unlikely(rdma_protocol_iwarp(&dev->ibdev, 1))) {
+                        rc = -EINVAL;
+                        *bad_wr = wr;
+                        break;
+                }
                 wqe->req_type = RDMA_SQ_REQ_TYPE_SEND_WITH_IMM;
                 swqe = (struct rdma_sq_send_wqe_1st *)wqe;
                 swqe->wqe_size = 2;
@@ -3075,6 +3080,11 @@ static int __qedr_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                 break;
 
         case IB_WR_RDMA_WRITE_WITH_IMM:
+                if (unlikely(rdma_protocol_iwarp(&dev->ibdev, 1))) {
+                        rc = -EINVAL;
+                        *bad_wr = wr;
+                        break;
+                }
                 wqe->req_type = RDMA_SQ_REQ_TYPE_RDMA_WR_WITH_IMM;
                 rwqe = (struct rdma_sq_rdma_wqe_1st *)wqe;
 
@@ -3724,7 +3734,7 @@ int qedr_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
 {
         struct qedr_dev *dev = get_qedr_dev(ibcq->device);
         struct qedr_cq *cq = get_qedr_cq(ibcq);
-        union rdma_cqe *cqe = cq->latest_cqe;
+        union rdma_cqe *cqe;
         u32 old_cons, new_cons;
         unsigned long flags;
         int update = 0;
@@ -3741,6 +3751,7 @@ int qedr_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
                 return qedr_gsi_poll_cq(ibcq, num_entries, wc);
 
         spin_lock_irqsave(&cq->cq_lock, flags);
+        cqe = cq->latest_cqe;
         old_cons = qed_chain_get_cons_idx_u32(&cq->pbl);
         while (num_entries && is_valid_cqe(cq, cqe)) {
                 struct qedr_qp *qp;
diff --git a/drivers/infiniband/sw/rdmavt/mr.c b/drivers/infiniband/sw/rdmavt/mr.c
index 1b2e5362a3ff..cc429b567d0a 100644
--- a/drivers/infiniband/sw/rdmavt/mr.c
+++ b/drivers/infiniband/sw/rdmavt/mr.c
@@ -489,11 +489,13 @@ static int rvt_check_refs(struct rvt_mregion *mr, const char *t)
         unsigned long timeout;
         struct rvt_dev_info *rdi = ib_to_rvt(mr->pd->device);
 
-        if (percpu_ref_is_zero(&mr->refcount))
-                return 0;
-        /* avoid dma mr */
-        if (mr->lkey)
+        if (mr->lkey) {
+                /* avoid dma mr */
                 rvt_dereg_clean_qps(mr);
+                /* @mr was indexed on rcu protected @lkey_table */
+                synchronize_rcu();
+        }
+
         timeout = wait_for_completion_timeout(&mr->comp, 5 * HZ);
         if (!timeout) {
                 rvt_pr_err(rdi,
diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c
index 1f316d66e6f7..41614c185918 100644
--- a/drivers/input/keyboard/matrix_keypad.c
+++ b/drivers/input/keyboard/matrix_keypad.c
@@ -218,8 +218,10 @@ static void matrix_keypad_stop(struct input_dev *dev)
 {
         struct matrix_keypad *keypad = input_get_drvdata(dev);
 
+        spin_lock_irq(&keypad->lock);
         keypad->stopped = true;
-        mb();
+        spin_unlock_irq(&keypad->lock);
+
         flush_work(&keypad->work.work);
         /*
          * matrix_keypad_scan() will leave IRQs enabled;
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 3d2e23a0ae39..a246fc686bb7 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -173,7 +173,6 @@ static const char * const smbus_pnp_ids[] = {
         "LEN0046", /* X250 */
         "LEN004a", /* W541 */
         "LEN200f", /* T450s */
-        "LEN2018", /* T460p */
         NULL
 };
 
diff --git a/drivers/input/touchscreen/mms114.c b/drivers/input/touchscreen/mms114.c
index db4f6bb502e3..a5ab774da4cc 100644
--- a/drivers/input/touchscreen/mms114.c
+++ b/drivers/input/touchscreen/mms114.c
@@ -1,11 +1,8 @@
-/*
- * Copyright (C) 2012 Samsung Electronics Co.Ltd
- * Author: Joonyoung Shim <jy0922.shim@samsung.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
+// SPDX-License-Identifier: GPL-2.0
+// Melfas MMS114/MMS152 touchscreen device driver
+//
+// Copyright (c) 2012 Samsung Electronics Co., Ltd.
+// Author: Joonyoung Shim <jy0922.shim@samsung.com>
 
 #include <linux/module.h>
 #include <linux/delay.h>
@@ -624,4 +621,4 @@ module_i2c_driver(mms114_driver);
 /* Module information */
 MODULE_AUTHOR("Joonyoung Shim <jy0922.shim@samsung.com>");
 MODULE_DESCRIPTION("MELFAS mms114 Touchscreen driver");
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 1d3056f53747..2cbb19cddbf8 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1412,7 +1412,7 @@ static struct irq_chip its_irq_chip = {
  * This gives us (((1UL << id_bits) - 8192) >> 5) possible allocations.
  */
 #define IRQS_PER_CHUNK_SHIFT    5
-#define IRQS_PER_CHUNK          (1 << IRQS_PER_CHUNK_SHIFT)
+#define IRQS_PER_CHUNK          (1UL << IRQS_PER_CHUNK_SHIFT)
 #define ITS_MAX_LPI_NRBITS      16 /* 64K LPIs */
 
 static unsigned long *lpi_bitmap;
@@ -2119,11 +2119,10 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
 
         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
         /*
-         * At least one bit of EventID is being used, hence a minimum
-         * of two entries. No, the architecture doesn't let you
-         * express an ITT with a single entry.
+         * We allocate at least one chunk worth of LPIs bet device,
+         * and thus that many ITEs. The device may require less though.
          */
-        nr_ites = max(2UL, roundup_pow_of_two(nvecs));
+        nr_ites = max(IRQS_PER_CHUNK, roundup_pow_of_two(nvecs));
         sz = nr_ites * its->ite_size;
         sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1;
         itt = kzalloc(sz, GFP_KERNEL);
@@ -2495,7 +2494,7 @@ static int its_vpe_set_affinity(struct irq_data *d,
 
 static void its_vpe_schedule(struct its_vpe *vpe)
 {
-        void * __iomem vlpi_base = gic_data_rdist_vlpi_base();
+        void __iomem *vlpi_base = gic_data_rdist_vlpi_base();
         u64 val;
 
         /* Schedule the VPE */
@@ -2527,7 +2526,7 @@ static void its_vpe_schedule(struct its_vpe *vpe)
 
 static void its_vpe_deschedule(struct its_vpe *vpe)
 {
-        void * __iomem vlpi_base = gic_data_rdist_vlpi_base();
+        void __iomem *vlpi_base = gic_data_rdist_vlpi_base();
         u32 count = 1000000;    /* 1s! */
         bool clean;
         u64 val;
diff --git a/drivers/irqchip/irq-imx-gpcv2.c b/drivers/irqchip/irq-imx-gpcv2.c
index 675eda5ff2b8..4760307ab43f 100644
--- a/drivers/irqchip/irq-imx-gpcv2.c
+++ b/drivers/irqchip/irq-imx-gpcv2.c
@@ -28,20 +28,6 @@ struct gpcv2_irqchip_data {
 
 static struct gpcv2_irqchip_data *imx_gpcv2_instance;
 
-/*
- * Interface for the low level wakeup code.
- */
-u32 imx_gpcv2_get_wakeup_source(u32 **sources)
-{
-        if (!imx_gpcv2_instance)
-                return 0;
-
-        if (sources)
-                *sources = imx_gpcv2_instance->wakeup_sources;
-
-        return IMR_NUM;
-}
-
 static int gpcv2_wakeup_source_save(void)
 {
         struct gpcv2_irqchip_data *cd;
diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
index 1a46b41dac70..6422846b546e 100644
--- a/drivers/md/bcache/request.c
+++ b/drivers/md/bcache/request.c
@@ -659,11 +659,11 @@ static void do_bio_hook(struct search *s, struct bio *orig_bio)
 static void search_free(struct closure *cl)
 {
         struct search *s = container_of(cl, struct search, cl);
-        bio_complete(s);
 
         if (s->iop.bio)
                 bio_put(s->iop.bio);
 
+        bio_complete(s);
         closure_debug_destroy(cl);
         mempool_free(s, s->d->c->search);
 }
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 312895788036..f2273143b3cb 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -963,6 +963,7 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
         uint32_t rtime = cpu_to_le32(get_seconds());
         struct uuid_entry *u;
         char buf[BDEVNAME_SIZE];
+        struct cached_dev *exist_dc, *t;
 
         bdevname(dc->bdev, buf);
 
@@ -987,6 +988,16 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
                 return -EINVAL;
         }
 
+        /* Check whether already attached */
+        list_for_each_entry_safe(exist_dc, t, &c->cached_devs, list) {
+                if (!memcmp(dc->sb.uuid, exist_dc->sb.uuid, 16)) {
+                        pr_err("Tried to attach %s but duplicate UUID already attached",
+                                buf);
+
+                        return -EINVAL;
+                }
+        }
+
         u = uuid_find(c, dc->sb.uuid);
 
         if (u &&
@@ -1204,7 +1215,7 @@ static void register_bdev(struct cache_sb *sb, struct page *sb_page,
 
         return;
 err:
-        pr_notice("error opening %s: %s", bdevname(bdev, name), err);
+        pr_notice("error %s: %s", bdevname(bdev, name), err);
         bcache_device_stop(&dc->disk);
 }
 
@@ -1274,7 +1285,7 @@ static int flash_devs_run(struct cache_set *c)
         struct uuid_entry *u;
 
         for (u = c->uuids;
-             u < c->uuids + c->devices_max_used && !ret;
+             u < c->uuids + c->nr_uuids && !ret;
              u++)
                 if (UUID_FLASH_ONLY(u))
                         ret = flash_dev_run(c, u);
@@ -1883,6 +1894,8 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page,
         const char *err = NULL; /* must be set for any error case */
         int ret = 0;
 
+        bdevname(bdev, name);
+
         memcpy(&ca->sb, sb, sizeof(struct cache_sb));
         ca->bdev = bdev;
         ca->bdev->bd_holder = ca;
@@ -1891,11 +1904,12 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page,
         bio_first_bvec_all(&ca->sb_bio)->bv_page = sb_page;
         get_page(sb_page);
 
-        if (blk_queue_discard(bdev_get_queue(ca->bdev)))
+        if (blk_queue_discard(bdev_get_queue(bdev)))
                 ca->discard = CACHE_DISCARD(&ca->sb);
 
         ret = cache_alloc(ca);
         if (ret != 0) {
+                blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
                 if (ret == -ENOMEM)
                         err = "cache_alloc(): -ENOMEM";
                 else
@@ -1918,14 +1932,14 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page,
                 goto out;
         }
 
-        pr_info("registered cache device %s", bdevname(bdev, name));
+        pr_info("registered cache device %s", name);
 
 out:
         kobject_put(&ca->kobj);
 
 err:
         if (err)
-                pr_notice("error opening %s: %s", bdevname(bdev, name), err);
+                pr_notice("error %s: %s", name, err);
 
         return ret;
 }
@@ -2014,6 +2028,7 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
         if (err)
                 goto err_close;
 
+        err = "failed to register device";
         if (SB_IS_BDEV(sb)) {
                 struct cached_dev *dc = kzalloc(sizeof(*dc), GFP_KERNEL);
                 if (!dc)
@@ -2028,7 +2043,7 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
                         goto err_close;
 
                 if (register_cache(sb, sb_page, bdev, ca) != 0)
-                        goto err_close;
+                        goto err;
         }
 out:
         if (sb_page)
@@ -2041,7 +2056,7 @@ out:
 err_close:
         blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
 err:
-        pr_info("error opening %s: %s", path, err);
+        pr_info("error %s: %s", path, err);
         ret = -EINVAL;
         goto out;
 }
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 414c9af54ded..aa2032fa80d4 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -386,9 +386,6 @@ static void __cache_size_refresh(void)
 static void *alloc_buffer_data(struct dm_bufio_client *c, gfp_t gfp_mask,
                                enum data_mode *data_mode)
 {
-        unsigned noio_flag;
-        void *ptr;
-
         if (c->block_size <= DM_BUFIO_BLOCK_SIZE_SLAB_LIMIT) {
                 *data_mode = DATA_MODE_SLAB;
                 return kmem_cache_alloc(DM_BUFIO_CACHE(c), gfp_mask);
@@ -412,16 +409,15 @@ static void *alloc_buffer_data(struct dm_bufio_client *c, gfp_t gfp_mask,
          * all allocations done by this process (including pagetables) are done
          * as if GFP_NOIO was specified.
          */
+        if (gfp_mask & __GFP_NORETRY) {
+                unsigned noio_flag = memalloc_noio_save();
+                void *ptr = __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL);
 
-        if (gfp_mask & __GFP_NORETRY)
-                noio_flag = memalloc_noio_save();
-
-        ptr = __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL);
-
-        if (gfp_mask & __GFP_NORETRY)
                 memalloc_noio_restore(noio_flag);
+                return ptr;
+        }
 
-        return ptr;
+        return __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL);
 }
 
 /*
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 7d3e572072f5..a05a560d3cba 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -211,29 +211,27 @@ static int alloc_multipath_stage2(struct dm_target *ti, struct multipath *m)
                 else
                         m->queue_mode = DM_TYPE_REQUEST_BASED;
 
-        } else if (m->queue_mode == DM_TYPE_BIO_BASED ||
-                   m->queue_mode == DM_TYPE_NVME_BIO_BASED) {
+        } else if (m->queue_mode == DM_TYPE_BIO_BASED) {
                 INIT_WORK(&m->process_queued_bios, process_queued_bios);
-
-                if (m->queue_mode == DM_TYPE_BIO_BASED) {
-                        /*
-                         * bio-based doesn't support any direct scsi_dh management;
-                         * it just discovers if a scsi_dh is attached.
-                         */
-                        set_bit(MPATHF_RETAIN_ATTACHED_HW_HANDLER, &m->flags);
-                }
-        }
-
-        if (m->queue_mode != DM_TYPE_NVME_BIO_BASED) {
-                set_bit(MPATHF_QUEUE_IO, &m->flags);
-                atomic_set(&m->pg_init_in_progress, 0);
-                atomic_set(&m->pg_init_count, 0);
-                m->pg_init_delay_msecs = DM_PG_INIT_DELAY_DEFAULT;
-                init_waitqueue_head(&m->pg_init_wait);
+                /*
+                 * bio-based doesn't support any direct scsi_dh management;
+                 * it just discovers if a scsi_dh is attached.
+                 */
+                set_bit(MPATHF_RETAIN_ATTACHED_HW_HANDLER, &m->flags);
         }
 
         dm_table_set_type(ti->table, m->queue_mode);
 
+        /*
+         * Init fields that are only used when a scsi_dh is attached
+         * - must do this unconditionally (really doesn't hurt non-SCSI uses)
+         */
+        set_bit(MPATHF_QUEUE_IO, &m->flags);
+        atomic_set(&m->pg_init_in_progress, 0);
+        atomic_set(&m->pg_init_count, 0);
+        m->pg_init_delay_msecs = DM_PG_INIT_DELAY_DEFAULT;
+        init_waitqueue_head(&m->pg_init_wait);
+
         return 0;
 }
 
@@ -337,9 +335,6 @@ static void __switch_pg(struct multipath *m, struct priority_group *pg)
 {
         m->current_pg = pg;
 
-        if (m->queue_mode == DM_TYPE_NVME_BIO_BASED)
-                return;
-
         /* Must we initialise the PG first, and queue I/O till it's ready? */
         if (m->hw_handler_name) {
                 set_bit(MPATHF_PG_INIT_REQUIRED, &m->flags);
@@ -385,8 +380,7 @@ static struct pgpath *choose_pgpath(struct multipath *m, size_t nr_bytes)
         unsigned bypassed = 1;
 
         if (!atomic_read(&m->nr_valid_paths)) {
-                if (m->queue_mode != DM_TYPE_NVME_BIO_BASED)
-                        clear_bit(MPATHF_QUEUE_IO, &m->flags);
+                clear_bit(MPATHF_QUEUE_IO, &m->flags);
                 goto failed;
         }
 
@@ -599,7 +593,7 @@ static struct pgpath *__map_bio(struct multipath *m, struct bio *bio)
         return pgpath;
 }
 
-static struct pgpath *__map_bio_nvme(struct multipath *m, struct bio *bio)
+static struct pgpath *__map_bio_fast(struct multipath *m, struct bio *bio)
 {
         struct pgpath *pgpath;
         unsigned long flags;
@@ -634,8 +628,8 @@ static int __multipath_map_bio(struct multipath *m, struct bio *bio,
 {
         struct pgpath *pgpath;
 
-        if (m->queue_mode == DM_TYPE_NVME_BIO_BASED)
-                pgpath = __map_bio_nvme(m, bio);
+        if (!m->hw_handler_name)
+                pgpath = __map_bio_fast(m, bio);
         else
                 pgpath = __map_bio(m, bio);
 
@@ -675,8 +669,7 @@ static void process_queued_io_list(struct multipath *m)
 {
         if (m->queue_mode == DM_TYPE_MQ_REQUEST_BASED)
                 dm_mq_kick_requeue_list(dm_table_get_md(m->ti->table));
-        else if (m->queue_mode == DM_TYPE_BIO_BASED ||
-                 m->queue_mode == DM_TYPE_NVME_BIO_BASED)
+        else if (m->queue_mode == DM_TYPE_BIO_BASED)
                 queue_work(kmultipathd, &m->process_queued_bios);
 }
 
@@ -811,15 +804,14 @@ static int parse_path_selector(struct dm_arg_set *as, struct priority_group *pg,
         return 0;
 }
 
-static int setup_scsi_dh(struct block_device *bdev, struct multipath *m, char **error)
+static int setup_scsi_dh(struct block_device *bdev, struct multipath *m,
+                         const char *attached_handler_name, char **error)
 {
         struct request_queue *q = bdev_get_queue(bdev);
-        const char *attached_handler_name;
         int r;
 
         if (test_bit(MPATHF_RETAIN_ATTACHED_HW_HANDLER, &m->flags)) {
 retain:
-                attached_handler_name = scsi_dh_attached_handler_name(q, GFP_KERNEL);
                 if (attached_handler_name) {
                         /*
                          * Clear any hw_handler_params associated with a
@@ -873,6 +865,8 @@ static struct pgpath *parse_path(struct dm_arg_set *as, struct path_selector *ps
         int r;
         struct pgpath *p;
         struct multipath *m = ti->private;
+        struct request_queue *q;
+        const char *attached_handler_name;
 
         /* we need at least a path arg */
         if (as->argc < 1) {
@@ -891,9 +885,11 @@ static struct pgpath *parse_path(struct dm_arg_set *as, struct path_selector *ps
                 goto bad;
         }
 
-        if (m->queue_mode != DM_TYPE_NVME_BIO_BASED) {
+        q = bdev_get_queue(p->path.dev->bdev);
+        attached_handler_name = scsi_dh_attached_handler_name(q, GFP_KERNEL);
+        if (attached_handler_name) {
                 INIT_DELAYED_WORK(&p->activate_path, activate_path_work);
-                r = setup_scsi_dh(p->path.dev->bdev, m, &ti->error);
+                r = setup_scsi_dh(p->path.dev->bdev, m, attached_handler_name, &ti->error);
                 if (r) {
                         dm_put_device(ti, p->path.dev);
                         goto bad;
@@ -1001,8 +997,7 @@ static int parse_hw_handler(struct dm_arg_set *as, struct multipath *m)
         if (!hw_argc)
                 return 0;
 
-        if (m->queue_mode == DM_TYPE_BIO_BASED ||
-            m->queue_mode == DM_TYPE_NVME_BIO_BASED) {
+        if (m->queue_mode == DM_TYPE_BIO_BASED) {
                 dm_consume_args(as, hw_argc);
                 DMERR("bio-based multipath doesn't allow hardware handler args");
                 return 0;
@@ -1091,8 +1086,6 @@ static int parse_features(struct dm_arg_set *as, struct multipath *m)
 
                         if (!strcasecmp(queue_mode_name, "bio"))
                                 m->queue_mode = DM_TYPE_BIO_BASED;
-                        else if (!strcasecmp(queue_mode_name, "nvme"))
-                                m->queue_mode = DM_TYPE_NVME_BIO_BASED;
                         else if (!strcasecmp(queue_mode_name, "rq"))
                                 m->queue_mode = DM_TYPE_REQUEST_BASED;
                         else if (!strcasecmp(queue_mode_name, "mq"))
@@ -1193,7 +1186,7 @@ static int multipath_ctr(struct dm_target *ti, unsigned argc, char **argv)
         ti->num_discard_bios = 1;
         ti->num_write_same_bios = 1;
         ti->num_write_zeroes_bios = 1;
-        if (m->queue_mode == DM_TYPE_BIO_BASED || m->queue_mode == DM_TYPE_NVME_BIO_BASED)
+        if (m->queue_mode == DM_TYPE_BIO_BASED)
                 ti->per_io_data_size = multipath_per_bio_data_size();
         else
                 ti->per_io_data_size = sizeof(struct dm_mpath_io);
@@ -1730,9 +1723,6 @@ static void multipath_status(struct dm_target *ti, status_type_t type,
                         case DM_TYPE_BIO_BASED:
                                 DMEMIT("queue_mode bio ");
                                 break;
-                        case DM_TYPE_NVME_BIO_BASED:
-                                DMEMIT("queue_mode nvme ");
-                                break;
                         case DM_TYPE_MQ_REQUEST_BASED:
                                 DMEMIT("queue_mode mq ");
                                 break;
@@ -2030,8 +2020,9 @@ static int multipath_busy(struct dm_target *ti)
  *---------------------------------------------------------------*/
 static struct target_type multipath_target = {
         .name = "multipath",
-        .version = {1, 12, 0},
-        .features = DM_TARGET_SINGLETON | DM_TARGET_IMMUTABLE,
+        .version = {1, 13, 0},
+        .features = DM_TARGET_SINGLETON | DM_TARGET_IMMUTABLE |
+                    DM_TARGET_PASSES_INTEGRITY,
         .module = THIS_MODULE,
         .ctr = multipath_ctr,
         .dtr = multipath_dtr,
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 7ef469e902c6..c1d1034ff7b7 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3408,9 +3408,10 @@ static sector_t rs_get_progress(struct raid_set *rs, unsigned long recovery,
                 set_bit(RT_FLAG_RS_IN_SYNC, &rs->runtime_flags);
 
         } else {
-                if (test_bit(MD_RECOVERY_NEEDED, &recovery) ||
-                    test_bit(MD_RECOVERY_RESHAPE, &recovery) ||
-                    test_bit(MD_RECOVERY_RUNNING, &recovery))
+                if (!test_bit(MD_RECOVERY_INTR, &recovery) &&
+                    (test_bit(MD_RECOVERY_NEEDED, &recovery) ||
+                     test_bit(MD_RECOVERY_RESHAPE, &recovery) ||
+                     test_bit(MD_RECOVERY_RUNNING, &recovery)))
                         r = mddev->curr_resync_completed;
                 else
                         r = mddev->recovery_cp;
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 5fe7ec356c33..7eb3e2a3c07d 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -942,17 +942,12 @@ static int dm_table_determine_type(struct dm_table *t)
 
         if (t->type != DM_TYPE_NONE) {
                 /* target already set the table's type */
-                if (t->type == DM_TYPE_BIO_BASED)
-                        return 0;
-                else if (t->type == DM_TYPE_NVME_BIO_BASED) {
-                        if (!dm_table_does_not_support_partial_completion(t)) {
-                                DMERR("nvme bio-based is only possible with devices"
-                                      " that don't support partial completion");
-                                return -EINVAL;
-                        }
-                        /* Fallthru, also verify all devices are blk-mq */
+                if (t->type == DM_TYPE_BIO_BASED) {
+                        /* possibly upgrade to a variant of bio-based */
+                        goto verify_bio_based;
                 }
                 BUG_ON(t->type == DM_TYPE_DAX_BIO_BASED);
+                BUG_ON(t->type == DM_TYPE_NVME_BIO_BASED);
                 goto verify_rq_based;
         }
 
@@ -985,6 +980,7 @@ static int dm_table_determine_type(struct dm_table *t)
         }
 
         if (bio_based) {
+verify_bio_based:
                 /* We must use this table as bio-based */
                 t->type = DM_TYPE_BIO_BASED;
                 if (dm_table_supports_dax(t) ||
@@ -1755,7 +1751,7 @@ static int device_no_partial_completion(struct dm_target *ti, struct dm_dev *dev
         char b[BDEVNAME_SIZE];
 
         /* For now, NVMe devices are the only devices of this class */
-        return (strncmp(bdevname(dev->bdev, b), "nvme", 3) == 0);
+        return (strncmp(bdevname(dev->bdev, b), "nvme", 4) == 0);
 }
 
 static bool dm_table_does_not_support_partial_completion(struct dm_table *t)
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 68136806d365..45328d8b2859 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -458,9 +458,11 @@ static int dm_blk_getgeo(struct block_device *bdev, struct hd_geometry *geo)
         return dm_get_geometry(md, geo);
 }
 
-static int dm_grab_bdev_for_ioctl(struct mapped_device *md,
-                                  struct block_device **bdev,
-                                  fmode_t *mode)
+static char *_dm_claim_ptr = "I belong to device-mapper";
+
+static int dm_get_bdev_for_ioctl(struct mapped_device *md,
+                                 struct block_device **bdev,
+                                 fmode_t *mode)
 {
         struct dm_target *tgt;
         struct dm_table *map;
@@ -490,6 +492,10 @@ retry:
                 goto out;
 
         bdgrab(*bdev);
+        r = blkdev_get(*bdev, *mode, _dm_claim_ptr);
+        if (r < 0)
+                goto out;
+
         dm_put_live_table(md, srcu_idx);
         return r;
 
@@ -508,7 +514,7 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode,
         struct mapped_device *md = bdev->bd_disk->private_data;
         int r;
 
-        r = dm_grab_bdev_for_ioctl(md, &bdev, &mode);
+        r = dm_get_bdev_for_ioctl(md, &bdev, &mode);
         if (r < 0)
                 return r;
 
@@ -528,7 +534,7 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode,
 
         r =  __blkdev_driver_ioctl(bdev, mode, cmd, arg);
 out:
-        bdput(bdev);
+        blkdev_put(bdev, mode);
         return r;
 }
 
@@ -708,14 +714,13 @@ static void dm_put_live_table_fast(struct mapped_device *md) __releases(RCU)
 static int open_table_device(struct table_device *td, dev_t dev,
                              struct mapped_device *md)
 {
-        static char *_claim_ptr = "I belong to device-mapper";
         struct block_device *bdev;
 
         int r;
 
         BUG_ON(td->dm_dev.bdev);
 
-        bdev = blkdev_get_by_dev(dev, td->dm_dev.mode | FMODE_EXCL, _claim_ptr);
+        bdev = blkdev_get_by_dev(dev, td->dm_dev.mode | FMODE_EXCL, _dm_claim_ptr);
         if (IS_ERR(bdev))
                 return PTR_ERR(bdev);
 
@@ -3011,7 +3016,7 @@ static int dm_pr_reserve(struct block_device *bdev, u64 key, enum pr_type type,
         fmode_t mode;
         int r;
 
-        r = dm_grab_bdev_for_ioctl(md, &bdev, &mode);
+        r = dm_get_bdev_for_ioctl(md, &bdev, &mode);
         if (r < 0)
                 return r;
 
@@ -3021,7 +3026,7 @@ static int dm_pr_reserve(struct block_device *bdev, u64 key, enum pr_type type,
         else
                 r = -EOPNOTSUPP;
 
-        bdput(bdev);
+        blkdev_put(bdev, mode);
         return r;
 }
 
@@ -3032,7 +3037,7 @@ static int dm_pr_release(struct block_device *bdev, u64 key, enum pr_type type)
         fmode_t mode;
         int r;
 
-        r = dm_grab_bdev_for_ioctl(md, &bdev, &mode);
+        r = dm_get_bdev_for_ioctl(md, &bdev, &mode);
         if (r < 0)
                 return r;
 
@@ -3042,7 +3047,7 @@ static int dm_pr_release(struct block_device *bdev, u64 key, enum pr_type type)
         else
                 r = -EOPNOTSUPP;
 
-        bdput(bdev);
+        blkdev_put(bdev, mode);
         return r;
 }
 
@@ -3054,7 +3059,7 @@ static int dm_pr_preempt(struct block_device *bdev, u64 old_key, u64 new_key,
         fmode_t mode;
         int r;
 
-        r = dm_grab_bdev_for_ioctl(md, &bdev, &mode);
+        r = dm_get_bdev_for_ioctl(md, &bdev, &mode);
         if (r < 0)
                 return r;
 
@@ -3064,7 +3069,7 @@ static int dm_pr_preempt(struct block_device *bdev, u64 old_key, u64 new_key,
         else
                 r = -EOPNOTSUPP;
 
-        bdput(bdev);
+        blkdev_put(bdev, mode);
         return r;
 }
 
@@ -3075,7 +3080,7 @@ static int dm_pr_clear(struct block_device *bdev, u64 key)
         fmode_t mode;
         int r;
 
-        r = dm_grab_bdev_for_ioctl(md, &bdev, &mode);
+        r = dm_get_bdev_for_ioctl(md, &bdev, &mode);
         if (r < 0)
                 return r;
 
@@ -3085,7 +3090,7 @@ static int dm_pr_clear(struct block_device *bdev, u64 key)
         else
                 r = -EOPNOTSUPP;
 
-        bdput(bdev);
+        blkdev_put(bdev, mode);
         return r;
 }
 
diff --git a/drivers/md/md-multipath.c b/drivers/md/md-multipath.c
index e40065bdbfc8..0a7e99d62c69 100644
--- a/drivers/md/md-multipath.c
+++ b/drivers/md/md-multipath.c
@@ -157,7 +157,7 @@ static void multipath_status(struct seq_file *seq, struct mddev *mddev)
                 seq_printf (seq, "%s", rdev && test_bit(In_sync, &rdev->flags) ? "U" : "_");
         }
         rcu_read_unlock();
-        seq_printf (seq, "]");
+        seq_putc(seq, ']');
 }
 
 static int multipath_congested(struct mddev *mddev, int bits)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index bc67ab6844f0..254e44e44668 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -801,6 +801,9 @@ void md_super_write(struct mddev *mddev, struct md_rdev *rdev,
         struct bio *bio;
         int ff = 0;
 
+        if (!page)
+                return;
+
         if (test_bit(Faulty, &rdev->flags))
                 return;
 
@@ -5452,6 +5455,7 @@ int md_run(struct mddev *mddev)
          * the only valid external interface is through the md
          * device.
          */
+        mddev->has_superblocks = false;
         rdev_for_each(rdev, mddev) {
                 if (test_bit(Faulty, &rdev->flags))
                         continue;
@@ -5465,6 +5469,9 @@ int md_run(struct mddev *mddev)
                                 set_disk_ro(mddev->gendisk, 1);
                 }
 
+                if (rdev->sb_page)
+                        mddev->has_superblocks = true;
+
                 /* perform some consistency tests on the device.
                  * We don't want the data to overlap the metadata,
                  * Internal Bitmap issues have been handled elsewhere.
@@ -5497,8 +5504,10 @@ int md_run(struct mddev *mddev)
         }
         if (mddev->sync_set == NULL) {
                 mddev->sync_set = bioset_create(BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS);
-                if (!mddev->sync_set)
-                        return -ENOMEM;
+                if (!mddev->sync_set) {
+                        err = -ENOMEM;
+                        goto abort;
+                }
         }
 
         spin_lock(&pers_lock);
@@ -5511,7 +5520,8 @@ int md_run(struct mddev *mddev)
                 else
                         pr_warn("md: personality for level %s is not loaded!\n",
                                 mddev->clevel);
-                return -EINVAL;
+                err = -EINVAL;
+                goto abort;
         }
         spin_unlock(&pers_lock);
         if (mddev->level != pers->level) {
@@ -5524,7 +5534,8 @@ int md_run(struct mddev *mddev)
             pers->start_reshape == NULL) {
                 /* This personality cannot handle reshaping... */
                 module_put(pers->owner);
-                return -EINVAL;
+                err = -EINVAL;
+                goto abort;
         }
 
         if (pers->sync_request) {
@@ -5593,7 +5604,7 @@ int md_run(struct mddev *mddev)
                 mddev->private = NULL;
                 module_put(pers->owner);
                 bitmap_destroy(mddev);
-                return err;
+                goto abort;
         }
         if (mddev->queue) {
                 bool nonrot = true;
@@ -5655,6 +5666,18 @@ int md_run(struct mddev *mddev)
         sysfs_notify_dirent_safe(mddev->sysfs_action);
         sysfs_notify(&mddev->kobj, NULL, "degraded");
         return 0;
+
+abort:
+        if (mddev->bio_set) {
+                bioset_free(mddev->bio_set);
+                mddev->bio_set = NULL;
+        }
+        if (mddev->sync_set) {
+                bioset_free(mddev->sync_set);
+                mddev->sync_set = NULL;
+        }
+
+        return err;
 }
 EXPORT_SYMBOL_GPL(md_run);
 
@@ -8049,6 +8072,7 @@ EXPORT_SYMBOL(md_done_sync);
 bool md_write_start(struct mddev *mddev, struct bio *bi)
 {
         int did_change = 0;
+
         if (bio_data_dir(bi) != WRITE)
                 return true;
 
@@ -8081,6 +8105,8 @@ bool md_write_start(struct mddev *mddev, struct bio *bi)
         rcu_read_unlock();
         if (did_change)
                 sysfs_notify_dirent_safe(mddev->sysfs_state);
+        if (!mddev->has_superblocks)
+                return true;
         wait_event(mddev->sb_wait,
                    !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags) ||
                    mddev->suspended);
@@ -8543,6 +8569,19 @@ void md_do_sync(struct md_thread *thread)
         set_mask_bits(&mddev->sb_flags, 0,
                       BIT(MD_SB_CHANGE_PENDING) | BIT(MD_SB_CHANGE_DEVS));
 
+        if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
+                        !test_bit(MD_RECOVERY_INTR, &mddev->recovery) &&
+                        mddev->delta_disks > 0 &&
+                        mddev->pers->finish_reshape &&
+                        mddev->pers->size &&
+                        mddev->queue) {
+                mddev_lock_nointr(mddev);
+                md_set_array_sectors(mddev, mddev->pers->size(mddev, 0, 0));
+                mddev_unlock(mddev);
+                set_capacity(mddev->gendisk, mddev->array_sectors);
+                revalidate_disk(mddev->gendisk);
+        }
+
         spin_lock(&mddev->lock);
         if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery)) {
                 /* We completed so min/max setting can be forgotten if used. */
@@ -8569,6 +8608,10 @@ static int remove_and_add_spares(struct mddev *mddev,
         int removed = 0;
         bool remove_some = false;
 
+        if (this && test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
+                /* Mustn't remove devices when resync thread is running */
+                return 0;
+
         rdev_for_each(rdev, mddev) {
                 if ((this == NULL || rdev == this) &&
                     rdev->raid_disk >= 0 &&
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 58cd20a5e85e..fbc925cce810 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -468,6 +468,8 @@ struct mddev {
         void (*sync_super)(struct mddev *mddev, struct md_rdev *rdev);
         struct md_cluster_info          *cluster_info;
         unsigned int                    good_device_nr; /* good device num within cluster raid */
+
+        bool    has_superblocks:1;
 };
 
 enum recovery_flags {
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f978eddc7a21..fe872dc6712e 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1809,6 +1809,17 @@ static int raid1_remove_disk(struct mddev *mddev, struct md_rdev *rdev)
                         struct md_rdev *repl =
                                 conf->mirrors[conf->raid_disks + number].rdev;
                         freeze_array(conf, 0);
+                        if (atomic_read(&repl->nr_pending)) {
+                                /* It means that some queued IO of retry_list
+                                 * hold repl. Thus, we cannot set replacement
+                                 * as NULL, avoiding rdev NULL pointer
+                                 * dereference in sync_request_write and
+                                 * handle_write_finished.
+                                 */
+                                err = -EBUSY;
+                                unfreeze_array(conf);
+                                goto abort;
+                        }
                         clear_bit(Replacement, &repl->flags);
                         p->rdev = repl;
                         conf->mirrors[conf->raid_disks + number].rdev = NULL;
diff --git a/drivers/md/raid1.h b/drivers/md/raid1.h
index c7294e7557e0..eb84bc68e2fd 100644
--- a/drivers/md/raid1.h
+++ b/drivers/md/raid1.h
@@ -26,6 +26,18 @@
 #define BARRIER_BUCKETS_NR_BITS         (PAGE_SHIFT - ilog2(sizeof(atomic_t)))
 #define BARRIER_BUCKETS_NR              (1<<BARRIER_BUCKETS_NR_BITS)
 
+/* Note: raid1_info.rdev can be set to NULL asynchronously by raid1_remove_disk.
+ * There are three safe ways to access raid1_info.rdev.
+ * 1/ when holding mddev->reconfig_mutex
+ * 2/ when resync/recovery is known to be happening - i.e. in code that is
+ *    called as part of performing resync/recovery.
+ * 3/ while holding rcu_read_lock(), use rcu_dereference to get the pointer
+ *    and if it is non-NULL, increment rdev->nr_pending before dropping the
+ *    RCU lock.
+ * When .rdev is set to NULL, the nr_pending count checked again and if it has
+ * been incremented, the pointer is put back in .rdev.
+ */
+
 struct raid1_info {
         struct md_rdev  *rdev;
         sector_t        head_position;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 99c9207899a7..c5e6c60fc0d4 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -141,7 +141,7 @@ static void r10bio_pool_free(void *r10_bio, void *data)
 #define RESYNC_WINDOW (1024*1024)
 /* maximum number of concurrent requests, memory permitting */
 #define RESYNC_DEPTH (32*1024*1024/RESYNC_BLOCK_SIZE)
-#define CLUSTER_RESYNC_WINDOW (16 * RESYNC_WINDOW)
+#define CLUSTER_RESYNC_WINDOW (32 * RESYNC_WINDOW)
 #define CLUSTER_RESYNC_WINDOW_SECTORS (CLUSTER_RESYNC_WINDOW >> 9)
 
 /*
@@ -2655,7 +2655,8 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio)
                 for (m = 0; m < conf->copies; m++) {
                         int dev = r10_bio->devs[m].devnum;
                         rdev = conf->mirrors[dev].rdev;
-                        if (r10_bio->devs[m].bio == NULL)
+                        if (r10_bio->devs[m].bio == NULL ||
+                                r10_bio->devs[m].bio->bi_end_io == NULL)
                                 continue;
                         if (!r10_bio->devs[m].bio->bi_status) {
                                 rdev_clear_badblocks(
@@ -2670,7 +2671,8 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio)
                                         md_error(conf->mddev, rdev);
                         }
                         rdev = conf->mirrors[dev].replacement;
-                        if (r10_bio->devs[m].repl_bio == NULL)
+                        if (r10_bio->devs[m].repl_bio == NULL ||
+                                r10_bio->devs[m].repl_bio->bi_end_io == NULL)
                                 continue;
 
                         if (!r10_bio->devs[m].repl_bio->bi_status) {
@@ -3782,7 +3784,7 @@ static int raid10_run(struct mddev *mddev)
                 if (fc > 1 || fo > 0) {
                         pr_err("only near layout is supported by clustered"
                                 " raid10\n");
-                        goto out;
+                        goto out_free_conf;
                 }
         }
 
@@ -4830,17 +4832,11 @@ static void raid10_finish_reshape(struct mddev *mddev)
                 return;
 
         if (mddev->delta_disks > 0) {
-                sector_t size = raid10_size(mddev, 0, 0);
-                md_set_array_sectors(mddev, size);
                 if (mddev->recovery_cp > mddev->resync_max_sectors) {
                         mddev->recovery_cp = mddev->resync_max_sectors;
                         set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
                 }
-                mddev->resync_max_sectors = size;
-                if (mddev->queue) {
-                        set_capacity(mddev->gendisk, mddev->array_sectors);
-                        revalidate_disk(mddev->gendisk);
-                }
+                mddev->resync_max_sectors = mddev->array_sectors;
         } else {
                 int d;
                 rcu_read_lock();
diff --git a/drivers/md/raid10.h b/drivers/md/raid10.h
index db2ac22ac1b4..e2e8840de9bf 100644
--- a/drivers/md/raid10.h
+++ b/drivers/md/raid10.h
@@ -2,6 +2,19 @@
 #ifndef _RAID10_H
 #define _RAID10_H
 
+/* Note: raid10_info.rdev can be set to NULL asynchronously by
+ * raid10_remove_disk.
+ * There are three safe ways to access raid10_info.rdev.
+ * 1/ when holding mddev->reconfig_mutex
+ * 2/ when resync/recovery/reshape is known to be happening - i.e. in code
+ *    that is called as part of performing resync/recovery/reshape.
+ * 3/ while holding rcu_read_lock(), use rcu_dereference to get the pointer
+ *    and if it is non-NULL, increment rdev->nr_pending before dropping the
+ *    RCU lock.
+ * When .rdev is set to NULL, the nr_pending count checked again and if it has
+ * been incremented, the pointer is put back in .rdev.
+ */
+
 struct raid10_info {
         struct md_rdev  *rdev, *replacement;
         sector_t        head_position;
diff --git a/drivers/md/raid5-log.h b/drivers/md/raid5-log.h
index 0c76bcedfc1c..a001808a2b77 100644
--- a/drivers/md/raid5-log.h
+++ b/drivers/md/raid5-log.h
@@ -44,6 +44,7 @@ extern void ppl_write_stripe_run(struct r5conf *conf);
 extern void ppl_stripe_write_finished(struct stripe_head *sh);
 extern int ppl_modify_log(struct r5conf *conf, struct md_rdev *rdev, bool add);
 extern void ppl_quiesce(struct r5conf *conf, int quiesce);
+extern int ppl_handle_flush_request(struct r5l_log *log, struct bio *bio);
 
 static inline bool raid5_has_ppl(struct r5conf *conf)
 {
@@ -104,7 +105,7 @@ static inline int log_handle_flush_request(struct r5conf *conf, struct bio *bio)
         if (conf->log)
                 ret = r5l_handle_flush_request(conf->log, bio);
         else if (raid5_has_ppl(conf))
-                ret = 0;
+                ret = ppl_handle_flush_request(conf->log, bio);
 
         return ret;
 }
diff --git a/drivers/md/raid5-ppl.c b/drivers/md/raid5-ppl.c
index 2764c2290062..42890a08375b 100644
--- a/drivers/md/raid5-ppl.c
+++ b/drivers/md/raid5-ppl.c
@@ -693,6 +693,16 @@ void ppl_quiesce(struct r5conf *conf, int quiesce)
         }
 }
 
+int ppl_handle_flush_request(struct r5l_log *log, struct bio *bio)
+{
+        if (bio->bi_iter.bi_size == 0) {
+                bio_endio(bio);
+                return 0;
+        }
+        bio->bi_opf &= ~REQ_PREFLUSH;
+        return -EAGAIN;
+}
+
 void ppl_stripe_write_finished(struct stripe_head *sh)
 {
         struct ppl_io_unit *io;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 50d01144b805..b5d2601483e3 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2196,15 +2196,16 @@ static int grow_one_stripe(struct r5conf *conf, gfp_t gfp)
 static int grow_stripes(struct r5conf *conf, int num)
 {
         struct kmem_cache *sc;
+        size_t namelen = sizeof(conf->cache_name[0]);
         int devs = max(conf->raid_disks, conf->previous_raid_disks);
 
         if (conf->mddev->gendisk)
-                sprintf(conf->cache_name[0],
+                snprintf(conf->cache_name[0], namelen,
                         "raid%d-%s", conf->level, mdname(conf->mddev));
         else
-                sprintf(conf->cache_name[0],
+                snprintf(conf->cache_name[0], namelen,
                         "raid%d-%p", conf->level, conf->mddev);
-        sprintf(conf->cache_name[1], "%s-alt", conf->cache_name[0]);
+        snprintf(conf->cache_name[1], namelen, "%.27s-alt", conf->cache_name[0]);
 
         conf->active_name = 0;
         sc = kmem_cache_create(conf->cache_name[conf->active_name],
@@ -6764,9 +6765,7 @@ static void free_conf(struct r5conf *conf)
 
         log_exit(conf);
 
-        if (conf->shrinker.nr_deferred)
-                unregister_shrinker(&conf->shrinker);
-
+        unregister_shrinker(&conf->shrinker);
         free_thread_groups(conf);
         shrink_stripes(conf);
         raid5_free_percpu(conf);
@@ -8001,13 +8000,7 @@ static void raid5_finish_reshape(struct mddev *mddev)
 
         if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery)) {
 
-                if (mddev->delta_disks > 0) {
-                        md_set_array_sectors(mddev, raid5_size(mddev, 0, 0));
-                        if (mddev->queue) {
-                                set_capacity(mddev->gendisk, mddev->array_sectors);
-                                revalidate_disk(mddev->gendisk);
-                        }
-                } else {
+                if (mddev->delta_disks <= 0) {
                         int d;
                         spin_lock_irq(&conf->device_lock);
                         mddev->degraded = raid5_calc_degraded(conf);
diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
index 2e6123825095..3f8da26032ac 100644
--- a/drivers/md/raid5.h
+++ b/drivers/md/raid5.h
@@ -450,6 +450,18 @@ enum {
  * HANDLE gets cleared if stripe_handle leaves nothing locked.
  */
 
+/* Note: disk_info.rdev can be set to NULL asynchronously by raid5_remove_disk.
+ * There are three safe ways to access disk_info.rdev.
+ * 1/ when holding mddev->reconfig_mutex
+ * 2/ when resync/recovery/reshape is known to be happening - i.e. in code that
+ *    is called as part of performing resync/recovery/reshape.
+ * 3/ while holding rcu_read_lock(), use rcu_dereference to get the pointer
+ *    and if it is non-NULL, increment rdev->nr_pending before dropping the RCU
+ *    lock.
+ * When .rdev is set to NULL, the nr_pending count checked again and if
+ * it has been incremented, the pointer is put back in .rdev.
+ */
+
 struct disk_info {
         struct md_rdev  *rdev, *replacement;
         struct page     *extra_page; /* extra page to use in prexor */
diff --git a/drivers/media/Kconfig b/drivers/media/Kconfig
index 145e12bfb819..372c074bb1b9 100644
--- a/drivers/media/Kconfig
+++ b/drivers/media/Kconfig
@@ -147,6 +147,8 @@ config DVB_CORE
 config DVB_MMAP
         bool "Enable DVB memory-mapped API (EXPERIMENTAL)"
         depends on DVB_CORE
+        depends on VIDEO_V4L2=y || VIDEO_V4L2=DVB_CORE
+        select VIDEOBUF2_VMALLOC
         default n
         help
           This option enables DVB experimental memory-mapped API, with
diff --git a/drivers/media/common/videobuf2/Kconfig b/drivers/media/common/videobuf2/Kconfig
index 5df05250de94..17c32ea58395 100644
--- a/drivers/media/common/videobuf2/Kconfig
+++ b/drivers/media/common/videobuf2/Kconfig
@@ -3,6 +3,9 @@ config VIDEOBUF2_CORE
         select DMA_SHARED_BUFFER
         tristate
 
+config VIDEOBUF2_V4L2
+        tristate
+
 config VIDEOBUF2_MEMOPS
         tristate
         select FRAME_VECTOR
diff --git a/drivers/media/common/videobuf2/Makefile b/drivers/media/common/videobuf2/Makefile
index 19de5ccda20b..77bebe8b202f 100644
--- a/drivers/media/common/videobuf2/Makefile
+++ b/drivers/media/common/videobuf2/Makefile
@@ -1,5 +1,12 @@
+# SPDX-License-Identifier: GPL-2.0
+videobuf2-common-objs := videobuf2-core.o
 
-obj-$(CONFIG_VIDEOBUF2_CORE) += videobuf2-core.o videobuf2-v4l2.o
+ifeq ($(CONFIG_TRACEPOINTS),y)
+  videobuf2-common-objs += vb2-trace.o
+endif
+
+obj-$(CONFIG_VIDEOBUF2_CORE) += videobuf2-common.o
+obj-$(CONFIG_VIDEOBUF2_V4L2) += videobuf2-v4l2.o
 obj-$(CONFIG_VIDEOBUF2_MEMOPS) += videobuf2-memops.o
 obj-$(CONFIG_VIDEOBUF2_VMALLOC) += videobuf2-vmalloc.o
 obj-$(CONFIG_VIDEOBUF2_DMA_CONTIG) += videobuf2-dma-contig.o
diff --git a/drivers/media/v4l2-core/vb2-trace.c b/drivers/media/common/videobuf2/vb2-trace.c
index 4c0f39d271f0..4c0f39d271f0 100644
--- a/drivers/media/v4l2-core/vb2-trace.c
+++ b/drivers/media/common/videobuf2/vb2-trace.c
diff --git a/drivers/media/dvb-core/Makefile b/drivers/media/dvb-core/Makefile
index 3a105d82019a..62b028ded9f7 100644
--- a/drivers/media/dvb-core/Makefile
+++ b/drivers/media/dvb-core/Makefile
@@ -4,7 +4,7 @@
 #
 
 dvb-net-$(CONFIG_DVB_NET) := dvb_net.o
-dvb-vb2-$(CONFIG_DVB_MMSP) := dvb_vb2.o
+dvb-vb2-$(CONFIG_DVB_MMAP) := dvb_vb2.o
 
 dvb-core-objs := dvbdev.o dmxdev.o dvb_demux.o                  \
                  dvb_ca_en50221.o dvb_frontend.o                \
diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
index 6d53af00190e..61a750fae465 100644
--- a/drivers/media/dvb-core/dmxdev.c
+++ b/drivers/media/dvb-core/dmxdev.c
@@ -128,11 +128,7 @@ static int dvb_dvr_open(struct inode *inode, struct file *file)
         struct dvb_device *dvbdev = file->private_data;
         struct dmxdev *dmxdev = dvbdev->priv;
         struct dmx_frontend *front;
-#ifndef DVB_MMAP
         bool need_ringbuffer = false;
-#else
-        const bool need_ringbuffer = true;
-#endif
 
         dprintk("%s\n", __func__);
 
@@ -144,17 +140,31 @@ static int dvb_dvr_open(struct inode *inode, struct file *file)
                 return -ENODEV;
         }
 
-#ifndef DVB_MMAP
+        dmxdev->may_do_mmap = 0;
+
+        /*
+         * The logic here is a little tricky due to the ifdef.
+         *
+         * The ringbuffer is used for both read and mmap.
+         *
+         * It is not needed, however, on two situations:
+         *      - Write devices (access with O_WRONLY);
+         *      - For duplex device nodes, opened with O_RDWR.
+         */
+
         if ((file->f_flags & O_ACCMODE) == O_RDONLY)
                 need_ringbuffer = true;
-#else
-        if ((file->f_flags & O_ACCMODE) == O_RDWR) {
+        else if ((file->f_flags & O_ACCMODE) == O_RDWR) {
                 if (!(dmxdev->capabilities & DMXDEV_CAP_DUPLEX)) {
+#ifdef CONFIG_DVB_MMAP
+                        dmxdev->may_do_mmap = 1;
+                        need_ringbuffer = true;
+#else
                         mutex_unlock(&dmxdev->mutex);
                         return -EOPNOTSUPP;
+#endif
                 }
         }
-#endif
 
         if (need_ringbuffer) {
                 void *mem;
@@ -169,8 +179,9 @@ static int dvb_dvr_open(struct inode *inode, struct file *file)
                         return -ENOMEM;
                 }
                 dvb_ringbuffer_init(&dmxdev->dvr_buffer, mem, DVR_BUFFER_SIZE);
-                dvb_vb2_init(&dmxdev->dvr_vb2_ctx, "dvr",
-                             file->f_flags & O_NONBLOCK);
+                if (dmxdev->may_do_mmap)
+                        dvb_vb2_init(&dmxdev->dvr_vb2_ctx, "dvr",
+                                     file->f_flags & O_NONBLOCK);
                 dvbdev->readers--;
         }
 
@@ -200,11 +211,6 @@ static int dvb_dvr_release(struct inode *inode, struct file *file)
 {
         struct dvb_device *dvbdev = file->private_data;
         struct dmxdev *dmxdev = dvbdev->priv;
-#ifndef DVB_MMAP
-        bool need_ringbuffer = false;
-#else
-        const bool need_ringbuffer = true;
-#endif
 
         mutex_lock(&dmxdev->mutex);
 
@@ -213,15 +219,14 @@ static int dvb_dvr_release(struct inode *inode, struct file *file)
                 dmxdev->demux->connect_frontend(dmxdev->demux,
                                                 dmxdev->dvr_orig_fe);
         }
-#ifndef DVB_MMAP
-        if ((file->f_flags & O_ACCMODE) == O_RDONLY)
-                need_ringbuffer = true;
-#endif
 
-        if (need_ringbuffer) {
-                if (dvb_vb2_is_streaming(&dmxdev->dvr_vb2_ctx))
-                        dvb_vb2_stream_off(&dmxdev->dvr_vb2_ctx);
-                dvb_vb2_release(&dmxdev->dvr_vb2_ctx);
+        if (((file->f_flags & O_ACCMODE) == O_RDONLY) ||
+            dmxdev->may_do_mmap) {
+                if (dmxdev->may_do_mmap) {
+                        if (dvb_vb2_is_streaming(&dmxdev->dvr_vb2_ctx))
+                                dvb_vb2_stream_off(&dmxdev->dvr_vb2_ctx);
+                        dvb_vb2_release(&dmxdev->dvr_vb2_ctx);
+                }
                 dvbdev->readers++;
                 if (dmxdev->dvr_buffer.data) {
                         void *mem = dmxdev->dvr_buffer.data;
@@ -380,7 +385,8 @@ static void dvb_dmxdev_filter_timer(struct dmxdev_filter *dmxdevfilter)
 
 static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
                                        const u8 *buffer2, size_t buffer2_len,
-                                       struct dmx_section_filter *filter)
+                                       struct dmx_section_filter *filter,
+                                       u32 *buffer_flags)
 {
         struct dmxdev_filter *dmxdevfilter = filter->priv;
         int ret;
@@ -399,10 +405,12 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
         dprintk("section callback %*ph\n", 6, buffer1);
         if (dvb_vb2_is_streaming(&dmxdevfilter->vb2_ctx)) {
                 ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx,
-                                          buffer1, buffer1_len);
+                                          buffer1, buffer1_len,
+                                          buffer_flags);
                 if (ret == buffer1_len)
                         ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx,
-                                                  buffer2, buffer2_len);
+                                                  buffer2, buffer2_len,
+                                                  buffer_flags);
         } else {
                 ret = dvb_dmxdev_buffer_write(&dmxdevfilter->buffer,
                                               buffer1, buffer1_len);
@@ -422,11 +430,12 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
 
 static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
                                   const u8 *buffer2, size_t buffer2_len,
-                                  struct dmx_ts_feed *feed)
+                                  struct dmx_ts_feed *feed,
+                                  u32 *buffer_flags)
 {
         struct dmxdev_filter *dmxdevfilter = feed->priv;
         struct dvb_ringbuffer *buffer;
-#ifdef DVB_MMAP
+#ifdef CONFIG_DVB_MMAP
         struct dvb_vb2_ctx *ctx;
 #endif
         int ret;
@@ -440,20 +449,22 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
         if (dmxdevfilter->params.pes.output == DMX_OUT_TAP ||
             dmxdevfilter->params.pes.output == DMX_OUT_TSDEMUX_TAP) {
                 buffer = &dmxdevfilter->buffer;
-#ifdef DVB_MMAP
+#ifdef CONFIG_DVB_MMAP
                 ctx = &dmxdevfilter->vb2_ctx;
 #endif
         } else {
                 buffer = &dmxdevfilter->dev->dvr_buffer;
-#ifdef DVB_MMAP
+#ifdef CONFIG_DVB_MMAP
                 ctx = &dmxdevfilter->dev->dvr_vb2_ctx;
 #endif
         }
 
         if (dvb_vb2_is_streaming(ctx)) {
-                ret = dvb_vb2_fill_buffer(ctx, buffer1, buffer1_len);
+                ret = dvb_vb2_fill_buffer(ctx, buffer1, buffer1_len,
+                                          buffer_flags);
                 if (ret == buffer1_len)
-                        ret = dvb_vb2_fill_buffer(ctx, buffer2, buffer2_len);
+                        ret = dvb_vb2_fill_buffer(ctx, buffer2, buffer2_len,
+                                                  buffer_flags);
         } else {
                 if (buffer->error) {
                         spin_unlock(&dmxdevfilter->dev->lock);
@@ -802,6 +813,12 @@ static int dvb_demux_open(struct inode *inode, struct file *file)
         mutex_init(&dmxdevfilter->mutex);
         file->private_data = dmxdevfilter;
 
+#ifdef CONFIG_DVB_MMAP
+        dmxdev->may_do_mmap = 1;
+#else
+        dmxdev->may_do_mmap = 0;
+#endif
+
         dvb_ringbuffer_init(&dmxdevfilter->buffer, NULL, 8192);
         dvb_vb2_init(&dmxdevfilter->vb2_ctx, "demux_filter",
                      file->f_flags & O_NONBLOCK);
@@ -1111,7 +1128,7 @@ static int dvb_demux_do_ioctl(struct file *file,
                 mutex_unlock(&dmxdevfilter->mutex);
                 break;
 
-#ifdef DVB_MMAP
+#ifdef CONFIG_DVB_MMAP
         case DMX_REQBUFS:
                 if (mutex_lock_interruptible(&dmxdevfilter->mutex)) {
                         mutex_unlock(&dmxdev->mutex);
@@ -1160,7 +1177,7 @@ static int dvb_demux_do_ioctl(struct file *file,
                 break;
 #endif
         default:
-                ret = -EINVAL;
+                ret = -ENOTTY;
                 break;
         }
         mutex_unlock(&dmxdev->mutex);
@@ -1199,13 +1216,16 @@ static __poll_t dvb_demux_poll(struct file *file, poll_table *wait)
         return mask;
 }
 
-#ifdef DVB_MMAP
+#ifdef CONFIG_DVB_MMAP
 static int dvb_demux_mmap(struct file *file, struct vm_area_struct *vma)
 {
         struct dmxdev_filter *dmxdevfilter = file->private_data;
         struct dmxdev *dmxdev = dmxdevfilter->dev;
         int ret;
 
+        if (!dmxdev->may_do_mmap)
+                return -ENOTTY;
+
         if (mutex_lock_interruptible(&dmxdev->mutex))
                 return -ERESTARTSYS;
 
@@ -1249,7 +1269,7 @@ static const struct file_operations dvb_demux_fops = {
         .release = dvb_demux_release,
         .poll = dvb_demux_poll,
         .llseek = default_llseek,
-#ifdef DVB_MMAP
+#ifdef CONFIG_DVB_MMAP
         .mmap = dvb_demux_mmap,
 #endif
 };
@@ -1280,7 +1300,7 @@ static int dvb_dvr_do_ioctl(struct file *file,
                 ret = dvb_dvr_set_buffer_size(dmxdev, arg);
                 break;
 
-#ifdef DVB_MMAP
+#ifdef CONFIG_DVB_MMAP
         case DMX_REQBUFS:
                 ret = dvb_vb2_reqbufs(&dmxdev->dvr_vb2_ctx, parg);
                 break;
@@ -1304,7 +1324,7 @@ static int dvb_dvr_do_ioctl(struct file *file,
                 break;
 #endif
         default:
-                ret = -EINVAL;
+                ret = -ENOTTY;
                 break;
         }
         mutex_unlock(&dmxdev->mutex);
@@ -1322,11 +1342,6 @@ static __poll_t dvb_dvr_poll(struct file *file, poll_table *wait)
         struct dvb_device *dvbdev = file->private_data;
         struct dmxdev *dmxdev = dvbdev->priv;
         __poll_t mask = 0;
-#ifndef DVB_MMAP
-        bool need_ringbuffer = false;
-#else
-        const bool need_ringbuffer = true;
-#endif
 
         dprintk("%s\n", __func__);
 
@@ -1337,11 +1352,8 @@ static __poll_t dvb_dvr_poll(struct file *file, poll_table *wait)
 
         poll_wait(file, &dmxdev->dvr_buffer.queue, wait);
 
-#ifndef DVB_MMAP
-        if ((file->f_flags & O_ACCMODE) == O_RDONLY)
-                need_ringbuffer = true;
-#endif
-        if (need_ringbuffer) {
+        if (((file->f_flags & O_ACCMODE) == O_RDONLY) ||
+            dmxdev->may_do_mmap) {
                 if (dmxdev->dvr_buffer.error)
                         mask |= (EPOLLIN | EPOLLRDNORM | EPOLLPRI | EPOLLERR);
 
@@ -1353,13 +1365,16 @@ static __poll_t dvb_dvr_poll(struct file *file, poll_table *wait)
         return mask;
 }
 
-#ifdef DVB_MMAP
+#ifdef CONFIG_DVB_MMAP
 static int dvb_dvr_mmap(struct file *file, struct vm_area_struct *vma)
 {
         struct dvb_device *dvbdev = file->private_data;
         struct dmxdev *dmxdev = dvbdev->priv;
         int ret;
 
+        if (!dmxdev->may_do_mmap)
+                return -ENOTTY;
+
         if (dmxdev->exit)
                 return -ENODEV;
 
@@ -1381,7 +1396,7 @@ static const struct file_operations dvb_dvr_fops = {
         .release = dvb_dvr_release,
         .poll = dvb_dvr_poll,
         .llseek = default_llseek,
-#ifdef DVB_MMAP
+#ifdef CONFIG_DVB_MMAP
         .mmap = dvb_dvr_mmap,
 #endif
 };
diff --git a/drivers/media/dvb-core/dvb_demux.c b/drivers/media/dvb-core/dvb_demux.c
index 210eed0269b0..f45091246bdc 100644
--- a/drivers/media/dvb-core/dvb_demux.c
+++ b/drivers/media/dvb-core/dvb_demux.c
@@ -55,6 +55,17 @@ MODULE_PARM_DESC(dvb_demux_feed_err_pkts,
                 dprintk(x);                             \
 } while (0)
 
+#ifdef CONFIG_DVB_DEMUX_SECTION_LOSS_LOG
+#  define dprintk_sect_loss(x...) dprintk(x)
+#else
+#  define dprintk_sect_loss(x...)
+#endif
+
+#define set_buf_flags(__feed, __flag)                   \
+        do {                                            \
+                (__feed)->buffer_flags |= (__flag);     \
+        } while (0)
+
 /******************************************************************************
  * static inlined helper functions
  ******************************************************************************/
@@ -104,31 +115,30 @@ static inline int dvb_dmx_swfilter_payload(struct dvb_demux_feed *feed,
 {
         int count = payload(buf);
         int p;
-#ifdef CONFIG_DVB_DEMUX_SECTION_LOSS_LOG
         int ccok;
         u8 cc;
-#endif
 
         if (count == 0)
                 return -1;
 
         p = 188 - count;
 
-#ifdef CONFIG_DVB_DEMUX_SECTION_LOSS_LOG
         cc = buf[3] & 0x0f;
         ccok = ((feed->cc + 1) & 0x0f) == cc;
         feed->cc = cc;
-        if (!ccok)
-                dprintk("missed packet: %d instead of %d!\n",
-                        cc, (feed->cc + 1) & 0x0f);
-#endif
+        if (!ccok) {
+                set_buf_flags(feed, DMX_BUFFER_FLAG_DISCONTINUITY_DETECTED);
+                dprintk_sect_loss("missed packet: %d instead of %d!\n",
+                                  cc, (feed->cc + 1) & 0x0f);
+        }
 
         if (buf[1] & 0x40)      // PUSI ?
                 feed->peslen = 0xfffa;
 
         feed->peslen += count;
 
-        return feed->cb.ts(&buf[p], count, NULL, 0, &feed->feed.ts);
+        return feed->cb.ts(&buf[p], count, NULL, 0, &feed->feed.ts,
+                           &feed->buffer_flags);
 }
 
 static int dvb_dmx_swfilter_sectionfilter(struct dvb_demux_feed *feed,
@@ -150,7 +160,7 @@ static int dvb_dmx_swfilter_sectionfilter(struct dvb_demux_feed *feed,
                 return 0;
 
         return feed->cb.sec(feed->feed.sec.secbuf, feed->feed.sec.seclen,
-                            NULL, 0, &f->filter);
+                            NULL, 0, &f->filter, &feed->buffer_flags);
 }
 
 static inline int dvb_dmx_swfilter_section_feed(struct dvb_demux_feed *feed)
@@ -169,8 +179,10 @@ static inline int dvb_dmx_swfilter_section_feed(struct dvb_demux_feed *feed)
         if (sec->check_crc) {
                 section_syntax_indicator = ((sec->secbuf[1] & 0x80) != 0);
                 if (section_syntax_indicator &&
-                    demux->check_crc32(feed, sec->secbuf, sec->seclen))
+                    demux->check_crc32(feed, sec->secbuf, sec->seclen)) {
+                        set_buf_flags(feed, DMX_BUFFER_FLAG_HAD_CRC32_DISCARD);
                         return -1;
+                }
         }
 
         do {
@@ -187,7 +199,6 @@ static void dvb_dmx_swfilter_section_new(struct dvb_demux_feed *feed)
 {
         struct dmx_section_feed *sec = &feed->feed.sec;
 
-#ifdef CONFIG_DVB_DEMUX_SECTION_LOSS_LOG
         if (sec->secbufp < sec->tsfeedp) {
                 int n = sec->tsfeedp - sec->secbufp;
 
@@ -197,12 +208,13 @@ static void dvb_dmx_swfilter_section_new(struct dvb_demux_feed *feed)
                  * but just first and last.
                  */
                 if (sec->secbuf[0] != 0xff || sec->secbuf[n - 1] != 0xff) {
-                        dprintk("section ts padding loss: %d/%d\n",
-                               n, sec->tsfeedp);
-                        dprintk("pad data: %*ph\n", n, sec->secbuf);
+                        set_buf_flags(feed,
+                                      DMX_BUFFER_FLAG_DISCONTINUITY_DETECTED);
+                        dprintk_sect_loss("section ts padding loss: %d/%d\n",
+                                          n, sec->tsfeedp);
+                        dprintk_sect_loss("pad data: %*ph\n", n, sec->secbuf);
                 }
         }
-#endif
 
         sec->tsfeedp = sec->secbufp = sec->seclen = 0;
         sec->secbuf = sec->secbuf_base;
@@ -237,11 +249,10 @@ static int dvb_dmx_swfilter_section_copy_dump(struct dvb_demux_feed *feed,
                 return 0;
 
         if (sec->tsfeedp + len > DMX_MAX_SECFEED_SIZE) {
-#ifdef CONFIG_DVB_DEMUX_SECTION_LOSS_LOG
-                dprintk("section buffer full loss: %d/%d\n",
-                        sec->tsfeedp + len - DMX_MAX_SECFEED_SIZE,
-                        DMX_MAX_SECFEED_SIZE);
-#endif
+                set_buf_flags(feed, DMX_BUFFER_FLAG_DISCONTINUITY_DETECTED);
+                dprintk_sect_loss("section buffer full loss: %d/%d\n",
+                                  sec->tsfeedp + len - DMX_MAX_SECFEED_SIZE,
+                                  DMX_MAX_SECFEED_SIZE);
                 len = DMX_MAX_SECFEED_SIZE - sec->tsfeedp;
         }
 
@@ -269,12 +280,13 @@ static int dvb_dmx_swfilter_section_copy_dump(struct dvb_demux_feed *feed,
                 sec->seclen = seclen;
                 sec->crc_val = ~0;
                 /* dump [secbuf .. secbuf+seclen) */
-                if (feed->pusi_seen)
+                if (feed->pusi_seen) {
                         dvb_dmx_swfilter_section_feed(feed);
-#ifdef CONFIG_DVB_DEMUX_SECTION_LOSS_LOG
-                else
-                        dprintk("pusi not seen, discarding section data\n");
-#endif
+                } else {
+                        set_buf_flags(feed,
+                                      DMX_BUFFER_FLAG_DISCONTINUITY_DETECTED);
+                        dprintk_sect_loss("pusi not seen, discarding section data\n");
+                }
                 sec->secbufp += seclen; /* secbufp and secbuf moving together is */
                 sec->secbuf += seclen;  /* redundant but saves pointer arithmetic */
         }
@@ -307,18 +319,22 @@ static int dvb_dmx_swfilter_section_packet(struct dvb_demux_feed *feed,
         }
 
         if (!ccok || dc_i) {
-#ifdef CONFIG_DVB_DEMUX_SECTION_LOSS_LOG
-                if (dc_i)
-                        dprintk("%d frame with disconnect indicator\n",
+                if (dc_i) {
+                        set_buf_flags(feed,
+                                      DMX_BUFFER_FLAG_DISCONTINUITY_INDICATOR);
+                        dprintk_sect_loss("%d frame with disconnect indicator\n",
                                 cc);
-                else
-                        dprintk("discontinuity: %d instead of %d. %d bytes lost\n",
+                } else {
+                        set_buf_flags(feed,
+                                      DMX_BUFFER_FLAG_DISCONTINUITY_DETECTED);
+                        dprintk_sect_loss("discontinuity: %d instead of %d. %d bytes lost\n",
                                 cc, (feed->cc + 1) & 0x0f, count + 4);
+                }
                 /*
-                 * those bytes under sume circumstances will again be reported
+                 * those bytes under some circumstances will again be reported
                  * in the following dvb_dmx_swfilter_section_new
                  */
-#endif
+
                 /*
                  * Discontinuity detected. Reset pusi_seen to
                  * stop feeding of suspicious data until next PUSI=1 arrives
@@ -326,6 +342,7 @@ static int dvb_dmx_swfilter_section_packet(struct dvb_demux_feed *feed,
                  * FIXME: does it make sense if the MPEG-TS is the one
                  *      reporting discontinuity?
                  */
+
                 feed->pusi_seen = false;
                 dvb_dmx_swfilter_section_new(feed);
         }
@@ -345,11 +362,11 @@ static int dvb_dmx_swfilter_section_packet(struct dvb_demux_feed *feed,
                         dvb_dmx_swfilter_section_new(feed);
                         dvb_dmx_swfilter_section_copy_dump(feed, after,
                                                            after_len);
+                } else if (count > 0) {
+                        set_buf_flags(feed,
+                                      DMX_BUFFER_FLAG_DISCONTINUITY_DETECTED);
+                        dprintk_sect_loss("PUSI=1 but %d bytes lost\n", count);
                 }
-#ifdef CONFIG_DVB_DEMUX_SECTION_LOSS_LOG
-                else if (count > 0)
-                        dprintk("PUSI=1 but %d bytes lost\n", count);
-#endif
         } else {
                 /* PUSI=0 (is not set), no section boundary */
                 dvb_dmx_swfilter_section_copy_dump(feed, &buf[p], count);
@@ -369,7 +386,8 @@ static inline void dvb_dmx_swfilter_packet_type(struct dvb_demux_feed *feed,
                         if (feed->ts_type & TS_PAYLOAD_ONLY)
                                 dvb_dmx_swfilter_payload(feed, buf);
                         else
-                                feed->cb.ts(buf, 188, NULL, 0, &feed->feed.ts);
+                                feed->cb.ts(buf, 188, NULL, 0, &feed->feed.ts,
+                                            &feed->buffer_flags);
                 }
                 /* Used only on full-featured devices */
                 if (feed->ts_type & TS_DECODER)
@@ -430,6 +448,11 @@ static void dvb_dmx_swfilter_packet(struct dvb_demux *demux, const u8 *buf)
         }
 
         if (buf[1] & 0x80) {
+                list_for_each_entry(feed, &demux->feed_list, list_head) {
+                        if ((feed->pid != pid) && (feed->pid != 0x2000))
+                                continue;
+                        set_buf_flags(feed, DMX_BUFFER_FLAG_TEI);
+                }
                 dprintk_tscheck("TEI detected. PID=0x%x data1=0x%x\n",
                                 pid, buf[1]);
                 /* data in this packet can't be trusted - drop it unless
@@ -445,6 +468,13 @@ static void dvb_dmx_swfilter_packet(struct dvb_demux *demux, const u8 *buf)
                                                 (demux->cnt_storage[pid] + 1) & 0xf;
 
                                 if ((buf[3] & 0xf) != demux->cnt_storage[pid]) {
+                                        list_for_each_entry(feed, &demux->feed_list, list_head) {
+                                                if ((feed->pid != pid) && (feed->pid != 0x2000))
+                                                        continue;
+                                                set_buf_flags(feed,
+                                                              DMX_BUFFER_PKT_COUNTER_MISMATCH);
+                                        }
+
                                         dprintk_tscheck("TS packet counter mismatch. PID=0x%x expected 0x%x got 0x%x\n",
                                                         pid, demux->cnt_storage[pid],
                                                         buf[3] & 0xf);
@@ -466,7 +496,8 @@ static void dvb_dmx_swfilter_packet(struct dvb_demux *demux, const u8 *buf)
                 if (feed->pid == pid)
                         dvb_dmx_swfilter_packet_type(feed, buf);
                 else if (feed->pid == 0x2000)
-                        feed->cb.ts(buf, 188, NULL, 0, &feed->feed.ts);
+                        feed->cb.ts(buf, 188, NULL, 0, &feed->feed.ts,
+                                    &feed->buffer_flags);
         }
 }
 
@@ -585,7 +616,8 @@ void dvb_dmx_swfilter_raw(struct dvb_demux *demux, const u8 *buf, size_t count)
 
         spin_lock_irqsave(&demux->lock, flags);
 
-        demux->feed->cb.ts(buf, count, NULL, 0, &demux->feed->feed.ts);
+        demux->feed->cb.ts(buf, count, NULL, 0, &demux->feed->feed.ts,
+                           &demux->feed->buffer_flags);
 
         spin_unlock_irqrestore(&demux->lock, flags);
 }
@@ -785,6 +817,7 @@ static int dvbdmx_allocate_ts_feed(struct dmx_demux *dmx,
         feed->demux = demux;
         feed->pid = 0xffff;
         feed->peslen = 0xfffa;
+        feed->buffer_flags = 0;
 
         (*ts_feed) = &feed->feed.ts;
         (*ts_feed)->parent = dmx;
@@ -1042,6 +1075,7 @@ static int dvbdmx_allocate_section_feed(struct dmx_demux *demux,
         dvbdmxfeed->cb.sec = callback;
         dvbdmxfeed->demux = dvbdmx;
         dvbdmxfeed->pid = 0xffff;
+        dvbdmxfeed->buffer_flags = 0;
         dvbdmxfeed->feed.sec.secbuf = dvbdmxfeed->feed.sec.secbuf_base;
         dvbdmxfeed->feed.sec.secbufp = dvbdmxfeed->feed.sec.seclen = 0;
         dvbdmxfeed->feed.sec.tsfeedp = 0;
diff --git a/drivers/media/dvb-core/dvb_net.c b/drivers/media/dvb-core/dvb_net.c
index b6c7eec863b9..ba39f9942e1d 100644
--- a/drivers/media/dvb-core/dvb_net.c
+++ b/drivers/media/dvb-core/dvb_net.c
@@ -883,7 +883,8 @@ static void dvb_net_ule(struct net_device *dev, const u8 *buf, size_t buf_len)
 
 static int dvb_net_ts_callback(const u8 *buffer1, size_t buffer1_len,
                                const u8 *buffer2, size_t buffer2_len,
-                               struct dmx_ts_feed *feed)
+                               struct dmx_ts_feed *feed,
+                               u32 *buffer_flags)
 {
         struct net_device *dev = feed->priv;
 
@@ -992,7 +993,7 @@ static void dvb_net_sec(struct net_device *dev,
 
 static int dvb_net_sec_callback(const u8 *buffer1, size_t buffer1_len,
                  const u8 *buffer2, size_t buffer2_len,
-                 struct dmx_section_filter *filter)
+                 struct dmx_section_filter *filter, u32 *buffer_flags)
 {
         struct net_device *dev = filter->priv;
 
diff --git a/drivers/media/dvb-core/dvb_vb2.c b/drivers/media/dvb-core/dvb_vb2.c
index 763145d74e83..b811adf88afa 100644
--- a/drivers/media/dvb-core/dvb_vb2.c
+++ b/drivers/media/dvb-core/dvb_vb2.c
@@ -256,7 +256,8 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx)
 }
 
 int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
-                        const unsigned char *src, int len)
+                        const unsigned char *src, int len,
+                        enum dmx_buffer_flags *buffer_flags)
 {
         unsigned long flags = 0;
         void *vbuf = NULL;
@@ -264,15 +265,17 @@ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
         unsigned char *psrc = (unsigned char *)src;
         int ll = 0;
 
-        dprintk(3, "[%s] %d bytes are rcvd\n", ctx->name, len);
-        if (!src) {
-                dprintk(3, "[%s]:NULL pointer src\n", ctx->name);
-                /**normal case: This func is called twice from demux driver
-                 * once with valid src pointer, second time with NULL pointer
-                 */
+        /*
+         * normal case: This func is called twice from demux driver
+         * one with valid src pointer, second time with NULL pointer
+         */
+        if (!src || !len)
                 return 0;
-        }
         spin_lock_irqsave(&ctx->slock, flags);
+        if (buffer_flags && *buffer_flags) {
+                ctx->flags |= *buffer_flags;
+                *buffer_flags = 0;
+        }
         while (todo) {
                 if (!ctx->buf) {
                         if (list_empty(&ctx->dvb_q)) {
@@ -395,6 +398,7 @@ int dvb_vb2_qbuf(struct dvb_vb2_ctx *ctx, struct dmx_buffer *b)
 
 int dvb_vb2_dqbuf(struct dvb_vb2_ctx *ctx, struct dmx_buffer *b)
 {
+        unsigned long flags;
         int ret;
 
         ret = vb2_core_dqbuf(&ctx->vb_q, &b->index, b, ctx->nonblocking);
@@ -402,7 +406,16 @@ int dvb_vb2_dqbuf(struct dvb_vb2_ctx *ctx, struct dmx_buffer *b)
                 dprintk(1, "[%s] errno=%d\n", ctx->name, ret);
                 return ret;
         }
-        dprintk(5, "[%s] index=%d\n", ctx->name, b->index);
+
+        spin_lock_irqsave(&ctx->slock, flags);
+        b->count = ctx->count++;
+        b->flags = ctx->flags;
+        ctx->flags = 0;
+        spin_unlock_irqrestore(&ctx->slock, flags);
+
+        dprintk(5, "[%s] index=%d, count=%d, flags=%d\n",
+                ctx->name, b->index, ctx->count, b->flags);
+
 
         return 0;
 }
diff --git a/drivers/media/dvb-frontends/m88ds3103.c b/drivers/media/dvb-frontends/m88ds3103.c
index 50bce68ffd66..65d157fe76d1 100644
--- a/drivers/media/dvb-frontends/m88ds3103.c
+++ b/drivers/media/dvb-frontends/m88ds3103.c
@@ -1262,11 +1262,12 @@ static int m88ds3103_select(struct i2c_mux_core *muxc, u32 chan)
  * New users must use I2C client binding directly!
  */
 struct dvb_frontend *m88ds3103_attach(const struct m88ds3103_config *cfg,
-                struct i2c_adapter *i2c, struct i2c_adapter **tuner_i2c_adapter)
+                                      struct i2c_adapter *i2c,
+                                      struct i2c_adapter **tuner_i2c_adapter)
 {
         struct i2c_client *client;
         struct i2c_board_info board_info;
-        struct m88ds3103_platform_data pdata;
+        struct m88ds3103_platform_data pdata = {};
 
         pdata.clk = cfg->clock;
         pdata.i2c_wr_max = cfg->i2c_wr_max;
@@ -1409,6 +1410,8 @@ static int m88ds3103_probe(struct i2c_client *client,
         case M88DS3103_CHIP_ID:
                 break;
         default:
+                ret = -ENODEV;
+                dev_err(&client->dev, "Unknown device. Chip_id=%02x\n", dev->chip_id);
                 goto err_kfree;
         }
 
diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
index 3c1851984b90..2476d812f669 100644
--- a/drivers/media/i2c/tvp5150.c
+++ b/drivers/media/i2c/tvp5150.c
@@ -505,80 +505,77 @@ static struct i2c_vbi_ram_value vbi_ram_default[] =
         /* FIXME: Current api doesn't handle all VBI types, those not
            yet supported are placed under #if 0 */
 #if 0
-        {0x010, /* Teletext, SECAM, WST System A */
+        [0] = {0x010, /* Teletext, SECAM, WST System A */
                 {V4L2_SLICED_TELETEXT_SECAM,6,23,1},
                 { 0xaa, 0xaa, 0xff, 0xff, 0xe7, 0x2e, 0x20, 0x26,
                   0xe6, 0xb4, 0x0e, 0x00, 0x00, 0x00, 0x10, 0x00 }
         },
 #endif
-        {0x030, /* Teletext, PAL, WST System B */
+        [1] = {0x030, /* Teletext, PAL, WST System B */
                 {V4L2_SLICED_TELETEXT_B,6,22,1},
                 { 0xaa, 0xaa, 0xff, 0xff, 0x27, 0x2e, 0x20, 0x2b,
                   0xa6, 0x72, 0x10, 0x00, 0x00, 0x00, 0x10, 0x00 }
         },
 #if 0
-        {0x050, /* Teletext, PAL, WST System C */
+        [2] = {0x050, /* Teletext, PAL, WST System C */
                 {V4L2_SLICED_TELETEXT_PAL_C,6,22,1},
                 { 0xaa, 0xaa, 0xff, 0xff, 0xe7, 0x2e, 0x20, 0x22,
                   0xa6, 0x98, 0x0d, 0x00, 0x00, 0x00, 0x10, 0x00 }
         },
-        {0x070, /* Teletext, NTSC, WST System B */
+        [3] = {0x070, /* Teletext, NTSC, WST System B */
                 {V4L2_SLICED_TELETEXT_NTSC_B,10,21,1},
                 { 0xaa, 0xaa, 0xff, 0xff, 0x27, 0x2e, 0x20, 0x23,
                   0x69, 0x93, 0x0d, 0x00, 0x00, 0x00, 0x10, 0x00 }
         },
-        {0x090, /* Tetetext, NTSC NABTS System C */
+        [4] = {0x090, /* Tetetext, NTSC NABTS System C */
                 {V4L2_SLICED_TELETEXT_NTSC_C,10,21,1},
                 { 0xaa, 0xaa, 0xff, 0xff, 0xe7, 0x2e, 0x20, 0x22,
                   0x69, 0x93, 0x0d, 0x00, 0x00, 0x00, 0x15, 0x00 }
         },
-        {0x0b0, /* Teletext, NTSC-J, NABTS System D */
+        [5] = {0x0b0, /* Teletext, NTSC-J, NABTS System D */
                 {V4L2_SLICED_TELETEXT_NTSC_D,10,21,1},
                 { 0xaa, 0xaa, 0xff, 0xff, 0xa7, 0x2e, 0x20, 0x23,
                   0x69, 0x93, 0x0d, 0x00, 0x00, 0x00, 0x10, 0x00 }
         },
-        {0x0d0, /* Closed Caption, PAL/SECAM */
+        [6] = {0x0d0, /* Closed Caption, PAL/SECAM */
                 {V4L2_SLICED_CAPTION_625,22,22,1},
                 { 0xaa, 0x2a, 0xff, 0x3f, 0x04, 0x51, 0x6e, 0x02,
                   0xa6, 0x7b, 0x09, 0x00, 0x00, 0x00, 0x27, 0x00 }
         },
 #endif
-        {0x0f0, /* Closed Caption, NTSC */
+        [7] = {0x0f0, /* Closed Caption, NTSC */
                 {V4L2_SLICED_CAPTION_525,21,21,1},
                 { 0xaa, 0x2a, 0xff, 0x3f, 0x04, 0x51, 0x6e, 0x02,
                   0x69, 0x8c, 0x09, 0x00, 0x00, 0x00, 0x27, 0x00 }
         },
-        {0x110, /* Wide Screen Signal, PAL/SECAM */
+        [8] = {0x110, /* Wide Screen Signal, PAL/SECAM */
                 {V4L2_SLICED_WSS_625,23,23,1},
                 { 0x5b, 0x55, 0xc5, 0xff, 0x00, 0x71, 0x6e, 0x42,
                   0xa6, 0xcd, 0x0f, 0x00, 0x00, 0x00, 0x3a, 0x00 }
         },
 #if 0
-        {0x130, /* Wide Screen Signal, NTSC C */
+        [9] = {0x130, /* Wide Screen Signal, NTSC C */
                 {V4L2_SLICED_WSS_525,20,20,1},
                 { 0x38, 0x00, 0x3f, 0x00, 0x00, 0x71, 0x6e, 0x43,
                   0x69, 0x7c, 0x08, 0x00, 0x00, 0x00, 0x39, 0x00 }
         },
-        {0x150, /* Vertical Interval Timecode (VITC), PAL/SECAM */
+        [10] = {0x150, /* Vertical Interval Timecode (VITC), PAL/SECAM */
                 {V4l2_SLICED_VITC_625,6,22,0},
                 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x8f, 0x6d, 0x49,
                   0xa6, 0x85, 0x08, 0x00, 0x00, 0x00, 0x4c, 0x00 }
         },
-        {0x170, /* Vertical Interval Timecode (VITC), NTSC */
+        [11] = {0x170, /* Vertical Interval Timecode (VITC), NTSC */
                 {V4l2_SLICED_VITC_525,10,20,0},
                 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x8f, 0x6d, 0x49,
                   0x69, 0x94, 0x08, 0x00, 0x00, 0x00, 0x4c, 0x00 }
         },
 #endif
-        {0x190, /* Video Program System (VPS), PAL */
+        [12] = {0x190, /* Video Program System (VPS), PAL */
                 {V4L2_SLICED_VPS,16,16,0},
                 { 0xaa, 0xaa, 0xff, 0xff, 0xba, 0xce, 0x2b, 0x0d,
                   0xa6, 0xda, 0x0b, 0x00, 0x00, 0x00, 0x60, 0x00 }
         },
         /* 0x1d0 User programmable */
-
-        /* End of struct */
-        { (u16)-1 }
 };
 
 static int tvp5150_write_inittab(struct v4l2_subdev *sd,
@@ -591,10 +588,10 @@ static int tvp5150_write_inittab(struct v4l2_subdev *sd,
         return 0;
 }
 
-static int tvp5150_vdp_init(struct v4l2_subdev *sd,
-                                const struct i2c_vbi_ram_value *regs)
+static int tvp5150_vdp_init(struct v4l2_subdev *sd)
 {
         unsigned int i;
+        int j;
 
         /* Disable Full Field */
         tvp5150_write(sd, TVP5150_FULL_FIELD_ENA, 0);
@@ -604,14 +601,17 @@ static int tvp5150_vdp_init(struct v4l2_subdev *sd,
                 tvp5150_write(sd, i, 0xff);
 
         /* Load Ram Table */
-        while (regs->reg != (u16)-1) {
+        for (j = 0; j < ARRAY_SIZE(vbi_ram_default); j++) {
+                const struct i2c_vbi_ram_value *regs = &vbi_ram_default[j];
+
+                if (!regs->type.vbi_type)
+                        continue;
+
                 tvp5150_write(sd, TVP5150_CONF_RAM_ADDR_HIGH, regs->reg >> 8);
                 tvp5150_write(sd, TVP5150_CONF_RAM_ADDR_LOW, regs->reg);
 
                 for (i = 0; i < 16; i++)
                         tvp5150_write(sd, TVP5150_VDP_CONF_RAM_DATA, regs->values[i]);
-
-                regs++;
         }
         return 0;
 }
@@ -620,19 +620,23 @@ static int tvp5150_vdp_init(struct v4l2_subdev *sd,
 static int tvp5150_g_sliced_vbi_cap(struct v4l2_subdev *sd,
                                 struct v4l2_sliced_vbi_cap *cap)
 {
-        const struct i2c_vbi_ram_value *regs = vbi_ram_default;
-        int line;
+        int line, i;
 
         dev_dbg_lvl(sd->dev, 1, debug, "g_sliced_vbi_cap\n");
         memset(cap, 0, sizeof *cap);
 
-        while (regs->reg != (u16)-1 ) {
-                for (line=regs->type.ini_line;line<=regs->type.end_line;line++) {
+        for (i = 0; i < ARRAY_SIZE(vbi_ram_default); i++) {
+                const struct i2c_vbi_ram_value *regs = &vbi_ram_default[i];
+
+                if (!regs->type.vbi_type)
+                        continue;
+
+                for (line = regs->type.ini_line;
+                     line <= regs->type.end_line;
+                     line++) {
                         cap->service_lines[0][line] |= regs->type.vbi_type;
                 }
                 cap->service_set |= regs->type.vbi_type;
-
-                regs++;
         }
         return 0;
 }
@@ -651,14 +655,13 @@ static int tvp5150_g_sliced_vbi_cap(struct v4l2_subdev *sd,
  *      MSB = field2
  */
 static int tvp5150_set_vbi(struct v4l2_subdev *sd,
-                        const struct i2c_vbi_ram_value *regs,
                         unsigned int type,u8 flags, int line,
                         const int fields)
 {
         struct tvp5150 *decoder = to_tvp5150(sd);
         v4l2_std_id std = decoder->norm;
         u8 reg;
-        int pos = 0;
+        int i, pos = 0;
 
         if (std == V4L2_STD_ALL) {
                 dev_err(sd->dev, "VBI can't be configured without knowing number of lines\n");
@@ -671,19 +674,19 @@ static int tvp5150_set_vbi(struct v4l2_subdev *sd,
         if (line < 6 || line > 27)
                 return 0;
 
-        while (regs->reg != (u16)-1) {
+        for (i = 0; i < ARRAY_SIZE(vbi_ram_default); i++) {
+                const struct i2c_vbi_ram_value *regs =  &vbi_ram_default[i];
+
+                if (!regs->type.vbi_type)
+                        continue;
+
                 if ((type & regs->type.vbi_type) &&
                     (line >= regs->type.ini_line) &&
                     (line <= regs->type.end_line))
                         break;
-
-                regs++;
                 pos++;
         }
 
-        if (regs->reg == (u16)-1)
-                return 0;
-
         type = pos | (flags & 0xf0);
         reg = ((line - 6) << 1) + TVP5150_LINE_MODE_INI;
 
@@ -696,8 +699,7 @@ static int tvp5150_set_vbi(struct v4l2_subdev *sd,
         return type;
 }
 
-static int tvp5150_get_vbi(struct v4l2_subdev *sd,
-                        const struct i2c_vbi_ram_value *regs, int line)
+static int tvp5150_get_vbi(struct v4l2_subdev *sd, int line)
 {
         struct tvp5150 *decoder = to_tvp5150(sd);
         v4l2_std_id std = decoder->norm;
@@ -726,8 +728,8 @@ static int tvp5150_get_vbi(struct v4l2_subdev *sd,
                         return 0;
                 }
                 pos = ret & 0x0f;
-                if (pos < 0x0f)
-                        type |= regs[pos].type.vbi_type;
+                if (pos < ARRAY_SIZE(vbi_ram_default))
+                        type |= vbi_ram_default[pos].type.vbi_type;
         }
 
         return type;
@@ -788,7 +790,7 @@ static int tvp5150_reset(struct v4l2_subdev *sd, u32 val)
         tvp5150_write_inittab(sd, tvp5150_init_default);
 
         /* Initializes VDP registers */
-        tvp5150_vdp_init(sd, vbi_ram_default);
+        tvp5150_vdp_init(sd);
 
         /* Selects decoder input */
         tvp5150_selmux(sd);
@@ -1121,8 +1123,8 @@ static int tvp5150_s_sliced_fmt(struct v4l2_subdev *sd, struct v4l2_sliced_vbi_f
                 for (i = 0; i <= 23; i++) {
                         svbi->service_lines[1][i] = 0;
                         svbi->service_lines[0][i] =
-                                tvp5150_set_vbi(sd, vbi_ram_default,
-                                       svbi->service_lines[0][i], 0xf0, i, 3);
+                                tvp5150_set_vbi(sd, svbi->service_lines[0][i],
+                                                0xf0, i, 3);
                 }
                 /* Enables FIFO */
                 tvp5150_write(sd, TVP5150_FIFO_OUT_CTRL, 1);
@@ -1148,7 +1150,7 @@ static int tvp5150_g_sliced_fmt(struct v4l2_subdev *sd, struct v4l2_sliced_vbi_f
 
         for (i = 0; i <= 23; i++) {
                 svbi->service_lines[0][i] =
-                        tvp5150_get_vbi(sd, vbi_ram_default, i);
+                        tvp5150_get_vbi(sd, i);
                 mask |= svbi->service_lines[0][i];
         }
         svbi->service_set = mask;
diff --git a/drivers/media/pci/ttpci/av7110.c b/drivers/media/pci/ttpci/av7110.c
index dc8e577b2f74..d6816effb878 100644
--- a/drivers/media/pci/ttpci/av7110.c
+++ b/drivers/media/pci/ttpci/av7110.c
@@ -324,14 +324,15 @@ static int DvbDmxFilterCallback(u8 *buffer1, size_t buffer1_len,
                 }
                 return dvbdmxfilter->feed->cb.sec(buffer1, buffer1_len,
                                                   buffer2, buffer2_len,
-                                                  &dvbdmxfilter->filter);
+                                                  &dvbdmxfilter->filter, NULL);
         case DMX_TYPE_TS:
                 if (!(dvbdmxfilter->feed->ts_type & TS_PACKET))
                         return 0;
                 if (dvbdmxfilter->feed->ts_type & TS_PAYLOAD_ONLY)
                         return dvbdmxfilter->feed->cb.ts(buffer1, buffer1_len,
                                                          buffer2, buffer2_len,
-                                                         &dvbdmxfilter->feed->feed.ts);
+                                                         &dvbdmxfilter->feed->feed.ts,
+                                                         NULL);
                 else
                         av7110_p2t_write(buffer1, buffer1_len,
                                          dvbdmxfilter->feed->pid,
diff --git a/drivers/media/pci/ttpci/av7110_av.c b/drivers/media/pci/ttpci/av7110_av.c
index 4daba76ec240..ef1bc17cdc4d 100644
--- a/drivers/media/pci/ttpci/av7110_av.c
+++ b/drivers/media/pci/ttpci/av7110_av.c
@@ -99,7 +99,7 @@ int av7110_record_cb(struct dvb_filter_pes2ts *p2t, u8 *buf, size_t len)
                 buf[4] = buf[5] = 0;
         if (dvbdmxfeed->ts_type & TS_PAYLOAD_ONLY)
                 return dvbdmxfeed->cb.ts(buf, len, NULL, 0,
-                                         &dvbdmxfeed->feed.ts);
+                                         &dvbdmxfeed->feed.ts, NULL);
         else
                 return dvb_filter_pes2ts(p2t, buf, len, 1);
 }
@@ -109,7 +109,7 @@ static int dvb_filter_pes2ts_cb(void *priv, unsigned char *data)
         struct dvb_demux_feed *dvbdmxfeed = (struct dvb_demux_feed *) priv;
 
         dvbdmxfeed->cb.ts(data, 188, NULL, 0,
-                          &dvbdmxfeed->feed.ts);
+                          &dvbdmxfeed->feed.ts, NULL);
         return 0;
 }
 
@@ -814,7 +814,7 @@ static void p_to_t(u8 const *buf, long int length, u16 pid, u8 *counter,
                         memcpy(obuf + l, buf + c, TS_SIZE - l);
                         c = length;
                 }
-                feed->cb.ts(obuf, 188, NULL, 0, &feed->feed.ts);
+                feed->cb.ts(obuf, 188, NULL, 0, &feed->feed.ts, NULL);
                 pes_start = 0;
         }
 }
diff --git a/drivers/media/usb/au0828/Kconfig b/drivers/media/usb/au0828/Kconfig
index 70521e0b4c53..bfaa806633df 100644
--- a/drivers/media/usb/au0828/Kconfig
+++ b/drivers/media/usb/au0828/Kconfig
@@ -1,7 +1,7 @@
 
 config VIDEO_AU0828
         tristate "Auvitek AU0828 support"
-        depends on I2C && INPUT && DVB_CORE && USB
+        depends on I2C && INPUT && DVB_CORE && USB && VIDEO_V4L2
         select I2C_ALGOBIT
         select VIDEO_TVEEPROM
         select VIDEOBUF2_VMALLOC
diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c
index a8900f5571f7..44ca66cb9b8f 100644
--- a/drivers/media/usb/ttusb-dec/ttusb_dec.c
+++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c
@@ -428,7 +428,7 @@ static int ttusb_dec_audio_pes2ts_cb(void *priv, unsigned char *data)
         struct ttusb_dec *dec = priv;
 
         dec->audio_filter->feed->cb.ts(data, 188, NULL, 0,
-                                       &dec->audio_filter->feed->feed.ts);
+                                       &dec->audio_filter->feed->feed.ts, NULL);
 
         return 0;
 }
@@ -438,7 +438,7 @@ static int ttusb_dec_video_pes2ts_cb(void *priv, unsigned char *data)
         struct ttusb_dec *dec = priv;
 
         dec->video_filter->feed->cb.ts(data, 188, NULL, 0,
-                                       &dec->video_filter->feed->feed.ts);
+                                       &dec->video_filter->feed->feed.ts, NULL);
 
         return 0;
 }
@@ -490,7 +490,7 @@ static void ttusb_dec_process_pva(struct ttusb_dec *dec, u8 *pva, int length)
 
                 if (output_pva) {
                         dec->video_filter->feed->cb.ts(pva, length, NULL, 0,
-                                &dec->video_filter->feed->feed.ts);
+                                &dec->video_filter->feed->feed.ts, NULL);
                         return;
                 }
 
@@ -551,7 +551,7 @@ static void ttusb_dec_process_pva(struct ttusb_dec *dec, u8 *pva, int length)
         case 0x02:              /* MainAudioStream */
                 if (output_pva) {
                         dec->audio_filter->feed->cb.ts(pva, length, NULL, 0,
-                                &dec->audio_filter->feed->feed.ts);
+                                &dec->audio_filter->feed->feed.ts, NULL);
                         return;
                 }
 
@@ -589,7 +589,7 @@ static void ttusb_dec_process_filter(struct ttusb_dec *dec, u8 *packet,
 
         if (filter)
                 filter->feed->cb.sec(&packet[2], length - 2, NULL, 0,
-                                     &filter->filter);
+                                     &filter->filter, NULL);
 }
 
 static void ttusb_dec_process_packet(struct ttusb_dec *dec)
diff --git a/drivers/media/v4l2-core/Kconfig b/drivers/media/v4l2-core/Kconfig
index bf52fbd07aed..8e37e7c5e0f7 100644
--- a/drivers/media/v4l2-core/Kconfig
+++ b/drivers/media/v4l2-core/Kconfig
@@ -7,6 +7,7 @@ config VIDEO_V4L2
         tristate
         depends on (I2C || I2C=n) && VIDEO_DEV
         select RATIONAL
+        select VIDEOBUF2_V4L2 if VIDEOBUF2_CORE
         default (I2C || I2C=n) && VIDEO_DEV
 
 config VIDEO_ADV_DEBUG
diff --git a/drivers/media/v4l2-core/Makefile b/drivers/media/v4l2-core/Makefile
index 80de2cb9c476..7df54582e956 100644
--- a/drivers/media/v4l2-core/Makefile
+++ b/drivers/media/v4l2-core/Makefile
@@ -13,7 +13,7 @@ ifeq ($(CONFIG_COMPAT),y)
 endif
 obj-$(CONFIG_V4L2_FWNODE) += v4l2-fwnode.o
 ifeq ($(CONFIG_TRACEPOINTS),y)
-  videodev-objs += vb2-trace.o v4l2-trace.o
+  videodev-objs += v4l2-trace.o
 endif
 videodev-$(CONFIG_MEDIA_CONTROLLER) += v4l2-mc.o
 
@@ -35,4 +35,3 @@ obj-$(CONFIG_VIDEOBUF_DVB) += videobuf-dvb.o
 
 ccflags-y += -I$(srctree)/drivers/media/dvb-frontends
 ccflags-y += -I$(srctree)/drivers/media/tuners
-
diff --git a/drivers/memory/brcmstb_dpfe.c b/drivers/memory/brcmstb_dpfe.c
index 0a7bdbed3a6f..e9c1485c32b9 100644
--- a/drivers/memory/brcmstb_dpfe.c
+++ b/drivers/memory/brcmstb_dpfe.c
@@ -45,8 +45,16 @@
 #define REG_TO_DCPU_MBOX        0x10
 #define REG_TO_HOST_MBOX        0x14
 
+/* Macros to process offsets returned by the DCPU */
+#define DRAM_MSG_ADDR_OFFSET    0x0
+#define DRAM_MSG_TYPE_OFFSET    0x1c
+#define DRAM_MSG_ADDR_MASK      ((1UL << DRAM_MSG_TYPE_OFFSET) - 1)
+#define DRAM_MSG_TYPE_MASK      ((1UL << \
+                                 (BITS_PER_LONG - DRAM_MSG_TYPE_OFFSET)) - 1)
+
 /* Message RAM */
-#define DCPU_MSG_RAM(x)         (0x100 + (x) * sizeof(u32))
+#define DCPU_MSG_RAM_START      0x100
+#define DCPU_MSG_RAM(x)         (DCPU_MSG_RAM_START + (x) * sizeof(u32))
 
 /* DRAM Info Offsets & Masks */
 #define DRAM_INFO_INTERVAL      0x0
@@ -255,6 +263,40 @@ static unsigned int get_msg_chksum(const u32 msg[])
         return sum;
 }
 
+static void __iomem *get_msg_ptr(struct private_data *priv, u32 response,
+                                 char *buf, ssize_t *size)
+{
+        unsigned int msg_type;
+        unsigned int offset;
+        void __iomem *ptr = NULL;
+
+        msg_type = (response >> DRAM_MSG_TYPE_OFFSET) & DRAM_MSG_TYPE_MASK;
+        offset = (response >> DRAM_MSG_ADDR_OFFSET) & DRAM_MSG_ADDR_MASK;
+
+        /*
+         * msg_type == 1: the offset is relative to the message RAM
+         * msg_type == 0: the offset is relative to the data RAM (this is the
+         *                previous way of passing data)
+         * msg_type is anything else: there's critical hardware problem
+         */
+        switch (msg_type) {
+        case 1:
+                ptr = priv->regs + DCPU_MSG_RAM_START + offset;
+                break;
+        case 0:
+                ptr = priv->dmem + offset;
+                break;
+        default:
+                dev_emerg(priv->dev, "invalid message reply from DCPU: %#x\n",
+                        response);
+                if (buf && size)
+                        *size = sprintf(buf,
+                                "FATAL: communication error with DCPU\n");
+        }
+
+        return ptr;
+}
+
 static int __send_command(struct private_data *priv, unsigned int cmd,
                           u32 result[])
 {
@@ -507,7 +549,7 @@ static ssize_t show_info(struct device *dev, struct device_attribute *devattr,
 {
         u32 response[MSG_FIELD_MAX];
         unsigned int info;
-        int ret;
+        ssize_t ret;
 
         ret = generic_show(DPFE_CMD_GET_INFO, response, dev, buf);
         if (ret)
@@ -528,18 +570,19 @@ static ssize_t show_refresh(struct device *dev,
         u32 response[MSG_FIELD_MAX];
         void __iomem *info;
         struct private_data *priv;
-        unsigned int offset;
         u8 refresh, sr_abort, ppre, thermal_offs, tuf;
         u32 mr4;
-        int ret;
+        ssize_t ret;
 
         ret = generic_show(DPFE_CMD_GET_REFRESH, response, dev, buf);
         if (ret)
                 return ret;
 
         priv = dev_get_drvdata(dev);
-        offset = response[MSG_ARG0];
-        info = priv->dmem + offset;
+
+        info = get_msg_ptr(priv, response[MSG_ARG0], buf, &ret);
+        if (!info)
+                return ret;
 
         mr4 = readl_relaxed(info + DRAM_INFO_MR4) & DRAM_INFO_MR4_MASK;
 
@@ -561,7 +604,6 @@ static ssize_t store_refresh(struct device *dev, struct device_attribute *attr,
         u32 response[MSG_FIELD_MAX];
         struct private_data *priv;
         void __iomem *info;
-        unsigned int offset;
         unsigned long val;
         int ret;
 
@@ -574,8 +616,10 @@ static ssize_t store_refresh(struct device *dev, struct device_attribute *attr,
         if (ret)
                 return ret;
 
-        offset = response[MSG_ARG0];
-        info = priv->dmem + offset;
+        info = get_msg_ptr(priv, response[MSG_ARG0], NULL, NULL);
+        if (!info)
+                return -EIO;
+
         writel_relaxed(val, info + DRAM_INFO_INTERVAL);
 
         return count;
@@ -587,23 +631,25 @@ static ssize_t show_vendor(struct device *dev, struct device_attribute *devattr,
         u32 response[MSG_FIELD_MAX];
         struct private_data *priv;
         void __iomem *info;
-        unsigned int offset;
-        int ret;
+        ssize_t ret;
 
         ret = generic_show(DPFE_CMD_GET_VENDOR, response, dev, buf);
         if (ret)
                 return ret;
 
-        offset = response[MSG_ARG0];
         priv = dev_get_drvdata(dev);
-        info = priv->dmem + offset;
+
+        info = get_msg_ptr(priv, response[MSG_ARG0], buf, &ret);
+        if (!info)
+                return ret;
 
         return sprintf(buf, "%#x %#x %#x %#x %#x\n",
                        readl_relaxed(info + DRAM_VENDOR_MR5) & DRAM_VENDOR_MASK,
                        readl_relaxed(info + DRAM_VENDOR_MR6) & DRAM_VENDOR_MASK,
                        readl_relaxed(info + DRAM_VENDOR_MR7) & DRAM_VENDOR_MASK,
                        readl_relaxed(info + DRAM_VENDOR_MR8) & DRAM_VENDOR_MASK,
-                       readl_relaxed(info + DRAM_VENDOR_ERROR));
+                       readl_relaxed(info + DRAM_VENDOR_ERROR) &
+                                     DRAM_VENDOR_MASK);
 }
 
 static int brcmstb_dpfe_resume(struct platform_device *pdev)
diff --git a/drivers/misc/ocxl/file.c b/drivers/misc/ocxl/file.c
index 337462e1569f..038509e5d031 100644
--- a/drivers/misc/ocxl/file.c
+++ b/drivers/misc/ocxl/file.c
@@ -102,10 +102,32 @@ static long afu_ioctl_attach(struct ocxl_context *ctx,
         return rc;
 }
 
+static long afu_ioctl_get_metadata(struct ocxl_context *ctx,
+                struct ocxl_ioctl_metadata __user *uarg)
+{
+        struct ocxl_ioctl_metadata arg;
+
+        memset(&arg, 0, sizeof(arg));
+
+        arg.version = 0;
+
+        arg.afu_version_major = ctx->afu->config.version_major;
+        arg.afu_version_minor = ctx->afu->config.version_minor;
+        arg.pasid = ctx->pasid;
+        arg.pp_mmio_size = ctx->afu->config.pp_mmio_stride;
+        arg.global_mmio_size = ctx->afu->config.global_mmio_size;
+
+        if (copy_to_user(uarg, &arg, sizeof(arg)))
+                return -EFAULT;
+
+        return 0;
+}
+
 #define CMD_STR(x) (x == OCXL_IOCTL_ATTACH ? "ATTACH" :                 \
                         x == OCXL_IOCTL_IRQ_ALLOC ? "IRQ_ALLOC" :       \
                         x == OCXL_IOCTL_IRQ_FREE ? "IRQ_FREE" :         \
                         x == OCXL_IOCTL_IRQ_SET_FD ? "IRQ_SET_FD" :     \
+                        x == OCXL_IOCTL_GET_METADATA ? "GET_METADATA" : \
                         "UNKNOWN")
 
 static long afu_ioctl(struct file *file, unsigned int cmd,
@@ -159,6 +181,11 @@ static long afu_ioctl(struct file *file, unsigned int cmd,
                                         irq_fd.eventfd);
                 break;
 
+        case OCXL_IOCTL_GET_METADATA:
+                rc = afu_ioctl_get_metadata(ctx,
+                                (struct ocxl_ioctl_metadata __user *) args);
+                break;
+
         default:
                 rc = -EINVAL;
         }
diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c
index 908e4db03535..42d6aa89a48a 100644
--- a/drivers/mmc/core/mmc_ops.c
+++ b/drivers/mmc/core/mmc_ops.c
@@ -848,7 +848,6 @@ int mmc_interrupt_hpi(struct mmc_card *card)
                 return 1;
         }
 
-        mmc_claim_host(card->host);
         err = mmc_send_status(card, &status);
         if (err) {
                 pr_err("%s: Get card status fail\n", mmc_hostname(card->host));
@@ -890,7 +889,6 @@ int mmc_interrupt_hpi(struct mmc_card *card)
         } while (!err);
 
 out:
-        mmc_release_host(card->host);
         return err;
 }
 
@@ -932,9 +930,7 @@ static int mmc_read_bkops_status(struct mmc_card *card)
         int err;
         u8 *ext_csd;
 
-        mmc_claim_host(card->host);
         err = mmc_get_ext_csd(card, &ext_csd);
-        mmc_release_host(card->host);
         if (err)
                 return err;
 
diff --git a/drivers/mmc/host/dw_mmc-exynos.c b/drivers/mmc/host/dw_mmc-exynos.c
index 35026795be28..fa41d9422d57 100644
--- a/drivers/mmc/host/dw_mmc-exynos.c
+++ b/drivers/mmc/host/dw_mmc-exynos.c
@@ -487,6 +487,7 @@ static unsigned long exynos_dwmmc_caps[4] = {
 
 static const struct dw_mci_drv_data exynos_drv_data = {
         .caps                   = exynos_dwmmc_caps,
+        .num_caps               = ARRAY_SIZE(exynos_dwmmc_caps),
         .init                   = dw_mci_exynos_priv_init,
         .set_ios                = dw_mci_exynos_set_ios,
         .parse_dt               = dw_mci_exynos_parse_dt,
diff --git a/drivers/mmc/host/dw_mmc-k3.c b/drivers/mmc/host/dw_mmc-k3.c
index 73fd75c3c824..89cdb3d533bb 100644
--- a/drivers/mmc/host/dw_mmc-k3.c
+++ b/drivers/mmc/host/dw_mmc-k3.c
@@ -135,6 +135,9 @@ static int dw_mci_hi6220_parse_dt(struct dw_mci *host)
         if (priv->ctrl_id < 0)
                 priv->ctrl_id = 0;
 
+        if (priv->ctrl_id >= TIMING_MODE)
+                return -EINVAL;
+
         host->priv = priv;
         return 0;
 }
@@ -207,6 +210,7 @@ static int dw_mci_hi6220_execute_tuning(struct dw_mci_slot *slot, u32 opcode)
 
 static const struct dw_mci_drv_data hi6220_data = {
         .caps                   = dw_mci_hi6220_caps,
+        .num_caps               = ARRAY_SIZE(dw_mci_hi6220_caps),
         .switch_voltage         = dw_mci_hi6220_switch_voltage,
         .set_ios                = dw_mci_hi6220_set_ios,
         .parse_dt               = dw_mci_hi6220_parse_dt,
diff --git a/drivers/mmc/host/dw_mmc-rockchip.c b/drivers/mmc/host/dw_mmc-rockchip.c
index a3f1c2b30145..339295212935 100644
--- a/drivers/mmc/host/dw_mmc-rockchip.c
+++ b/drivers/mmc/host/dw_mmc-rockchip.c
@@ -319,6 +319,7 @@ static const struct dw_mci_drv_data rk2928_drv_data = {
 
 static const struct dw_mci_drv_data rk3288_drv_data = {
         .caps                   = dw_mci_rk3288_dwmmc_caps,
+        .num_caps               = ARRAY_SIZE(dw_mci_rk3288_dwmmc_caps),
         .set_ios                = dw_mci_rk3288_set_ios,
         .execute_tuning         = dw_mci_rk3288_execute_tuning,
         .parse_dt               = dw_mci_rk3288_parse_dt,
diff --git a/drivers/mmc/host/dw_mmc-zx.c b/drivers/mmc/host/dw_mmc-zx.c
index d38e94ae2b85..c06b5393312f 100644
--- a/drivers/mmc/host/dw_mmc-zx.c
+++ b/drivers/mmc/host/dw_mmc-zx.c
@@ -195,6 +195,7 @@ static unsigned long zx_dwmmc_caps[3] = {
 
 static const struct dw_mci_drv_data zx_drv_data = {
         .caps                   = zx_dwmmc_caps,
+        .num_caps               = ARRAY_SIZE(zx_dwmmc_caps),
         .execute_tuning         = dw_mci_zx_execute_tuning,
         .prepare_hs400_tuning   = dw_mci_zx_prepare_hs400_tuning,
         .parse_dt               = dw_mci_zx_parse_dt,
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 0aa39975f33b..d9b4acefed31 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -165,6 +165,8 @@ static int dw_mci_regs_show(struct seq_file *s, void *v)
 {
         struct dw_mci *host = s->private;
 
+        pm_runtime_get_sync(host->dev);
+
         seq_printf(s, "STATUS:\t0x%08x\n", mci_readl(host, STATUS));
         seq_printf(s, "RINTSTS:\t0x%08x\n", mci_readl(host, RINTSTS));
         seq_printf(s, "CMD:\t0x%08x\n", mci_readl(host, CMD));
@@ -172,6 +174,8 @@ static int dw_mci_regs_show(struct seq_file *s, void *v)
         seq_printf(s, "INTMASK:\t0x%08x\n", mci_readl(host, INTMASK));
         seq_printf(s, "CLKENA:\t0x%08x\n", mci_readl(host, CLKENA));
 
+        pm_runtime_put_autosuspend(host->dev);
+
         return 0;
 }
 
@@ -2778,12 +2782,57 @@ static irqreturn_t dw_mci_interrupt(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
+static int dw_mci_init_slot_caps(struct dw_mci_slot *slot)
+{
+        struct dw_mci *host = slot->host;
+        const struct dw_mci_drv_data *drv_data = host->drv_data;
+        struct mmc_host *mmc = slot->mmc;
+        int ctrl_id;
+
+        if (host->pdata->caps)
+                mmc->caps = host->pdata->caps;
+
+        /*
+         * Support MMC_CAP_ERASE by default.
+         * It needs to use trim/discard/erase commands.
+         */
+        mmc->caps |= MMC_CAP_ERASE;
+
+        if (host->pdata->pm_caps)
+                mmc->pm_caps = host->pdata->pm_caps;
+
+        if (host->dev->of_node) {
+                ctrl_id = of_alias_get_id(host->dev->of_node, "mshc");
+                if (ctrl_id < 0)
+                        ctrl_id = 0;
+        } else {
+                ctrl_id = to_platform_device(host->dev)->id;
+        }
+
+        if (drv_data && drv_data->caps) {
+                if (ctrl_id >= drv_data->num_caps) {
+                        dev_err(host->dev, "invalid controller id %d\n",
+                                ctrl_id);
+                        return -EINVAL;
+                }
+                mmc->caps |= drv_data->caps[ctrl_id];
+        }
+
+        if (host->pdata->caps2)
+                mmc->caps2 = host->pdata->caps2;
+
+        /* Process SDIO IRQs through the sdio_irq_work. */
+        if (mmc->caps & MMC_CAP_SDIO_IRQ)
+                mmc->caps2 |= MMC_CAP2_SDIO_IRQ_NOTHREAD;
+
+        return 0;
+}
+
 static int dw_mci_init_slot(struct dw_mci *host)
 {
         struct mmc_host *mmc;
         struct dw_mci_slot *slot;
-        const struct dw_mci_drv_data *drv_data = host->drv_data;
-        int ctrl_id, ret;
+        int ret;
         u32 freq[2];
 
         mmc = mmc_alloc_host(sizeof(struct dw_mci_slot), host->dev);
@@ -2817,38 +2866,13 @@ static int dw_mci_init_slot(struct dw_mci *host)
         if (!mmc->ocr_avail)
                 mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
 
-        if (host->pdata->caps)
-                mmc->caps = host->pdata->caps;
-
-        /*
-         * Support MMC_CAP_ERASE by default.
-         * It needs to use trim/discard/erase commands.
-         */
-        mmc->caps |= MMC_CAP_ERASE;
-
-        if (host->pdata->pm_caps)
-                mmc->pm_caps = host->pdata->pm_caps;
-
-        if (host->dev->of_node) {
-                ctrl_id = of_alias_get_id(host->dev->of_node, "mshc");
-                if (ctrl_id < 0)
-                        ctrl_id = 0;
-        } else {
-                ctrl_id = to_platform_device(host->dev)->id;
-        }
-        if (drv_data && drv_data->caps)
-                mmc->caps |= drv_data->caps[ctrl_id];
-
-        if (host->pdata->caps2)
-                mmc->caps2 = host->pdata->caps2;
-
         ret = mmc_of_parse(mmc);
         if (ret)
                 goto err_host_allocated;
 
-        /* Process SDIO IRQs through the sdio_irq_work. */
-        if (mmc->caps & MMC_CAP_SDIO_IRQ)
-                mmc->caps2 |= MMC_CAP2_SDIO_IRQ_NOTHREAD;
+        ret = dw_mci_init_slot_caps(slot);
+        if (ret)
+                goto err_host_allocated;
 
         /* Useful defaults if platform data is unset. */
         if (host->use_dma == TRANS_MODE_IDMAC) {
diff --git a/drivers/mmc/host/dw_mmc.h b/drivers/mmc/host/dw_mmc.h
index e3124f06a47e..1424bd490dd1 100644
--- a/drivers/mmc/host/dw_mmc.h
+++ b/drivers/mmc/host/dw_mmc.h
@@ -543,6 +543,7 @@ struct dw_mci_slot {
 /**
  * dw_mci driver data - dw-mshc implementation specific driver data.
  * @caps: mmc subsystem specified capabilities of the controller(s).
+ * @num_caps: number of capabilities specified by @caps.
  * @init: early implementation specific initialization.
  * @set_ios: handle bus specific extensions.
  * @parse_dt: parse implementation specific device tree properties.
@@ -554,6 +555,7 @@ struct dw_mci_slot {
  */
 struct dw_mci_drv_data {
         unsigned long   *caps;
+        u32             num_caps;
         int             (*init)(struct dw_mci *host);
         void            (*set_ios)(struct dw_mci *host, struct mmc_ios *ios);
         int             (*parse_dt)(struct dw_mci *host);
diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
index 6d1a983e6227..82c4f05f91d8 100644
--- a/drivers/mmc/host/sdhci-pci-core.c
+++ b/drivers/mmc/host/sdhci-pci-core.c
@@ -654,9 +654,36 @@ static void byt_read_dsm(struct sdhci_pci_slot *slot)
         slot->chip->rpm_retune = intel_host->d3_retune;
 }
 
-static int byt_emmc_probe_slot(struct sdhci_pci_slot *slot)
+static int intel_execute_tuning(struct mmc_host *mmc, u32 opcode)
+{
+        int err = sdhci_execute_tuning(mmc, opcode);
+        struct sdhci_host *host = mmc_priv(mmc);
+
+        if (err)
+                return err;
+
+        /*
+         * Tuning can leave the IP in an active state (Buffer Read Enable bit
+         * set) which prevents the entry to low power states (i.e. S0i3). Data
+         * reset will clear it.
+         */
+        sdhci_reset(host, SDHCI_RESET_DATA);
+
+        return 0;
+}
+
+static void byt_probe_slot(struct sdhci_pci_slot *slot)
 {
+        struct mmc_host_ops *ops = &slot->host->mmc_host_ops;
+
         byt_read_dsm(slot);
+
+        ops->execute_tuning = intel_execute_tuning;
+}
+
+static int byt_emmc_probe_slot(struct sdhci_pci_slot *slot)
+{
+        byt_probe_slot(slot);
         slot->host->mmc->caps |= MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE |
                                  MMC_CAP_HW_RESET | MMC_CAP_1_8V_DDR |
                                  MMC_CAP_CMD_DURING_TFR |
@@ -779,7 +806,7 @@ static int ni_byt_sdio_probe_slot(struct sdhci_pci_slot *slot)
 {
         int err;
 
-        byt_read_dsm(slot);
+        byt_probe_slot(slot);
 
         err = ni_set_max_freq(slot);
         if (err)
@@ -792,7 +819,7 @@ static int ni_byt_sdio_probe_slot(struct sdhci_pci_slot *slot)
 
 static int byt_sdio_probe_slot(struct sdhci_pci_slot *slot)
 {
-        byt_read_dsm(slot);
+        byt_probe_slot(slot);
         slot->host->mmc->caps |= MMC_CAP_POWER_OFF_CARD | MMC_CAP_NONREMOVABLE |
                                  MMC_CAP_WAIT_WHILE_BUSY;
         return 0;
@@ -800,7 +827,7 @@ static int byt_sdio_probe_slot(struct sdhci_pci_slot *slot)
 
 static int byt_sd_probe_slot(struct sdhci_pci_slot *slot)
 {
-        byt_read_dsm(slot);
+        byt_probe_slot(slot);
         slot->host->mmc->caps |= MMC_CAP_WAIT_WHILE_BUSY |
                                  MMC_CAP_AGGRESSIVE_PM | MMC_CAP_CD_WAKE;
         slot->cd_idx = 0;
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index f5c87bd35fa1..f27f9bae1a4a 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -3063,9 +3063,6 @@ static void gfar_process_frame(struct net_device *ndev, struct sk_buff *skb)
         if (ndev->features & NETIF_F_RXCSUM)
                 gfar_rx_checksum(skb, fcb);
 
-        /* Tell the skb what kind of packet this is */
-        skb->protocol = eth_type_trans(skb, ndev);
-
         /* There's need to check for NETIF_F_HW_VLAN_CTAG_RX here.
          * Even if vlan rx accel is disabled, on some chips
          * RXFCB_VLN is pseudo randomly set.
@@ -3136,13 +3133,15 @@ int gfar_clean_rx_ring(struct gfar_priv_rx_q *rx_queue, int rx_work_limit)
                         continue;
                 }
 
+                gfar_process_frame(ndev, skb);
+
                 /* Increment the number of packets */
                 total_pkts++;
                 total_bytes += skb->len;
 
                 skb_record_rx_queue(skb, rx_queue->qindex);
 
-                gfar_process_frame(ndev, skb);
+                skb->protocol = eth_type_trans(skb, ndev);
 
                 /* Send the packet up the stack */
                 napi_gro_receive(&rx_queue->grp->napi_rx, skb);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 0da5aa2c8aba..9fc063af233c 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -1888,6 +1888,14 @@ static void ixgbe_dma_sync_frag(struct ixgbe_ring *rx_ring,
                                      ixgbe_rx_pg_size(rx_ring),
                                      DMA_FROM_DEVICE,
                                      IXGBE_RX_DMA_ATTR);
+        } else if (ring_uses_build_skb(rx_ring)) {
+                unsigned long offset = (unsigned long)(skb->data) & ~PAGE_MASK;
+
+                dma_sync_single_range_for_cpu(rx_ring->dev,
+                                              IXGBE_CB(skb)->dma,
+                                              offset,
+                                              skb_headlen(skb),
+                                              DMA_FROM_DEVICE);
         } else {
                 struct skb_frag_struct *frag = &skb_shinfo(skb)->frags[0];
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index 21d29f7936f6..d39b0b7011b2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -124,7 +124,7 @@ void mlx5_enter_error_state(struct mlx5_core_dev *dev, bool force)
                 trigger_cmd_completions(dev);
         }
 
-        mlx5_core_event(dev, MLX5_DEV_EVENT_SYS_ERROR, 0);
+        mlx5_core_event(dev, MLX5_DEV_EVENT_SYS_ERROR, 1);
         mlx5_core_err(dev, "end\n");
 
 unlock:
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.h b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.h
index f6963b0b4a55..122506daa586 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.h
@@ -107,20 +107,20 @@ static const struct mlxsw_afk_element_info mlxsw_afk_element_infos[] = {
         MLXSW_AFK_ELEMENT_INFO_U32(VID, 0x10, 8, 12),
         MLXSW_AFK_ELEMENT_INFO_U32(PCP, 0x10, 20, 3),
         MLXSW_AFK_ELEMENT_INFO_U32(TCP_FLAGS, 0x10, 23, 9),
-        MLXSW_AFK_ELEMENT_INFO_U32(IP_TTL_, 0x14, 0, 8),
-        MLXSW_AFK_ELEMENT_INFO_U32(IP_ECN, 0x14, 9, 2),
-        MLXSW_AFK_ELEMENT_INFO_U32(IP_DSCP, 0x14, 11, 6),
-        MLXSW_AFK_ELEMENT_INFO_U32(SRC_IP4, 0x18, 0, 32),
-        MLXSW_AFK_ELEMENT_INFO_U32(DST_IP4, 0x1C, 0, 32),
-        MLXSW_AFK_ELEMENT_INFO_BUF(SRC_IP6_HI, 0x18, 8),
-        MLXSW_AFK_ELEMENT_INFO_BUF(SRC_IP6_LO, 0x20, 8),
-        MLXSW_AFK_ELEMENT_INFO_BUF(DST_IP6_HI, 0x28, 8),
-        MLXSW_AFK_ELEMENT_INFO_BUF(DST_IP6_LO, 0x30, 8),
         MLXSW_AFK_ELEMENT_INFO_U32(DST_L4_PORT, 0x14, 0, 16),
         MLXSW_AFK_ELEMENT_INFO_U32(SRC_L4_PORT, 0x14, 16, 16),
+        MLXSW_AFK_ELEMENT_INFO_U32(IP_TTL_, 0x18, 0, 8),
+        MLXSW_AFK_ELEMENT_INFO_U32(IP_ECN, 0x18, 9, 2),
+        MLXSW_AFK_ELEMENT_INFO_U32(IP_DSCP, 0x18, 11, 6),
+        MLXSW_AFK_ELEMENT_INFO_U32(SRC_IP4, 0x20, 0, 32),
+        MLXSW_AFK_ELEMENT_INFO_U32(DST_IP4, 0x24, 0, 32),
+        MLXSW_AFK_ELEMENT_INFO_BUF(SRC_IP6_HI, 0x20, 8),
+        MLXSW_AFK_ELEMENT_INFO_BUF(SRC_IP6_LO, 0x28, 8),
+        MLXSW_AFK_ELEMENT_INFO_BUF(DST_IP6_HI, 0x30, 8),
+        MLXSW_AFK_ELEMENT_INFO_BUF(DST_IP6_LO, 0x38, 8),
 };
 
-#define MLXSW_AFK_ELEMENT_STORAGE_SIZE 0x38
+#define MLXSW_AFK_ELEMENT_STORAGE_SIZE 0x40
 
 struct mlxsw_afk_element_inst { /* element instance in actual block */
         const struct mlxsw_afk_element_info *info;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 3dcc58d61506..c7e941aecc2a 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -1459,6 +1459,7 @@ mlxsw_sp_port_vlan_create(struct mlxsw_sp_port *mlxsw_sp_port, u16 vid)
         }
 
         mlxsw_sp_port_vlan->mlxsw_sp_port = mlxsw_sp_port;
+        mlxsw_sp_port_vlan->ref_count = 1;
         mlxsw_sp_port_vlan->vid = vid;
         list_add(&mlxsw_sp_port_vlan->list, &mlxsw_sp_port->vlans_list);
 
@@ -1486,8 +1487,10 @@ mlxsw_sp_port_vlan_get(struct mlxsw_sp_port *mlxsw_sp_port, u16 vid)
         struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan;
 
         mlxsw_sp_port_vlan = mlxsw_sp_port_vlan_find_by_vid(mlxsw_sp_port, vid);
-        if (mlxsw_sp_port_vlan)
+        if (mlxsw_sp_port_vlan) {
+                mlxsw_sp_port_vlan->ref_count++;
                 return mlxsw_sp_port_vlan;
+        }
 
         return mlxsw_sp_port_vlan_create(mlxsw_sp_port, vid);
 }
@@ -1496,6 +1499,9 @@ void mlxsw_sp_port_vlan_put(struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan)
 {
         struct mlxsw_sp_fid *fid = mlxsw_sp_port_vlan->fid;
 
+        if (--mlxsw_sp_port_vlan->ref_count != 0)
+                return;
+
         if (mlxsw_sp_port_vlan->bridge_port)
                 mlxsw_sp_port_vlan_bridge_leave(mlxsw_sp_port_vlan);
         else if (fid)
@@ -4207,13 +4213,12 @@ static struct devlink_resource_ops mlxsw_sp_resource_kvd_hash_double_ops = {
         .size_validate = mlxsw_sp_resource_kvd_hash_double_size_validate,
 };
 
-static struct devlink_resource_size_params mlxsw_sp_kvd_size_params;
-static struct devlink_resource_size_params mlxsw_sp_linear_size_params;
-static struct devlink_resource_size_params mlxsw_sp_hash_single_size_params;
-static struct devlink_resource_size_params mlxsw_sp_hash_double_size_params;
-
 static void
-mlxsw_sp_resource_size_params_prepare(struct mlxsw_core *mlxsw_core)
+mlxsw_sp_resource_size_params_prepare(struct mlxsw_core *mlxsw_core,
+                                      struct devlink_resource_size_params *kvd_size_params,
+                                      struct devlink_resource_size_params *linear_size_params,
+                                      struct devlink_resource_size_params *hash_double_size_params,
+                                      struct devlink_resource_size_params *hash_single_size_params)
 {
         u32 single_size_min = MLXSW_CORE_RES_GET(mlxsw_core,
                                                  KVD_SINGLE_MIN_SIZE);
@@ -4222,37 +4227,35 @@ mlxsw_sp_resource_size_params_prepare(struct mlxsw_core *mlxsw_core)
         u32 kvd_size = MLXSW_CORE_RES_GET(mlxsw_core, KVD_SIZE);
         u32 linear_size_min = 0;
 
-        /* KVD top resource */
-        mlxsw_sp_kvd_size_params.size_min = kvd_size;
-        mlxsw_sp_kvd_size_params.size_max = kvd_size;
-        mlxsw_sp_kvd_size_params.size_granularity = MLXSW_SP_KVD_GRANULARITY;
-        mlxsw_sp_kvd_size_params.unit = DEVLINK_RESOURCE_UNIT_ENTRY;
-
-        /* Linear part init */
-        mlxsw_sp_linear_size_params.size_min = linear_size_min;
-        mlxsw_sp_linear_size_params.size_max = kvd_size - single_size_min -
-                                               double_size_min;
-        mlxsw_sp_linear_size_params.size_granularity = MLXSW_SP_KVD_GRANULARITY;
-        mlxsw_sp_linear_size_params.unit = DEVLINK_RESOURCE_UNIT_ENTRY;
-
-        /* Hash double part init */
-        mlxsw_sp_hash_double_size_params.size_min = double_size_min;
-        mlxsw_sp_hash_double_size_params.size_max = kvd_size - single_size_min -
-                                                    linear_size_min;
-        mlxsw_sp_hash_double_size_params.size_granularity = MLXSW_SP_KVD_GRANULARITY;
-        mlxsw_sp_hash_double_size_params.unit = DEVLINK_RESOURCE_UNIT_ENTRY;
-
-        /* Hash single part init */
-        mlxsw_sp_hash_single_size_params.size_min = single_size_min;
-        mlxsw_sp_hash_single_size_params.size_max = kvd_size - double_size_min -
-                                                    linear_size_min;
-        mlxsw_sp_hash_single_size_params.size_granularity = MLXSW_SP_KVD_GRANULARITY;
-        mlxsw_sp_hash_single_size_params.unit = DEVLINK_RESOURCE_UNIT_ENTRY;
+        devlink_resource_size_params_init(kvd_size_params, kvd_size, kvd_size,
+                                          MLXSW_SP_KVD_GRANULARITY,
+                                          DEVLINK_RESOURCE_UNIT_ENTRY);
+        devlink_resource_size_params_init(linear_size_params, linear_size_min,
+                                          kvd_size - single_size_min -
+                                          double_size_min,
+                                          MLXSW_SP_KVD_GRANULARITY,
+                                          DEVLINK_RESOURCE_UNIT_ENTRY);
+        devlink_resource_size_params_init(hash_double_size_params,
+                                          double_size_min,
+                                          kvd_size - single_size_min -
+                                          linear_size_min,
+                                          MLXSW_SP_KVD_GRANULARITY,
+                                          DEVLINK_RESOURCE_UNIT_ENTRY);
+        devlink_resource_size_params_init(hash_single_size_params,
+                                          single_size_min,
+                                          kvd_size - double_size_min -
+                                          linear_size_min,
+                                          MLXSW_SP_KVD_GRANULARITY,
+                                          DEVLINK_RESOURCE_UNIT_ENTRY);
 }
 
 static int mlxsw_sp_resources_register(struct mlxsw_core *mlxsw_core)
 {
         struct devlink *devlink = priv_to_devlink(mlxsw_core);
+        struct devlink_resource_size_params hash_single_size_params;
+        struct devlink_resource_size_params hash_double_size_params;
+        struct devlink_resource_size_params linear_size_params;
+        struct devlink_resource_size_params kvd_size_params;
         u32 kvd_size, single_size, double_size, linear_size;
         const struct mlxsw_config_profile *profile;
         int err;
@@ -4261,13 +4264,17 @@ static int mlxsw_sp_resources_register(struct mlxsw_core *mlxsw_core)
         if (!MLXSW_CORE_RES_VALID(mlxsw_core, KVD_SIZE))
                 return -EIO;
 
-        mlxsw_sp_resource_size_params_prepare(mlxsw_core);
+        mlxsw_sp_resource_size_params_prepare(mlxsw_core, &kvd_size_params,
+                                              &linear_size_params,
+                                              &hash_double_size_params,
+                                              &hash_single_size_params);
+
         kvd_size = MLXSW_CORE_RES_GET(mlxsw_core, KVD_SIZE);
         err = devlink_resource_register(devlink, MLXSW_SP_RESOURCE_NAME_KVD,
                                         true, kvd_size,
                                         MLXSW_SP_RESOURCE_KVD,
                                         DEVLINK_RESOURCE_ID_PARENT_TOP,
-                                        &mlxsw_sp_kvd_size_params,
+                                        &kvd_size_params,
                                         &mlxsw_sp_resource_kvd_ops);
         if (err)
                 return err;
@@ -4277,7 +4284,7 @@ static int mlxsw_sp_resources_register(struct mlxsw_core *mlxsw_core)
                                         false, linear_size,
                                         MLXSW_SP_RESOURCE_KVD_LINEAR,
                                         MLXSW_SP_RESOURCE_KVD,
-                                        &mlxsw_sp_linear_size_params,
+                                        &linear_size_params,
                                         &mlxsw_sp_resource_kvd_linear_ops);
         if (err)
                 return err;
@@ -4291,7 +4298,7 @@ static int mlxsw_sp_resources_register(struct mlxsw_core *mlxsw_core)
                                         false, double_size,
                                         MLXSW_SP_RESOURCE_KVD_HASH_DOUBLE,
                                         MLXSW_SP_RESOURCE_KVD,
-                                        &mlxsw_sp_hash_double_size_params,
+                                        &hash_double_size_params,
                                         &mlxsw_sp_resource_kvd_hash_double_ops);
         if (err)
                 return err;
@@ -4301,7 +4308,7 @@ static int mlxsw_sp_resources_register(struct mlxsw_core *mlxsw_core)
                                         false, single_size,
                                         MLXSW_SP_RESOURCE_KVD_HASH_SINGLE,
                                         MLXSW_SP_RESOURCE_KVD,
-                                        &mlxsw_sp_hash_single_size_params,
+                                        &hash_single_size_params,
                                         &mlxsw_sp_resource_kvd_hash_single_ops);
         if (err)
                 return err;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index bdd8f94a452c..4ec1ca3c96c8 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -211,6 +211,7 @@ struct mlxsw_sp_port_vlan {
         struct list_head list;
         struct mlxsw_sp_port *mlxsw_sp_port;
         struct mlxsw_sp_fid *fid;
+        unsigned int ref_count;
         u16 vid;
         struct mlxsw_sp_bridge_port *bridge_port;
         struct list_head bridge_vlan_node;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c
index bbd238e50f05..54262af4e98f 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c
@@ -112,11 +112,11 @@ static const int mlxsw_sp_sfgc_bc_packet_types[MLXSW_REG_SFGC_TYPE_MAX] = {
         [MLXSW_REG_SFGC_TYPE_UNREGISTERED_MULTICAST_NON_IP]     = 1,
         [MLXSW_REG_SFGC_TYPE_IPV4_LINK_LOCAL]                   = 1,
         [MLXSW_REG_SFGC_TYPE_IPV6_ALL_HOST]                     = 1,
+        [MLXSW_REG_SFGC_TYPE_UNREGISTERED_MULTICAST_IPV6]       = 1,
 };
 
 static const int mlxsw_sp_sfgc_mc_packet_types[MLXSW_REG_SFGC_TYPE_MAX] = {
         [MLXSW_REG_SFGC_TYPE_UNREGISTERED_MULTICAST_IPV4]       = 1,
-        [MLXSW_REG_SFGC_TYPE_UNREGISTERED_MULTICAST_IPV6]       = 1,
 };
 
 static const int *mlxsw_sp_packet_type_sfgc_types[] = {
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index 593ad31be749..161bcdc012f0 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -1203,6 +1203,7 @@ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
                                      bool dynamic)
 {
         char *sfd_pl;
+        u8 num_rec;
         int err;
 
         sfd_pl = kmalloc(MLXSW_REG_SFD_LEN, GFP_KERNEL);
@@ -1212,9 +1213,16 @@ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
         mlxsw_reg_sfd_pack(sfd_pl, mlxsw_sp_sfd_op(adding), 0);
         mlxsw_reg_sfd_uc_pack(sfd_pl, 0, mlxsw_sp_sfd_rec_policy(dynamic),
                               mac, fid, action, local_port);
+        num_rec = mlxsw_reg_sfd_num_rec_get(sfd_pl);
         err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sfd), sfd_pl);
-        kfree(sfd_pl);
+        if (err)
+                goto out;
+
+        if (num_rec != mlxsw_reg_sfd_num_rec_get(sfd_pl))
+                err = -EBUSY;
 
+out:
+        kfree(sfd_pl);
         return err;
 }
 
@@ -1239,6 +1247,7 @@ static int mlxsw_sp_port_fdb_uc_lag_op(struct mlxsw_sp *mlxsw_sp, u16 lag_id,
                                        bool adding, bool dynamic)
 {
         char *sfd_pl;
+        u8 num_rec;
         int err;
 
         sfd_pl = kmalloc(MLXSW_REG_SFD_LEN, GFP_KERNEL);
@@ -1249,9 +1258,16 @@ static int mlxsw_sp_port_fdb_uc_lag_op(struct mlxsw_sp *mlxsw_sp, u16 lag_id,
         mlxsw_reg_sfd_uc_lag_pack(sfd_pl, 0, mlxsw_sp_sfd_rec_policy(dynamic),
                                   mac, fid, MLXSW_REG_SFD_REC_ACTION_NOP,
                                   lag_vid, lag_id);
+        num_rec = mlxsw_reg_sfd_num_rec_get(sfd_pl);
         err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sfd), sfd_pl);
-        kfree(sfd_pl);
+        if (err)
+                goto out;
+
+        if (num_rec != mlxsw_reg_sfd_num_rec_get(sfd_pl))
+                err = -EBUSY;
 
+out:
+        kfree(sfd_pl);
         return err;
 }
 
@@ -1296,6 +1312,7 @@ static int mlxsw_sp_port_mdb_op(struct mlxsw_sp *mlxsw_sp, const char *addr,
                                 u16 fid, u16 mid_idx, bool adding)
 {
         char *sfd_pl;
+        u8 num_rec;
         int err;
 
         sfd_pl = kmalloc(MLXSW_REG_SFD_LEN, GFP_KERNEL);
@@ -1305,7 +1322,15 @@ static int mlxsw_sp_port_mdb_op(struct mlxsw_sp *mlxsw_sp, const char *addr,
         mlxsw_reg_sfd_pack(sfd_pl, mlxsw_sp_sfd_op(adding), 0);
         mlxsw_reg_sfd_mc_pack(sfd_pl, 0, addr, fid,
                               MLXSW_REG_SFD_REC_ACTION_NOP, mid_idx);
+        num_rec = mlxsw_reg_sfd_num_rec_get(sfd_pl);
         err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sfd), sfd_pl);
+        if (err)
+                goto out;
+
+        if (num_rec != mlxsw_reg_sfd_num_rec_get(sfd_pl))
+                err = -EBUSY;
+
+out:
         kfree(sfd_pl);
         return err;
 }
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 92dcf8717fc6..14c839bb09e7 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -439,6 +439,17 @@ static void sh_eth_modify(struct net_device *ndev, int enum_index, u32 clear,
                      enum_index);
 }
 
+static void sh_eth_tsu_write(struct sh_eth_private *mdp, u32 data,
+                             int enum_index)
+{
+        iowrite32(data, mdp->tsu_addr + mdp->reg_offset[enum_index]);
+}
+
+static u32 sh_eth_tsu_read(struct sh_eth_private *mdp, int enum_index)
+{
+        return ioread32(mdp->tsu_addr + mdp->reg_offset[enum_index]);
+}
+
 static bool sh_eth_is_gether(struct sh_eth_private *mdp)
 {
         return mdp->reg_offset == sh_eth_offset_gigabit;
diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
index a6753ccba711..e5fe70134690 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -567,15 +567,4 @@ static inline void *sh_eth_tsu_get_offset(struct sh_eth_private *mdp,
         return mdp->tsu_addr + mdp->reg_offset[enum_index];
 }
 
-static inline void sh_eth_tsu_write(struct sh_eth_private *mdp, u32 data,
-                                    int enum_index)
-{
-        iowrite32(data, mdp->tsu_addr + mdp->reg_offset[enum_index]);
-}
-
-static inline u32 sh_eth_tsu_read(struct sh_eth_private *mdp, int enum_index)
-{
-        return ioread32(mdp->tsu_addr + mdp->reg_offset[enum_index]);
-}
-
 #endif  /* #ifndef __SH_ETH_H__ */
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 17e529af79dc..0265d703eb03 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -852,13 +852,6 @@ int netvsc_send(struct net_device *ndev,
         if (unlikely(!net_device || net_device->destroy))
                 return -ENODEV;
 
-        /* We may race with netvsc_connect_vsp()/netvsc_init_buf() and get
-         * here before the negotiation with the host is finished and
-         * send_section_map may not be allocated yet.
-         */
-        if (unlikely(!net_device->send_section_map))
-                return -EAGAIN;
-
         nvchan = &net_device->chan_table[packet->q_idx];
         packet->send_buf_index = NETVSC_INVALID_INDEX;
         packet->cp_partial = false;
@@ -866,10 +859,8 @@ int netvsc_send(struct net_device *ndev,
         /* Send control message directly without accessing msd (Multi-Send
          * Data) field which may be changed during data packet processing.
          */
-        if (!skb) {
-                cur_send = packet;
-                goto send_now;
-        }
+        if (!skb)
+                return netvsc_send_pkt(device, packet, net_device, pb, skb);
 
         /* batch packets in send buffer if possible */
         msdp = &nvchan->msd;
@@ -953,7 +944,6 @@ int netvsc_send(struct net_device *ndev,
                 }
         }
 
-send_now:
         if (cur_send)
                 ret = netvsc_send_pkt(device, cur_send, net_device, pb, skb);
 
@@ -1217,9 +1207,10 @@ int netvsc_poll(struct napi_struct *napi, int budget)
         if (send_recv_completions(ndev, net_device, nvchan) == 0 &&
             work_done < budget &&
             napi_complete_done(napi, work_done) &&
-            hv_end_read(&channel->inbound)) {
+            hv_end_read(&channel->inbound) &&
+            napi_schedule_prep(napi)) {
                 hv_begin_read(&channel->inbound);
-                napi_reschedule(napi);
+                __napi_schedule(napi);
         }
 
         /* Driver may overshoot since multiple packets per descriptor */
@@ -1242,7 +1233,7 @@ void netvsc_channel_cb(void *context)
                 /* disable interupts from host */
                 hv_begin_read(rbi);
 
-                __napi_schedule(&nvchan->napi);
+                __napi_schedule_irqoff(&nvchan->napi);
         }
 }
 
@@ -1296,7 +1287,6 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device,
                          netvsc_channel_cb, net_device->chan_table);
 
         if (ret != 0) {
-                netif_napi_del(&net_device->chan_table[0].napi);
                 netdev_err(ndev, "unable to open channel: %d\n", ret);
                 goto cleanup;
         }
@@ -1306,11 +1296,6 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device,
 
         napi_enable(&net_device->chan_table[0].napi);
 
-        /* Writing nvdev pointer unlocks netvsc_send(), make sure chn_table is
-         * populated.
-         */
-        rcu_assign_pointer(net_device_ctx->nvdev, net_device);
-
         /* Connect with the NetVsp */
         ret = netvsc_connect_vsp(device, net_device, device_info);
         if (ret != 0) {
@@ -1319,6 +1304,11 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device,
                 goto close;
         }
 
+        /* Writing nvdev pointer unlocks netvsc_send(), make sure chn_table is
+         * populated.
+         */
+        rcu_assign_pointer(net_device_ctx->nvdev, net_device);
+
         return net_device;
 
 close:
@@ -1329,6 +1319,7 @@ close:
         vmbus_close(device->channel);
 
 cleanup:
+        netif_napi_del(&net_device->chan_table[0].napi);
         free_netvsc_device(&net_device->rcu);
 
         return ERR_PTR(ret);
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index c5584c2d440e..cdb78eefab67 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -66,10 +66,36 @@ static int debug = -1;
 module_param(debug, int, S_IRUGO);
 MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)");
 
-static void netvsc_set_multicast_list(struct net_device *net)
+static void netvsc_change_rx_flags(struct net_device *net, int change)
 {
-        struct net_device_context *net_device_ctx = netdev_priv(net);
-        struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev);
+        struct net_device_context *ndev_ctx = netdev_priv(net);
+        struct net_device *vf_netdev = rtnl_dereference(ndev_ctx->vf_netdev);
+        int inc;
+
+        if (!vf_netdev)
+                return;
+
+        if (change & IFF_PROMISC) {
+                inc = (net->flags & IFF_PROMISC) ? 1 : -1;
+                dev_set_promiscuity(vf_netdev, inc);
+        }
+
+        if (change & IFF_ALLMULTI) {
+                inc = (net->flags & IFF_ALLMULTI) ? 1 : -1;
+                dev_set_allmulti(vf_netdev, inc);
+        }
+}
+
+static void netvsc_set_rx_mode(struct net_device *net)
+{
+        struct net_device_context *ndev_ctx = netdev_priv(net);
+        struct net_device *vf_netdev = rtnl_dereference(ndev_ctx->vf_netdev);
+        struct netvsc_device *nvdev = rtnl_dereference(ndev_ctx->nvdev);
+
+        if (vf_netdev) {
+                dev_uc_sync(vf_netdev, net);
+                dev_mc_sync(vf_netdev, net);
+        }
 
         rndis_filter_update(nvdev);
 }
@@ -91,12 +117,11 @@ static int netvsc_open(struct net_device *net)
                 return ret;
         }
 
-        netif_tx_wake_all_queues(net);
-
         rdev = nvdev->extension;
-
-        if (!rdev->link_state)
+        if (!rdev->link_state) {
                 netif_carrier_on(net);
+                netif_tx_wake_all_queues(net);
+        }
 
         if (vf_netdev) {
                 /* Setting synthetic device up transparently sets
@@ -299,8 +324,19 @@ static u16 netvsc_select_queue(struct net_device *ndev, struct sk_buff *skb,
         rcu_read_lock();
         vf_netdev = rcu_dereference(ndc->vf_netdev);
         if (vf_netdev) {
-                txq = skb_rx_queue_recorded(skb) ? skb_get_rx_queue(skb) : 0;
-                qdisc_skb_cb(skb)->slave_dev_queue_mapping = skb->queue_mapping;
+                const struct net_device_ops *vf_ops = vf_netdev->netdev_ops;
+
+                if (vf_ops->ndo_select_queue)
+                        txq = vf_ops->ndo_select_queue(vf_netdev, skb,
+                                                       accel_priv, fallback);
+                else
+                        txq = fallback(vf_netdev, skb);
+
+                /* Record the queue selected by VF so that it can be
+                 * used for common case where VF has more queues than
+                 * the synthetic device.
+                 */
+                qdisc_skb_cb(skb)->slave_dev_queue_mapping = txq;
         } else {
                 txq = netvsc_pick_tx(ndev, skb);
         }
@@ -1576,7 +1612,8 @@ static const struct net_device_ops device_ops = {
         .ndo_open =                     netvsc_open,
         .ndo_stop =                     netvsc_close,
         .ndo_start_xmit =               netvsc_start_xmit,
-        .ndo_set_rx_mode =              netvsc_set_multicast_list,
+        .ndo_change_rx_flags =          netvsc_change_rx_flags,
+        .ndo_set_rx_mode =              netvsc_set_rx_mode,
         .ndo_change_mtu =               netvsc_change_mtu,
         .ndo_validate_addr =            eth_validate_addr,
         .ndo_set_mac_address =          netvsc_set_mac_addr,
@@ -1807,6 +1844,11 @@ static void __netvsc_vf_setup(struct net_device *ndev,
                 netdev_warn(vf_netdev,
                             "unable to change mtu to %u\n", ndev->mtu);
 
+        /* set multicast etc flags on VF */
+        dev_change_flags(vf_netdev, ndev->flags | IFF_SLAVE);
+        dev_uc_sync(vf_netdev, ndev);
+        dev_mc_sync(vf_netdev, ndev);
+
         if (netif_running(ndev)) {
                 ret = dev_open(vf_netdev);
                 if (ret)
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index c3ca191fea7f..8927c483c217 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -854,15 +854,19 @@ static void rndis_set_multicast(struct work_struct *w)
 {
         struct rndis_device *rdev
                 = container_of(w, struct rndis_device, mcast_work);
+        u32 filter = NDIS_PACKET_TYPE_DIRECTED;
+        unsigned int flags = rdev->ndev->flags;
 
-        if (rdev->ndev->flags & IFF_PROMISC)
-                rndis_filter_set_packet_filter(rdev,
-                                               NDIS_PACKET_TYPE_PROMISCUOUS);
-        else
-                rndis_filter_set_packet_filter(rdev,
-                                               NDIS_PACKET_TYPE_BROADCAST |
-                                               NDIS_PACKET_TYPE_ALL_MULTICAST |
-                                               NDIS_PACKET_TYPE_DIRECTED);
+        if (flags & IFF_PROMISC) {
+                filter = NDIS_PACKET_TYPE_PROMISCUOUS;
+        } else {
+                if (flags & IFF_ALLMULTI)
+                        flags |= NDIS_PACKET_TYPE_ALL_MULTICAST;
+                if (flags & IFF_BROADCAST)
+                        flags |= NDIS_PACKET_TYPE_BROADCAST;
+        }
+
+        rndis_filter_set_packet_filter(rdev, filter);
 }
 
 void rndis_filter_update(struct netvsc_device *nvdev)
@@ -1340,6 +1344,9 @@ void rndis_filter_device_remove(struct hv_device *dev,
 {
         struct rndis_device *rndis_dev = net_dev->extension;
 
+        /* Don't try and setup sub channels if about to halt */
+        cancel_work_sync(&net_dev->subchan_work);
+
         /* Halt and release the rndis device */
         rndis_filter_halt_device(rndis_dev);
 
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index e3e29c2b028b..a6f924fee584 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -819,7 +819,7 @@ void phy_start(struct phy_device *phydev)
                 break;
         case PHY_HALTED:
                 /* if phy was suspended, bring the physical link up again */
-                phy_resume(phydev);
+                __phy_resume(phydev);
 
                 /* make sure interrupts are re-enabled for the PHY */
                 if (phy_interrupt_is_valid(phydev)) {
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index d39ae77707ef..478405e544cc 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -135,9 +135,7 @@ static int mdio_bus_phy_resume(struct device *dev)
         if (!mdio_bus_phy_may_suspend(phydev))
                 goto no_resume;
 
-        mutex_lock(&phydev->lock);
         ret = phy_resume(phydev);
-        mutex_unlock(&phydev->lock);
         if (ret < 0)
                 return ret;
 
@@ -1041,9 +1039,7 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
         if (err)
                 goto error;
 
-        mutex_lock(&phydev->lock);
         phy_resume(phydev);
-        mutex_unlock(&phydev->lock);
         phy_led_triggers_register(phydev);
 
         return err;
@@ -1172,7 +1168,7 @@ int phy_suspend(struct phy_device *phydev)
 }
 EXPORT_SYMBOL(phy_suspend);
 
-int phy_resume(struct phy_device *phydev)
+int __phy_resume(struct phy_device *phydev)
 {
         struct phy_driver *phydrv = to_phy_driver(phydev->mdio.dev.driver);
         int ret = 0;
@@ -1189,6 +1185,18 @@ int phy_resume(struct phy_device *phydev)
 
         return ret;
 }
+EXPORT_SYMBOL(__phy_resume);
+
+int phy_resume(struct phy_device *phydev)
+{
+        int ret;
+
+        mutex_lock(&phydev->lock);
+        ret = __phy_resume(phydev);
+        mutex_unlock(&phydev->lock);
+
+        return ret;
+}
 EXPORT_SYMBOL(phy_resume);
 
 int phy_loopback(struct phy_device *phydev, bool enable)
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 255a5def56e9..fa2a9bdd1866 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -3161,6 +3161,15 @@ ppp_connect_channel(struct channel *pch, int unit)
                 goto outl;
 
         ppp_lock(ppp);
+        spin_lock_bh(&pch->downl);
+        if (!pch->chan) {
+                /* Don't connect unregistered channels */
+                spin_unlock_bh(&pch->downl);
+                ppp_unlock(ppp);
+                ret = -ENOTCONN;
+                goto outl;
+        }
+        spin_unlock_bh(&pch->downl);
         if (pch->file.hdrlen > ppp->file.hdrlen)
                 ppp->file.hdrlen = pch->file.hdrlen;
         hdrlen = pch->file.hdrlen + 2;  /* for protocol bytes */
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index b52258c327d2..7433bb2e4451 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -181,7 +181,6 @@ struct tun_file {
         struct tun_struct *detached;
         struct ptr_ring tx_ring;
         struct xdp_rxq_info xdp_rxq;
-        int xdp_pending_pkts;
 };
 
 struct tun_flow_entry {
@@ -1643,6 +1642,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
         else
                 *skb_xdp = 0;
 
+        preempt_disable();
         rcu_read_lock();
         xdp_prog = rcu_dereference(tun->xdp_prog);
         if (xdp_prog && !*skb_xdp) {
@@ -1662,11 +1662,12 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
                 case XDP_REDIRECT:
                         get_page(alloc_frag->page);
                         alloc_frag->offset += buflen;
-                        ++tfile->xdp_pending_pkts;
                         err = xdp_do_redirect(tun->dev, &xdp, xdp_prog);
+                        xdp_do_flush_map();
                         if (err)
                                 goto err_redirect;
                         rcu_read_unlock();
+                        preempt_enable();
                         return NULL;
                 case XDP_TX:
                         xdp_xmit = true;
@@ -1688,6 +1689,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
         skb = build_skb(buf, buflen);
         if (!skb) {
                 rcu_read_unlock();
+                preempt_enable();
                 return ERR_PTR(-ENOMEM);
         }
 
@@ -1700,10 +1702,12 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
                 skb->dev = tun->dev;
                 generic_xdp_tx(skb, xdp_prog);
                 rcu_read_unlock();
+                preempt_enable();
                 return NULL;
         }
 
         rcu_read_unlock();
+        preempt_enable();
 
         return skb;
 
@@ -1711,6 +1715,7 @@ err_redirect:
         put_page(alloc_frag->page);
 err_xdp:
         rcu_read_unlock();
+        preempt_enable();
         this_cpu_inc(tun->pcpu_stats->rx_dropped);
         return NULL;
 }
@@ -1984,11 +1989,6 @@ static ssize_t tun_chr_write_iter(struct kiocb *iocb, struct iov_iter *from)
         result = tun_get_user(tun, tfile, NULL, from,
                               file->f_flags & O_NONBLOCK, false);
 
-        if (tfile->xdp_pending_pkts) {
-                tfile->xdp_pending_pkts = 0;
-                xdp_do_flush_map();
-        }
-
         tun_put(tun);
         return result;
 }
@@ -2325,13 +2325,6 @@ static int tun_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
         ret = tun_get_user(tun, tfile, m->msg_control, &m->msg_iter,
                            m->msg_flags & MSG_DONTWAIT,
                            m->msg_flags & MSG_MORE);
-
-        if (tfile->xdp_pending_pkts >= NAPI_POLL_WEIGHT ||
-            !(m->msg_flags & MSG_MORE)) {
-                tfile->xdp_pending_pkts = 0;
-                xdp_do_flush_map();
-        }
-
         tun_put(tun);
         return ret;
 }
@@ -3163,7 +3156,6 @@ static int tun_chr_open(struct inode *inode, struct file * file)
         sock_set_flag(&tfile->sk, SOCK_ZEROCOPY);
 
         memset(&tfile->tx_ring, 0, sizeof(tfile->tx_ring));
-        tfile->xdp_pending_pkts = 0;
 
         return 0;
 }
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 05dca3e5c93d..fff4b13eece2 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -896,6 +896,12 @@ static const struct usb_device_id	products[] = {
                                       USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long)&wwan_info,
 }, {
+        /* Cinterion PLS8 modem by GEMALTO */
+        USB_DEVICE_AND_INTERFACE_INFO(0x1e2d, 0x0061, USB_CLASS_COMM,
+                                      USB_CDC_SUBCLASS_ETHERNET,
+                                      USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long)&wwan_info,
+}, {
         USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET,
                         USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long) &cdc_info,
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 958b2e8b90f6..86f7196f9d91 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -1794,7 +1794,7 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg)
 
                 tx_data += len;
                 agg->skb_len += len;
-                agg->skb_num++;
+                agg->skb_num += skb_shinfo(skb)->gso_segs ?: 1;
 
                 dev_kfree_skb_any(skb);
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 9bb9e562b893..23374603e4d9 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -504,6 +504,7 @@ static struct page *xdp_linearize_page(struct receive_queue *rq,
         page_off += *len;
 
         while (--*num_buf) {
+                int tailroom = SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
                 unsigned int buflen;
                 void *buf;
                 int off;
@@ -518,7 +519,7 @@ static struct page *xdp_linearize_page(struct receive_queue *rq,
                 /* guard against a misconfigured or uncooperative backend that
                  * is sending packet larger than the MTU.
                  */
-                if ((page_off + buflen) > PAGE_SIZE) {
+                if ((page_off + buflen + tailroom) > PAGE_SIZE) {
                         put_page(p);
                         goto err_buf;
                 }
@@ -690,6 +691,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
         unsigned int truesize;
         unsigned int headroom = mergeable_ctx_to_headroom(ctx);
         bool sent;
+        int err;
 
         head_skb = NULL;
 
@@ -701,7 +703,12 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
                 void *data;
                 u32 act;
 
-                /* This happens when rx buffer size is underestimated */
+                /* This happens when rx buffer size is underestimated
+                 * or headroom is not enough because of the buffer
+                 * was refilled before XDP is set. This should only
+                 * happen for the first several packets, so we don't
+                 * care much about its performance.
+                 */
                 if (unlikely(num_buf > 1 ||
                              headroom < virtnet_get_headroom(vi))) {
                         /* linearize data for XDP */
@@ -736,9 +743,6 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
 
                 act = bpf_prog_run_xdp(xdp_prog, &xdp);
 
-                if (act != XDP_PASS)
-                        ewma_pkt_len_add(&rq->mrg_avg_pkt_len, len);
-
                 switch (act) {
                 case XDP_PASS:
                         /* recalculate offset to account for any header
@@ -770,6 +774,18 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
                                 goto err_xdp;
                         rcu_read_unlock();
                         goto xdp_xmit;
+                case XDP_REDIRECT:
+                        err = xdp_do_redirect(dev, &xdp, xdp_prog);
+                        if (err) {
+                                if (unlikely(xdp_page != page))
+                                        put_page(xdp_page);
+                                goto err_xdp;
+                        }
+                        *xdp_xmit = true;
+                        if (unlikely(xdp_page != page))
+                                goto err_xdp;
+                        rcu_read_unlock();
+                        goto xdp_xmit;
                 default:
                         bpf_warn_invalid_xdp_action(act);
                 case XDP_ABORTED:
@@ -1013,13 +1029,18 @@ static int add_recvbuf_big(struct virtnet_info *vi, struct receive_queue *rq,
 }
 
 static unsigned int get_mergeable_buf_len(struct receive_queue *rq,
-                                          struct ewma_pkt_len *avg_pkt_len)
+                                          struct ewma_pkt_len *avg_pkt_len,
+                                          unsigned int room)
 {
         const size_t hdr_len = sizeof(struct virtio_net_hdr_mrg_rxbuf);
         unsigned int len;
 
-        len = hdr_len + clamp_t(unsigned int, ewma_pkt_len_read(avg_pkt_len),
+        if (room)
+                return PAGE_SIZE - room;
+
+        len = hdr_len + clamp_t(unsigned int, ewma_pkt_len_read(avg_pkt_len),
                                 rq->min_buf_len, PAGE_SIZE - hdr_len);
+
         return ALIGN(len, L1_CACHE_BYTES);
 }
 
@@ -1028,21 +1049,27 @@ static int add_recvbuf_mergeable(struct virtnet_info *vi,
 {
         struct page_frag *alloc_frag = &rq->alloc_frag;
         unsigned int headroom = virtnet_get_headroom(vi);
+        unsigned int tailroom = headroom ? sizeof(struct skb_shared_info) : 0;
+        unsigned int room = SKB_DATA_ALIGN(headroom + tailroom);
         char *buf;
         void *ctx;
         int err;
         unsigned int len, hole;
 
-        len = get_mergeable_buf_len(rq, &rq->mrg_avg_pkt_len);
-        if (unlikely(!skb_page_frag_refill(len + headroom, alloc_frag, gfp)))
+        /* Extra tailroom is needed to satisfy XDP's assumption. This
+         * means rx frags coalescing won't work, but consider we've
+         * disabled GSO for XDP, it won't be a big issue.
+         */
+        len = get_mergeable_buf_len(rq, &rq->mrg_avg_pkt_len, room);
+        if (unlikely(!skb_page_frag_refill(len + room, alloc_frag, gfp)))
                 return -ENOMEM;
 
         buf = (char *)page_address(alloc_frag->page) + alloc_frag->offset;
         buf += headroom; /* advance address leaving hole at front of pkt */
         get_page(alloc_frag->page);
-        alloc_frag->offset += len + headroom;
+        alloc_frag->offset += len + room;
         hole = alloc_frag->size - alloc_frag->offset;
-        if (hole < len + headroom) {
+        if (hole < len + room) {
                 /* To avoid internal fragmentation, if there is very likely not
                  * enough space for another buffer, add the remaining space to
                  * the current buffer.
@@ -2185,8 +2212,9 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog,
         }
 
         /* Make sure NAPI is not using any XDP TX queues for RX. */
-        for (i = 0; i < vi->max_queue_pairs; i++)
-                napi_disable(&vi->rq[i].napi);
+        if (netif_running(dev))
+                for (i = 0; i < vi->max_queue_pairs; i++)
+                        napi_disable(&vi->rq[i].napi);
 
         netif_set_real_num_rx_queues(dev, curr_qp + xdp_qp);
         err = _virtnet_set_queues(vi, curr_qp + xdp_qp);
@@ -2205,7 +2233,8 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog,
                 }
                 if (old_prog)
                         bpf_prog_put(old_prog);
-                virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
+                if (netif_running(dev))
+                        virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
         }
 
         return 0;
@@ -2576,12 +2605,15 @@ static ssize_t mergeable_rx_buffer_size_show(struct netdev_rx_queue *queue,
 {
         struct virtnet_info *vi = netdev_priv(queue->dev);
         unsigned int queue_index = get_netdev_rx_queue_index(queue);
+        unsigned int headroom = virtnet_get_headroom(vi);
+        unsigned int tailroom = headroom ? sizeof(struct skb_shared_info) : 0;
         struct ewma_pkt_len *avg;
 
         BUG_ON(queue_index >= vi->max_queue_pairs);
         avg = &vi->rq[queue_index].mrg_avg_pkt_len;
         return sprintf(buf, "%u\n",
-                       get_mergeable_buf_len(&vi->rq[queue_index], avg));
+                       get_mergeable_buf_len(&vi->rq[queue_index], avg,
+                                       SKB_DATA_ALIGN(headroom + tailroom)));
 }
 
 static struct rx_queue_attribute mergeable_rx_buffer_size_attribute =
diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c
index afeca6bcdade..ab8b3cbbb205 100644
--- a/drivers/net/wan/hdlc_ppp.c
+++ b/drivers/net/wan/hdlc_ppp.c
@@ -574,7 +574,10 @@ static void ppp_timer(struct timer_list *t)
                         ppp_cp_event(proto->dev, proto->pid, TO_GOOD, 0, 0,
                                      0, NULL);
                         proto->restart_counter--;
-                } else
+                } else if (netif_carrier_ok(proto->dev))
+                        ppp_cp_event(proto->dev, proto->pid, TO_GOOD, 0, 0,
+                                     0, NULL);
+                else
                         ppp_cp_event(proto->dev, proto->pid, TO_BAD, 0, 0,
                                      0, NULL);
                 break;
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 8328d395e332..3127bc8633ca 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -2005,7 +2005,10 @@ static void netback_changed(struct xenbus_device *dev,
         case XenbusStateInitialised:
         case XenbusStateReconfiguring:
         case XenbusStateReconfigured:
+                break;
+
         case XenbusStateUnknown:
+                wake_up_all(&module_unload_q);
                 break;
 
         case XenbusStateInitWait:
@@ -2136,7 +2139,9 @@ static int xennet_remove(struct xenbus_device *dev)
                 xenbus_switch_state(dev, XenbusStateClosing);
                 wait_event(module_unload_q,
                            xenbus_read_driver_state(dev->otherend) ==
-                           XenbusStateClosing);
+                           XenbusStateClosing ||
+                           xenbus_read_driver_state(dev->otherend) ==
+                           XenbusStateUnknown);
 
                 xenbus_switch_state(dev, XenbusStateClosed);
                 wait_event(module_unload_q,
diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
index 10041ac4032c..06f8dcc52ca6 100644
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
@@ -335,8 +335,7 @@ static int pmem_attach_disk(struct device *dev,
                 dev_warn(dev, "unable to guarantee persistence of writes\n");
                 fua = 0;
         }
-        wbc = nvdimm_has_cache(nd_region) &&
-                !test_bit(ND_REGION_PERSIST_CACHE, &nd_region->flags);
+        wbc = nvdimm_has_cache(nd_region);
 
         if (!devm_request_mem_region(dev, res->start, resource_size(res),
                                 dev_name(&ndns->dev))) {
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 0fe7ea35c221..7aeca5db7916 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -2844,7 +2844,7 @@ out:
 }
 
 static int nvme_init_ns_head(struct nvme_ns *ns, unsigned nsid,
-                struct nvme_id_ns *id, bool *new)
+                struct nvme_id_ns *id)
 {
         struct nvme_ctrl *ctrl = ns->ctrl;
         bool is_shared = id->nmic & (1 << 0);
@@ -2860,8 +2860,6 @@ static int nvme_init_ns_head(struct nvme_ns *ns, unsigned nsid,
                         ret = PTR_ERR(head);
                         goto out_unlock;
                 }
-
-                *new = true;
         } else {
                 struct nvme_ns_ids ids;
 
@@ -2873,8 +2871,6 @@ static int nvme_init_ns_head(struct nvme_ns *ns, unsigned nsid,
                         ret = -EINVAL;
                         goto out_unlock;
                 }
-
-                *new = false;
         }
 
         list_add_tail(&ns->siblings, &head->list);
@@ -2945,7 +2941,6 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
         struct nvme_id_ns *id;
         char disk_name[DISK_NAME_LEN];
         int node = dev_to_node(ctrl->dev), flags = GENHD_FL_EXT_DEVT;
-        bool new = true;
 
         ns = kzalloc_node(sizeof(*ns), GFP_KERNEL, node);
         if (!ns)
@@ -2971,7 +2966,7 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
         if (id->ncap == 0)
                 goto out_free_id;
 
-        if (nvme_init_ns_head(ns, nsid, id, &new))
+        if (nvme_init_ns_head(ns, nsid, id))
                 goto out_free_id;
         nvme_setup_streams_ns(ctrl, ns);
         
@@ -3037,9 +3032,7 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
                 pr_warn("%s: failed to register lightnvm sysfs group for identification\n",
                         ns->disk->disk_name);
 
-        if (new)
-                nvme_mpath_add_disk(ns->head);
-        nvme_mpath_add_disk_links(ns);
+        nvme_mpath_add_disk(ns->head);
         return;
  out_unlink_ns:
         mutex_lock(&ctrl->subsys->lock);
@@ -3059,7 +3052,6 @@ static void nvme_ns_remove(struct nvme_ns *ns)
                 return;
 
         if (ns->disk && ns->disk->flags & GENHD_FL_UP) {
-                nvme_mpath_remove_disk_links(ns);
                 sysfs_remove_group(&disk_to_dev(ns->disk)->kobj,
                                         &nvme_ns_id_attr_group);
                 if (ns->ndev)
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 5dd4ceefed8f..8f0f34d06d46 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -493,7 +493,7 @@ EXPORT_SYMBOL_GPL(nvmf_should_reconnect);
  */
 int nvmf_register_transport(struct nvmf_transport_ops *ops)
 {
-        if (!ops->create_ctrl || !ops->module)
+        if (!ops->create_ctrl)
                 return -EINVAL;
 
         down_write(&nvmf_transports_rwsem);
@@ -650,6 +650,11 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
                                 ret = -EINVAL;
                                 goto out;
                         }
+                        if (opts->discovery_nqn) {
+                                pr_debug("Ignoring nr_io_queues value for discovery controller\n");
+                                break;
+                        }
+
                         opts->nr_io_queues = min_t(unsigned int,
                                         num_online_cpus(), token);
                         break;
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 7f51f8414b97..1dc1387b7134 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -1206,7 +1206,7 @@ nvme_fc_connect_admin_queue(struct nvme_fc_ctrl *ctrl,
                                 sizeof(struct fcnvme_lsdesc_cr_assoc_cmd));
 
         assoc_rqst->assoc_cmd.ersp_ratio = cpu_to_be16(ersp_ratio);
-        assoc_rqst->assoc_cmd.sqsize = cpu_to_be16(qsize);
+        assoc_rqst->assoc_cmd.sqsize = cpu_to_be16(qsize - 1);
         /* Linux supports only Dynamic controllers */
         assoc_rqst->assoc_cmd.cntlid = cpu_to_be16(0xffff);
         uuid_copy(&assoc_rqst->assoc_cmd.hostid, &ctrl->ctrl.opts->host->id);
@@ -1321,7 +1321,7 @@ nvme_fc_connect_queue(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue,
                                 sizeof(struct fcnvme_lsdesc_cr_conn_cmd));
         conn_rqst->connect_cmd.ersp_ratio = cpu_to_be16(ersp_ratio);
         conn_rqst->connect_cmd.qid  = cpu_to_be16(queue->qnum);
-        conn_rqst->connect_cmd.sqsize = cpu_to_be16(qsize);
+        conn_rqst->connect_cmd.sqsize = cpu_to_be16(qsize - 1);
 
         lsop->queue = queue;
         lsreq->rqstaddr = conn_rqst;
@@ -2481,11 +2481,11 @@ nvme_fc_create_io_queues(struct nvme_fc_ctrl *ctrl)
                 goto out_free_tag_set;
         }
 
-        ret = nvme_fc_create_hw_io_queues(ctrl, ctrl->ctrl.opts->queue_size);
+        ret = nvme_fc_create_hw_io_queues(ctrl, ctrl->ctrl.sqsize + 1);
         if (ret)
                 goto out_cleanup_blk_queue;
 
-        ret = nvme_fc_connect_io_queues(ctrl, ctrl->ctrl.opts->queue_size);
+        ret = nvme_fc_connect_io_queues(ctrl, ctrl->ctrl.sqsize + 1);
         if (ret)
                 goto out_delete_hw_queues;
 
@@ -2532,11 +2532,11 @@ nvme_fc_reinit_io_queues(struct nvme_fc_ctrl *ctrl)
         if (ret)
                 goto out_free_io_queues;
 
-        ret = nvme_fc_create_hw_io_queues(ctrl, ctrl->ctrl.opts->queue_size);
+        ret = nvme_fc_create_hw_io_queues(ctrl, ctrl->ctrl.sqsize + 1);
         if (ret)
                 goto out_free_io_queues;
 
-        ret = nvme_fc_connect_io_queues(ctrl, ctrl->ctrl.opts->queue_size);
+        ret = nvme_fc_connect_io_queues(ctrl, ctrl->ctrl.sqsize + 1);
         if (ret)
                 goto out_delete_hw_queues;
 
@@ -2632,13 +2632,12 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
         nvme_fc_init_queue(ctrl, 0);
 
         ret = __nvme_fc_create_hw_queue(ctrl, &ctrl->queues[0], 0,
-                                NVME_AQ_BLK_MQ_DEPTH);
+                                NVME_AQ_DEPTH);
         if (ret)
                 goto out_free_queue;
 
         ret = nvme_fc_connect_admin_queue(ctrl, &ctrl->queues[0],
-                                NVME_AQ_BLK_MQ_DEPTH,
-                                (NVME_AQ_BLK_MQ_DEPTH / 4));
+                                NVME_AQ_DEPTH, (NVME_AQ_DEPTH / 4));
         if (ret)
                 goto out_delete_hw_queue;
 
@@ -2666,7 +2665,7 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
         }
 
         ctrl->ctrl.sqsize =
-                min_t(int, NVME_CAP_MQES(ctrl->ctrl.cap) + 1, ctrl->ctrl.sqsize);
+                min_t(int, NVME_CAP_MQES(ctrl->ctrl.cap), ctrl->ctrl.sqsize);
 
         ret = nvme_enable_ctrl(&ctrl->ctrl, ctrl->ctrl.cap);
         if (ret)
@@ -2699,6 +2698,14 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
                 opts->queue_size = ctrl->ctrl.maxcmd;
         }
 
+        if (opts->queue_size > ctrl->ctrl.sqsize + 1) {
+                /* warn if sqsize is lower than queue_size */
+                dev_warn(ctrl->ctrl.device,
+                        "queue_size %zu > ctrl sqsize %u, clamping down\n",
+                        opts->queue_size, ctrl->ctrl.sqsize + 1);
+                opts->queue_size = ctrl->ctrl.sqsize + 1;
+        }
+
         ret = nvme_fc_init_aen_ops(ctrl);
         if (ret)
                 goto out_term_aen_ops;
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index 3b211d9e58b8..060f69e03427 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -198,30 +198,16 @@ void nvme_mpath_add_disk(struct nvme_ns_head *head)
 {
         if (!head->disk)
                 return;
-        device_add_disk(&head->subsys->dev, head->disk);
-        if (sysfs_create_group(&disk_to_dev(head->disk)->kobj,
-                        &nvme_ns_id_attr_group))
-                pr_warn("%s: failed to create sysfs group for identification\n",
-                        head->disk->disk_name);
-}
-
-void nvme_mpath_add_disk_links(struct nvme_ns *ns)
-{
-        struct kobject *slave_disk_kobj, *holder_disk_kobj;
-
-        if (!ns->head->disk)
-                return;
-
-        slave_disk_kobj = &disk_to_dev(ns->disk)->kobj;
-        if (sysfs_create_link(ns->head->disk->slave_dir, slave_disk_kobj,
-                        kobject_name(slave_disk_kobj)))
-                return;
 
-        holder_disk_kobj = &disk_to_dev(ns->head->disk)->kobj;
-        if (sysfs_create_link(ns->disk->part0.holder_dir, holder_disk_kobj,
-                        kobject_name(holder_disk_kobj)))
-                sysfs_remove_link(ns->head->disk->slave_dir,
-                        kobject_name(slave_disk_kobj));
+        mutex_lock(&head->subsys->lock);
+        if (!(head->disk->flags & GENHD_FL_UP)) {
+                device_add_disk(&head->subsys->dev, head->disk);
+                if (sysfs_create_group(&disk_to_dev(head->disk)->kobj,
+                                &nvme_ns_id_attr_group))
+                        pr_warn("%s: failed to create sysfs group for identification\n",
+                                head->disk->disk_name);
+        }
+        mutex_unlock(&head->subsys->lock);
 }
 
 void nvme_mpath_remove_disk(struct nvme_ns_head *head)
@@ -238,14 +224,3 @@ void nvme_mpath_remove_disk(struct nvme_ns_head *head)
         blk_cleanup_queue(head->disk->queue);
         put_disk(head->disk);
 }
-
-void nvme_mpath_remove_disk_links(struct nvme_ns *ns)
-{
-        if (!ns->head->disk)
-                return;
-
-        sysfs_remove_link(ns->disk->part0.holder_dir,
-                        kobject_name(&disk_to_dev(ns->head->disk)->kobj));
-        sysfs_remove_link(ns->head->disk->slave_dir,
-                        kobject_name(&disk_to_dev(ns->disk)->kobj));
-}
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 0521e4707d1c..d733b14ede9d 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -410,9 +410,7 @@ bool nvme_req_needs_failover(struct request *req, blk_status_t error);
 void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl);
 int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl,struct nvme_ns_head *head);
 void nvme_mpath_add_disk(struct nvme_ns_head *head);
-void nvme_mpath_add_disk_links(struct nvme_ns *ns);
 void nvme_mpath_remove_disk(struct nvme_ns_head *head);
-void nvme_mpath_remove_disk_links(struct nvme_ns *ns);
 
 static inline void nvme_mpath_clear_current_path(struct nvme_ns *ns)
 {
@@ -454,12 +452,6 @@ static inline void nvme_mpath_add_disk(struct nvme_ns_head *head)
 static inline void nvme_mpath_remove_disk(struct nvme_ns_head *head)
 {
 }
-static inline void nvme_mpath_add_disk_links(struct nvme_ns *ns)
-{
-}
-static inline void nvme_mpath_remove_disk_links(struct nvme_ns *ns)
-{
-}
 static inline void nvme_mpath_clear_current_path(struct nvme_ns *ns)
 {
 }
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 73036d2fbbd5..b6f43b738f03 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1153,12 +1153,6 @@ static bool nvme_should_reset(struct nvme_dev *dev, u32 csts)
         if (!(csts & NVME_CSTS_CFS) && !nssro)
                 return false;
 
-        /* If PCI error recovery process is happening, we cannot reset or
-         * the recovery mechanism will surely fail.
-         */
-        if (pci_channel_offline(to_pci_dev(dev->dev)))
-                return false;
-
         return true;
 }
 
@@ -1189,6 +1183,13 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved)
         struct nvme_command cmd;
         u32 csts = readl(dev->bar + NVME_REG_CSTS);
 
+        /* If PCI error recovery process is happening, we cannot reset or
+         * the recovery mechanism will surely fail.
+         */
+        mb();
+        if (pci_channel_offline(to_pci_dev(dev->dev)))
+                return BLK_EH_RESET_TIMER;
+
         /*
          * Reset immediately if the controller is failed
          */
@@ -1459,7 +1460,7 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, int qid)
         nvmeq->cq_vector = qid - 1;
         result = adapter_alloc_cq(dev, qid, nvmeq);
         if (result < 0)
-                return result;
+                goto release_vector;
 
         result = adapter_alloc_sq(dev, qid, nvmeq);
         if (result < 0)
@@ -1473,9 +1474,12 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, int qid)
         return result;
 
  release_sq:
+        dev->online_queues--;
         adapter_delete_sq(dev, qid);
  release_cq:
         adapter_delete_cq(dev, qid);
+ release_vector:
+        nvmeq->cq_vector = -1;
         return result;
 }
 
@@ -1910,7 +1914,7 @@ static int nvme_setup_io_queues(struct nvme_dev *dev)
         int result, nr_io_queues;
         unsigned long size;
 
-        nr_io_queues = num_present_cpus();
+        nr_io_queues = num_possible_cpus();
         result = nvme_set_queue_count(&dev->ctrl, &nr_io_queues);
         if (result < 0)
                 return result;
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 3a51ed50eff2..4d84a73ee12d 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -1051,7 +1051,7 @@ static void nvme_rdma_unmap_data(struct nvme_rdma_queue *queue,
         struct nvme_rdma_device *dev = queue->device;
         struct ib_device *ibdev = dev->dev;
 
-        if (!blk_rq_bytes(rq))
+        if (!blk_rq_payload_bytes(rq))
                 return;
 
         if (req->mr) {
@@ -1166,7 +1166,7 @@ static int nvme_rdma_map_data(struct nvme_rdma_queue *queue,
 
         c->common.flags |= NVME_CMD_SGL_METABUF;
 
-        if (!blk_rq_bytes(rq))
+        if (!blk_rq_payload_bytes(rq))
                 return nvme_rdma_set_sg_null(c);
 
         req->sg_table.sgl = req->first_sgl;
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 0bd737117a80..a78029e4e5f4 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -520,9 +520,12 @@ bool nvmet_req_init(struct nvmet_req *req, struct nvmet_cq *cq,
                 goto fail;
         }
 
-        /* either variant of SGLs is fine, as we don't support metadata */
-        if (unlikely((flags & NVME_CMD_SGL_ALL) != NVME_CMD_SGL_METABUF &&
-                     (flags & NVME_CMD_SGL_ALL) != NVME_CMD_SGL_METASEG)) {
+        /*
+         * For fabrics, PSDT field shall describe metadata pointer (MPTR) that
+         * contains an address of a single contiguous physical buffer that is
+         * byte aligned.
+         */
+        if (unlikely((flags & NVME_CMD_SGL_ALL) != NVME_CMD_SGL_METABUF)) {
                 status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
                 goto fail;
         }
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index 7991ec3a17db..861d1509b22b 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -184,7 +184,7 @@ static blk_status_t nvme_loop_queue_rq(struct blk_mq_hw_ctx *hctx,
                 return BLK_STS_OK;
         }
 
-        if (blk_rq_bytes(req)) {
+        if (blk_rq_payload_bytes(req)) {
                 iod->sg_table.sgl = iod->first_sgl;
                 if (sg_alloc_table_chained(&iod->sg_table,
                                 blk_rq_nr_phys_segments(req),
@@ -193,7 +193,7 @@ static blk_status_t nvme_loop_queue_rq(struct blk_mq_hw_ctx *hctx,
 
                 iod->req.sg = iod->sg_table.sgl;
                 iod->req.sg_cnt = blk_rq_map_sg(req->q, req, iod->sg_table.sgl);
-                iod->req.transfer_len = blk_rq_bytes(req);
+                iod->req.transfer_len = blk_rq_payload_bytes(req);
         }
 
         blk_mq_start_request(req);
diff --git a/drivers/pci/dwc/pcie-designware-host.c b/drivers/pci/dwc/pcie-designware-host.c
index 8de2d5c69b1d..dc9303abda42 100644
--- a/drivers/pci/dwc/pcie-designware-host.c
+++ b/drivers/pci/dwc/pcie-designware-host.c
@@ -613,7 +613,7 @@ void dw_pcie_setup_rc(struct pcie_port *pp)
         /* setup bus numbers */
         val = dw_pcie_readl_dbi(pci, PCI_PRIMARY_BUS);
         val &= 0xff000000;
-        val |= 0x00010100;
+        val |= 0x00ff0100;
         dw_pcie_writel_dbi(pci, PCI_PRIMARY_BUS, val);
 
         /* setup command register */
diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
index 369d48d6c6f1..365447240d95 100644
--- a/drivers/pci/setup-res.c
+++ b/drivers/pci/setup-res.c
@@ -401,6 +401,10 @@ void pci_release_resource(struct pci_dev *dev, int resno)
         struct resource *res = dev->resource + resno;
 
         pci_info(dev, "BAR %d: releasing %pR\n", resno, res);
+
+        if (!res->parent)
+                return;
+
         release_resource(res);
         res->end = resource_size(res) - 1;
         res->start = 0;
diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c
index 0c2ed11c0603..f63db346c219 100644
--- a/drivers/perf/arm_pmu.c
+++ b/drivers/perf/arm_pmu.c
@@ -638,7 +638,7 @@ static int arm_perf_teardown_cpu(unsigned int cpu, struct hlist_node *node)
                 if (irq_is_percpu_devid(irq))
                         disable_percpu_irq(irq);
                 else
-                        disable_irq(irq);
+                        disable_irq_nosync(irq);
         }
 
         per_cpu(cpu_armpmu, cpu) = NULL;
diff --git a/drivers/phy/qualcomm/phy-qcom-ufs.c b/drivers/phy/qualcomm/phy-qcom-ufs.c
index c5ff4525edef..c5493ea51282 100644
--- a/drivers/phy/qualcomm/phy-qcom-ufs.c
+++ b/drivers/phy/qualcomm/phy-qcom-ufs.c
@@ -675,3 +675,8 @@ int ufs_qcom_phy_power_off(struct phy *generic_phy)
         return 0;
 }
 EXPORT_SYMBOL_GPL(ufs_qcom_phy_power_off);
+
+MODULE_AUTHOR("Yaniv Gardi <ygardi@codeaurora.org>");
+MODULE_AUTHOR("Vivek Gautam <vivek.gautam@codeaurora.org>");
+MODULE_DESCRIPTION("Universal Flash Storage (UFS) QCOM PHY");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/pinctrl/meson/pinctrl-meson-axg.c b/drivers/pinctrl/meson/pinctrl-meson-axg.c
index 1fda9d6c7ea3..4b91ff74779b 100644
--- a/drivers/pinctrl/meson/pinctrl-meson-axg.c
+++ b/drivers/pinctrl/meson/pinctrl-meson-axg.c
@@ -716,7 +716,7 @@ static const char * const uart_b_groups[] = {
         "uart_tx_b_x", "uart_rx_b_x", "uart_cts_b_x", "uart_rts_b_x",
 };
 
-static const char * const uart_ao_b_gpioz_groups[] = {
+static const char * const uart_ao_b_z_groups[] = {
         "uart_ao_tx_b_z", "uart_ao_rx_b_z",
         "uart_ao_cts_b_z", "uart_ao_rts_b_z",
 };
@@ -855,7 +855,7 @@ static struct meson_pmx_func meson_axg_periphs_functions[] = {
         FUNCTION(nand),
         FUNCTION(uart_a),
         FUNCTION(uart_b),
-        FUNCTION(uart_ao_b_gpioz),
+        FUNCTION(uart_ao_b_z),
         FUNCTION(i2c0),
         FUNCTION(i2c1),
         FUNCTION(i2c2),
diff --git a/drivers/platform/chrome/chromeos_laptop.c b/drivers/platform/chrome/chromeos_laptop.c
index 6dec6ab13300..d8599736a41a 100644
--- a/drivers/platform/chrome/chromeos_laptop.c
+++ b/drivers/platform/chrome/chromeos_laptop.c
@@ -423,7 +423,7 @@ static int chromeos_laptop_probe(struct platform_device *pdev)
         return ret;
 }
 
-static const struct chromeos_laptop samsung_series_5_550 = {
+static struct chromeos_laptop samsung_series_5_550 = {
         .i2c_peripherals = {
                 /* Touchpad. */
                 { .add = setup_cyapa_tp, I2C_ADAPTER_SMBUS },
@@ -432,14 +432,14 @@ static const struct chromeos_laptop samsung_series_5_550 = {
         },
 };
 
-static const struct chromeos_laptop samsung_series_5 = {
+static struct chromeos_laptop samsung_series_5 = {
         .i2c_peripherals = {
                 /* Light Sensor. */
                 { .add = setup_tsl2583_als, I2C_ADAPTER_SMBUS },
         },
 };
 
-static const struct chromeos_laptop chromebook_pixel = {
+static struct chromeos_laptop chromebook_pixel = {
         .i2c_peripherals = {
                 /* Touch Screen. */
                 { .add = setup_atmel_1664s_ts, I2C_ADAPTER_PANEL },
@@ -450,14 +450,14 @@ static const struct chromeos_laptop chromebook_pixel = {
         },
 };
 
-static const struct chromeos_laptop hp_chromebook_14 = {
+static struct chromeos_laptop hp_chromebook_14 = {
         .i2c_peripherals = {
                 /* Touchpad. */
                 { .add = setup_cyapa_tp, I2C_ADAPTER_DESIGNWARE_0 },
         },
 };
 
-static const struct chromeos_laptop dell_chromebook_11 = {
+static struct chromeos_laptop dell_chromebook_11 = {
         .i2c_peripherals = {
                 /* Touchpad. */
                 { .add = setup_cyapa_tp, I2C_ADAPTER_DESIGNWARE_0 },
@@ -466,28 +466,28 @@ static const struct chromeos_laptop dell_chromebook_11 = {
         },
 };
 
-static const struct chromeos_laptop toshiba_cb35 = {
+static struct chromeos_laptop toshiba_cb35 = {
         .i2c_peripherals = {
                 /* Touchpad. */
                 { .add = setup_cyapa_tp, I2C_ADAPTER_DESIGNWARE_0 },
         },
 };
 
-static const struct chromeos_laptop acer_c7_chromebook = {
+static struct chromeos_laptop acer_c7_chromebook = {
         .i2c_peripherals = {
                 /* Touchpad. */
                 { .add = setup_cyapa_tp, I2C_ADAPTER_SMBUS },
         },
 };
 
-static const struct chromeos_laptop acer_ac700 = {
+static struct chromeos_laptop acer_ac700 = {
         .i2c_peripherals = {
                 /* Light Sensor. */
                 { .add = setup_tsl2563_als, I2C_ADAPTER_SMBUS },
         },
 };
 
-static const struct chromeos_laptop acer_c720 = {
+static struct chromeos_laptop acer_c720 = {
         .i2c_peripherals = {
                 /* Touchscreen. */
                 { .add = setup_atmel_1664s_ts, I2C_ADAPTER_DESIGNWARE_1 },
@@ -500,14 +500,14 @@ static const struct chromeos_laptop acer_c720 = {
         },
 };
 
-static const struct chromeos_laptop hp_pavilion_14_chromebook = {
+static struct chromeos_laptop hp_pavilion_14_chromebook = {
         .i2c_peripherals = {
                 /* Touchpad. */
                 { .add = setup_cyapa_tp, I2C_ADAPTER_SMBUS },
         },
 };
 
-static const struct chromeos_laptop cr48 = {
+static struct chromeos_laptop cr48 = {
         .i2c_peripherals = {
                 /* Light Sensor. */
                 { .add = setup_tsl2563_als, I2C_ADAPTER_SMBUS },
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 9a8f96465cdc..51ebc5a6053f 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -105,31 +105,45 @@ config ASUS_LAPTOP
 
           If you have an ACPI-compatible ASUS laptop, say Y or M here.
 
+#
+# The DELL_SMBIOS driver depends on ACPI_WMI and/or DCDBAS if those
+# backends are selected. The "depends" line prevents a configuration
+# where DELL_SMBIOS=y while either of those dependencies =m.
+#
 config DELL_SMBIOS
-        tristate
+        tristate "Dell SMBIOS driver"
+        depends on DCDBAS || DCDBAS=n
+        depends on ACPI_WMI || ACPI_WMI=n
+        ---help---
+        This provides support for the Dell SMBIOS calling interface.
+        If you have a Dell computer you should enable this option.
+
+        Be sure to select at least one backend for it to work properly.
 
 config DELL_SMBIOS_WMI
-        tristate "Dell SMBIOS calling interface (WMI implementation)"
+        bool "Dell SMBIOS driver WMI backend"
+        default y
         depends on ACPI_WMI
         select DELL_WMI_DESCRIPTOR
-        select DELL_SMBIOS
+        depends on DELL_SMBIOS
         ---help---
         This provides an implementation for the Dell SMBIOS calling interface
         communicated over ACPI-WMI.
 
-        If you have a Dell computer from >2007 you should say Y or M here.
+        If you have a Dell computer from >2007 you should say Y here.
         If you aren't sure and this module doesn't work for your computer
         it just won't load.
 
 config DELL_SMBIOS_SMM
-        tristate "Dell SMBIOS calling interface (SMM implementation)"
+        bool "Dell SMBIOS driver SMM backend"
+        default y
         depends on DCDBAS
-        select DELL_SMBIOS
+        depends on DELL_SMBIOS
         ---help---
         This provides an implementation for the Dell SMBIOS calling interface
         communicated over SMI/SMM.
 
-        If you have a Dell computer from <=2017 you should say Y or M here.
+        If you have a Dell computer from <=2017 you should say Y here.
         If you aren't sure and this module doesn't work for your computer
         it just won't load.
 
diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile
index c388608ad2a3..2ba6cb795338 100644
--- a/drivers/platform/x86/Makefile
+++ b/drivers/platform/x86/Makefile
@@ -13,8 +13,9 @@ obj-$(CONFIG_MSI_LAPTOP)	+= msi-laptop.o
 obj-$(CONFIG_ACPI_CMPC)         += classmate-laptop.o
 obj-$(CONFIG_COMPAL_LAPTOP)     += compal-laptop.o
 obj-$(CONFIG_DELL_SMBIOS)       += dell-smbios.o
-obj-$(CONFIG_DELL_SMBIOS_WMI)   += dell-smbios-wmi.o
-obj-$(CONFIG_DELL_SMBIOS_SMM)   += dell-smbios-smm.o
+dell-smbios-objs                := dell-smbios-base.o
+dell-smbios-$(CONFIG_DELL_SMBIOS_WMI)   += dell-smbios-wmi.o
+dell-smbios-$(CONFIG_DELL_SMBIOS_SMM)   += dell-smbios-smm.o
 obj-$(CONFIG_DELL_LAPTOP)       += dell-laptop.o
 obj-$(CONFIG_DELL_WMI)          += dell-wmi.o
 obj-$(CONFIG_DELL_WMI_DESCRIPTOR)       += dell-wmi-descriptor.o
diff --git a/drivers/platform/x86/dell-smbios.c b/drivers/platform/x86/dell-smbios-base.c
index 8541cde4cb7d..2485c80a9fdd 100644
--- a/drivers/platform/x86/dell-smbios.c
+++ b/drivers/platform/x86/dell-smbios-base.c
@@ -36,7 +36,7 @@ static DEFINE_MUTEX(smbios_mutex);
 struct smbios_device {
         struct list_head list;
         struct device *device;
-        int (*call_fn)(struct calling_interface_buffer *);
+        int (*call_fn)(struct calling_interface_buffer *arg);
 };
 
 struct smbios_call {
@@ -352,8 +352,10 @@ static void __init parse_da_table(const struct dmi_header *dm)
         struct calling_interface_structure *table =
                 container_of(dm, struct calling_interface_structure, header);
 
-        /* 4 bytes of table header, plus 7 bytes of Dell header, plus at least
-           6 bytes of entry */
+        /*
+         * 4 bytes of table header, plus 7 bytes of Dell header
+         * plus at least 6 bytes of entry
+         */
 
         if (dm->length < 17)
                 return;
@@ -554,7 +556,7 @@ static void free_group(struct platform_device *pdev)
 static int __init dell_smbios_init(void)
 {
         const struct dmi_device *valid;
-        int ret;
+        int ret, wmi, smm;
 
         valid = dmi_find_device(DMI_DEV_TYPE_OEM_STRING, "Dell System", NULL);
         if (!valid) {
@@ -589,8 +591,24 @@ static int __init dell_smbios_init(void)
         if (ret)
                 goto fail_create_group;
 
+        /* register backends */
+        wmi = init_dell_smbios_wmi();
+        if (wmi)
+                pr_debug("Failed to initialize WMI backend: %d\n", wmi);
+        smm = init_dell_smbios_smm();
+        if (smm)
+                pr_debug("Failed to initialize SMM backend: %d\n", smm);
+        if (wmi && smm) {
+                pr_err("No SMBIOS backends available (wmi: %d, smm: %d)\n",
+                        wmi, smm);
+                goto fail_sysfs;
+        }
+
         return 0;
 
+fail_sysfs:
+        free_group(platform_device);
+
 fail_create_group:
         platform_device_del(platform_device);
 
@@ -607,6 +625,8 @@ fail_platform_driver:
 
 static void __exit dell_smbios_exit(void)
 {
+        exit_dell_smbios_wmi();
+        exit_dell_smbios_smm();
         mutex_lock(&smbios_mutex);
         if (platform_device) {
                 free_group(platform_device);
@@ -617,11 +637,12 @@ static void __exit dell_smbios_exit(void)
         mutex_unlock(&smbios_mutex);
 }
 
-subsys_initcall(dell_smbios_init);
+module_init(dell_smbios_init);
 module_exit(dell_smbios_exit);
 
 MODULE_AUTHOR("Matthew Garrett <mjg@redhat.com>");
 MODULE_AUTHOR("Gabriele Mazzotta <gabriele.mzt@gmail.com>");
 MODULE_AUTHOR("Pali Rohár <pali.rohar@gmail.com>");
+MODULE_AUTHOR("Mario Limonciello <mario.limonciello@dell.com>");
 MODULE_DESCRIPTION("Common functions for kernel modules using Dell SMBIOS");
 MODULE_LICENSE("GPL");
diff --git a/drivers/platform/x86/dell-smbios-smm.c b/drivers/platform/x86/dell-smbios-smm.c
index 89f65c4651a0..e9e9da556318 100644
--- a/drivers/platform/x86/dell-smbios-smm.c
+++ b/drivers/platform/x86/dell-smbios-smm.c
@@ -58,7 +58,7 @@ static const struct dmi_system_id dell_device_table[] __initconst = {
 };
 MODULE_DEVICE_TABLE(dmi, dell_device_table);
 
-static void __init parse_da_table(const struct dmi_header *dm)
+static void parse_da_table(const struct dmi_header *dm)
 {
         struct calling_interface_structure *table =
                 container_of(dm, struct calling_interface_structure, header);
@@ -73,7 +73,7 @@ static void __init parse_da_table(const struct dmi_header *dm)
         da_command_code = table->cmdIOCode;
 }
 
-static void __init find_cmd_address(const struct dmi_header *dm, void *dummy)
+static void find_cmd_address(const struct dmi_header *dm, void *dummy)
 {
         switch (dm->type) {
         case 0xda: /* Calling interface */
@@ -128,7 +128,7 @@ static bool test_wsmt_enabled(void)
         return false;
 }
 
-static int __init dell_smbios_smm_init(void)
+int init_dell_smbios_smm(void)
 {
         int ret;
         /*
@@ -176,7 +176,7 @@ fail_platform_device_alloc:
         return ret;
 }
 
-static void __exit dell_smbios_smm_exit(void)
+void exit_dell_smbios_smm(void)
 {
         if (platform_device) {
                 dell_smbios_unregister_device(&platform_device->dev);
@@ -184,13 +184,3 @@ static void __exit dell_smbios_smm_exit(void)
                 free_page((unsigned long)buffer);
         }
 }
-
-subsys_initcall(dell_smbios_smm_init);
-module_exit(dell_smbios_smm_exit);
-
-MODULE_AUTHOR("Matthew Garrett <mjg@redhat.com>");
-MODULE_AUTHOR("Gabriele Mazzotta <gabriele.mzt@gmail.com>");
-MODULE_AUTHOR("Pali Rohár <pali.rohar@gmail.com>");
-MODULE_AUTHOR("Mario Limonciello <mario.limonciello@dell.com>");
-MODULE_DESCRIPTION("Dell SMBIOS communications over SMI");
-MODULE_LICENSE("GPL");
diff --git a/drivers/platform/x86/dell-smbios-wmi.c b/drivers/platform/x86/dell-smbios-wmi.c
index 609557aa5868..fbefedb1c172 100644
--- a/drivers/platform/x86/dell-smbios-wmi.c
+++ b/drivers/platform/x86/dell-smbios-wmi.c
@@ -228,7 +228,7 @@ static const struct wmi_device_id dell_smbios_wmi_id_table[] = {
         { },
 };
 
-static void __init parse_b1_table(const struct dmi_header *dm)
+static void parse_b1_table(const struct dmi_header *dm)
 {
         struct misc_bios_flags_structure *flags =
         container_of(dm, struct misc_bios_flags_structure, header);
@@ -242,7 +242,7 @@ static void __init parse_b1_table(const struct dmi_header *dm)
                 wmi_supported = 1;
 }
 
-static void __init find_b1(const struct dmi_header *dm, void *dummy)
+static void find_b1(const struct dmi_header *dm, void *dummy)
 {
         switch (dm->type) {
         case 0xb1: /* misc bios flags */
@@ -261,7 +261,7 @@ static struct wmi_driver dell_smbios_wmi_driver = {
         .filter_callback = dell_smbios_wmi_filter,
 };
 
-static int __init init_dell_smbios_wmi(void)
+int init_dell_smbios_wmi(void)
 {
         dmi_walk(find_b1, NULL);
 
@@ -271,15 +271,9 @@ static int __init init_dell_smbios_wmi(void)
         return wmi_driver_register(&dell_smbios_wmi_driver);
 }
 
-static void __exit exit_dell_smbios_wmi(void)
+void exit_dell_smbios_wmi(void)
 {
         wmi_driver_unregister(&dell_smbios_wmi_driver);
 }
 
-module_init(init_dell_smbios_wmi);
-module_exit(exit_dell_smbios_wmi);
-
 MODULE_ALIAS("wmi:" DELL_WMI_SMBIOS_GUID);
-MODULE_AUTHOR("Mario Limonciello <mario.limonciello@dell.com>");
-MODULE_DESCRIPTION("Dell SMBIOS communications over WMI");
-MODULE_LICENSE("GPL");
diff --git a/drivers/platform/x86/dell-smbios.h b/drivers/platform/x86/dell-smbios.h
index 138d478d9adc..d8adaf959740 100644
--- a/drivers/platform/x86/dell-smbios.h
+++ b/drivers/platform/x86/dell-smbios.h
@@ -75,4 +75,29 @@ int dell_laptop_register_notifier(struct notifier_block *nb);
 int dell_laptop_unregister_notifier(struct notifier_block *nb);
 void dell_laptop_call_notifier(unsigned long action, void *data);
 
-#endif
+/* for the supported backends */
+#ifdef CONFIG_DELL_SMBIOS_WMI
+int init_dell_smbios_wmi(void);
+void exit_dell_smbios_wmi(void);
+#else /* CONFIG_DELL_SMBIOS_WMI */
+static inline int init_dell_smbios_wmi(void)
+{
+        return -ENODEV;
+}
+static inline void exit_dell_smbios_wmi(void)
+{}
+#endif /* CONFIG_DELL_SMBIOS_WMI */
+
+#ifdef CONFIG_DELL_SMBIOS_SMM
+int init_dell_smbios_smm(void);
+void exit_dell_smbios_smm(void);
+#else /* CONFIG_DELL_SMBIOS_SMM */
+static inline int init_dell_smbios_smm(void)
+{
+        return -ENODEV;
+}
+static inline void exit_dell_smbios_smm(void)
+{}
+#endif /* CONFIG_DELL_SMBIOS_SMM */
+
+#endif /* _DELL_SMBIOS_H_ */
diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
index 2c9927430d85..8d102195a392 100644
--- a/drivers/platform/x86/dell-wmi.c
+++ b/drivers/platform/x86/dell-wmi.c
@@ -714,7 +714,7 @@ static int __init dell_wmi_init(void)
 
         return wmi_driver_register(&dell_wmi_driver);
 }
-module_init(dell_wmi_init);
+late_initcall(dell_wmi_init);
 
 static void __exit dell_wmi_exit(void)
 {
diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c
index d1a01311c1a2..5e3df194723e 100644
--- a/drivers/platform/x86/intel-hid.c
+++ b/drivers/platform/x86/intel-hid.c
@@ -376,6 +376,7 @@ static int intel_hid_remove(struct platform_device *device)
 {
         acpi_handle handle = ACPI_HANDLE(&device->dev);
 
+        device_init_wakeup(&device->dev, false);
         acpi_remove_notify_handler(handle, ACPI_DEVICE_NOTIFY, notify_handler);
         intel_hid_set_enable(&device->dev, false);
         intel_button_array_enable(&device->dev, false);
diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c
index b703d6f5b099..c13780b8dabb 100644
--- a/drivers/platform/x86/intel-vbtn.c
+++ b/drivers/platform/x86/intel-vbtn.c
@@ -7,6 +7,7 @@
  */
 
 #include <linux/acpi.h>
+#include <linux/dmi.h>
 #include <linux/input.h>
 #include <linux/input/sparse-keymap.h>
 #include <linux/kernel.h>
@@ -97,9 +98,35 @@ out_unknown:
         dev_dbg(&device->dev, "unknown event index 0x%x\n", event);
 }
 
-static int intel_vbtn_probe(struct platform_device *device)
+static void detect_tablet_mode(struct platform_device *device)
 {
+        const char *chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE);
+        struct intel_vbtn_priv *priv = dev_get_drvdata(&device->dev);
+        acpi_handle handle = ACPI_HANDLE(&device->dev);
         struct acpi_buffer vgbs_output = { ACPI_ALLOCATE_BUFFER, NULL };
+        union acpi_object *obj;
+        acpi_status status;
+        int m;
+
+        if (!(chassis_type && strcmp(chassis_type, "31") == 0))
+                goto out;
+
+        status = acpi_evaluate_object(handle, "VGBS", NULL, &vgbs_output);
+        if (ACPI_FAILURE(status))
+                goto out;
+
+        obj = vgbs_output.pointer;
+        if (!(obj && obj->type == ACPI_TYPE_INTEGER))
+                goto out;
+
+        m = !(obj->integer.value & TABLET_MODE_FLAG);
+        input_report_switch(priv->input_dev, SW_TABLET_MODE, m);
+out:
+        kfree(vgbs_output.pointer);
+}
+
+static int intel_vbtn_probe(struct platform_device *device)
+{
         acpi_handle handle = ACPI_HANDLE(&device->dev);
         struct intel_vbtn_priv *priv;
         acpi_status status;
@@ -122,22 +149,7 @@ static int intel_vbtn_probe(struct platform_device *device)
                 return err;
         }
 
-        /*
-         * VGBS being present and returning something means we have
-         * a tablet mode switch.
-         */
-        status = acpi_evaluate_object(handle, "VGBS", NULL, &vgbs_output);
-        if (ACPI_SUCCESS(status)) {
-                union acpi_object *obj = vgbs_output.pointer;
-
-                if (obj && obj->type == ACPI_TYPE_INTEGER) {
-                        int m = !(obj->integer.value & TABLET_MODE_FLAG);
-
-                        input_report_switch(priv->input_dev, SW_TABLET_MODE, m);
-                }
-        }
-
-        kfree(vgbs_output.pointer);
+        detect_tablet_mode(device);
 
         status = acpi_install_notify_handler(handle,
                                              ACPI_DEVICE_NOTIFY,
@@ -154,6 +166,7 @@ static int intel_vbtn_remove(struct platform_device *device)
 {
         acpi_handle handle = ACPI_HANDLE(&device->dev);
 
+        device_init_wakeup(&device->dev, false);
         acpi_remove_notify_handler(handle, ACPI_DEVICE_NOTIFY, notify_handler);
 
         /*
diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index c0c8945603cb..8796211ef24a 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -945,7 +945,7 @@ static int wmi_dev_probe(struct device *dev)
                 wblock->char_dev.mode = 0444;
                 ret = misc_register(&wblock->char_dev);
                 if (ret) {
-                        dev_warn(dev, "failed to register char dev: %d", ret);
+                        dev_warn(dev, "failed to register char dev: %d\n", ret);
                         ret = -ENOMEM;
                         goto probe_misc_failure;
                 }
@@ -1048,7 +1048,7 @@ static int wmi_create_device(struct device *wmi_bus_dev,
 
         if (result) {
                 dev_warn(wmi_bus_dev,
-                         "%s data block query control method not found",
+                         "%s data block query control method not found\n",
                          method);
                 return result;
         }
@@ -1198,7 +1198,7 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device)
 
                 retval = device_add(&wblock->dev.dev);
                 if (retval) {
-                        dev_err(wmi_bus_dev, "failed to register %pULL\n",
+                        dev_err(wmi_bus_dev, "failed to register %pUL\n",
                                 wblock->gblock.guid);
                         if (debug_event)
                                 wmi_method_enable(wblock, 0);
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index dd4708c58480..1fc0c0811da4 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -4310,7 +4310,7 @@ static int _regulator_resume_early(struct device *dev, void *data)
 
         rstate = regulator_get_suspend_state(rdev, *state);
         if (rstate == NULL)
-                return -EINVAL;
+                return 0;
 
         mutex_lock(&rdev->mutex);
 
diff --git a/drivers/regulator/stm32-vrefbuf.c b/drivers/regulator/stm32-vrefbuf.c
index 72c8b3e1022b..e0a9c445ed67 100644
--- a/drivers/regulator/stm32-vrefbuf.c
+++ b/drivers/regulator/stm32-vrefbuf.c
@@ -51,7 +51,7 @@ static int stm32_vrefbuf_enable(struct regulator_dev *rdev)
          * arbitrary timeout.
          */
         ret = readl_poll_timeout(priv->base + STM32_VREFBUF_CSR, val,
-                                 !(val & STM32_VRR), 650, 10000);
+                                 val & STM32_VRR, 650, 10000);
         if (ret) {
                 dev_err(&rdev->dev, "stm32 vrefbuf timed out!\n");
                 val = readl_relaxed(priv->base + STM32_VREFBUF_CSR);
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index a7c15f0085e2..ecef8e73d40b 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -2581,8 +2581,6 @@ int dasd_cancel_req(struct dasd_ccw_req *cqr)
         case DASD_CQR_QUEUED:
                 /* request was not started - just set to cleared */
                 cqr->status = DASD_CQR_CLEARED;
-                if (cqr->callback_data == DASD_SLEEPON_START_TAG)
-                        cqr->callback_data = DASD_SLEEPON_END_TAG;
                 break;
         case DASD_CQR_IN_IO:
                 /* request in IO - terminate IO and release again */
@@ -3902,9 +3900,12 @@ static int dasd_generic_requeue_all_requests(struct dasd_device *device)
                 wait_event(dasd_flush_wq,
                            (cqr->status != DASD_CQR_CLEAR_PENDING));
 
-                /* mark sleepon requests as ended */
-                if (cqr->callback_data == DASD_SLEEPON_START_TAG)
-                        cqr->callback_data = DASD_SLEEPON_END_TAG;
+                /*
+                 * requeue requests to blocklayer will only work
+                 * for block device requests
+                 */
+                if (_dasd_requeue_request(cqr))
+                        continue;
 
                 /* remove requests from device and block queue */
                 list_del_init(&cqr->devlist);
@@ -3917,13 +3918,6 @@ static int dasd_generic_requeue_all_requests(struct dasd_device *device)
                         cqr = refers;
                 }
 
-                /*
-                 * requeue requests to blocklayer will only work
-                 * for block device requests
-                 */
-                if (_dasd_requeue_request(cqr))
-                        continue;
-
                 if (cqr->block)
                         list_del_init(&cqr->blocklist);
                 cqr->block->base->discipline->free_cp(
@@ -3940,8 +3934,7 @@ static int dasd_generic_requeue_all_requests(struct dasd_device *device)
                 list_splice_tail(&requeue_queue, &device->ccw_queue);
                 spin_unlock_irq(get_ccwdev_lock(device->cdev));
         }
-        /* wake up generic waitqueue for eventually ended sleepon requests */
-        wake_up(&generic_waitq);
+        dasd_schedule_device_bh(device);
         return rc;
 }
 
diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c
index 1319122e9d12..9169af7dbb43 100644
--- a/drivers/s390/cio/device_fsm.c
+++ b/drivers/s390/cio/device_fsm.c
@@ -795,6 +795,7 @@ ccw_device_online_timeout(struct ccw_device *cdev, enum dev_event dev_event)
 
         ccw_device_set_timeout(cdev, 0);
         cdev->private->iretry = 255;
+        cdev->private->async_kill_io_rc = -ETIMEDOUT;
         ret = ccw_device_cancel_halt_clear(cdev);
         if (ret == -EBUSY) {
                 ccw_device_set_timeout(cdev, 3*HZ);
@@ -871,7 +872,7 @@ ccw_device_killing_irq(struct ccw_device *cdev, enum dev_event dev_event)
         /* OK, i/o is dead now. Call interrupt handler. */
         if (cdev->handler)
                 cdev->handler(cdev, cdev->private->intparm,
-                              ERR_PTR(-EIO));
+                              ERR_PTR(cdev->private->async_kill_io_rc));
 }
 
 static void
@@ -888,14 +889,16 @@ ccw_device_killing_timeout(struct ccw_device *cdev, enum dev_event dev_event)
         ccw_device_online_verify(cdev, 0);
         if (cdev->handler)
                 cdev->handler(cdev, cdev->private->intparm,
-                              ERR_PTR(-EIO));
+                              ERR_PTR(cdev->private->async_kill_io_rc));
 }
 
 void ccw_device_kill_io(struct ccw_device *cdev)
 {
         int ret;
 
+        ccw_device_set_timeout(cdev, 0);
         cdev->private->iretry = 255;
+        cdev->private->async_kill_io_rc = -EIO;
         ret = ccw_device_cancel_halt_clear(cdev);
         if (ret == -EBUSY) {
                 ccw_device_set_timeout(cdev, 3*HZ);
diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c
index 1caf6a398760..75ce12a24dc2 100644
--- a/drivers/s390/cio/device_ops.c
+++ b/drivers/s390/cio/device_ops.c
@@ -159,7 +159,7 @@ int ccw_device_clear(struct ccw_device *cdev, unsigned long intparm)
 }
 
 /**
- * ccw_device_start_key() - start a s390 channel program with key
+ * ccw_device_start_timeout_key() - start a s390 channel program with timeout and key
  * @cdev: target ccw device
  * @cpa: logical start address of channel program
  * @intparm: user specific interruption parameter; will be presented back to
@@ -170,10 +170,15 @@ int ccw_device_clear(struct ccw_device *cdev, unsigned long intparm)
  * @key: storage key to be used for the I/O
  * @flags: additional flags; defines the action to be performed for I/O
  *         processing.
+ * @expires: timeout value in jiffies
  *
  * Start a S/390 channel program. When the interrupt arrives, the
  * IRQ handler is called, either immediately, delayed (dev-end missing,
  * or sense required) or never (no IRQ handler registered).
+ * This function notifies the device driver if the channel program has not
+ * completed during the time specified by @expires. If a timeout occurs, the
+ * channel program is terminated via xsch, hsch or csch, and the device's
+ * interrupt handler will be called with an irb containing ERR_PTR(-%ETIMEDOUT).
  * Returns:
  *  %0, if the operation was successful;
  *  -%EBUSY, if the device is busy, or status pending;
@@ -182,9 +187,9 @@ int ccw_device_clear(struct ccw_device *cdev, unsigned long intparm)
  * Context:
  *  Interrupts disabled, ccw device lock held
  */
-int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
-                         unsigned long intparm, __u8 lpm, __u8 key,
-                         unsigned long flags)
+int ccw_device_start_timeout_key(struct ccw_device *cdev, struct ccw1 *cpa,
+                                 unsigned long intparm, __u8 lpm, __u8 key,
+                                 unsigned long flags, int expires)
 {
         struct subchannel *sch;
         int ret;
@@ -224,6 +229,8 @@ int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
         switch (ret) {
         case 0:
                 cdev->private->intparm = intparm;
+                if (expires)
+                        ccw_device_set_timeout(cdev, expires);
                 break;
         case -EACCES:
         case -ENODEV:
@@ -234,7 +241,7 @@ int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
 }
 
 /**
- * ccw_device_start_timeout_key() - start a s390 channel program with timeout and key
+ * ccw_device_start_key() - start a s390 channel program with key
  * @cdev: target ccw device
  * @cpa: logical start address of channel program
  * @intparm: user specific interruption parameter; will be presented back to
@@ -245,15 +252,10 @@ int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
  * @key: storage key to be used for the I/O
  * @flags: additional flags; defines the action to be performed for I/O
  *         processing.
- * @expires: timeout value in jiffies
  *
  * Start a S/390 channel program. When the interrupt arrives, the
  * IRQ handler is called, either immediately, delayed (dev-end missing,
  * or sense required) or never (no IRQ handler registered).
- * This function notifies the device driver if the channel program has not
- * completed during the time specified by @expires. If a timeout occurs, the
- * channel program is terminated via xsch, hsch or csch, and the device's
- * interrupt handler will be called with an irb containing ERR_PTR(-%ETIMEDOUT).
  * Returns:
  *  %0, if the operation was successful;
  *  -%EBUSY, if the device is busy, or status pending;
@@ -262,19 +264,12 @@ int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
  * Context:
  *  Interrupts disabled, ccw device lock held
  */
-int ccw_device_start_timeout_key(struct ccw_device *cdev, struct ccw1 *cpa,
-                                 unsigned long intparm, __u8 lpm, __u8 key,
-                                 unsigned long flags, int expires)
+int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
+                         unsigned long intparm, __u8 lpm, __u8 key,
+                         unsigned long flags)
 {
-        int ret;
-
-        if (!cdev)
-                return -ENODEV;
-        ccw_device_set_timeout(cdev, expires);
-        ret = ccw_device_start_key(cdev, cpa, intparm, lpm, key, flags);
-        if (ret != 0)
-                ccw_device_set_timeout(cdev, 0);
-        return ret;
+        return ccw_device_start_timeout_key(cdev, cpa, intparm, lpm, key,
+                                            flags, 0);
 }
 
 /**
@@ -489,18 +484,20 @@ void ccw_device_get_id(struct ccw_device *cdev, struct ccw_dev_id *dev_id)
 EXPORT_SYMBOL(ccw_device_get_id);
 
 /**
- * ccw_device_tm_start_key() - perform start function
+ * ccw_device_tm_start_timeout_key() - perform start function
  * @cdev: ccw device on which to perform the start function
  * @tcw: transport-command word to be started
  * @intparm: user defined parameter to be passed to the interrupt handler
  * @lpm: mask of paths to use
  * @key: storage key to use for storage access
+ * @expires: time span in jiffies after which to abort request
  *
  * Start the tcw on the given ccw device. Return zero on success, non-zero
  * otherwise.
  */
-int ccw_device_tm_start_key(struct ccw_device *cdev, struct tcw *tcw,
-                            unsigned long intparm, u8 lpm, u8 key)
+int ccw_device_tm_start_timeout_key(struct ccw_device *cdev, struct tcw *tcw,
+                                    unsigned long intparm, u8 lpm, u8 key,
+                                    int expires)
 {
         struct subchannel *sch;
         int rc;
@@ -527,37 +524,32 @@ int ccw_device_tm_start_key(struct ccw_device *cdev, struct tcw *tcw,
                         return -EACCES;
         }
         rc = cio_tm_start_key(sch, tcw, lpm, key);
-        if (rc == 0)
+        if (rc == 0) {
                 cdev->private->intparm = intparm;
+                if (expires)
+                        ccw_device_set_timeout(cdev, expires);
+        }
         return rc;
 }
-EXPORT_SYMBOL(ccw_device_tm_start_key);
+EXPORT_SYMBOL(ccw_device_tm_start_timeout_key);
 
 /**
- * ccw_device_tm_start_timeout_key() - perform start function
+ * ccw_device_tm_start_key() - perform start function
  * @cdev: ccw device on which to perform the start function
  * @tcw: transport-command word to be started
  * @intparm: user defined parameter to be passed to the interrupt handler
  * @lpm: mask of paths to use
  * @key: storage key to use for storage access
- * @expires: time span in jiffies after which to abort request
  *
  * Start the tcw on the given ccw device. Return zero on success, non-zero
  * otherwise.
  */
-int ccw_device_tm_start_timeout_key(struct ccw_device *cdev, struct tcw *tcw,
-                                    unsigned long intparm, u8 lpm, u8 key,
-                                    int expires)
+int ccw_device_tm_start_key(struct ccw_device *cdev, struct tcw *tcw,
+                            unsigned long intparm, u8 lpm, u8 key)
 {
-        int ret;
-
-        ccw_device_set_timeout(cdev, expires);
-        ret = ccw_device_tm_start_key(cdev, tcw, intparm, lpm, key);
-        if (ret != 0)
-                ccw_device_set_timeout(cdev, 0);
-        return ret;
+        return ccw_device_tm_start_timeout_key(cdev, tcw, intparm, lpm, key, 0);
 }
-EXPORT_SYMBOL(ccw_device_tm_start_timeout_key);
+EXPORT_SYMBOL(ccw_device_tm_start_key);
 
 /**
  * ccw_device_tm_start() - perform start function
diff --git a/drivers/s390/cio/io_sch.h b/drivers/s390/cio/io_sch.h
index af571d8d6925..90e4e3a7841b 100644
--- a/drivers/s390/cio/io_sch.h
+++ b/drivers/s390/cio/io_sch.h
@@ -157,6 +157,7 @@ struct ccw_device_private {
         unsigned long intparm;  /* user interruption parameter */
         struct qdio_irq *qdio_data;
         struct irb irb;         /* device status */
+        int async_kill_io_rc;
         struct senseid senseid; /* SenseID info */
         struct pgid pgid[8];    /* path group IDs per chpid*/
         struct ccw1 iccws[2];   /* ccws for SNID/SID/SPGID commands */
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index ca72f3311004..c8b308cfabf1 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -2134,24 +2134,25 @@ int qeth_send_control_data(struct qeth_card *card, int len,
         }
         reply->callback = reply_cb;
         reply->param = reply_param;
-        if (card->state == CARD_STATE_DOWN)
-                reply->seqno = QETH_IDX_COMMAND_SEQNO;
-        else
-                reply->seqno = card->seqno.ipa++;
+
         init_waitqueue_head(&reply->wait_q);
-        spin_lock_irqsave(&card->lock, flags);
-        list_add_tail(&reply->list, &card->cmd_waiter_list);
-        spin_unlock_irqrestore(&card->lock, flags);
 
         while (atomic_cmpxchg(&card->write.irq_pending, 0, 1)) ;
-        qeth_prepare_control_data(card, len, iob);
 
         if (IS_IPA(iob->data)) {
                 cmd = __ipa_cmd(iob);
+                cmd->hdr.seqno = card->seqno.ipa++;
+                reply->seqno = cmd->hdr.seqno;
                 event_timeout = QETH_IPA_TIMEOUT;
         } else {
+                reply->seqno = QETH_IDX_COMMAND_SEQNO;
                 event_timeout = QETH_TIMEOUT;
         }
+        qeth_prepare_control_data(card, len, iob);
+
+        spin_lock_irqsave(&card->lock, flags);
+        list_add_tail(&reply->list, &card->cmd_waiter_list);
+        spin_unlock_irqrestore(&card->lock, flags);
 
         timeout = jiffies + event_timeout;
 
@@ -2933,7 +2934,7 @@ static void qeth_fill_ipacmd_header(struct qeth_card *card,
         memset(cmd, 0, sizeof(struct qeth_ipa_cmd));
         cmd->hdr.command = command;
         cmd->hdr.initiator = IPA_CMD_INITIATOR_HOST;
-        cmd->hdr.seqno = card->seqno.ipa;
+        /* cmd->hdr.seqno is set by qeth_send_control_data() */
         cmd->hdr.adapter_type = qeth_get_ipa_adp_type(card->info.link_type);
         cmd->hdr.rel_adapter_no = (__u8) card->info.portno;
         if (card->options.layer2)
@@ -3898,10 +3899,12 @@ EXPORT_SYMBOL_GPL(qeth_get_elements_for_frags);
 int qeth_get_elements_no(struct qeth_card *card,
                      struct sk_buff *skb, int extra_elems, int data_offset)
 {
-        int elements = qeth_get_elements_for_range(
-                                (addr_t)skb->data + data_offset,
-                                (addr_t)skb->data + skb_headlen(skb)) +
-                        qeth_get_elements_for_frags(skb);
+        addr_t end = (addr_t)skb->data + skb_headlen(skb);
+        int elements = qeth_get_elements_for_frags(skb);
+        addr_t start = (addr_t)skb->data + data_offset;
+
+        if (start != end)
+                elements += qeth_get_elements_for_range(start, end);
 
         if ((elements + extra_elems) > QETH_MAX_BUFFER_ELEMENTS(card)) {
                 QETH_DBF_MESSAGE(2, "Invalid size of IP packet "
diff --git a/drivers/s390/net/qeth_l3.h b/drivers/s390/net/qeth_l3.h
index bdd45f4dcace..498fe9af2cdb 100644
--- a/drivers/s390/net/qeth_l3.h
+++ b/drivers/s390/net/qeth_l3.h
@@ -40,8 +40,40 @@ struct qeth_ipaddr {
                         unsigned int pfxlen;
                 } a6;
         } u;
-
 };
+
+static inline bool qeth_l3_addr_match_ip(struct qeth_ipaddr *a1,
+                                         struct qeth_ipaddr *a2)
+{
+        if (a1->proto != a2->proto)
+                return false;
+        if (a1->proto == QETH_PROT_IPV6)
+                return ipv6_addr_equal(&a1->u.a6.addr, &a2->u.a6.addr);
+        return a1->u.a4.addr == a2->u.a4.addr;
+}
+
+static inline bool qeth_l3_addr_match_all(struct qeth_ipaddr *a1,
+                                          struct qeth_ipaddr *a2)
+{
+        /* Assumes that the pair was obtained via qeth_l3_addr_find_by_ip(),
+         * so 'proto' and 'addr' match for sure.
+         *
+         * For ucast:
+         * -    'mac' is always 0.
+         * -    'mask'/'pfxlen' for RXIP/VIPA is always 0. For NORMAL, matching
+         *      values are required to avoid mixups in takeover eligibility.
+         *
+         * For mcast,
+         * -    'mac' is mapped from the IP, and thus always matches.
+         * -    'mask'/'pfxlen' is always 0.
+         */
+        if (a1->type != a2->type)
+                return false;
+        if (a1->proto == QETH_PROT_IPV6)
+                return a1->u.a6.pfxlen == a2->u.a6.pfxlen;
+        return a1->u.a4.mask == a2->u.a4.mask;
+}
+
 static inline  u64 qeth_l3_ipaddr_hash(struct qeth_ipaddr *addr)
 {
         u64  ret = 0;
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index b0c888e86cd4..962a04b68dd2 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -67,6 +67,24 @@ void qeth_l3_ipaddr_to_string(enum qeth_prot_versions proto, const __u8 *addr,
                 qeth_l3_ipaddr6_to_string(addr, buf);
 }
 
+static struct qeth_ipaddr *qeth_l3_find_addr_by_ip(struct qeth_card *card,
+                                                   struct qeth_ipaddr *query)
+{
+        u64 key = qeth_l3_ipaddr_hash(query);
+        struct qeth_ipaddr *addr;
+
+        if (query->is_multicast) {
+                hash_for_each_possible(card->ip_mc_htable, addr, hnode, key)
+                        if (qeth_l3_addr_match_ip(addr, query))
+                                return addr;
+        } else {
+                hash_for_each_possible(card->ip_htable,  addr, hnode, key)
+                        if (qeth_l3_addr_match_ip(addr, query))
+                                return addr;
+        }
+        return NULL;
+}
+
 static void qeth_l3_convert_addr_to_bits(u8 *addr, u8 *bits, int len)
 {
         int i, j;
@@ -120,34 +138,6 @@ static bool qeth_l3_is_addr_covered_by_ipato(struct qeth_card *card,
         return rc;
 }
 
-inline int
-qeth_l3_ipaddrs_is_equal(struct qeth_ipaddr *addr1, struct qeth_ipaddr *addr2)
-{
-        return addr1->proto == addr2->proto &&
-               !memcmp(&addr1->u, &addr2->u, sizeof(addr1->u)) &&
-               ether_addr_equal_64bits(addr1->mac, addr2->mac);
-}
-
-static struct qeth_ipaddr *
-qeth_l3_ip_from_hash(struct qeth_card *card, struct qeth_ipaddr *tmp_addr)
-{
-        struct qeth_ipaddr *addr;
-
-        if (tmp_addr->is_multicast) {
-                hash_for_each_possible(card->ip_mc_htable,  addr,
-                                hnode, qeth_l3_ipaddr_hash(tmp_addr))
-                        if (qeth_l3_ipaddrs_is_equal(tmp_addr, addr))
-                                return addr;
-        } else {
-                hash_for_each_possible(card->ip_htable,  addr,
-                                hnode, qeth_l3_ipaddr_hash(tmp_addr))
-                        if (qeth_l3_ipaddrs_is_equal(tmp_addr, addr))
-                                return addr;
-        }
-
-        return NULL;
-}
-
 int qeth_l3_delete_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr)
 {
         int rc = 0;
@@ -162,23 +152,18 @@ int qeth_l3_delete_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr)
                 QETH_CARD_HEX(card, 4, ((char *)&tmp_addr->u.a6.addr) + 8, 8);
         }
 
-        addr = qeth_l3_ip_from_hash(card, tmp_addr);
-        if (!addr)
+        addr = qeth_l3_find_addr_by_ip(card, tmp_addr);
+        if (!addr || !qeth_l3_addr_match_all(addr, tmp_addr))
                 return -ENOENT;
 
         addr->ref_counter--;
-        if (addr->ref_counter > 0 && (addr->type == QETH_IP_TYPE_NORMAL ||
-                                      addr->type == QETH_IP_TYPE_RXIP))
+        if (addr->type == QETH_IP_TYPE_NORMAL && addr->ref_counter > 0)
                 return rc;
         if (addr->in_progress)
                 return -EINPROGRESS;
 
-        if (!qeth_card_hw_is_reachable(card)) {
-                addr->disp_flag = QETH_DISP_ADDR_DELETE;
-                return 0;
-        }
-
-        rc = qeth_l3_deregister_addr_entry(card, addr);
+        if (qeth_card_hw_is_reachable(card))
+                rc = qeth_l3_deregister_addr_entry(card, addr);
 
         hash_del(&addr->hnode);
         kfree(addr);
@@ -190,6 +175,7 @@ int qeth_l3_add_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr)
 {
         int rc = 0;
         struct qeth_ipaddr *addr;
+        char buf[40];
 
         QETH_CARD_TEXT(card, 4, "addip");
 
@@ -200,8 +186,20 @@ int qeth_l3_add_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr)
                 QETH_CARD_HEX(card, 4, ((char *)&tmp_addr->u.a6.addr) + 8, 8);
         }
 
-        addr = qeth_l3_ip_from_hash(card, tmp_addr);
-        if (!addr) {
+        addr = qeth_l3_find_addr_by_ip(card, tmp_addr);
+        if (addr) {
+                if (tmp_addr->type != QETH_IP_TYPE_NORMAL)
+                        return -EADDRINUSE;
+                if (qeth_l3_addr_match_all(addr, tmp_addr)) {
+                        addr->ref_counter++;
+                        return 0;
+                }
+                qeth_l3_ipaddr_to_string(tmp_addr->proto, (u8 *)&tmp_addr->u,
+                                         buf);
+                dev_warn(&card->gdev->dev,
+                         "Registering IP address %s failed\n", buf);
+                return -EADDRINUSE;
+        } else {
                 addr = qeth_l3_get_addr_buffer(tmp_addr->proto);
                 if (!addr)
                         return -ENOMEM;
@@ -241,19 +239,15 @@ int qeth_l3_add_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr)
                                 (rc == IPA_RC_LAN_OFFLINE)) {
                         addr->disp_flag = QETH_DISP_ADDR_DO_NOTHING;
                         if (addr->ref_counter < 1) {
-                                qeth_l3_delete_ip(card, addr);
+                                qeth_l3_deregister_addr_entry(card, addr);
+                                hash_del(&addr->hnode);
                                 kfree(addr);
                         }
                 } else {
                         hash_del(&addr->hnode);
                         kfree(addr);
                 }
-        } else {
-                if (addr->type == QETH_IP_TYPE_NORMAL ||
-                    addr->type == QETH_IP_TYPE_RXIP)
-                        addr->ref_counter++;
         }
-
         return rc;
 }
 
@@ -321,11 +315,7 @@ static void qeth_l3_recover_ip(struct qeth_card *card)
         spin_lock_bh(&card->ip_lock);
 
         hash_for_each_safe(card->ip_htable, i, tmp, addr, hnode) {
-                if (addr->disp_flag == QETH_DISP_ADDR_DELETE) {
-                        qeth_l3_deregister_addr_entry(card, addr);
-                        hash_del(&addr->hnode);
-                        kfree(addr);
-                } else if (addr->disp_flag == QETH_DISP_ADDR_ADD) {
+                if (addr->disp_flag == QETH_DISP_ADDR_ADD) {
                         if (addr->proto == QETH_PROT_IPV4) {
                                 addr->in_progress = 1;
                                 spin_unlock_bh(&card->ip_lock);
@@ -643,12 +633,7 @@ int qeth_l3_add_vipa(struct qeth_card *card, enum qeth_prot_versions proto,
                 return -ENOMEM;
 
         spin_lock_bh(&card->ip_lock);
-
-        if (qeth_l3_ip_from_hash(card, ipaddr))
-                rc = -EEXIST;
-        else
-                rc = qeth_l3_add_ip(card, ipaddr);
-
+        rc = qeth_l3_add_ip(card, ipaddr);
         spin_unlock_bh(&card->ip_lock);
 
         kfree(ipaddr);
@@ -713,12 +698,7 @@ int qeth_l3_add_rxip(struct qeth_card *card, enum qeth_prot_versions proto,
                 return -ENOMEM;
 
         spin_lock_bh(&card->ip_lock);
-
-        if (qeth_l3_ip_from_hash(card, ipaddr))
-                rc = -EEXIST;
-        else
-                rc = qeth_l3_add_ip(card, ipaddr);
-
+        rc = qeth_l3_add_ip(card, ipaddr);
         spin_unlock_bh(&card->ip_lock);
 
         kfree(ipaddr);
@@ -1239,8 +1219,9 @@ qeth_l3_add_mc_to_hash(struct qeth_card *card, struct in_device *in4_dev)
                 tmp->u.a4.addr = be32_to_cpu(im4->multiaddr);
                 tmp->is_multicast = 1;
 
-                ipm = qeth_l3_ip_from_hash(card, tmp);
+                ipm = qeth_l3_find_addr_by_ip(card, tmp);
                 if (ipm) {
+                        /* for mcast, by-IP match means full match */
                         ipm->disp_flag = QETH_DISP_ADDR_DO_NOTHING;
                 } else {
                         ipm = qeth_l3_get_addr_buffer(QETH_PROT_IPV4);
@@ -1319,8 +1300,9 @@ static void qeth_l3_add_mc6_to_hash(struct qeth_card *card,
                        sizeof(struct in6_addr));
                 tmp->is_multicast = 1;
 
-                ipm = qeth_l3_ip_from_hash(card, tmp);
+                ipm = qeth_l3_find_addr_by_ip(card, tmp);
                 if (ipm) {
+                        /* for mcast, by-IP match means full match */
                         ipm->disp_flag = QETH_DISP_ADDR_DO_NOTHING;
                         continue;
                 }
@@ -2450,11 +2432,12 @@ static void qeth_tso_fill_header(struct qeth_card *card,
 static int qeth_l3_get_elements_no_tso(struct qeth_card *card,
                         struct sk_buff *skb, int extra_elems)
 {
-        addr_t tcpdptr = (addr_t)tcp_hdr(skb) + tcp_hdrlen(skb);
-        int elements = qeth_get_elements_for_range(
-                                tcpdptr,
-                                (addr_t)skb->data + skb_headlen(skb)) +
-                                qeth_get_elements_for_frags(skb);
+        addr_t start = (addr_t)tcp_hdr(skb) + tcp_hdrlen(skb);
+        addr_t end = (addr_t)skb->data + skb_headlen(skb);
+        int elements = qeth_get_elements_for_frags(skb);
+
+        if (start != end)
+                elements += qeth_get_elements_for_range(start, end);
 
         if ((elements + extra_elems) > QETH_MAX_BUFFER_ELEMENTS(card)) {
                 QETH_DBF_MESSAGE(2,
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index 57bf43e34863..dd9464920456 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -328,8 +328,6 @@ static void scsi_host_dev_release(struct device *dev)
         if (shost->work_q)
                 destroy_workqueue(shost->work_q);
 
-        destroy_rcu_head(&shost->rcu);
-
         if (shost->shost_state == SHOST_CREATED) {
                 /*
                  * Free the shost_dev device name here if scsi_host_alloc()
@@ -404,7 +402,6 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
         INIT_LIST_HEAD(&shost->starved_list);
         init_waitqueue_head(&shost->host_wait);
         mutex_init(&shost->scan_mutex);
-        init_rcu_head(&shost->rcu);
 
         index = ida_simple_get(&host_index_ida, 0, 0, GFP_KERNEL);
         if (index < 0)
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index 073ced07e662..dc8e850fbfd2 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -216,36 +216,30 @@ inline void megasas_return_cmd_fusion(struct megasas_instance *instance,
 /**
  * megasas_fire_cmd_fusion -    Sends command to the FW
  * @instance:                   Adapter soft state
- * @req_desc:                   32bit or 64bit Request descriptor
+ * @req_desc:                   64bit Request descriptor
  *
- * Perform PCI Write. Ventura supports 32 bit Descriptor.
- * Prior to Ventura (12G) MR controller supports 64 bit Descriptor.
+ * Perform PCI Write.
  */
 
 static void
 megasas_fire_cmd_fusion(struct megasas_instance *instance,
                 union MEGASAS_REQUEST_DESCRIPTOR_UNION *req_desc)
 {
-        if (instance->adapter_type == VENTURA_SERIES)
-                writel(le32_to_cpu(req_desc->u.low),
-                        &instance->reg_set->inbound_single_queue_port);
-        else {
 #if defined(writeq) && defined(CONFIG_64BIT)
-                u64 req_data = (((u64)le32_to_cpu(req_desc->u.high) << 32) |
-                                le32_to_cpu(req_desc->u.low));
+        u64 req_data = (((u64)le32_to_cpu(req_desc->u.high) << 32) |
+                le32_to_cpu(req_desc->u.low));
 
-                writeq(req_data, &instance->reg_set->inbound_low_queue_port);
+        writeq(req_data, &instance->reg_set->inbound_low_queue_port);
 #else
-                unsigned long flags;
-                spin_lock_irqsave(&instance->hba_lock, flags);
-                writel(le32_to_cpu(req_desc->u.low),
-                        &instance->reg_set->inbound_low_queue_port);
-                writel(le32_to_cpu(req_desc->u.high),
-                        &instance->reg_set->inbound_high_queue_port);
-                mmiowb();
-                spin_unlock_irqrestore(&instance->hba_lock, flags);
+        unsigned long flags;
+        spin_lock_irqsave(&instance->hba_lock, flags);
+        writel(le32_to_cpu(req_desc->u.low),
+                &instance->reg_set->inbound_low_queue_port);
+        writel(le32_to_cpu(req_desc->u.high),
+                &instance->reg_set->inbound_high_queue_port);
+        mmiowb();
+        spin_unlock_irqrestore(&instance->hba_lock, flags);
 #endif
-        }
 }
 
 /**
@@ -982,7 +976,6 @@ megasas_ioc_init_fusion(struct megasas_instance *instance)
         const char *sys_info;
         MFI_CAPABILITIES *drv_ops;
         u32 scratch_pad_2;
-        unsigned long flags;
         ktime_t time;
         bool cur_fw_64bit_dma_capable;
 
@@ -1121,14 +1114,7 @@ megasas_ioc_init_fusion(struct megasas_instance *instance)
                         break;
         }
 
-        /* For Ventura also IOC INIT required 64 bit Descriptor write. */
-        spin_lock_irqsave(&instance->hba_lock, flags);
-        writel(le32_to_cpu(req_desc.u.low),
-               &instance->reg_set->inbound_low_queue_port);
-        writel(le32_to_cpu(req_desc.u.high),
-               &instance->reg_set->inbound_high_queue_port);
-        mmiowb();
-        spin_unlock_irqrestore(&instance->hba_lock, flags);
+        megasas_fire_cmd_fusion(instance, &req_desc);
 
         wait_and_poll(instance, cmd, MFI_POLL_TIMEOUT_SECS);
 
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 59a87ca328d3..0aafbfd1b746 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -6297,14 +6297,14 @@ _base_reset_handler(struct MPT3SAS_ADAPTER *ioc, int reset_phase)
 }
 
 /**
- * _wait_for_commands_to_complete - reset controller
+ * mpt3sas_wait_for_commands_to_complete - reset controller
  * @ioc: Pointer to MPT_ADAPTER structure
  *
  * This function is waiting 10s for all pending commands to complete
  * prior to putting controller in reset.
  */
-static void
-_wait_for_commands_to_complete(struct MPT3SAS_ADAPTER *ioc)
+void
+mpt3sas_wait_for_commands_to_complete(struct MPT3SAS_ADAPTER *ioc)
 {
         u32 ioc_state;
 
@@ -6377,7 +6377,7 @@ mpt3sas_base_hard_reset_handler(struct MPT3SAS_ADAPTER *ioc,
                         is_fault = 1;
         }
         _base_reset_handler(ioc, MPT3_IOC_PRE_RESET);
-        _wait_for_commands_to_complete(ioc);
+        mpt3sas_wait_for_commands_to_complete(ioc);
         _base_mask_interrupts(ioc);
         r = _base_make_ioc_ready(ioc, type);
         if (r)
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h
index 789bc421424b..99ccf83b8c51 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.h
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.h
@@ -1433,6 +1433,9 @@ void mpt3sas_base_update_missing_delay(struct MPT3SAS_ADAPTER *ioc,
 
 int mpt3sas_port_enable(struct MPT3SAS_ADAPTER *ioc);
 
+void
+mpt3sas_wait_for_commands_to_complete(struct MPT3SAS_ADAPTER *ioc);
+
 
 /* scsih shared API */
 struct scsi_cmnd *mpt3sas_scsih_scsi_lookup_get(struct MPT3SAS_ADAPTER *ioc,
diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 74fca184dba9..a1cb0236c550 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -2835,7 +2835,8 @@ scsih_abort(struct scsi_cmnd *scmd)
         _scsih_tm_display_info(ioc, scmd);
 
         sas_device_priv_data = scmd->device->hostdata;
-        if (!sas_device_priv_data || !sas_device_priv_data->sas_target) {
+        if (!sas_device_priv_data || !sas_device_priv_data->sas_target ||
+            ioc->remove_host) {
                 sdev_printk(KERN_INFO, scmd->device,
                         "device been deleted! scmd(%p)\n", scmd);
                 scmd->result = DID_NO_CONNECT << 16;
@@ -2898,7 +2899,8 @@ scsih_dev_reset(struct scsi_cmnd *scmd)
         _scsih_tm_display_info(ioc, scmd);
 
         sas_device_priv_data = scmd->device->hostdata;
-        if (!sas_device_priv_data || !sas_device_priv_data->sas_target) {
+        if (!sas_device_priv_data || !sas_device_priv_data->sas_target ||
+            ioc->remove_host) {
                 sdev_printk(KERN_INFO, scmd->device,
                         "device been deleted! scmd(%p)\n", scmd);
                 scmd->result = DID_NO_CONNECT << 16;
@@ -2961,7 +2963,8 @@ scsih_target_reset(struct scsi_cmnd *scmd)
         _scsih_tm_display_info(ioc, scmd);
 
         sas_device_priv_data = scmd->device->hostdata;
-        if (!sas_device_priv_data || !sas_device_priv_data->sas_target) {
+        if (!sas_device_priv_data || !sas_device_priv_data->sas_target ||
+            ioc->remove_host) {
                 starget_printk(KERN_INFO, starget, "target been deleted! scmd(%p)\n",
                         scmd);
                 scmd->result = DID_NO_CONNECT << 16;
@@ -3019,7 +3022,7 @@ scsih_host_reset(struct scsi_cmnd *scmd)
             ioc->name, scmd);
         scsi_print_command(scmd);
 
-        if (ioc->is_driver_loading) {
+        if (ioc->is_driver_loading || ioc->remove_host) {
                 pr_info(MPT3SAS_FMT "Blocking the host reset\n",
                     ioc->name);
                 r = FAILED;
@@ -4453,7 +4456,7 @@ _scsih_flush_running_cmds(struct MPT3SAS_ADAPTER *ioc)
                 st = scsi_cmd_priv(scmd);
                 mpt3sas_base_clear_st(ioc, st);
                 scsi_dma_unmap(scmd);
-                if (ioc->pci_error_recovery)
+                if (ioc->pci_error_recovery || ioc->remove_host)
                         scmd->result = DID_NO_CONNECT << 16;
                 else
                         scmd->result = DID_RESET << 16;
@@ -9739,6 +9742,10 @@ static void scsih_remove(struct pci_dev *pdev)
         unsigned long flags;
 
         ioc->remove_host = 1;
+
+        mpt3sas_wait_for_commands_to_complete(ioc);
+        _scsih_flush_running_cmds(ioc);
+
         _scsih_fw_event_cleanup_queue(ioc);
 
         spin_lock_irqsave(&ioc->fw_event_lock, flags);
@@ -9815,6 +9822,10 @@ scsih_shutdown(struct pci_dev *pdev)
         unsigned long flags;
 
         ioc->remove_host = 1;
+
+        mpt3sas_wait_for_commands_to_complete(ioc);
+        _scsih_flush_running_cmds(ioc);
+
         _scsih_fw_event_cleanup_queue(ioc);
 
         spin_lock_irqsave(&ioc->fw_event_lock, flags);
@@ -10547,7 +10558,7 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         snprintf(ioc->firmware_event_name, sizeof(ioc->firmware_event_name),
             "fw_event_%s%d", ioc->driver_name, ioc->id);
         ioc->firmware_event_thread = alloc_ordered_workqueue(
-            ioc->firmware_event_name, WQ_MEM_RECLAIM);
+            ioc->firmware_event_name, 0);
         if (!ioc->firmware_event_thread) {
                 pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n",
                     ioc->name, __FILE__, __LINE__, __func__);
diff --git a/drivers/scsi/qedi/qedi_fw.c b/drivers/scsi/qedi/qedi_fw.c
index 667d7697ba01..d09afe1b567d 100644
--- a/drivers/scsi/qedi/qedi_fw.c
+++ b/drivers/scsi/qedi/qedi_fw.c
@@ -762,6 +762,11 @@ static void qedi_process_cmd_cleanup_resp(struct qedi_ctx *qedi,
 
         iscsi_cid = cqe->conn_id;
         qedi_conn = qedi->cid_que.conn_cid_tbl[iscsi_cid];
+        if (!qedi_conn) {
+                QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
+                          "icid not found 0x%x\n", cqe->conn_id);
+                return;
+        }
 
         /* Based on this itt get the corresponding qedi_cmd */
         spin_lock_bh(&qedi_conn->tmf_work_lock);
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index be7d6824581a..c9689f97c307 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -261,9 +261,9 @@
 struct name_list_extended {
         struct get_name_list_extended *l;
         dma_addr_t              ldma;
-        struct list_head        fcports;        /* protect by sess_list */
+        struct list_head        fcports;
+        spinlock_t              fcports_lock;
         u32                     size;
-        u8                      sent;
 };
 /*
  * Timeout timer counts in seconds
@@ -2217,6 +2217,7 @@ typedef struct {
 
 /* FCP-4 types */
 #define FC4_TYPE_FCP_SCSI       0x08
+#define FC4_TYPE_NVME           0x28
 #define FC4_TYPE_OTHER          0x0
 #define FC4_TYPE_UNKNOWN        0xff
 
diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
index 5bf9a59432f6..403fa096f8c8 100644
--- a/drivers/scsi/qla2xxx/qla_gs.c
+++ b/drivers/scsi/qla2xxx/qla_gs.c
@@ -3179,6 +3179,7 @@ done_free_sp:
         sp->free(sp);
         fcport->flags &= ~FCF_ASYNC_SENT;
 done:
+        fcport->flags &= ~FCF_ASYNC_ACTIVE;
         return rval;
 }
 
@@ -3370,6 +3371,7 @@ done_free_sp:
         sp->free(sp);
         fcport->flags &= ~FCF_ASYNC_SENT;
 done:
+        fcport->flags &= ~FCF_ASYNC_ACTIVE;
         return rval;
 }
 
@@ -3971,6 +3973,9 @@ out:
         spin_lock_irqsave(&vha->work_lock, flags);
         vha->scan.scan_flags &= ~SF_SCANNING;
         spin_unlock_irqrestore(&vha->work_lock, flags);
+
+        if ((fc4type == FC4_TYPE_FCP_SCSI) && vha->flags.nvme_enabled)
+                qla24xx_async_gpnft(vha, FC4_TYPE_NVME);
 }
 
 static void qla2x00_async_gpnft_gnnft_sp_done(void *s, int res)
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 2dea1129d396..00329dda6179 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -213,6 +213,7 @@ done_free_sp:
         sp->free(sp);
         fcport->flags &= ~FCF_ASYNC_SENT;
 done:
+        fcport->flags &= ~FCF_ASYNC_ACTIVE;
         return rval;
 }
 
@@ -263,7 +264,7 @@ qla2x00_async_logout(struct scsi_qla_host *vha, fc_port_t *fcport)
 done_free_sp:
         sp->free(sp);
 done:
-        fcport->flags &= ~FCF_ASYNC_SENT;
+        fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
         return rval;
 }
 
@@ -271,6 +272,7 @@ void
 qla2x00_async_prlo_done(struct scsi_qla_host *vha, fc_port_t *fcport,
     uint16_t *data)
 {
+        fcport->flags &= ~FCF_ASYNC_ACTIVE;
         /* Don't re-login in target mode */
         if (!fcport->tgt_session)
                 qla2x00_mark_device_lost(vha, fcport, 1, 0);
@@ -284,6 +286,7 @@ qla2x00_async_prlo_sp_done(void *s, int res)
         struct srb_iocb *lio = &sp->u.iocb_cmd;
         struct scsi_qla_host *vha = sp->vha;
 
+        sp->fcport->flags &= ~FCF_ASYNC_ACTIVE;
         if (!test_bit(UNLOADING, &vha->dpc_flags))
                 qla2x00_post_async_prlo_done_work(sp->fcport->vha, sp->fcport,
                     lio->u.logio.data);
@@ -322,6 +325,7 @@ qla2x00_async_prlo(struct scsi_qla_host *vha, fc_port_t *fcport)
 done_free_sp:
         sp->free(sp);
 done:
+        fcport->flags &= ~FCF_ASYNC_ACTIVE;
         return rval;
 }
 
@@ -375,6 +379,8 @@ qla2x00_async_adisc_sp_done(void *ptr, int res)
             "Async done-%s res %x %8phC\n",
             sp->name, res, sp->fcport->port_name);
 
+        sp->fcport->flags &= ~FCF_ASYNC_SENT;
+
         memset(&ea, 0, sizeof(ea));
         ea.event = FCME_ADISC_DONE;
         ea.rc = res;
@@ -425,7 +431,7 @@ qla2x00_async_adisc(struct scsi_qla_host *vha, fc_port_t *fcport,
 done_free_sp:
         sp->free(sp);
 done:
-        fcport->flags &= ~FCF_ASYNC_SENT;
+        fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
         qla2x00_post_async_adisc_work(vha, fcport, data);
         return rval;
 }
@@ -643,8 +649,7 @@ qla24xx_async_gnl_sp_done(void *s, int res)
                     (loop_id & 0x7fff));
         }
 
-        spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
-        vha->gnl.sent = 0;
+        spin_lock_irqsave(&vha->gnl.fcports_lock, flags);
 
         INIT_LIST_HEAD(&h);
         fcport = tf = NULL;
@@ -653,12 +658,16 @@ qla24xx_async_gnl_sp_done(void *s, int res)
 
         list_for_each_entry_safe(fcport, tf, &h, gnl_entry) {
                 list_del_init(&fcport->gnl_entry);
+                spin_lock(&vha->hw->tgt.sess_lock);
                 fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
+                spin_unlock(&vha->hw->tgt.sess_lock);
                 ea.fcport = fcport;
 
                 qla2x00_fcport_event_handler(vha, &ea);
         }
+        spin_unlock_irqrestore(&vha->gnl.fcports_lock, flags);
 
+        spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
         /* create new fcport if fw has knowledge of new sessions */
         for (i = 0; i < n; i++) {
                 port_id_t id;
@@ -710,18 +719,21 @@ int qla24xx_async_gnl(struct scsi_qla_host *vha, fc_port_t *fcport)
         ql_dbg(ql_dbg_disc, vha, 0x20d9,
             "Async-gnlist WWPN %8phC \n", fcport->port_name);
 
-        spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
+        spin_lock_irqsave(&vha->gnl.fcports_lock, flags);
+        if (!list_empty(&fcport->gnl_entry)) {
+                spin_unlock_irqrestore(&vha->gnl.fcports_lock, flags);
+                rval = QLA_SUCCESS;
+                goto done;
+        }
+
+        spin_lock(&vha->hw->tgt.sess_lock);
         fcport->disc_state = DSC_GNL;
         fcport->last_rscn_gen = fcport->rscn_gen;
         fcport->last_login_gen = fcport->login_gen;
+        spin_unlock(&vha->hw->tgt.sess_lock);
 
         list_add_tail(&fcport->gnl_entry, &vha->gnl.fcports);
-        if (vha->gnl.sent) {
-                spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
-                return QLA_SUCCESS;
-        }
-        vha->gnl.sent = 1;
-        spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
+        spin_unlock_irqrestore(&vha->gnl.fcports_lock, flags);
 
         sp = qla2x00_get_sp(vha, fcport, GFP_KERNEL);
         if (!sp)
@@ -1049,6 +1061,7 @@ void qla24xx_handle_gpdb_event(scsi_qla_host_t *vha, struct event_arg *ea)
         fc_port_t *fcport = ea->fcport;
         struct port_database_24xx *pd;
         struct srb *sp = ea->sp;
+        uint8_t ls;
 
         pd = (struct port_database_24xx *)sp->u.iocb_cmd.u.mbx.in;
 
@@ -1061,7 +1074,12 @@ void qla24xx_handle_gpdb_event(scsi_qla_host_t *vha, struct event_arg *ea)
         if (fcport->disc_state == DSC_DELETE_PEND)
                 return;
 
-        switch (pd->current_login_state) {
+        if (fcport->fc4f_nvme)
+                ls = pd->current_login_state >> 4;
+        else
+                ls = pd->current_login_state & 0xf;
+
+        switch (ls) {
         case PDS_PRLI_COMPLETE:
                 __qla24xx_parse_gpdb(vha, fcport, pd);
                 break;
@@ -1151,8 +1169,9 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport)
         if (fcport->scan_state != QLA_FCPORT_FOUND)
                 return 0;
 
-        if ((fcport->fw_login_state == DSC_LS_PLOGI_PEND) ||
-            (fcport->fw_login_state == DSC_LS_PRLI_PEND))
+        if ((fcport->loop_id != FC_NO_LOOP_ID) &&
+            ((fcport->fw_login_state == DSC_LS_PLOGI_PEND) ||
+             (fcport->fw_login_state == DSC_LS_PRLI_PEND)))
                 return 0;
 
         if (fcport->fw_login_state == DSC_LS_PLOGI_COMP) {
@@ -1527,6 +1546,7 @@ qla24xx_abort_sp_done(void *ptr, int res)
         srb_t *sp = ptr;
         struct srb_iocb *abt = &sp->u.iocb_cmd;
 
+        del_timer(&sp->u.iocb_cmd.timer);
         complete(&abt->u.abt.comp);
 }
 
@@ -1791,6 +1811,7 @@ qla2x00_async_logout_done(struct scsi_qla_host *vha, fc_port_t *fcport,
         qla2x00_mark_device_lost(vha, fcport, 1, 0);
         qlt_logo_completion_handler(fcport, data[0]);
         fcport->login_gen++;
+        fcport->flags &= ~FCF_ASYNC_ACTIVE;
         return;
 }
 
@@ -1798,6 +1819,7 @@ void
 qla2x00_async_adisc_done(struct scsi_qla_host *vha, fc_port_t *fcport,
     uint16_t *data)
 {
+        fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
         if (data[0] == MBS_COMMAND_COMPLETE) {
                 qla2x00_update_fcport(vha, fcport);
 
@@ -1805,7 +1827,6 @@ qla2x00_async_adisc_done(struct scsi_qla_host *vha, fc_port_t *fcport,
         }
 
         /* Retry login. */
-        fcport->flags &= ~FCF_ASYNC_SENT;
         if (data[1] & QLA_LOGIO_LOGIN_RETRIED)
                 set_bit(RELOGIN_NEEDED, &vha->dpc_flags);
         else
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index afcb5567998a..5c5dcca4d1da 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -454,7 +454,7 @@ static int qla2x00_alloc_queues(struct qla_hw_data *ha, struct req_que *req,
         ha->req_q_map[0] = req;
         set_bit(0, ha->rsp_qid_map);
         set_bit(0, ha->req_qid_map);
-        return 1;
+        return 0;
 
 fail_qpair_map:
         kfree(ha->base_qpair);
@@ -471,6 +471,9 @@ fail_req_map:
 
 static void qla2x00_free_req_que(struct qla_hw_data *ha, struct req_que *req)
 {
+        if (!ha->req_q_map)
+                return;
+
         if (IS_QLAFX00(ha)) {
                 if (req && req->ring_fx00)
                         dma_free_coherent(&ha->pdev->dev,
@@ -481,14 +484,17 @@ static void qla2x00_free_req_que(struct qla_hw_data *ha, struct req_que *req)
                 (req->length + 1) * sizeof(request_t),
                 req->ring, req->dma);
 
-        if (req)
+        if (req) {
                 kfree(req->outstanding_cmds);
-
-        kfree(req);
+                kfree(req);
+        }
 }
 
 static void qla2x00_free_rsp_que(struct qla_hw_data *ha, struct rsp_que *rsp)
 {
+        if (!ha->rsp_q_map)
+                return;
+
         if (IS_QLAFX00(ha)) {
                 if (rsp && rsp->ring)
                         dma_free_coherent(&ha->pdev->dev,
@@ -499,7 +505,8 @@ static void qla2x00_free_rsp_que(struct qla_hw_data *ha, struct rsp_que *rsp)
                 (rsp->length + 1) * sizeof(response_t),
                 rsp->ring, rsp->dma);
         }
-        kfree(rsp);
+        if (rsp)
+                kfree(rsp);
 }
 
 static void qla2x00_free_queues(struct qla_hw_data *ha)
@@ -1723,6 +1730,8 @@ __qla2x00_abort_all_cmds(struct qla_qpair *qp, int res)
         struct qla_tgt_cmd *cmd;
         uint8_t trace = 0;
 
+        if (!ha->req_q_map)
+                return;
         spin_lock_irqsave(qp->qp_lock_ptr, flags);
         req = qp->req;
         for (cnt = 1; cnt < req->num_outstanding_cmds; cnt++) {
@@ -3095,14 +3104,14 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
         /* Set up the irqs */
         ret = qla2x00_request_irqs(ha, rsp);
         if (ret)
-                goto probe_hw_failed;
+                goto probe_failed;
 
         /* Alloc arrays of request and response ring ptrs */
-        if (!qla2x00_alloc_queues(ha, req, rsp)) {
+        if (qla2x00_alloc_queues(ha, req, rsp)) {
                 ql_log(ql_log_fatal, base_vha, 0x003d,
                     "Failed to allocate memory for queue pointers..."
                     "aborting.\n");
-                goto probe_init_failed;
+                goto probe_failed;
         }
 
         if (ha->mqenable && shost_use_blk_mq(host)) {
@@ -3387,15 +3396,6 @@ skip_dpc:
 
         return 0;
 
-probe_init_failed:
-        qla2x00_free_req_que(ha, req);
-        ha->req_q_map[0] = NULL;
-        clear_bit(0, ha->req_qid_map);
-        qla2x00_free_rsp_que(ha, rsp);
-        ha->rsp_q_map[0] = NULL;
-        clear_bit(0, ha->rsp_qid_map);
-        ha->max_req_queues = ha->max_rsp_queues = 0;
-
 probe_failed:
         if (base_vha->timer_active)
                 qla2x00_stop_timer(base_vha);
@@ -4508,11 +4508,17 @@ qla2x00_mem_free(struct qla_hw_data *ha)
         if (ha->init_cb)
                 dma_free_coherent(&ha->pdev->dev, ha->init_cb_size,
                         ha->init_cb, ha->init_cb_dma);
-        vfree(ha->optrom_buffer);
-        kfree(ha->nvram);
-        kfree(ha->npiv_info);
-        kfree(ha->swl);
-        kfree(ha->loop_id_map);
+
+        if (ha->optrom_buffer)
+                vfree(ha->optrom_buffer);
+        if (ha->nvram)
+                kfree(ha->nvram);
+        if (ha->npiv_info)
+                kfree(ha->npiv_info);
+        if (ha->swl)
+                kfree(ha->swl);
+        if (ha->loop_id_map)
+                kfree(ha->loop_id_map);
 
         ha->srb_mempool = NULL;
         ha->ctx_mempool = NULL;
@@ -4528,6 +4534,15 @@ qla2x00_mem_free(struct qla_hw_data *ha)
         ha->ex_init_cb_dma = 0;
         ha->async_pd = NULL;
         ha->async_pd_dma = 0;
+        ha->loop_id_map = NULL;
+        ha->npiv_info = NULL;
+        ha->optrom_buffer = NULL;
+        ha->swl = NULL;
+        ha->nvram = NULL;
+        ha->mctp_dump = NULL;
+        ha->dcbx_tlv = NULL;
+        ha->xgmac_data = NULL;
+        ha->sfp_data = NULL;
 
         ha->s_dma_pool = NULL;
         ha->dl_dma_pool = NULL;
@@ -4577,6 +4592,7 @@ struct scsi_qla_host *qla2x00_create_host(struct scsi_host_template *sht,
 
         spin_lock_init(&vha->work_lock);
         spin_lock_init(&vha->cmd_list_lock);
+        spin_lock_init(&vha->gnl.fcports_lock);
         init_waitqueue_head(&vha->fcport_waitQ);
         init_waitqueue_head(&vha->vref_waitq);
 
@@ -4806,9 +4822,12 @@ void qla24xx_create_new_sess(struct scsi_qla_host *vha, struct qla_work_evt *e)
                         fcport->d_id = e->u.new_sess.id;
                         fcport->flags |= FCF_FABRIC_DEVICE;
                         fcport->fw_login_state = DSC_LS_PLOGI_PEND;
-                        if (e->u.new_sess.fc4_type == FC4_TYPE_FCP_SCSI)
+                        if (e->u.new_sess.fc4_type == FC4_TYPE_FCP_SCSI) {
                                 fcport->fc4_type = FC4_TYPE_FCP_SCSI;
-
+                        } else if (e->u.new_sess.fc4_type == FC4_TYPE_NVME) {
+                                fcport->fc4_type = FC4_TYPE_OTHER;
+                                fcport->fc4f_nvme = FC4_TYPE_NVME;
+                        }
                         memcpy(fcport->port_name, e->u.new_sess.port_name,
                             WWN_SIZE);
                 } else {
@@ -4877,6 +4896,8 @@ void qla24xx_create_new_sess(struct scsi_qla_host *vha, struct qla_work_evt *e)
                         }
                         qlt_plogi_ack_unref(vha, pla);
                 } else {
+                        fc_port_t *dfcp = NULL;
+
                         spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
                         tfcp = qla2x00_find_fcport_by_nportid(vha,
                             &e->u.new_sess.id, 1);
@@ -4899,11 +4920,13 @@ void qla24xx_create_new_sess(struct scsi_qla_host *vha, struct qla_work_evt *e)
                                 default:
                                         fcport->login_pause = 1;
                                         tfcp->conflict = fcport;
-                                        qlt_schedule_sess_for_deletion(tfcp);
+                                        dfcp = tfcp;
                                         break;
                                 }
                         }
                         spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
+                        if (dfcp)
+                                qlt_schedule_sess_for_deletion(tfcp);
 
                         wwn = wwn_to_u64(fcport->node_name);
 
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 896b2d8bd803..b49ac85f3de2 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -1224,10 +1224,10 @@ static void qla24xx_chk_fcp_state(struct fc_port *sess)
         }
 }
 
-/* ha->tgt.sess_lock supposed to be held on entry */
 void qlt_schedule_sess_for_deletion(struct fc_port *sess)
 {
         struct qla_tgt *tgt = sess->tgt;
+        struct qla_hw_data *ha = sess->vha->hw;
         unsigned long flags;
 
         if (sess->disc_state == DSC_DELETE_PEND)
@@ -1244,16 +1244,16 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess)
                         return;
         }
 
+        spin_lock_irqsave(&ha->tgt.sess_lock, flags);
         if (sess->deleted == QLA_SESS_DELETED)
                 sess->logout_on_delete = 0;
 
-        spin_lock_irqsave(&sess->vha->work_lock, flags);
         if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
-                spin_unlock_irqrestore(&sess->vha->work_lock, flags);
+                spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
                 return;
         }
         sess->deleted = QLA_SESS_DELETION_IN_PROGRESS;
-        spin_unlock_irqrestore(&sess->vha->work_lock, flags);
+        spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
 
         sess->disc_state = DSC_DELETE_PEND;
 
@@ -1262,13 +1262,10 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess)
         ql_dbg(ql_dbg_tgt, sess->vha, 0xe001,
             "Scheduling sess %p for deletion\n", sess);
 
-        /* use cancel to push work element through before re-queue */
-        cancel_work_sync(&sess->del_work);
         INIT_WORK(&sess->del_work, qla24xx_delete_sess_fn);
-        queue_work(sess->vha->hw->wq, &sess->del_work);
+        WARN_ON(!queue_work(sess->vha->hw->wq, &sess->del_work));
 }
 
-/* ha->tgt.sess_lock supposed to be held on entry */
 static void qlt_clear_tgt_db(struct qla_tgt *tgt)
 {
         struct fc_port *sess;
@@ -1451,8 +1448,8 @@ qlt_fc_port_deleted(struct scsi_qla_host *vha, fc_port_t *fcport, int max_gen)
         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf008, "qla_tgt_fc_port_deleted %p", sess);
 
         sess->local = 1;
-        qlt_schedule_sess_for_deletion(sess);
         spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
+        qlt_schedule_sess_for_deletion(sess);
 }
 
 static inline int test_tgt_sess_count(struct qla_tgt *tgt)
@@ -1512,10 +1509,8 @@ int qlt_stop_phase1(struct qla_tgt *tgt)
          * Lock is needed, because we still can get an incoming packet.
          */
         mutex_lock(&vha->vha_tgt.tgt_mutex);
-        spin_lock_irqsave(&ha->tgt.sess_lock, flags);
         tgt->tgt_stop = 1;
         qlt_clear_tgt_db(tgt);
-        spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
         mutex_unlock(&vha->vha_tgt.tgt_mutex);
         mutex_unlock(&qla_tgt_mutex);
 
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index d042915ce895..ca53a5f785ee 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -223,7 +223,8 @@ static void scsi_eh_reset(struct scsi_cmnd *scmd)
 
 static void scsi_eh_inc_host_failed(struct rcu_head *head)
 {
-        struct Scsi_Host *shost = container_of(head, typeof(*shost), rcu);
+        struct scsi_cmnd *scmd = container_of(head, typeof(*scmd), rcu);
+        struct Scsi_Host *shost = scmd->device->host;
         unsigned long flags;
 
         spin_lock_irqsave(shost->host_lock, flags);
@@ -259,7 +260,7 @@ void scsi_eh_scmd_add(struct scsi_cmnd *scmd)
          * Ensure that all tasks observe the host state change before the
          * host_failed change.
          */
-        call_rcu(&shost->rcu, scsi_eh_inc_host_failed);
+        call_rcu(&scmd->rcu, scsi_eh_inc_host_failed);
 }
 
 /**
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index a86df9ca7d1c..c84f931388f2 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -671,6 +671,7 @@ static bool scsi_end_request(struct request *req, blk_status_t error,
         if (!blk_rq_is_scsi(req)) {
                 WARN_ON_ONCE(!(cmd->flags & SCMD_INITIALIZED));
                 cmd->flags &= ~SCMD_INITIALIZED;
+                destroy_rcu_head(&cmd->rcu);
         }
 
         if (req->mq_ctx) {
@@ -720,6 +721,8 @@ static blk_status_t __scsi_error_from_host_byte(struct scsi_cmnd *cmd,
                 int result)
 {
         switch (host_byte(result)) {
+        case DID_OK:
+                return BLK_STS_OK;
         case DID_TRANSPORT_FAILFAST:
                 return BLK_STS_TRANSPORT;
         case DID_TARGET_FAILURE:
@@ -1151,6 +1154,7 @@ static void scsi_initialize_rq(struct request *rq)
         struct scsi_cmnd *cmd = blk_mq_rq_to_pdu(rq);
 
         scsi_req_init(&cmd->req);
+        init_rcu_head(&cmd->rcu);
         cmd->jiffies_at_alloc = jiffies;
         cmd->retries = 0;
 }
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index bff21e636ddd..3541caf3fceb 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2595,6 +2595,7 @@ sd_read_write_protect_flag(struct scsi_disk *sdkp, unsigned char *buffer)
         int res;
         struct scsi_device *sdp = sdkp->device;
         struct scsi_mode_data data;
+        int disk_ro = get_disk_ro(sdkp->disk);
         int old_wp = sdkp->write_prot;
 
         set_disk_ro(sdkp->disk, 0);
@@ -2635,7 +2636,7 @@ sd_read_write_protect_flag(struct scsi_disk *sdkp, unsigned char *buffer)
                           "Test WP failed, assume Write Enabled\n");
         } else {
                 sdkp->write_prot = ((data.device_specific & 0x80) != 0);
-                set_disk_ro(sdkp->disk, sdkp->write_prot);
+                set_disk_ro(sdkp->disk, sdkp->write_prot || disk_ro);
                 if (sdkp->first_scan || old_wp != sdkp->write_prot) {
                         sd_printk(KERN_NOTICE, sdkp, "Write Protect is %s\n",
                                   sdkp->write_prot ? "on" : "off");
diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 6c348a211ebb..89cf4498f535 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -403,7 +403,7 @@ static int sd_zbc_check_capacity(struct scsi_disk *sdkp, unsigned char *buf)
  */
 static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
 {
-        u64 zone_blocks;
+        u64 zone_blocks = 0;
         sector_t block = 0;
         unsigned char *buf;
         unsigned char *rec;
@@ -421,10 +421,8 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
 
         /* Do a report zone to get the same field */
         ret = sd_zbc_report_zones(sdkp, buf, SD_ZBC_BUF_SIZE, 0);
-        if (ret) {
-                zone_blocks = 0;
-                goto out;
-        }
+        if (ret)
+                goto out_free;
 
         same = buf[4] & 0x0f;
         if (same > 0) {
@@ -464,7 +462,7 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
                         ret = sd_zbc_report_zones(sdkp, buf,
                                                   SD_ZBC_BUF_SIZE, block);
                         if (ret)
-                                return ret;
+                                goto out_free;
                 }
 
         } while (block < sdkp->capacity);
@@ -472,35 +470,32 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
         zone_blocks = sdkp->zone_blocks;
 
 out:
-        kfree(buf);
-
         if (!zone_blocks) {
                 if (sdkp->first_scan)
                         sd_printk(KERN_NOTICE, sdkp,
                                   "Devices with non constant zone "
                                   "size are not supported\n");
-                return -ENODEV;
-        }
-
-        if (!is_power_of_2(zone_blocks)) {
+                ret = -ENODEV;
+        } else if (!is_power_of_2(zone_blocks)) {
                 if (sdkp->first_scan)
                         sd_printk(KERN_NOTICE, sdkp,
                                   "Devices with non power of 2 zone "
                                   "size are not supported\n");
-                return -ENODEV;
-        }
-
-        if (logical_to_sectors(sdkp->device, zone_blocks) > UINT_MAX) {
+                ret = -ENODEV;
+        } else if (logical_to_sectors(sdkp->device, zone_blocks) > UINT_MAX) {
                 if (sdkp->first_scan)
                         sd_printk(KERN_NOTICE, sdkp,
                                   "Zone size too large\n");
-                return -ENODEV;
+                ret = -ENODEV;
+        } else {
+                sdkp->zone_blocks = zone_blocks;
+                sdkp->zone_shift = ilog2(zone_blocks);
         }
 
-        sdkp->zone_blocks = zone_blocks;
-        sdkp->zone_shift = ilog2(zone_blocks);
+out_free:
+        kfree(buf);
 
-        return 0;
+        return ret;
 }
 
 /**
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 6be5ab32c94f..8c51d628b52e 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1311,7 +1311,8 @@ static int storvsc_do_io(struct hv_device *device,
                          */
                         cpumask_and(&alloced_mask, &stor_device->alloced_cpus,
                                     cpumask_of_node(cpu_to_node(q_num)));
-                        for_each_cpu(tgt_cpu, &alloced_mask) {
+                        for_each_cpu_wrap(tgt_cpu, &alloced_mask,
+                                        outgoing_channel->target_cpu + 1) {
                                 if (tgt_cpu != outgoing_channel->target_cpu) {
                                         outgoing_channel =
                                         stor_device->stor_chns[tgt_cpu];
diff --git a/drivers/soc/imx/gpc.c b/drivers/soc/imx/gpc.c
index cfb42f5eccb2..750f93197411 100644
--- a/drivers/soc/imx/gpc.c
+++ b/drivers/soc/imx/gpc.c
@@ -470,13 +470,21 @@ static int imx_gpc_probe(struct platform_device *pdev)
 
 static int imx_gpc_remove(struct platform_device *pdev)
 {
+        struct device_node *pgc_node;
         int ret;
 
+        pgc_node = of_get_child_by_name(pdev->dev.of_node, "pgc");
+
+        /* bail out if DT too old and doesn't provide the necessary info */
+        if (!of_property_read_bool(pdev->dev.of_node, "#power-domain-cells") &&
+            !pgc_node)
+                return 0;
+
         /*
          * If the old DT binding is used the toplevel driver needs to
          * de-register the power domains
          */
-        if (!of_get_child_by_name(pdev->dev.of_node, "pgc")) {
+        if (!pgc_node) {
                 of_genpd_del_provider(pdev->dev.of_node);
 
                 ret = pm_genpd_remove(&imx_gpc_domains[GPC_PGC_DOMAIN_PU].base);
diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
index 6dbba5aff191..86580b6df33d 100644
--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -326,24 +326,23 @@ static loff_t ashmem_llseek(struct file *file, loff_t offset, int origin)
         mutex_lock(&ashmem_mutex);
 
         if (asma->size == 0) {
-                ret = -EINVAL;
-                goto out;
+                mutex_unlock(&ashmem_mutex);
+                return -EINVAL;
         }
 
         if (!asma->file) {
-                ret = -EBADF;
-                goto out;
+                mutex_unlock(&ashmem_mutex);
+                return -EBADF;
         }
 
+        mutex_unlock(&ashmem_mutex);
+
         ret = vfs_llseek(asma->file, offset, origin);
         if (ret < 0)
-                goto out;
+                return ret;
 
         /** Copy f_pos from backing file, since f_ops->llseek() sets it */
         file->f_pos = asma->file->f_pos;
-
-out:
-        mutex_unlock(&ashmem_mutex);
         return ret;
 }
 
@@ -702,16 +701,14 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd,
         size_t pgstart, pgend;
         int ret = -EINVAL;
 
+        if (unlikely(copy_from_user(&pin, p, sizeof(pin))))
+                return -EFAULT;
+
         mutex_lock(&ashmem_mutex);
 
         if (unlikely(!asma->file))
                 goto out_unlock;
 
-        if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) {
-                ret = -EFAULT;
-                goto out_unlock;
-        }
-
         /* per custom, you can pass zero for len to mean "everything onward" */
         if (!pin.len)
                 pin.len = PAGE_ALIGN(asma->size) - pin.offset;
diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c
index e618a87521a3..9d733471ca2e 100644
--- a/drivers/staging/comedi/drivers.c
+++ b/drivers/staging/comedi/drivers.c
@@ -475,8 +475,7 @@ unsigned int comedi_nsamples_left(struct comedi_subdevice *s,
         struct comedi_cmd *cmd = &async->cmd;
 
         if (cmd->stop_src == TRIG_COUNT) {
-                unsigned int nscans = nsamples / cmd->scan_end_arg;
-                unsigned int scans_left = __comedi_nscans_left(s, nscans);
+                unsigned int scans_left = __comedi_nscans_left(s, cmd->stop_arg);
                 unsigned int scan_pos =
                     comedi_bytes_to_samples(s, async->scan_progress);
                 unsigned long long samples_left = 0;
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 5c0e59e8fe46..cbe98bc2b998 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2180,6 +2180,12 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
                                 }
                                 if (tty_hung_up_p(file))
                                         break;
+                                /*
+                                 * Abort readers for ttys which never actually
+                                 * get hung up.  See __tty_hangup().
+                                 */
+                                if (test_bit(TTY_HUPPING, &tty->flags))
+                                        break;
                                 if (!timeout)
                                         break;
                                 if (file->f_flags & O_NONBLOCK) {
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index 881730cd48c1..3296a05cda2d 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -3384,11 +3384,9 @@ static int serial_pci_is_class_communication(struct pci_dev *dev)
         /*
          * If it is not a communications device or the programming
          * interface is greater than 6, give up.
-         *
-         * (Should we try to make guesses for multiport serial devices
-         * later?)
          */
         if ((((dev->class >> 8) != PCI_CLASS_COMMUNICATION_SERIAL) &&
+             ((dev->class >> 8) != PCI_CLASS_COMMUNICATION_MULTISERIAL) &&
              ((dev->class >> 8) != PCI_CLASS_COMMUNICATION_MODEM)) ||
             (dev->class & 0xff) > 6)
                 return -ENODEV;
@@ -3425,6 +3423,12 @@ serial_pci_guess_board(struct pci_dev *dev, struct pciserial_board *board)
 {
         int num_iomem, num_port, first_port = -1, i;
 
+        /*
+         * Should we try to make guesses for multiport serial devices later?
+         */
+        if ((dev->class >> 8) == PCI_CLASS_COMMUNICATION_MULTISERIAL)
+                return -ENODEV;
+
         num_iomem = num_port = 0;
         for (i = 0; i < PCI_NUM_BAR_RESOURCES; i++) {
                 if (pci_resource_flags(dev, i) & IORESOURCE_IO) {
@@ -4696,6 +4700,17 @@ static const struct pci_device_id serial_pci_tbl[] = {
                 PCI_ANY_ID, PCI_ANY_ID, 0, 0,    /* 135a.0dc0 */
                 pbn_b2_4_115200 },
         /*
+         * BrainBoxes UC-260
+         */
+        {       PCI_VENDOR_ID_INTASHIELD, 0x0D21,
+                PCI_ANY_ID, PCI_ANY_ID,
+                PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00,
+                pbn_b2_4_115200 },
+        {       PCI_VENDOR_ID_INTASHIELD, 0x0E34,
+                PCI_ANY_ID, PCI_ANY_ID,
+                 PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00,
+                pbn_b2_4_115200 },
+        /*
          * Perle PCI-RAS cards
          */
         {       PCI_VENDOR_ID_PLX, PCI_DEVICE_ID_PLX_9030,
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index df46a9e88c34..e287fe8f10fc 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -1734,6 +1734,7 @@ static void atmel_get_ip_name(struct uart_port *port)
                 switch (version) {
                 case 0x302:
                 case 0x10213:
+                case 0x10302:
                         dev_dbg(port->dev, "This version is usart\n");
                         atmel_port->has_frac_baudrate = true;
                         atmel_port->has_hw_timer = true;
diff --git a/drivers/tty/serial/earlycon.c b/drivers/tty/serial/earlycon.c
index 870e84fb6e39..a24278380fec 100644
--- a/drivers/tty/serial/earlycon.c
+++ b/drivers/tty/serial/earlycon.c
@@ -245,11 +245,12 @@ int __init of_setup_earlycon(const struct earlycon_id *match,
         }
         port->mapbase = addr;
         port->uartclk = BASE_BAUD * 16;
-        port->membase = earlycon_map(port->mapbase, SZ_4K);
 
         val = of_get_flat_dt_prop(node, "reg-offset", NULL);
         if (val)
                 port->mapbase += be32_to_cpu(*val);
+        port->membase = earlycon_map(port->mapbase, SZ_4K);
+
         val = of_get_flat_dt_prop(node, "reg-shift", NULL);
         if (val)
                 port->regshift = be32_to_cpu(*val);
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 552fd050f2bb..91f3a1a5cb7f 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -2262,7 +2262,7 @@ static int imx_uart_probe(struct platform_device *pdev)
         uart_get_rs485_mode(&pdev->dev, &sport->port.rs485);
 
         if (sport->port.rs485.flags & SER_RS485_ENABLED &&
-            (!sport->have_rtscts || !sport->have_rtsgpio))
+            (!sport->have_rtscts && !sport->have_rtsgpio))
                 dev_err(&pdev->dev, "no RTS control, disabling rs485\n");
 
         imx_uart_rs485_config(&sport->port, &sport->port.rs485);
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index c8dde56b532b..35b9201db3b4 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -1144,6 +1144,8 @@ static int uart_do_autoconfig(struct tty_struct *tty,struct uart_state *state)
                 uport->ops->config_port(uport, flags);
 
                 ret = uart_startup(tty, state, 1);
+                if (ret == 0)
+                        tty_port_set_initialized(port, true);
                 if (ret > 0)
                         ret = 0;
         }
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 0ec2d938011d..fdbbff547106 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -886,6 +886,8 @@ static void sci_receive_chars(struct uart_port *port)
                 /* Tell the rest of the system the news. New characters! */
                 tty_flip_buffer_push(tport);
         } else {
+                /* TTY buffers full; read from RX reg to prevent lockup */
+                serial_port_in(port, SCxRDR);
                 serial_port_in(port, SCxSR); /* dummy read */
                 sci_clear_SCxSR(port, SCxSR_RDxF_CLEAR(port));
         }
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index eb9133b472f4..63114ea35ec1 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -586,6 +586,14 @@ static void __tty_hangup(struct tty_struct *tty, int exit_session)
                 return;
         }
 
+        /*
+         * Some console devices aren't actually hung up for technical and
+         * historical reasons, which can lead to indefinite interruptible
+         * sleep in n_tty_read().  The following explicitly tells
+         * n_tty_read() to abort readers.
+         */
+        set_bit(TTY_HUPPING, &tty->flags);
+
         /* inuse_filps is protected by the single tty lock,
            this really needs to change if we want to flush the
            workqueue with the lock held */
@@ -640,6 +648,7 @@ static void __tty_hangup(struct tty_struct *tty, int exit_session)
          * from the ldisc side, which is now guaranteed.
          */
         set_bit(TTY_HUPPED, &tty->flags);
+        clear_bit(TTY_HUPPING, &tty->flags);
         tty_unlock(tty);
 
         if (f)
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index c64cf6c4a83d..0c11d40a12bc 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -151,6 +151,10 @@ int usb_control_msg(struct usb_device *dev, unsigned int pipe, __u8 request,
 
         ret = usb_internal_control_msg(dev, pipe, dr, data, size, timeout);
 
+        /* Linger a bit, prior to the next control message. */
+        if (dev->quirks & USB_QUIRK_DELAY_CTRL_MSG)
+                msleep(200);
+
         kfree(dr);
 
         return ret;
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index f4a548471f0f..54b019e267c5 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -230,7 +230,8 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
 
         /* Corsair Strafe RGB */
-        { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
+        { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT |
+          USB_QUIRK_DELAY_CTRL_MSG },
 
         /* Corsair K70 LUX */
         { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT },
diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
index 03fd20f0b496..c4a47496d2fb 100644
--- a/drivers/usb/dwc2/params.c
+++ b/drivers/usb/dwc2/params.c
@@ -137,7 +137,7 @@ static void dwc2_set_stm32f4x9_fsotg_params(struct dwc2_hsotg *hsotg)
         p->activate_stm_fs_transceiver = true;
 }
 
-static void dwc2_set_stm32f7xx_hsotg_params(struct dwc2_hsotg *hsotg)
+static void dwc2_set_stm32f7_hsotg_params(struct dwc2_hsotg *hsotg)
 {
         struct dwc2_core_params *p = &hsotg->params;
 
@@ -164,8 +164,8 @@ const struct of_device_id dwc2_of_match_table[] = {
         { .compatible = "st,stm32f4x9-fsotg",
           .data = dwc2_set_stm32f4x9_fsotg_params },
         { .compatible = "st,stm32f4x9-hsotg" },
-        { .compatible = "st,stm32f7xx-hsotg",
-          .data = dwc2_set_stm32f7xx_hsotg_params },
+        { .compatible = "st,stm32f7-hsotg",
+          .data = dwc2_set_stm32f7_hsotg_params },
         {},
 };
 MODULE_DEVICE_TABLE(of, dwc2_of_match_table);
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index f1d838a4acd6..e94bf91cc58a 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -175,7 +175,7 @@ void dwc3_set_mode(struct dwc3 *dwc, u32 mode)
         dwc->desired_dr_role = mode;
         spin_unlock_irqrestore(&dwc->lock, flags);
 
-        queue_work(system_power_efficient_wq, &dwc->drd_work);
+        queue_work(system_freezable_wq, &dwc->drd_work);
 }
 
 u32 dwc3_core_fifo_space(struct dwc3_ep *dep, u8 type)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index c2592d883f67..d2428a9e8900 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1538,7 +1538,6 @@ ffs_fs_kill_sb(struct super_block *sb)
         if (sb->s_fs_info) {
                 ffs_release_dev(sb->s_fs_info);
                 ffs_data_closed(sb->s_fs_info);
-                ffs_data_put(sb->s_fs_info);
         }
 }
 
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 84f88fa411cd..d088c340e4d0 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -447,7 +447,8 @@ static int ohci_init (struct ohci_hcd *ohci)
         struct usb_hcd *hcd = ohci_to_hcd(ohci);
 
         /* Accept arbitrarily long scatter-gather lists */
-        hcd->self.sg_tablesize = ~0;
+        if (!(hcd->driver->flags & HCD_LOCAL_MEM))
+                hcd->self.sg_tablesize = ~0;
 
         if (distrust_firmware)
                 ohci->flags |= OHCI_QUIRK_HUB_POWER;
diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c
index a1ab8acf39ba..c359bae7b754 100644
--- a/drivers/usb/host/xhci-dbgcap.c
+++ b/drivers/usb/host/xhci-dbgcap.c
@@ -328,13 +328,14 @@ dbc_ep_do_queue(struct dbc_ep *dep, struct dbc_request *req)
 int dbc_ep_queue(struct dbc_ep *dep, struct dbc_request *req,
                  gfp_t gfp_flags)
 {
+        unsigned long           flags;
         struct xhci_dbc         *dbc = dep->dbc;
         int                     ret = -ESHUTDOWN;
 
-        spin_lock(&dbc->lock);
+        spin_lock_irqsave(&dbc->lock, flags);
         if (dbc->state == DS_CONFIGURED)
                 ret = dbc_ep_do_queue(dep, req);
-        spin_unlock(&dbc->lock);
+        spin_unlock_irqrestore(&dbc->lock, flags);
 
         mod_delayed_work(system_wq, &dbc->event_work, 0);
 
@@ -521,15 +522,16 @@ static void xhci_do_dbc_stop(struct xhci_hcd *xhci)
 static int xhci_dbc_start(struct xhci_hcd *xhci)
 {
         int                     ret;
+        unsigned long           flags;
         struct xhci_dbc         *dbc = xhci->dbc;
 
         WARN_ON(!dbc);
 
         pm_runtime_get_sync(xhci_to_hcd(xhci)->self.controller);
 
-        spin_lock(&dbc->lock);
+        spin_lock_irqsave(&dbc->lock, flags);
         ret = xhci_do_dbc_start(xhci);
-        spin_unlock(&dbc->lock);
+        spin_unlock_irqrestore(&dbc->lock, flags);
 
         if (ret) {
                 pm_runtime_put(xhci_to_hcd(xhci)->self.controller);
@@ -541,6 +543,7 @@ static int xhci_dbc_start(struct xhci_hcd *xhci)
 
 static void xhci_dbc_stop(struct xhci_hcd *xhci)
 {
+        unsigned long           flags;
         struct xhci_dbc         *dbc = xhci->dbc;
         struct dbc_port         *port = &dbc->port;
 
@@ -551,9 +554,9 @@ static void xhci_dbc_stop(struct xhci_hcd *xhci)
         if (port->registered)
                 xhci_dbc_tty_unregister_device(xhci);
 
-        spin_lock(&dbc->lock);
+        spin_lock_irqsave(&dbc->lock, flags);
         xhci_do_dbc_stop(xhci);
-        spin_unlock(&dbc->lock);
+        spin_unlock_irqrestore(&dbc->lock, flags);
 
         pm_runtime_put_sync(xhci_to_hcd(xhci)->self.controller);
 }
@@ -779,14 +782,15 @@ static void xhci_dbc_handle_events(struct work_struct *work)
         int                     ret;
         enum evtreturn          evtr;
         struct xhci_dbc         *dbc;
+        unsigned long           flags;
         struct xhci_hcd         *xhci;
 
         dbc = container_of(to_delayed_work(work), struct xhci_dbc, event_work);
         xhci = dbc->xhci;
 
-        spin_lock(&dbc->lock);
+        spin_lock_irqsave(&dbc->lock, flags);
         evtr = xhci_dbc_do_handle_events(dbc);
-        spin_unlock(&dbc->lock);
+        spin_unlock_irqrestore(&dbc->lock, flags);
 
         switch (evtr) {
         case EVT_GSER:
diff --git a/drivers/usb/host/xhci-dbgtty.c b/drivers/usb/host/xhci-dbgtty.c
index 8d47b6fbf973..75f0b92694ba 100644
--- a/drivers/usb/host/xhci-dbgtty.c
+++ b/drivers/usb/host/xhci-dbgtty.c
@@ -92,21 +92,23 @@ static void dbc_start_rx(struct dbc_port *port)
 static void
 dbc_read_complete(struct xhci_hcd *xhci, struct dbc_request *req)
 {
+        unsigned long           flags;
         struct xhci_dbc         *dbc = xhci->dbc;
         struct dbc_port         *port = &dbc->port;
 
-        spin_lock(&port->port_lock);
+        spin_lock_irqsave(&port->port_lock, flags);
         list_add_tail(&req->list_pool, &port->read_queue);
         tasklet_schedule(&port->push);
-        spin_unlock(&port->port_lock);
+        spin_unlock_irqrestore(&port->port_lock, flags);
 }
 
 static void dbc_write_complete(struct xhci_hcd *xhci, struct dbc_request *req)
 {
+        unsigned long           flags;
         struct xhci_dbc         *dbc = xhci->dbc;
         struct dbc_port         *port = &dbc->port;
 
-        spin_lock(&port->port_lock);
+        spin_lock_irqsave(&port->port_lock, flags);
         list_add(&req->list_pool, &port->write_pool);
         switch (req->status) {
         case 0:
@@ -119,7 +121,7 @@ static void dbc_write_complete(struct xhci_hcd *xhci, struct dbc_request *req)
                           req->status);
                 break;
         }
-        spin_unlock(&port->port_lock);
+        spin_unlock_irqrestore(&port->port_lock, flags);
 }
 
 static void xhci_dbc_free_req(struct dbc_ep *dep, struct dbc_request *req)
@@ -327,12 +329,13 @@ static void dbc_rx_push(unsigned long _port)
 {
         struct dbc_request      *req;
         struct tty_struct       *tty;
+        unsigned long           flags;
         bool                    do_push = false;
         bool                    disconnect = false;
         struct dbc_port         *port = (void *)_port;
         struct list_head        *queue = &port->read_queue;
 
-        spin_lock_irq(&port->port_lock);
+        spin_lock_irqsave(&port->port_lock, flags);
         tty = port->port.tty;
         while (!list_empty(queue)) {
                 req = list_first_entry(queue, struct dbc_request, list_pool);
@@ -392,16 +395,17 @@ static void dbc_rx_push(unsigned long _port)
         if (!disconnect)
                 dbc_start_rx(port);
 
-        spin_unlock_irq(&port->port_lock);
+        spin_unlock_irqrestore(&port->port_lock, flags);
 }
 
 static int dbc_port_activate(struct tty_port *_port, struct tty_struct *tty)
 {
+        unsigned long   flags;
         struct dbc_port *port = container_of(_port, struct dbc_port, port);
 
-        spin_lock_irq(&port->port_lock);
+        spin_lock_irqsave(&port->port_lock, flags);
         dbc_start_rx(port);
-        spin_unlock_irq(&port->port_lock);
+        spin_unlock_irqrestore(&port->port_lock, flags);
 
         return 0;
 }
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 5262fa571a5d..d9f831b67e57 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -126,6 +126,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         if (pdev->vendor == PCI_VENDOR_ID_AMD && usb_amd_find_chipset_info())
                 xhci->quirks |= XHCI_AMD_PLL_FIX;
 
+        if (pdev->vendor == PCI_VENDOR_ID_AMD && pdev->device == 0x43bb)
+                xhci->quirks |= XHCI_SUSPEND_DELAY;
+
         if (pdev->vendor == PCI_VENDOR_ID_AMD)
                 xhci->quirks |= XHCI_TRUST_TX_LENGTH;
 
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 6f038306c14d..6652e2d5bd2e 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -360,7 +360,6 @@ static int __maybe_unused xhci_plat_suspend(struct device *dev)
 {
         struct usb_hcd  *hcd = dev_get_drvdata(dev);
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
-        int ret;
 
         /*
          * xhci_suspend() needs `do_wakeup` to know whether host is allowed
@@ -370,12 +369,7 @@ static int __maybe_unused xhci_plat_suspend(struct device *dev)
          * reconsider this when xhci_plat_suspend enlarges its scope, e.g.,
          * also applies to runtime suspend.
          */
-        ret = xhci_suspend(xhci, device_may_wakeup(dev));
-
-        if (!device_may_wakeup(dev) && !IS_ERR(xhci->clk))
-                clk_disable_unprepare(xhci->clk);
-
-        return ret;
+        return xhci_suspend(xhci, device_may_wakeup(dev));
 }
 
 static int __maybe_unused xhci_plat_resume(struct device *dev)
@@ -384,9 +378,6 @@ static int __maybe_unused xhci_plat_resume(struct device *dev)
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
         int ret;
 
-        if (!device_may_wakeup(dev) && !IS_ERR(xhci->clk))
-                clk_prepare_enable(xhci->clk);
-
         ret = xhci_priv_resume_quirk(hcd);
         if (ret)
                 return ret;
diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c
index f0b559660007..f33ffc2bc4ed 100644
--- a/drivers/usb/host/xhci-rcar.c
+++ b/drivers/usb/host/xhci-rcar.c
@@ -83,6 +83,10 @@ static const struct soc_device_attribute rcar_quirks_match[]  = {
                 .soc_id = "r8a7796",
                 .data = (void *)RCAR_XHCI_FIRMWARE_V3,
         },
+        {
+                .soc_id = "r8a77965",
+                .data = (void *)RCAR_XHCI_FIRMWARE_V3,
+        },
         { /* sentinel */ },
 };
 
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 25d4b748a56f..5d37700ae4b0 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -877,6 +877,9 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
         clear_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags);
         del_timer_sync(&xhci->shared_hcd->rh_timer);
 
+        if (xhci->quirks & XHCI_SUSPEND_DELAY)
+                usleep_range(1000, 1500);
+
         spin_lock_irq(&xhci->lock);
         clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
         clear_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags);
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index e4d7d3d06a75..866e141d4972 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -718,11 +718,12 @@ struct xhci_ep_ctx {
 /* bits 10:14 are Max Primary Streams */
 /* bit 15 is Linear Stream Array */
 /* Interval - period between requests to an endpoint - 125u increments. */
-#define EP_INTERVAL(p)          (((p) & 0xff) << 16)
-#define EP_INTERVAL_TO_UFRAMES(p)               (1 << (((p) >> 16) & 0xff))
-#define CTX_TO_EP_INTERVAL(p)   (((p) >> 16) & 0xff)
-#define EP_MAXPSTREAMS_MASK     (0x1f << 10)
-#define EP_MAXPSTREAMS(p)       (((p) << 10) & EP_MAXPSTREAMS_MASK)
+#define EP_INTERVAL(p)                  (((p) & 0xff) << 16)
+#define EP_INTERVAL_TO_UFRAMES(p)       (1 << (((p) >> 16) & 0xff))
+#define CTX_TO_EP_INTERVAL(p)           (((p) >> 16) & 0xff)
+#define EP_MAXPSTREAMS_MASK             (0x1f << 10)
+#define EP_MAXPSTREAMS(p)               (((p) << 10) & EP_MAXPSTREAMS_MASK)
+#define CTX_TO_EP_MAXPSTREAMS(p)        (((p) & EP_MAXPSTREAMS_MASK) >> 10)
 /* Endpoint is set up with a Linear Stream Array (vs. Secondary Stream Array) */
 #define EP_HAS_LSA              (1 << 15)
 /* hosts with LEC=1 use bits 31:24 as ESIT high bits. */
@@ -1825,6 +1826,7 @@ struct xhci_hcd {
 #define XHCI_U2_DISABLE_WAKE    (1 << 27)
 #define XHCI_ASMEDIA_MODIFY_FLOWCONTROL (1 << 28)
 #define XHCI_HW_LPM_DISABLE     (1 << 29)
+#define XHCI_SUSPEND_DELAY      (1 << 30)
 
         unsigned int            num_active_eps;
         unsigned int            limit_active_eps;
@@ -2549,21 +2551,22 @@ static inline const char *xhci_decode_ep_context(u32 info, u32 info2, u64 deq,
         u8 burst;
         u8 cerr;
         u8 mult;
-        u8 lsa;
-        u8 hid;
+
+        bool lsa;
+        bool hid;
 
         esit = CTX_TO_MAX_ESIT_PAYLOAD_HI(info) << 16 |
                 CTX_TO_MAX_ESIT_PAYLOAD(tx_info);
 
         ep_state = info & EP_STATE_MASK;
-        max_pstr = info & EP_MAXPSTREAMS_MASK;
+        max_pstr = CTX_TO_EP_MAXPSTREAMS(info);
         interval = CTX_TO_EP_INTERVAL(info);
         mult = CTX_TO_EP_MULT(info) + 1;
-        lsa = info & EP_HAS_LSA;
+        lsa = !!(info & EP_HAS_LSA);
 
         cerr = (info2 & (3 << 1)) >> 1;
         ep_type = CTX_TO_EP_TYPE(info2);
-        hid = info2 & (1 << 7);
+        hid = !!(info2 & (1 << 7));
         burst = CTX_TO_MAX_BURST(info2);
         maxp = MAX_PACKET_DECODED(info2);
 
diff --git a/drivers/usb/mon/mon_text.c b/drivers/usb/mon/mon_text.c
index f5e1bb5e5217..984f7e12a6a5 100644
--- a/drivers/usb/mon/mon_text.c
+++ b/drivers/usb/mon/mon_text.c
@@ -85,6 +85,8 @@ struct mon_reader_text {
 
         wait_queue_head_t wait;
         int printf_size;
+        size_t printf_offset;
+        size_t printf_togo;
         char *printf_buf;
         struct mutex printf_lock;
 
@@ -376,75 +378,103 @@ err_alloc:
         return rc;
 }
 
-/*
- * For simplicity, we read one record in one system call and throw out
- * what does not fit. This means that the following does not work:
- *   dd if=/dbg/usbmon/0t bs=10
- * Also, we do not allow seeks and do not bother advancing the offset.
- */
+static ssize_t mon_text_copy_to_user(struct mon_reader_text *rp,
+    char __user * const buf, const size_t nbytes)
+{
+        const size_t togo = min(nbytes, rp->printf_togo);
+
+        if (copy_to_user(buf, &rp->printf_buf[rp->printf_offset], togo))
+                return -EFAULT;
+        rp->printf_togo -= togo;
+        rp->printf_offset += togo;
+        return togo;
+}
+
+/* ppos is not advanced since the llseek operation is not permitted. */
 static ssize_t mon_text_read_t(struct file *file, char __user *buf,
-                                size_t nbytes, loff_t *ppos)
+    size_t nbytes, loff_t *ppos)
 {
         struct mon_reader_text *rp = file->private_data;
         struct mon_event_text *ep;
         struct mon_text_ptr ptr;
+        ssize_t ret;
 
-        ep = mon_text_read_wait(rp, file);
-        if (IS_ERR(ep))
-                return PTR_ERR(ep);
         mutex_lock(&rp->printf_lock);
-        ptr.cnt = 0;
-        ptr.pbuf = rp->printf_buf;
-        ptr.limit = rp->printf_size;
-
-        mon_text_read_head_t(rp, &ptr, ep);
-        mon_text_read_statset(rp, &ptr, ep);
-        ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
-            " %d", ep->length);
-        mon_text_read_data(rp, &ptr, ep);
-
-        if (copy_to_user(buf, rp->printf_buf, ptr.cnt))
-                ptr.cnt = -EFAULT;
+
+        if (rp->printf_togo == 0) {
+
+                ep = mon_text_read_wait(rp, file);
+                if (IS_ERR(ep)) {
+                        mutex_unlock(&rp->printf_lock);
+                        return PTR_ERR(ep);
+                }
+                ptr.cnt = 0;
+                ptr.pbuf = rp->printf_buf;
+                ptr.limit = rp->printf_size;
+
+                mon_text_read_head_t(rp, &ptr, ep);
+                mon_text_read_statset(rp, &ptr, ep);
+                ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
+                    " %d", ep->length);
+                mon_text_read_data(rp, &ptr, ep);
+
+                rp->printf_togo = ptr.cnt;
+                rp->printf_offset = 0;
+
+                kmem_cache_free(rp->e_slab, ep);
+        }
+
+        ret = mon_text_copy_to_user(rp, buf, nbytes);
         mutex_unlock(&rp->printf_lock);
-        kmem_cache_free(rp->e_slab, ep);
-        return ptr.cnt;
+        return ret;
 }
 
+/* ppos is not advanced since the llseek operation is not permitted. */
 static ssize_t mon_text_read_u(struct file *file, char __user *buf,
-                                size_t nbytes, loff_t *ppos)
+    size_t nbytes, loff_t *ppos)
 {
         struct mon_reader_text *rp = file->private_data;
         struct mon_event_text *ep;
         struct mon_text_ptr ptr;
+        ssize_t ret;
 
-        ep = mon_text_read_wait(rp, file);
-        if (IS_ERR(ep))
-                return PTR_ERR(ep);
         mutex_lock(&rp->printf_lock);
-        ptr.cnt = 0;
-        ptr.pbuf = rp->printf_buf;
-        ptr.limit = rp->printf_size;
 
-        mon_text_read_head_u(rp, &ptr, ep);
-        if (ep->type == 'E') {
-                mon_text_read_statset(rp, &ptr, ep);
-        } else if (ep->xfertype == USB_ENDPOINT_XFER_ISOC) {
-                mon_text_read_isostat(rp, &ptr, ep);
-                mon_text_read_isodesc(rp, &ptr, ep);
-        } else if (ep->xfertype == USB_ENDPOINT_XFER_INT) {
-                mon_text_read_intstat(rp, &ptr, ep);
-        } else {
-                mon_text_read_statset(rp, &ptr, ep);
+        if (rp->printf_togo == 0) {
+
+                ep = mon_text_read_wait(rp, file);
+                if (IS_ERR(ep)) {
+                        mutex_unlock(&rp->printf_lock);
+                        return PTR_ERR(ep);
+                }
+                ptr.cnt = 0;
+                ptr.pbuf = rp->printf_buf;
+                ptr.limit = rp->printf_size;
+
+                mon_text_read_head_u(rp, &ptr, ep);
+                if (ep->type == 'E') {
+                        mon_text_read_statset(rp, &ptr, ep);
+                } else if (ep->xfertype == USB_ENDPOINT_XFER_ISOC) {
+                        mon_text_read_isostat(rp, &ptr, ep);
+                        mon_text_read_isodesc(rp, &ptr, ep);
+                } else if (ep->xfertype == USB_ENDPOINT_XFER_INT) {
+                        mon_text_read_intstat(rp, &ptr, ep);
+                } else {
+                        mon_text_read_statset(rp, &ptr, ep);
+                }
+                ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
+                    " %d", ep->length);
+                mon_text_read_data(rp, &ptr, ep);
+
+                rp->printf_togo = ptr.cnt;
+                rp->printf_offset = 0;
+
+                kmem_cache_free(rp->e_slab, ep);
         }
-        ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
-            " %d", ep->length);
-        mon_text_read_data(rp, &ptr, ep);
 
-        if (copy_to_user(buf, rp->printf_buf, ptr.cnt))
-                ptr.cnt = -EFAULT;
+        ret = mon_text_copy_to_user(rp, buf, nbytes);
         mutex_unlock(&rp->printf_lock);
-        kmem_cache_free(rp->e_slab, ep);
-        return ptr.cnt;
+        return ret;
 }
 
 static struct mon_event_text *mon_text_read_wait(struct mon_reader_text *rp,
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index eef4ad578b31..4d723077be2b 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1756,6 +1756,7 @@ vbus_show(struct device *dev, struct device_attribute *attr, char *buf)
         int             vbus;
         u8              devctl;
 
+        pm_runtime_get_sync(dev);
         spin_lock_irqsave(&musb->lock, flags);
         val = musb->a_wait_bcon;
         vbus = musb_platform_get_vbus_status(musb);
@@ -1769,6 +1770,7 @@ vbus_show(struct device *dev, struct device_attribute *attr, char *buf)
                         vbus = 0;
         }
         spin_unlock_irqrestore(&musb->lock, flags);
+        pm_runtime_put_sync(dev);
 
         return sprintf(buf, "Vbus %s, timeout %lu msec\n",
                         vbus ? "on" : "off", val);
@@ -2471,11 +2473,11 @@ static int musb_remove(struct platform_device *pdev)
         musb_disable_interrupts(musb);
         musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
         spin_unlock_irqrestore(&musb->lock, flags);
+        musb_platform_exit(musb);
 
         pm_runtime_dont_use_autosuspend(musb->controller);
         pm_runtime_put_sync(musb->controller);
         pm_runtime_disable(musb->controller);
-        musb_platform_exit(musb);
         musb_phy_callback = NULL;
         if (musb->dma_controller)
                 musb_dma_controller_destroy(musb->dma_controller);
diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index 3b1b9695177a..6034c39b67d1 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -1076,7 +1076,7 @@ static int uas_post_reset(struct usb_interface *intf)
                 return 0;
 
         err = uas_configure_endpoints(devinfo);
-        if (err && err != ENODEV)
+        if (err && err != -ENODEV)
                 shost_printk(KERN_ERR, shost,
                              "%s: alloc streams error %d after reset",
                              __func__, err);
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 264af199aec8..747d3a9596d9 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2118,6 +2118,13 @@ UNUSUAL_DEV(  0x152d, 0x2566, 0x0114, 0x0114,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_BROKEN_FUA ),
 
+/* Reported by Teijo Kinnunen <teijo.kinnunen@code-q.fi> */
+UNUSUAL_DEV(  0x152d, 0x2567, 0x0117, 0x0117,
+                "JMicron",
+                "USB to ATA/ATAPI Bridge",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_BROKEN_FUA ),
+
 /* Reported-by George Cherian <george.cherian@cavium.com> */
 UNUSUAL_DEV(0x152d, 0x9561, 0x0000, 0x9999,
                 "JMicron",
diff --git a/drivers/usb/typec/fusb302/fusb302.c b/drivers/usb/typec/fusb302/fusb302.c
index 9ce4756adad6..dcd8ef085b30 100644
--- a/drivers/usb/typec/fusb302/fusb302.c
+++ b/drivers/usb/typec/fusb302/fusb302.c
@@ -1857,7 +1857,8 @@ static int fusb302_probe(struct i2c_client *client,
         chip->tcpm_port = tcpm_register_port(&client->dev, &chip->tcpc_dev);
         if (IS_ERR(chip->tcpm_port)) {
                 ret = PTR_ERR(chip->tcpm_port);
-                dev_err(dev, "cannot register tcpm port, ret=%d", ret);
+                if (ret != -EPROBE_DEFER)
+                        dev_err(dev, "cannot register tcpm port, ret=%d", ret);
                 goto destroy_workqueue;
         }
 
diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
index f4d563ee7690..8b637a4b474b 100644
--- a/drivers/usb/typec/tcpm.c
+++ b/drivers/usb/typec/tcpm.c
@@ -252,9 +252,6 @@ struct tcpm_port {
         unsigned int nr_src_pdo;
         u32 snk_pdo[PDO_MAX_OBJECTS];
         unsigned int nr_snk_pdo;
-        unsigned int nr_fixed; /* number of fixed sink PDOs */
-        unsigned int nr_var; /* number of variable sink PDOs */
-        unsigned int nr_batt; /* number of battery sink PDOs */
         u32 snk_vdo[VDO_MAX_OBJECTS];
         unsigned int nr_snk_vdo;
 
@@ -1770,90 +1767,39 @@ static int tcpm_pd_check_request(struct tcpm_port *port)
         return 0;
 }
 
-#define min_power(x, y) min(pdo_max_power(x), pdo_max_power(y))
-#define min_current(x, y) min(pdo_max_current(x), pdo_max_current(y))
-
-static int tcpm_pd_select_pdo(struct tcpm_port *port, int *sink_pdo,
-                              int *src_pdo)
+static int tcpm_pd_select_pdo(struct tcpm_port *port)
 {
-        unsigned int i, j, max_mw = 0, max_mv = 0, mw = 0, mv = 0, ma = 0;
+        unsigned int i, max_mw = 0, max_mv = 0;
         int ret = -EINVAL;
 
         /*
-         * Select the source PDO providing the most power which has a
-         * matchig sink cap.
+         * Select the source PDO providing the most power while staying within
+         * the board's voltage limits. Prefer PDO providing exp
          */
         for (i = 0; i < port->nr_source_caps; i++) {
                 u32 pdo = port->source_caps[i];
                 enum pd_pdo_type type = pdo_type(pdo);
+                unsigned int mv, ma, mw;
 
-                if (type == PDO_TYPE_FIXED) {
-                        for (j = 0; j < port->nr_fixed; j++) {
-                                if (pdo_fixed_voltage(pdo) ==
-                                    pdo_fixed_voltage(port->snk_pdo[j])) {
-                                        ma = min_current(pdo, port->snk_pdo[j]);
-                                        mv = pdo_fixed_voltage(pdo);
-                                        mw = ma * mv / 1000;
-                                        if (mw > max_mw ||
-                                            (mw == max_mw && mv > max_mv)) {
-                                                ret = 0;
-                                                *src_pdo = i;
-                                                *sink_pdo = j;
-                                                max_mw = mw;
-                                                max_mv = mv;
-                                        }
-                                        /* There could only be one fixed pdo
-                                         * at a specific voltage level.
-                                         * So breaking here.
-                                         */
-                                        break;
-                                }
-                        }
-                } else if (type == PDO_TYPE_BATT) {
-                        for (j = port->nr_fixed;
-                             j < port->nr_fixed +
-                                 port->nr_batt;
-                             j++) {
-                                if (pdo_min_voltage(pdo) >=
-                                     pdo_min_voltage(port->snk_pdo[j]) &&
-                                     pdo_max_voltage(pdo) <=
-                                     pdo_max_voltage(port->snk_pdo[j])) {
-                                        mw = min_power(pdo, port->snk_pdo[j]);
-                                        mv = pdo_min_voltage(pdo);
-                                        if (mw > max_mw ||
-                                            (mw == max_mw && mv > max_mv)) {
-                                                ret = 0;
-                                                *src_pdo = i;
-                                                *sink_pdo = j;
-                                                max_mw = mw;
-                                                max_mv = mv;
-                                        }
-                                }
-                        }
-                } else if (type == PDO_TYPE_VAR) {
-                        for (j = port->nr_fixed +
-                                 port->nr_batt;
-                             j < port->nr_fixed +
-                                 port->nr_batt +
-                                 port->nr_var;
-                             j++) {
-                                if (pdo_min_voltage(pdo) >=
-                                     pdo_min_voltage(port->snk_pdo[j]) &&
-                                     pdo_max_voltage(pdo) <=
-                                     pdo_max_voltage(port->snk_pdo[j])) {
-                                        ma = min_current(pdo, port->snk_pdo[j]);
-                                        mv = pdo_min_voltage(pdo);
-                                        mw = ma * mv / 1000;
-                                        if (mw > max_mw ||
-                                            (mw == max_mw && mv > max_mv)) {
-                                                ret = 0;
-                                                *src_pdo = i;
-                                                *sink_pdo = j;
-                                                max_mw = mw;
-                                                max_mv = mv;
-                                        }
-                                }
-                        }
+                if (type == PDO_TYPE_FIXED)
+                        mv = pdo_fixed_voltage(pdo);
+                else
+                        mv = pdo_min_voltage(pdo);
+
+                if (type == PDO_TYPE_BATT) {
+                        mw = pdo_max_power(pdo);
+                } else {
+                        ma = min(pdo_max_current(pdo),
+                                 port->max_snk_ma);
+                        mw = ma * mv / 1000;
+                }
+
+                /* Perfer higher voltages if available */
+                if ((mw > max_mw || (mw == max_mw && mv > max_mv)) &&
+                    mv <= port->max_snk_mv) {
+                        ret = i;
+                        max_mw = mw;
+                        max_mv = mv;
                 }
         }
 
@@ -1865,14 +1811,13 @@ static int tcpm_pd_build_request(struct tcpm_port *port, u32 *rdo)
         unsigned int mv, ma, mw, flags;
         unsigned int max_ma, max_mw;
         enum pd_pdo_type type;
-        int src_pdo_index, snk_pdo_index;
-        u32 pdo, matching_snk_pdo;
+        int index;
+        u32 pdo;
 
-        if (tcpm_pd_select_pdo(port, &snk_pdo_index, &src_pdo_index) < 0)
+        index = tcpm_pd_select_pdo(port);
+        if (index < 0)
                 return -EINVAL;
-
-        pdo = port->source_caps[src_pdo_index];
-        matching_snk_pdo = port->snk_pdo[snk_pdo_index];
+        pdo = port->source_caps[index];
         type = pdo_type(pdo);
 
         if (type == PDO_TYPE_FIXED)
@@ -1880,28 +1825,26 @@ static int tcpm_pd_build_request(struct tcpm_port *port, u32 *rdo)
         else
                 mv = pdo_min_voltage(pdo);
 
-        /* Select maximum available current within the sink pdo's limit */
+        /* Select maximum available current within the board's power limit */
         if (type == PDO_TYPE_BATT) {
-                mw = min_power(pdo, matching_snk_pdo);
-                ma = 1000 * mw / mv;
+                mw = pdo_max_power(pdo);
+                ma = 1000 * min(mw, port->max_snk_mw) / mv;
         } else {
-                ma = min_current(pdo, matching_snk_pdo);
-                mw = ma * mv / 1000;
+                ma = min(pdo_max_current(pdo),
+                         1000 * port->max_snk_mw / mv);
         }
+        ma = min(ma, port->max_snk_ma);
 
         flags = RDO_USB_COMM | RDO_NO_SUSPEND;
 
         /* Set mismatch bit if offered power is less than operating power */
+        mw = ma * mv / 1000;
         max_ma = ma;
         max_mw = mw;
         if (mw < port->operating_snk_mw) {
                 flags |= RDO_CAP_MISMATCH;
-                if (type == PDO_TYPE_BATT &&
-                    (pdo_max_power(matching_snk_pdo) > pdo_max_power(pdo)))
-                        max_mw = pdo_max_power(matching_snk_pdo);
-                else if (pdo_max_current(matching_snk_pdo) >
-                         pdo_max_current(pdo))
-                        max_ma = pdo_max_current(matching_snk_pdo);
+                max_mw = port->operating_snk_mw;
+                max_ma = max_mw * 1000 / mv;
         }
 
         tcpm_log(port, "cc=%d cc1=%d cc2=%d vbus=%d vconn=%s polarity=%d",
@@ -1910,16 +1853,16 @@ static int tcpm_pd_build_request(struct tcpm_port *port, u32 *rdo)
                  port->polarity);
 
         if (type == PDO_TYPE_BATT) {
-                *rdo = RDO_BATT(src_pdo_index + 1, mw, max_mw, flags);
+                *rdo = RDO_BATT(index + 1, mw, max_mw, flags);
 
                 tcpm_log(port, "Requesting PDO %d: %u mV, %u mW%s",
-                         src_pdo_index, mv, mw,
+                         index, mv, mw,
                          flags & RDO_CAP_MISMATCH ? " [mismatch]" : "");
         } else {
-                *rdo = RDO_FIXED(src_pdo_index + 1, ma, max_ma, flags);
+                *rdo = RDO_FIXED(index + 1, ma, max_ma, flags);
 
                 tcpm_log(port, "Requesting PDO %d: %u mV, %u mA%s",
-                         src_pdo_index, mv, ma,
+                         index, mv, ma,
                          flags & RDO_CAP_MISMATCH ? " [mismatch]" : "");
         }
 
@@ -3650,19 +3593,6 @@ int tcpm_update_sink_capabilities(struct tcpm_port *port, const u32 *pdo,
 }
 EXPORT_SYMBOL_GPL(tcpm_update_sink_capabilities);
 
-static int nr_type_pdos(const u32 *pdo, unsigned int nr_pdo,
-                        enum pd_pdo_type type)
-{
-        int count = 0;
-        int i;
-
-        for (i = 0; i < nr_pdo; i++) {
-                if (pdo_type(pdo[i]) == type)
-                        count++;
-        }
-        return count;
-}
-
 struct tcpm_port *tcpm_register_port(struct device *dev, struct tcpc_dev *tcpc)
 {
         struct tcpm_port *port;
@@ -3708,15 +3638,6 @@ struct tcpm_port *tcpm_register_port(struct device *dev, struct tcpc_dev *tcpc)
                                           tcpc->config->nr_src_pdo);
         port->nr_snk_pdo = tcpm_copy_pdos(port->snk_pdo, tcpc->config->snk_pdo,
                                           tcpc->config->nr_snk_pdo);
-        port->nr_fixed =  nr_type_pdos(port->snk_pdo,
-                                       port->nr_snk_pdo,
-                                       PDO_TYPE_FIXED);
-        port->nr_var = nr_type_pdos(port->snk_pdo,
-                                    port->nr_snk_pdo,
-                                    PDO_TYPE_VAR);
-        port->nr_batt = nr_type_pdos(port->snk_pdo,
-                                     port->nr_snk_pdo,
-                                     PDO_TYPE_BATT);
         port->nr_snk_vdo = tcpm_copy_vdos(port->snk_vdo, tcpc->config->snk_vdo,
                                           tcpc->config->nr_snk_vdo);
 
diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c
index d86f72bbbb91..6dcd3ff655c3 100644
--- a/drivers/usb/usbip/vudc_sysfs.c
+++ b/drivers/usb/usbip/vudc_sysfs.c
@@ -105,10 +105,14 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a
         if (rv != 0)
                 return -EINVAL;
 
+        if (!udc) {
+                dev_err(dev, "no device");
+                return -ENODEV;
+        }
         spin_lock_irqsave(&udc->lock, flags);
         /* Don't export what we don't have */
-        if (!udc || !udc->driver || !udc->pullup) {
-                dev_err(dev, "no device or gadget not bound");
+        if (!udc->driver || !udc->pullup) {
+                dev_err(dev, "gadget not bound");
                 ret = -ENODEV;
                 goto unlock;
         }
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index e30e29ae4819..45657e2b1ff7 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -338,11 +338,12 @@ static int vaddr_get_pfn(struct mm_struct *mm, unsigned long vaddr,
 {
         struct page *page[1];
         struct vm_area_struct *vma;
+        struct vm_area_struct *vmas[1];
         int ret;
 
         if (mm == current->mm) {
-                ret = get_user_pages_fast(vaddr, 1, !!(prot & IOMMU_WRITE),
-                                          page);
+                ret = get_user_pages_longterm(vaddr, 1, !!(prot & IOMMU_WRITE),
+                                              page, vmas);
         } else {
                 unsigned int flags = 0;
 
@@ -351,7 +352,18 @@ static int vaddr_get_pfn(struct mm_struct *mm, unsigned long vaddr,
 
                 down_read(&mm->mmap_sem);
                 ret = get_user_pages_remote(NULL, mm, vaddr, 1, flags, page,
-                                            NULL, NULL);
+                                            vmas, NULL);
+                /*
+                 * The lifetime of a vaddr_get_pfn() page pin is
+                 * userspace-controlled. In the fs-dax case this could
+                 * lead to indefinite stalls in filesystem operations.
+                 * Disallow attempts to pin fs-dax pages via this
+                 * interface.
+                 */
+                if (ret > 0 && vma_is_fsdax(vmas[0])) {
+                        ret = -EOPNOTSUPP;
+                        put_page(page[0]);
+                }
                 up_read(&mm->mmap_sem);
         }
 
diff --git a/drivers/video/fbdev/sbuslib.c b/drivers/video/fbdev/sbuslib.c
index af6fc97f4ba4..a436d44f1b7f 100644
--- a/drivers/video/fbdev/sbuslib.c
+++ b/drivers/video/fbdev/sbuslib.c
@@ -122,7 +122,7 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg,
                 unsigned char __user *ured;
                 unsigned char __user *ugreen;
                 unsigned char __user *ublue;
-                int index, count, i;
+                unsigned int index, count, i;
 
                 if (get_user(index, &c->index) ||
                     __get_user(count, &c->count) ||
@@ -161,7 +161,7 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg,
                 unsigned char __user *ugreen;
                 unsigned char __user *ublue;
                 struct fb_cmap *cmap = &info->cmap;
-                int index, count, i;
+                unsigned int index, count, i;
                 u8 red, green, blue;
 
                 if (get_user(index, &c->index) ||
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index eb30f3e09a47..71458f493cf8 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -428,8 +428,6 @@ unmap_release:
                 i = virtio16_to_cpu(_vq->vdev, vq->vring.desc[i].next);
         }
 
-        vq->vq.num_free += total_sg;
-
         if (indirect)
                 kfree(desc);
 
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index aff773bcebdb..37460cd6cabb 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -226,6 +226,7 @@ config ZIIRAVE_WATCHDOG
 config RAVE_SP_WATCHDOG
         tristate "RAVE SP Watchdog timer"
         depends on RAVE_SP_CORE
+        depends on NVMEM || !NVMEM
         select WATCHDOG_CORE
         help
           Support for the watchdog on RAVE SP device.
@@ -903,6 +904,7 @@ config F71808E_WDT
 config SP5100_TCO
         tristate "AMD/ATI SP5100 TCO Timer/Watchdog"
         depends on X86 && PCI
+        select WATCHDOG_CORE
         ---help---
           Hardware watchdog driver for the AMD/ATI SP5100 chipset. The TCO
           (Total Cost of Ownership) timer is a watchdog timer that will reboot
@@ -1008,6 +1010,7 @@ config WAFER_WDT
 config I6300ESB_WDT
         tristate "Intel 6300ESB Timer/Watchdog"
         depends on PCI
+        select WATCHDOG_CORE
         ---help---
           Hardware driver for the watchdog timer built into the Intel
           6300ESB controller hub.
@@ -1837,6 +1840,7 @@ config WATCHDOG_SUN4V
 config XEN_WDT
         tristate "Xen Watchdog support"
         depends on XEN
+        select WATCHDOG_CORE
         help
           Say Y here to support the hypervisor watchdog capability provided
           by Xen 4.0 and newer.  The watchdog timeout period is normally one
diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c
index e0678c14480f..3a33c5344bd5 100644
--- a/drivers/watchdog/f71808e_wdt.c
+++ b/drivers/watchdog/f71808e_wdt.c
@@ -566,7 +566,8 @@ static ssize_t watchdog_write(struct file *file, const char __user *buf,
                                 char c;
                                 if (get_user(c, buf + i))
                                         return -EFAULT;
-                                expect_close = (c == 'V');
+                                if (c == 'V')
+                                        expect_close = true;
                         }
 
                         /* Properly order writes across fork()ed processes */
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index f1f00dfc0e68..b0a158073abd 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -28,16 +28,7 @@
 #include <linux/types.h>
 #include <linux/uaccess.h>
 #include <linux/watchdog.h>
-#ifdef CONFIG_HPWDT_NMI_DECODING
-#include <linux/dmi.h>
-#include <linux/spinlock.h>
-#include <linux/nmi.h>
-#include <linux/kdebug.h>
-#include <linux/notifier.h>
-#include <asm/set_memory.h>
-#endif /* CONFIG_HPWDT_NMI_DECODING */
 #include <asm/nmi.h>
-#include <asm/frame.h>
 
 #define HPWDT_VERSION                   "1.4.0"
 #define SECS_TO_TICKS(secs)             ((secs) * 1000 / 128)
@@ -48,6 +39,9 @@
 static unsigned int soft_margin = DEFAULT_MARGIN;       /* in seconds */
 static unsigned int reload;                     /* the computed soft_margin */
 static bool nowayout = WATCHDOG_NOWAYOUT;
+#ifdef CONFIG_HPWDT_NMI_DECODING
+static unsigned int allow_kdump = 1;
+#endif
 static char expect_release;
 static unsigned long hpwdt_is_open;
 
@@ -63,373 +57,6 @@ static const struct pci_device_id hpwdt_devices[] = {
 };
 MODULE_DEVICE_TABLE(pci, hpwdt_devices);
 
-#ifdef CONFIG_HPWDT_NMI_DECODING
-#define PCI_BIOS32_SD_VALUE             0x5F32335F      /* "_32_" */
-#define CRU_BIOS_SIGNATURE_VALUE        0x55524324
-#define PCI_BIOS32_PARAGRAPH_LEN        16
-#define PCI_ROM_BASE1                   0x000F0000
-#define ROM_SIZE                        0x10000
-
-struct bios32_service_dir {
-        u32 signature;
-        u32 entry_point;
-        u8 revision;
-        u8 length;
-        u8 checksum;
-        u8 reserved[5];
-};
-
-/* type 212 */
-struct smbios_cru64_info {
-        u8 type;
-        u8 byte_length;
-        u16 handle;
-        u32 signature;
-        u64 physical_address;
-        u32 double_length;
-        u32 double_offset;
-};
-#define SMBIOS_CRU64_INFORMATION        212
-
-/* type 219 */
-struct smbios_proliant_info {
-        u8 type;
-        u8 byte_length;
-        u16 handle;
-        u32 power_features;
-        u32 omega_features;
-        u32 reserved;
-        u32 misc_features;
-};
-#define SMBIOS_ICRU_INFORMATION         219
-
-
-struct cmn_registers {
-        union {
-                struct {
-                        u8 ral;
-                        u8 rah;
-                        u16 rea2;
-                };
-                u32 reax;
-        } u1;
-        union {
-                struct {
-                        u8 rbl;
-                        u8 rbh;
-                        u8 reb2l;
-                        u8 reb2h;
-                };
-                u32 rebx;
-        } u2;
-        union {
-                struct {
-                        u8 rcl;
-                        u8 rch;
-                        u16 rec2;
-                };
-                u32 recx;
-        } u3;
-        union {
-                struct {
-                        u8 rdl;
-                        u8 rdh;
-                        u16 red2;
-                };
-                u32 redx;
-        } u4;
-
-        u32 resi;
-        u32 redi;
-        u16 rds;
-        u16 res;
-        u32 reflags;
-}  __attribute__((packed));
-
-static unsigned int hpwdt_nmi_decoding;
-static unsigned int allow_kdump = 1;
-static unsigned int is_icru;
-static unsigned int is_uefi;
-static DEFINE_SPINLOCK(rom_lock);
-static void *cru_rom_addr;
-static struct cmn_registers cmn_regs;
-
-extern asmlinkage void asminline_call(struct cmn_registers *pi86Regs,
-                                                unsigned long *pRomEntry);
-
-#ifdef CONFIG_X86_32
-/* --32 Bit Bios------------------------------------------------------------ */
-
-#define HPWDT_ARCH      32
-
-asm(".text                          \n\t"
-    ".align 4                       \n\t"
-    ".globl asminline_call          \n"
-    "asminline_call:                \n\t"
-    "pushl       %ebp               \n\t"
-    "movl        %esp, %ebp         \n\t"
-    "pusha                          \n\t"
-    "pushf                          \n\t"
-    "push        %es                \n\t"
-    "push        %ds                \n\t"
-    "pop         %es                \n\t"
-    "movl        8(%ebp),%eax       \n\t"
-    "movl        4(%eax),%ebx       \n\t"
-    "movl        8(%eax),%ecx       \n\t"
-    "movl        12(%eax),%edx      \n\t"
-    "movl        16(%eax),%esi      \n\t"
-    "movl        20(%eax),%edi      \n\t"
-    "movl        (%eax),%eax        \n\t"
-    "push        %cs                \n\t"
-    "call        *12(%ebp)          \n\t"
-    "pushf                          \n\t"
-    "pushl       %eax               \n\t"
-    "movl        8(%ebp),%eax       \n\t"
-    "movl        %ebx,4(%eax)       \n\t"
-    "movl        %ecx,8(%eax)       \n\t"
-    "movl        %edx,12(%eax)      \n\t"
-    "movl        %esi,16(%eax)      \n\t"
-    "movl        %edi,20(%eax)      \n\t"
-    "movw        %ds,24(%eax)       \n\t"
-    "movw        %es,26(%eax)       \n\t"
-    "popl        %ebx               \n\t"
-    "movl        %ebx,(%eax)        \n\t"
-    "popl        %ebx               \n\t"
-    "movl        %ebx,28(%eax)      \n\t"
-    "pop         %es                \n\t"
-    "popf                           \n\t"
-    "popa                           \n\t"
-    "leave                          \n\t"
-    "ret                            \n\t"
-    ".previous");
-
-
-/*
- *      cru_detect
- *
- *      Routine Description:
- *      This function uses the 32-bit BIOS Service Directory record to
- *      search for a $CRU record.
- *
- *      Return Value:
- *      0        :  SUCCESS
- *      <0       :  FAILURE
- */
-static int cru_detect(unsigned long map_entry,
-        unsigned long map_offset)
-{
-        void *bios32_map;
-        unsigned long *bios32_entrypoint;
-        unsigned long cru_physical_address;
-        unsigned long cru_length;
-        unsigned long physical_bios_base = 0;
-        unsigned long physical_bios_offset = 0;
-        int retval = -ENODEV;
-
-        bios32_map = ioremap(map_entry, (2 * PAGE_SIZE));
-
-        if (bios32_map == NULL)
-                return -ENODEV;
-
-        bios32_entrypoint = bios32_map + map_offset;
-
-        cmn_regs.u1.reax = CRU_BIOS_SIGNATURE_VALUE;
-
-        set_memory_x((unsigned long)bios32_map, 2);
-        asminline_call(&cmn_regs, bios32_entrypoint);
-
-        if (cmn_regs.u1.ral != 0) {
-                pr_warn("Call succeeded but with an error: 0x%x\n",
-                        cmn_regs.u1.ral);
-        } else {
-                physical_bios_base = cmn_regs.u2.rebx;
-                physical_bios_offset = cmn_regs.u4.redx;
-                cru_length = cmn_regs.u3.recx;
-                cru_physical_address =
-                        physical_bios_base + physical_bios_offset;
-
-                /* If the values look OK, then map it in. */
-                if ((physical_bios_base + physical_bios_offset)) {
-                        cru_rom_addr =
-                                ioremap(cru_physical_address, cru_length);
-                        if (cru_rom_addr) {
-                                set_memory_x((unsigned long)cru_rom_addr & PAGE_MASK,
-                                        (cru_length + PAGE_SIZE - 1) >> PAGE_SHIFT);
-                                retval = 0;
-                        }
-                }
-
-                pr_debug("CRU Base Address:   0x%lx\n", physical_bios_base);
-                pr_debug("CRU Offset Address: 0x%lx\n", physical_bios_offset);
-                pr_debug("CRU Length:         0x%lx\n", cru_length);
-                pr_debug("CRU Mapped Address: %p\n", &cru_rom_addr);
-        }
-        iounmap(bios32_map);
-        return retval;
-}
-
-/*
- *      bios_checksum
- */
-static int bios_checksum(const char __iomem *ptr, int len)
-{
-        char sum = 0;
-        int i;
-
-        /*
-         * calculate checksum of size bytes. This should add up
-         * to zero if we have a valid header.
-         */
-        for (i = 0; i < len; i++)
-                sum += ptr[i];
-
-        return ((sum == 0) && (len > 0));
-}
-
-/*
- *      bios32_present
- *
- *      Routine Description:
- *      This function finds the 32-bit BIOS Service Directory
- *
- *      Return Value:
- *      0        :  SUCCESS
- *      <0       :  FAILURE
- */
-static int bios32_present(const char __iomem *p)
-{
-        struct bios32_service_dir *bios_32_ptr;
-        int length;
-        unsigned long map_entry, map_offset;
-
-        bios_32_ptr = (struct bios32_service_dir *) p;
-
-        /*
-         * Search for signature by checking equal to the swizzled value
-         * instead of calling another routine to perform a strcmp.
-         */
-        if (bios_32_ptr->signature == PCI_BIOS32_SD_VALUE) {
-                length = bios_32_ptr->length * PCI_BIOS32_PARAGRAPH_LEN;
-                if (bios_checksum(p, length)) {
-                        /*
-                         * According to the spec, we're looking for the
-                         * first 4KB-aligned address below the entrypoint
-                         * listed in the header. The Service Directory code
-                         * is guaranteed to occupy no more than 2 4KB pages.
-                         */
-                        map_entry = bios_32_ptr->entry_point & ~(PAGE_SIZE - 1);
-                        map_offset = bios_32_ptr->entry_point - map_entry;
-
-                        return cru_detect(map_entry, map_offset);
-                }
-        }
-        return -ENODEV;
-}
-
-static int detect_cru_service(void)
-{
-        char __iomem *p, *q;
-        int rc = -1;
-
-        /*
-         * Search from 0x0f0000 through 0x0fffff, inclusive.
-         */
-        p = ioremap(PCI_ROM_BASE1, ROM_SIZE);
-        if (p == NULL)
-                return -ENOMEM;
-
-        for (q = p; q < p + ROM_SIZE; q += 16) {
-                rc = bios32_present(q);
-                if (!rc)
-                        break;
-        }
-        iounmap(p);
-        return rc;
-}
-/* ------------------------------------------------------------------------- */
-#endif /* CONFIG_X86_32 */
-#ifdef CONFIG_X86_64
-/* --64 Bit Bios------------------------------------------------------------ */
-
-#define HPWDT_ARCH      64
-
-asm(".text                      \n\t"
-    ".align 4                   \n\t"
-    ".globl asminline_call      \n\t"
-    ".type asminline_call, @function \n\t"
-    "asminline_call:            \n\t"
-    FRAME_BEGIN
-    "pushq      %rax            \n\t"
-    "pushq      %rbx            \n\t"
-    "pushq      %rdx            \n\t"
-    "pushq      %r12            \n\t"
-    "pushq      %r9             \n\t"
-    "movq       %rsi, %r12      \n\t"
-    "movq       %rdi, %r9       \n\t"
-    "movl       4(%r9),%ebx     \n\t"
-    "movl       8(%r9),%ecx     \n\t"
-    "movl       12(%r9),%edx    \n\t"
-    "movl       16(%r9),%esi    \n\t"
-    "movl       20(%r9),%edi    \n\t"
-    "movl       (%r9),%eax      \n\t"
-    "call       *%r12           \n\t"
-    "pushfq                     \n\t"
-    "popq        %r12           \n\t"
-    "movl       %eax, (%r9)     \n\t"
-    "movl       %ebx, 4(%r9)    \n\t"
-    "movl       %ecx, 8(%r9)    \n\t"
-    "movl       %edx, 12(%r9)   \n\t"
-    "movl       %esi, 16(%r9)   \n\t"
-    "movl       %edi, 20(%r9)   \n\t"
-    "movq       %r12, %rax      \n\t"
-    "movl       %eax, 28(%r9)   \n\t"
-    "popq       %r9             \n\t"
-    "popq       %r12            \n\t"
-    "popq       %rdx            \n\t"
-    "popq       %rbx            \n\t"
-    "popq       %rax            \n\t"
-    FRAME_END
-    "ret                        \n\t"
-    ".previous");
-
-/*
- *      dmi_find_cru
- *
- *      Routine Description:
- *      This function checks whether or not a SMBIOS/DMI record is
- *      the 64bit CRU info or not
- */
-static void dmi_find_cru(const struct dmi_header *dm, void *dummy)
-{
-        struct smbios_cru64_info *smbios_cru64_ptr;
-        unsigned long cru_physical_address;
-
-        if (dm->type == SMBIOS_CRU64_INFORMATION) {
-                smbios_cru64_ptr = (struct smbios_cru64_info *) dm;
-                if (smbios_cru64_ptr->signature == CRU_BIOS_SIGNATURE_VALUE) {
-                        cru_physical_address =
-                                smbios_cru64_ptr->physical_address +
-                                smbios_cru64_ptr->double_offset;
-                        cru_rom_addr = ioremap(cru_physical_address,
-                                smbios_cru64_ptr->double_length);
-                        set_memory_x((unsigned long)cru_rom_addr & PAGE_MASK,
-                                smbios_cru64_ptr->double_length >> PAGE_SHIFT);
-                }
-        }
-}
-
-static int detect_cru_service(void)
-{
-        cru_rom_addr = NULL;
-
-        dmi_walk(dmi_find_cru, NULL);
-
-        /* if cru_rom_addr has been set then we found a CRU service */
-        return ((cru_rom_addr != NULL) ? 0 : -ENODEV);
-}
-/* ------------------------------------------------------------------------- */
-#endif /* CONFIG_X86_64 */
-#endif /* CONFIG_HPWDT_NMI_DECODING */
 
 /*
  *      Watchdog operations
@@ -486,30 +113,12 @@ static int hpwdt_my_nmi(void)
  */
 static int hpwdt_pretimeout(unsigned int ulReason, struct pt_regs *regs)
 {
-        unsigned long rom_pl;
-        static int die_nmi_called;
-
-        if (!hpwdt_nmi_decoding)
-                return NMI_DONE;
-
         if ((ulReason == NMI_UNKNOWN) && !hpwdt_my_nmi())
                 return NMI_DONE;
 
-        spin_lock_irqsave(&rom_lock, rom_pl);
-        if (!die_nmi_called && !is_icru && !is_uefi)
-                asminline_call(&cmn_regs, cru_rom_addr);
-        die_nmi_called = 1;
-        spin_unlock_irqrestore(&rom_lock, rom_pl);
-
         if (allow_kdump)
                 hpwdt_stop();
 
-        if (!is_icru && !is_uefi) {
-                if (cmn_regs.u1.ral == 0) {
-                        nmi_panic(regs, "An NMI occurred, but unable to determine source.\n");
-                        return NMI_HANDLED;
-                }
-        }
         nmi_panic(regs, "An NMI occurred. Depending on your system the reason "
                 "for the NMI is logged in any one of the following "
                 "resources:\n"
@@ -675,84 +284,11 @@ static struct miscdevice hpwdt_miscdev = {
  *      Init & Exit
  */
 
-#ifdef CONFIG_HPWDT_NMI_DECODING
-#ifdef CONFIG_X86_LOCAL_APIC
-static void hpwdt_check_nmi_decoding(struct pci_dev *dev)
-{
-        /*
-         * If nmi_watchdog is turned off then we can turn on
-         * our nmi decoding capability.
-         */
-        hpwdt_nmi_decoding = 1;
-}
-#else
-static void hpwdt_check_nmi_decoding(struct pci_dev *dev)
-{
-        dev_warn(&dev->dev, "NMI decoding is disabled. "
-                "Your kernel does not support a NMI Watchdog.\n");
-}
-#endif /* CONFIG_X86_LOCAL_APIC */
-
-/*
- *      dmi_find_icru
- *
- *      Routine Description:
- *      This function checks whether or not we are on an iCRU-based server.
- *      This check is independent of architecture and needs to be made for
- *      any ProLiant system.
- */
-static void dmi_find_icru(const struct dmi_header *dm, void *dummy)
-{
-        struct smbios_proliant_info *smbios_proliant_ptr;
-
-        if (dm->type == SMBIOS_ICRU_INFORMATION) {
-                smbios_proliant_ptr = (struct smbios_proliant_info *) dm;
-                if (smbios_proliant_ptr->misc_features & 0x01)
-                        is_icru = 1;
-                if (smbios_proliant_ptr->misc_features & 0x1400)
-                        is_uefi = 1;
-        }
-}
 
 static int hpwdt_init_nmi_decoding(struct pci_dev *dev)
 {
+#ifdef CONFIG_HPWDT_NMI_DECODING
         int retval;
-
-        /*
-         * On typical CRU-based systems we need to map that service in
-         * the BIOS. For 32 bit Operating Systems we need to go through
-         * the 32 Bit BIOS Service Directory. For 64 bit Operating
-         * Systems we get that service through SMBIOS.
-         *
-         * On systems that support the new iCRU service all we need to
-         * do is call dmi_walk to get the supported flag value and skip
-         * the old cru detect code.
-         */
-        dmi_walk(dmi_find_icru, NULL);
-        if (!is_icru && !is_uefi) {
-
-                /*
-                * We need to map the ROM to get the CRU service.
-                * For 32 bit Operating Systems we need to go through the 32 Bit
-                * BIOS Service Directory
-                * For 64 bit Operating Systems we get that service through SMBIOS.
-                */
-                retval = detect_cru_service();
-                if (retval < 0) {
-                        dev_warn(&dev->dev,
-                                "Unable to detect the %d Bit CRU Service.\n",
-                                HPWDT_ARCH);
-                        return retval;
-                }
-
-                /*
-                * We know this is the only CRU call we need to make so lets keep as
-                * few instructions as possible once the NMI comes in.
-                */
-                cmn_regs.u1.rah = 0x0D;
-                cmn_regs.u1.ral = 0x02;
-        }
-
         /*
          * Only one function can register for NMI_UNKNOWN
          */
@@ -780,45 +316,26 @@ error:
         dev_warn(&dev->dev,
                 "Unable to register a die notifier (err=%d).\n",
                 retval);
-        if (cru_rom_addr)
-                iounmap(cru_rom_addr);
         return retval;
+#endif  /* CONFIG_HPWDT_NMI_DECODING */
+        return 0;
 }
 
 static void hpwdt_exit_nmi_decoding(void)
 {
+#ifdef CONFIG_HPWDT_NMI_DECODING
         unregister_nmi_handler(NMI_UNKNOWN, "hpwdt");
         unregister_nmi_handler(NMI_SERR, "hpwdt");
         unregister_nmi_handler(NMI_IO_CHECK, "hpwdt");
-        if (cru_rom_addr)
-                iounmap(cru_rom_addr);
-}
-#else /* !CONFIG_HPWDT_NMI_DECODING */
-static void hpwdt_check_nmi_decoding(struct pci_dev *dev)
-{
-}
-
-static int hpwdt_init_nmi_decoding(struct pci_dev *dev)
-{
-        return 0;
+#endif
 }
 
-static void hpwdt_exit_nmi_decoding(void)
-{
-}
-#endif /* CONFIG_HPWDT_NMI_DECODING */
-
 static int hpwdt_init_one(struct pci_dev *dev,
                                         const struct pci_device_id *ent)
 {
         int retval;
 
         /*
-         * Check if we can do NMI decoding or not
-         */
-        hpwdt_check_nmi_decoding(dev);
-
-        /*
          * First let's find out if we are on an iLO2+ server. We will
          * not run on a legacy ASM box.
          * So we only support the G5 ProLiant servers and higher.
@@ -922,6 +439,6 @@ MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
 #ifdef CONFIG_HPWDT_NMI_DECODING
 module_param(allow_kdump, int, 0);
 MODULE_PARM_DESC(allow_kdump, "Start a kernel dump after NMI occurs");
-#endif /* !CONFIG_HPWDT_NMI_DECODING */
+#endif /* CONFIG_HPWDT_NMI_DECODING */
 
 module_pci_driver(hpwdt_driver);
diff --git a/drivers/watchdog/sbsa_gwdt.c b/drivers/watchdog/sbsa_gwdt.c
index 316c2eb122d2..e8bd9887c566 100644
--- a/drivers/watchdog/sbsa_gwdt.c
+++ b/drivers/watchdog/sbsa_gwdt.c
@@ -50,6 +50,7 @@
  */
 
 #include <linux/io.h>
+#include <linux/io-64-nonatomic-lo-hi.h>
 #include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
@@ -159,7 +160,7 @@ static unsigned int sbsa_gwdt_get_timeleft(struct watchdog_device *wdd)
             !(readl(gwdt->control_base + SBSA_GWDT_WCS) & SBSA_GWDT_WCS_WS0))
                 timeleft += readl(gwdt->control_base + SBSA_GWDT_WOR);
 
-        timeleft += readq(gwdt->control_base + SBSA_GWDT_WCV) -
+        timeleft += lo_hi_readq(gwdt->control_base + SBSA_GWDT_WCV) -
                     arch_counter_get_cntvct();
 
         do_div(timeleft, gwdt->clk);
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 1ab4bd11f5f3..762378f1811c 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -755,8 +755,8 @@ out:
         mutex_unlock(&irq_mapping_update_lock);
         return irq;
 error_irq:
-        for (; i >= 0; i--)
-                __unbind_from_irq(irq + i);
+        while (nvec--)
+                __unbind_from_irq(irq + nvec);
         mutex_unlock(&irq_mapping_update_lock);
         return ret;
 }
diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
index 156e5aea36db..b1092fbefa63 100644
--- a/drivers/xen/pvcalls-back.c
+++ b/drivers/xen/pvcalls-back.c
@@ -416,7 +416,7 @@ static int pvcalls_back_connect(struct xenbus_device *dev,
                                         sock);
         if (!map) {
                 ret = -EFAULT;
-                sock_release(map->sock);
+                sock_release(sock);
         }
 
 out:
diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
index aedbee3b2838..2f11ca72a281 100644
--- a/drivers/xen/pvcalls-front.c
+++ b/drivers/xen/pvcalls-front.c
@@ -73,20 +73,25 @@ struct sock_mapping {
                         wait_queue_head_t inflight_conn_req;
                 } active;
                 struct {
-                /* Socket status */
+                /*
+                 * Socket status, needs to be 64-bit aligned due to the
+                 * test_and_* functions which have this requirement on arm64.
+                 */
 #define PVCALLS_STATUS_UNINITALIZED  0
 #define PVCALLS_STATUS_BIND          1
 #define PVCALLS_STATUS_LISTEN        2
-                        uint8_t status;
+                        uint8_t status __attribute__((aligned(8)));
                 /*
                  * Internal state-machine flags.
                  * Only one accept operation can be inflight for a socket.
                  * Only one poll operation can be inflight for a given socket.
+                 * flags needs to be 64-bit aligned due to the test_and_*
+                 * functions which have this requirement on arm64.
                  */
 #define PVCALLS_FLAG_ACCEPT_INFLIGHT 0
 #define PVCALLS_FLAG_POLL_INFLIGHT   1
 #define PVCALLS_FLAG_POLL_RET        2
-                        uint8_t flags;
+                        uint8_t flags __attribute__((aligned(8)));
                         uint32_t inflight_req_id;
                         struct sock_mapping *accept_map;
                         wait_queue_head_t inflight_accept_req;
diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
index 74888cacd0b0..ec9eb4fba59c 100644
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -466,8 +466,11 @@ int xenbus_probe_node(struct xen_bus_type *bus,
 
         /* Register with generic device framework. */
         err = device_register(&xendev->dev);
-        if (err)
+        if (err) {
+                put_device(&xendev->dev);
+                xendev = NULL;
                 goto fail;
+        }
 
         return 0;
 fail:
diff --git a/fs/aio.c b/fs/aio.c
index a062d75109cb..6bcd3fb5265a 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -68,9 +68,9 @@ struct aio_ring {
 #define AIO_RING_PAGES  8
 
 struct kioctx_table {
-        struct rcu_head rcu;
-        unsigned        nr;
-        struct kioctx   *table[];
+        struct rcu_head         rcu;
+        unsigned                nr;
+        struct kioctx __rcu     *table[];
 };
 
 struct kioctx_cpu {
@@ -115,7 +115,8 @@ struct kioctx {
         struct page             **ring_pages;
         long                    nr_pages;
 
-        struct work_struct      free_work;
+        struct rcu_head         free_rcu;
+        struct work_struct      free_work;      /* see free_ioctx() */
 
         /*
          * signals when all in-flight requests are done
@@ -329,7 +330,7 @@ static int aio_ring_mremap(struct vm_area_struct *vma)
         for (i = 0; i < table->nr; i++) {
                 struct kioctx *ctx;
 
-                ctx = table->table[i];
+                ctx = rcu_dereference(table->table[i]);
                 if (ctx && ctx->aio_ring_file == file) {
                         if (!atomic_read(&ctx->dead)) {
                                 ctx->user_id = ctx->mmap_base = vma->vm_start;
@@ -588,6 +589,12 @@ static int kiocb_cancel(struct aio_kiocb *kiocb)
         return cancel(&kiocb->common);
 }
 
+/*
+ * free_ioctx() should be RCU delayed to synchronize against the RCU
+ * protected lookup_ioctx() and also needs process context to call
+ * aio_free_ring(), so the double bouncing through kioctx->free_rcu and
+ * ->free_work.
+ */
 static void free_ioctx(struct work_struct *work)
 {
         struct kioctx *ctx = container_of(work, struct kioctx, free_work);
@@ -601,6 +608,14 @@ static void free_ioctx(struct work_struct *work)
         kmem_cache_free(kioctx_cachep, ctx);
 }
 
+static void free_ioctx_rcufn(struct rcu_head *head)
+{
+        struct kioctx *ctx = container_of(head, struct kioctx, free_rcu);
+
+        INIT_WORK(&ctx->free_work, free_ioctx);
+        schedule_work(&ctx->free_work);
+}
+
 static void free_ioctx_reqs(struct percpu_ref *ref)
 {
         struct kioctx *ctx = container_of(ref, struct kioctx, reqs);
@@ -609,8 +624,8 @@ static void free_ioctx_reqs(struct percpu_ref *ref)
         if (ctx->rq_wait && atomic_dec_and_test(&ctx->rq_wait->count))
                 complete(&ctx->rq_wait->comp);
 
-        INIT_WORK(&ctx->free_work, free_ioctx);
-        schedule_work(&ctx->free_work);
+        /* Synchronize against RCU protected table->table[] dereferences */
+        call_rcu(&ctx->free_rcu, free_ioctx_rcufn);
 }
 
 /*
@@ -651,9 +666,9 @@ static int ioctx_add_table(struct kioctx *ctx, struct mm_struct *mm)
         while (1) {
                 if (table)
                         for (i = 0; i < table->nr; i++)
-                                if (!table->table[i]) {
+                                if (!rcu_access_pointer(table->table[i])) {
                                         ctx->id = i;
-                                        table->table[i] = ctx;
+                                        rcu_assign_pointer(table->table[i], ctx);
                                         spin_unlock(&mm->ioctx_lock);
 
                                         /* While kioctx setup is in progress,
@@ -834,11 +849,11 @@ static int kill_ioctx(struct mm_struct *mm, struct kioctx *ctx,
         }
 
         table = rcu_dereference_raw(mm->ioctx_table);
-        WARN_ON(ctx != table->table[ctx->id]);
-        table->table[ctx->id] = NULL;
+        WARN_ON(ctx != rcu_access_pointer(table->table[ctx->id]));
+        RCU_INIT_POINTER(table->table[ctx->id], NULL);
         spin_unlock(&mm->ioctx_lock);
 
-        /* percpu_ref_kill() will do the necessary call_rcu() */
+        /* free_ioctx_reqs() will do the necessary RCU synchronization */
         wake_up_all(&ctx->wait);
 
         /*
@@ -880,7 +895,8 @@ void exit_aio(struct mm_struct *mm)
 
         skipped = 0;
         for (i = 0; i < table->nr; ++i) {
-                struct kioctx *ctx = table->table[i];
+                struct kioctx *ctx =
+                        rcu_dereference_protected(table->table[i], true);
 
                 if (!ctx) {
                         skipped++;
@@ -1069,7 +1085,7 @@ static struct kioctx *lookup_ioctx(unsigned long ctx_id)
         if (!table || id >= table->nr)
                 goto out;
 
-        ctx = table->table[id];
+        ctx = rcu_dereference(table->table[id]);
         if (ctx && ctx->user_id == ctx_id) {
                 percpu_ref_get(&ctx->users);
                 ret = ctx;
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 4a181fcb5175..fe09ef9c21f3 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1058,6 +1058,27 @@ retry:
         return 0;
 }
 
+static struct gendisk *bdev_get_gendisk(struct block_device *bdev, int *partno)
+{
+        struct gendisk *disk = get_gendisk(bdev->bd_dev, partno);
+
+        if (!disk)
+                return NULL;
+        /*
+         * Now that we hold gendisk reference we make sure bdev we looked up is
+         * not stale. If it is, it means device got removed and created before
+         * we looked up gendisk and we fail open in such case. Associating
+         * unhashed bdev with newly created gendisk could lead to two bdevs
+         * (and thus two independent caches) being associated with one device
+         * which is bad.
+         */
+        if (inode_unhashed(bdev->bd_inode)) {
+                put_disk_and_module(disk);
+                return NULL;
+        }
+        return disk;
+}
+
 /**
  * bd_start_claiming - start claiming a block device
  * @bdev: block device of interest
@@ -1094,7 +1115,7 @@ static struct block_device *bd_start_claiming(struct block_device *bdev,
          * @bdev might not have been initialized properly yet, look up
          * and grab the outer block device the hard way.
          */
-        disk = get_gendisk(bdev->bd_dev, &partno);
+        disk = bdev_get_gendisk(bdev, &partno);
         if (!disk)
                 return ERR_PTR(-ENXIO);
 
@@ -1111,8 +1132,7 @@ static struct block_device *bd_start_claiming(struct block_device *bdev,
         else
                 whole = bdgrab(bdev);
 
-        module_put(disk->fops->owner);
-        put_disk(disk);
+        put_disk_and_module(disk);
         if (!whole)
                 return ERR_PTR(-ENOMEM);
 
@@ -1407,10 +1427,10 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part);
 static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
 {
         struct gendisk *disk;
-        struct module *owner;
         int ret;
         int partno;
         int perm = 0;
+        bool first_open = false;
 
         if (mode & FMODE_READ)
                 perm |= MAY_READ;
@@ -1430,14 +1450,14 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
  restart:
 
         ret = -ENXIO;
-        disk = get_gendisk(bdev->bd_dev, &partno);
+        disk = bdev_get_gendisk(bdev, &partno);
         if (!disk)
                 goto out;
-        owner = disk->fops->owner;
 
         disk_block_events(disk);
         mutex_lock_nested(&bdev->bd_mutex, for_part);
         if (!bdev->bd_openers) {
+                first_open = true;
                 bdev->bd_disk = disk;
                 bdev->bd_queue = disk->queue;
                 bdev->bd_contains = bdev;
@@ -1463,8 +1483,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                                         bdev->bd_queue = NULL;
                                         mutex_unlock(&bdev->bd_mutex);
                                         disk_unblock_events(disk);
-                                        put_disk(disk);
-                                        module_put(owner);
+                                        put_disk_and_module(disk);
                                         goto restart;
                                 }
                         }
@@ -1524,15 +1543,15 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                         if (ret)
                                 goto out_unlock_bdev;
                 }
-                /* only one opener holds refs to the module and disk */
-                put_disk(disk);
-                module_put(owner);
         }
         bdev->bd_openers++;
         if (for_part)
                 bdev->bd_part_count++;
         mutex_unlock(&bdev->bd_mutex);
         disk_unblock_events(disk);
+        /* only one opener holds refs to the module and disk */
+        if (!first_open)
+                put_disk_and_module(disk);
         return 0;
 
  out_clear:
@@ -1546,8 +1565,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
  out_unlock_bdev:
         mutex_unlock(&bdev->bd_mutex);
         disk_unblock_events(disk);
-        put_disk(disk);
-        module_put(owner);
+        put_disk_and_module(disk);
  out:
         bdput(bdev);
 
@@ -1770,8 +1788,6 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part)
                         disk->fops->release(disk, mode);
         }
         if (!bdev->bd_openers) {
-                struct module *owner = disk->fops->owner;
-
                 disk_put_part(bdev->bd_part);
                 bdev->bd_part = NULL;
                 bdev->bd_disk = NULL;
@@ -1779,8 +1795,7 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part)
                         victim = bdev->bd_contains;
                 bdev->bd_contains = NULL;
 
-                put_disk(disk);
-                module_put(owner);
+                put_disk_and_module(disk);
         }
         mutex_unlock(&bdev->bd_mutex);
         bdput(bdev);
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index f94b2d8c744a..26484648d090 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -1519,6 +1519,7 @@ int btrfs_check_shared(struct btrfs_root *root, u64 inum, u64 bytenr)
                 if (!node)
                         break;
                 bytenr = node->val;
+                shared.share_count = 0;
                 cond_resched();
         }
 
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 1a462ab85c49..da308774b8a4 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -2974,7 +2974,7 @@ static inline void free_fs_info(struct btrfs_fs_info *fs_info)
         kfree(fs_info->super_copy);
         kfree(fs_info->super_for_commit);
         security_free_mnt_opts(&fs_info->security_opts);
-        kfree(fs_info);
+        kvfree(fs_info);
 }
 
 /* tree mod log functions from ctree.c */
@@ -3095,7 +3095,10 @@ btrfs_lookup_inode_extref(struct btrfs_trans_handle *trans,
                           u64 inode_objectid, u64 ref_objectid, int ins_len,
                           int cow);
 
-int btrfs_find_name_in_ext_backref(struct btrfs_path *path,
+int btrfs_find_name_in_backref(struct extent_buffer *leaf, int slot,
+                               const char *name,
+                               int name_len, struct btrfs_inode_ref **ref_ret);
+int btrfs_find_name_in_ext_backref(struct extent_buffer *leaf, int slot,
                                    u64 ref_objectid, const char *name,
                                    int name_len,
                                    struct btrfs_inode_extref **extref_ret);
diff --git a/fs/btrfs/inode-item.c b/fs/btrfs/inode-item.c
index 39c968f80157..65e1a76bf755 100644
--- a/fs/btrfs/inode-item.c
+++ b/fs/btrfs/inode-item.c
@@ -22,10 +22,10 @@
 #include "transaction.h"
 #include "print-tree.h"
 
-static int find_name_in_backref(struct btrfs_path *path, const char *name,
-                         int name_len, struct btrfs_inode_ref **ref_ret)
+int btrfs_find_name_in_backref(struct extent_buffer *leaf, int slot,
+                               const char *name,
+                               int name_len, struct btrfs_inode_ref **ref_ret)
 {
-        struct extent_buffer *leaf;
         struct btrfs_inode_ref *ref;
         unsigned long ptr;
         unsigned long name_ptr;
@@ -33,9 +33,8 @@ static int find_name_in_backref(struct btrfs_path *path, const char *name,
         u32 cur_offset = 0;
         int len;
 
-        leaf = path->nodes[0];
-        item_size = btrfs_item_size_nr(leaf, path->slots[0]);
-        ptr = btrfs_item_ptr_offset(leaf, path->slots[0]);
+        item_size = btrfs_item_size_nr(leaf, slot);
+        ptr = btrfs_item_ptr_offset(leaf, slot);
         while (cur_offset < item_size) {
                 ref = (struct btrfs_inode_ref *)(ptr + cur_offset);
                 len = btrfs_inode_ref_name_len(leaf, ref);
@@ -44,18 +43,19 @@ static int find_name_in_backref(struct btrfs_path *path, const char *name,
                 if (len != name_len)
                         continue;
                 if (memcmp_extent_buffer(leaf, name, name_ptr, name_len) == 0) {
-                        *ref_ret = ref;
+                        if (ref_ret)
+                                *ref_ret = ref;
                         return 1;
                 }
         }
         return 0;
 }
 
-int btrfs_find_name_in_ext_backref(struct btrfs_path *path, u64 ref_objectid,
+int btrfs_find_name_in_ext_backref(struct extent_buffer *leaf, int slot,
+                                   u64 ref_objectid,
                                    const char *name, int name_len,
                                    struct btrfs_inode_extref **extref_ret)
 {
-        struct extent_buffer *leaf;
         struct btrfs_inode_extref *extref;
         unsigned long ptr;
         unsigned long name_ptr;
@@ -63,9 +63,8 @@ int btrfs_find_name_in_ext_backref(struct btrfs_path *path, u64 ref_objectid,
         u32 cur_offset = 0;
         int ref_name_len;
 
-        leaf = path->nodes[0];
-        item_size = btrfs_item_size_nr(leaf, path->slots[0]);
-        ptr = btrfs_item_ptr_offset(leaf, path->slots[0]);
+        item_size = btrfs_item_size_nr(leaf, slot);
+        ptr = btrfs_item_ptr_offset(leaf, slot);
 
         /*
          * Search all extended backrefs in this item. We're only
@@ -113,7 +112,9 @@ btrfs_lookup_inode_extref(struct btrfs_trans_handle *trans,
                 return ERR_PTR(ret);
         if (ret > 0)
                 return NULL;
-        if (!btrfs_find_name_in_ext_backref(path, ref_objectid, name, name_len, &extref))
+        if (!btrfs_find_name_in_ext_backref(path->nodes[0], path->slots[0],
+                                            ref_objectid, name, name_len,
+                                            &extref))
                 return NULL;
         return extref;
 }
@@ -155,7 +156,8 @@ static int btrfs_del_inode_extref(struct btrfs_trans_handle *trans,
          * This should always succeed so error here will make the FS
          * readonly.
          */
-        if (!btrfs_find_name_in_ext_backref(path, ref_objectid,
+        if (!btrfs_find_name_in_ext_backref(path->nodes[0], path->slots[0],
+                                            ref_objectid,
                                             name, name_len, &extref)) {
                 btrfs_handle_fs_error(root->fs_info, -ENOENT, NULL);
                 ret = -EROFS;
@@ -225,7 +227,8 @@ int btrfs_del_inode_ref(struct btrfs_trans_handle *trans,
         } else if (ret < 0) {
                 goto out;
         }
-        if (!find_name_in_backref(path, name, name_len, &ref)) {
+        if (!btrfs_find_name_in_backref(path->nodes[0], path->slots[0],
+                                        name, name_len, &ref)) {
                 ret = -ENOENT;
                 search_ext_refs = 1;
                 goto out;
@@ -293,7 +296,9 @@ static int btrfs_insert_inode_extref(struct btrfs_trans_handle *trans,
         ret = btrfs_insert_empty_item(trans, root, path, &key,
                                       ins_len);
         if (ret == -EEXIST) {
-                if (btrfs_find_name_in_ext_backref(path, ref_objectid,
+                if (btrfs_find_name_in_ext_backref(path->nodes[0],
+                                                   path->slots[0],
+                                                   ref_objectid,
                                                    name, name_len, NULL))
                         goto out;
 
@@ -351,7 +356,8 @@ int btrfs_insert_inode_ref(struct btrfs_trans_handle *trans,
         if (ret == -EEXIST) {
                 u32 old_size;
 
-                if (find_name_in_backref(path, name, name_len, &ref))
+                if (btrfs_find_name_in_backref(path->nodes[0], path->slots[0],
+                                               name, name_len, &ref))
                         goto out;
 
                 old_size = btrfs_item_size_nr(path->nodes[0], path->slots[0]);
@@ -365,7 +371,9 @@ int btrfs_insert_inode_ref(struct btrfs_trans_handle *trans,
                 ret = 0;
         } else if (ret < 0) {
                 if (ret == -EOVERFLOW) {
-                        if (find_name_in_backref(path, name, name_len, &ref))
+                        if (btrfs_find_name_in_backref(path->nodes[0],
+                                                       path->slots[0],
+                                                       name, name_len, &ref))
                                 ret = -EEXIST;
                         else
                                 ret = -EMLINK;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index a79299a89b7d..f53470112670 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -2043,12 +2043,15 @@ static noinline int add_pending_csums(struct btrfs_trans_handle *trans,
                              struct inode *inode, struct list_head *list)
 {
         struct btrfs_ordered_sum *sum;
+        int ret;
 
         list_for_each_entry(sum, list, list) {
                 trans->adding_csums = true;
-                btrfs_csum_file_blocks(trans,
+                ret = btrfs_csum_file_blocks(trans,
                        BTRFS_I(inode)->root->fs_info->csum_root, sum);
                 trans->adding_csums = false;
+                if (ret)
+                        return ret;
         }
         return 0;
 }
@@ -3062,7 +3065,11 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent)
                 goto out;
         }
 
-        add_pending_csums(trans, inode, &ordered_extent->list);
+        ret = add_pending_csums(trans, inode, &ordered_extent->list);
+        if (ret) {
+                btrfs_abort_transaction(trans, ret);
+                goto out;
+        }
 
         btrfs_ordered_update_i_size(inode, 0, ordered_extent);
         ret = btrfs_update_inode_fallback(trans, root, inode);
diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
index dec0907dfb8a..fcfc20de2df3 100644
--- a/fs/btrfs/raid56.c
+++ b/fs/btrfs/raid56.c
@@ -1370,6 +1370,7 @@ static int find_bio_stripe(struct btrfs_raid_bio *rbio,
                 stripe_start = stripe->physical;
                 if (physical >= stripe_start &&
                     physical < stripe_start + rbio->stripe_len &&
+                    stripe->dev->bdev &&
                     bio->bi_disk == stripe->dev->bdev->bd_disk &&
                     bio->bi_partno == stripe->dev->bdev->bd_partno) {
                         return i;
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index f0c3f00e97cb..cd2298d185dd 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -3268,8 +3268,22 @@ static int relocate_file_extent_cluster(struct inode *inode,
                         nr++;
                 }
 
-                btrfs_set_extent_delalloc(inode, page_start, page_end, 0, NULL,
-                                          0);
+                ret = btrfs_set_extent_delalloc(inode, page_start, page_end, 0,
+                                                NULL, 0);
+                if (ret) {
+                        unlock_page(page);
+                        put_page(page);
+                        btrfs_delalloc_release_metadata(BTRFS_I(inode),
+                                                         PAGE_SIZE);
+                        btrfs_delalloc_release_extents(BTRFS_I(inode),
+                                                       PAGE_SIZE);
+
+                        clear_extent_bits(&BTRFS_I(inode)->io_tree,
+                                          page_start, page_end,
+                                          EXTENT_LOCKED | EXTENT_BOUNDARY);
+                        goto out;
+
+                }
                 set_page_dirty(page);
 
                 unlock_extent(&BTRFS_I(inode)->io_tree,
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index f306c608dc28..484e2af793de 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -5005,6 +5005,9 @@ static int send_hole(struct send_ctx *sctx, u64 end)
         u64 len;
         int ret = 0;
 
+        if (sctx->flags & BTRFS_SEND_FLAG_NO_FILE_DATA)
+                return send_update_extent(sctx, offset, end - offset);
+
         p = fs_path_alloc();
         if (!p)
                 return -ENOMEM;
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 6e71a2a78363..4b817947e00f 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -1545,7 +1545,7 @@ static struct dentry *btrfs_mount_root(struct file_system_type *fs_type,
          * it for searching for existing supers, so this lets us do that and
          * then open_ctree will properly initialize everything later.
          */
-        fs_info = kzalloc(sizeof(struct btrfs_fs_info), GFP_KERNEL);
+        fs_info = kvzalloc(sizeof(struct btrfs_fs_info), GFP_KERNEL);
         if (!fs_info) {
                 error = -ENOMEM;
                 goto error_sec_opts;
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 4fd19b4d6675..434457794c27 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -967,7 +967,9 @@ static noinline int backref_in_log(struct btrfs_root *log,
         ptr = btrfs_item_ptr_offset(path->nodes[0], path->slots[0]);
 
         if (key->type == BTRFS_INODE_EXTREF_KEY) {
-                if (btrfs_find_name_in_ext_backref(path, ref_objectid,
+                if (btrfs_find_name_in_ext_backref(path->nodes[0],
+                                                   path->slots[0],
+                                                   ref_objectid,
                                                    name, namelen, NULL))
                         match = 1;
 
@@ -1191,7 +1193,8 @@ static int extref_get_fields(struct extent_buffer *eb, unsigned long ref_ptr,
         read_extent_buffer(eb, *name, (unsigned long)&extref->name,
                            *namelen);
 
-        *index = btrfs_inode_extref_index(eb, extref);
+        if (index)
+                *index = btrfs_inode_extref_index(eb, extref);
         if (parent_objectid)
                 *parent_objectid = btrfs_inode_extref_parent(eb, extref);
 
@@ -1212,12 +1215,102 @@ static int ref_get_fields(struct extent_buffer *eb, unsigned long ref_ptr,
 
         read_extent_buffer(eb, *name, (unsigned long)(ref + 1), *namelen);
 
-        *index = btrfs_inode_ref_index(eb, ref);
+        if (index)
+                *index = btrfs_inode_ref_index(eb, ref);
 
         return 0;
 }
 
 /*
+ * Take an inode reference item from the log tree and iterate all names from the
+ * inode reference item in the subvolume tree with the same key (if it exists).
+ * For any name that is not in the inode reference item from the log tree, do a
+ * proper unlink of that name (that is, remove its entry from the inode
+ * reference item and both dir index keys).
+ */
+static int unlink_old_inode_refs(struct btrfs_trans_handle *trans,
+                                 struct btrfs_root *root,
+                                 struct btrfs_path *path,
+                                 struct btrfs_inode *inode,
+                                 struct extent_buffer *log_eb,
+                                 int log_slot,
+                                 struct btrfs_key *key)
+{
+        int ret;
+        unsigned long ref_ptr;
+        unsigned long ref_end;
+        struct extent_buffer *eb;
+
+again:
+        btrfs_release_path(path);
+        ret = btrfs_search_slot(NULL, root, key, path, 0, 0);
+        if (ret > 0) {
+                ret = 0;
+                goto out;
+        }
+        if (ret < 0)
+                goto out;
+
+        eb = path->nodes[0];
+        ref_ptr = btrfs_item_ptr_offset(eb, path->slots[0]);
+        ref_end = ref_ptr + btrfs_item_size_nr(eb, path->slots[0]);
+        while (ref_ptr < ref_end) {
+                char *name = NULL;
+                int namelen;
+                u64 parent_id;
+
+                if (key->type == BTRFS_INODE_EXTREF_KEY) {
+                        ret = extref_get_fields(eb, ref_ptr, &namelen, &name,
+                                                NULL, &parent_id);
+                } else {
+                        parent_id = key->offset;
+                        ret = ref_get_fields(eb, ref_ptr, &namelen, &name,
+                                             NULL);
+                }
+                if (ret)
+                        goto out;
+
+                if (key->type == BTRFS_INODE_EXTREF_KEY)
+                        ret = btrfs_find_name_in_ext_backref(log_eb, log_slot,
+                                                             parent_id, name,
+                                                             namelen, NULL);
+                else
+                        ret = btrfs_find_name_in_backref(log_eb, log_slot, name,
+                                                         namelen, NULL);
+
+                if (!ret) {
+                        struct inode *dir;
+
+                        btrfs_release_path(path);
+                        dir = read_one_inode(root, parent_id);
+                        if (!dir) {
+                                ret = -ENOENT;
+                                kfree(name);
+                                goto out;
+                        }
+                        ret = btrfs_unlink_inode(trans, root, BTRFS_I(dir),
+                                                 inode, name, namelen);
+                        kfree(name);
+                        iput(dir);
+                        if (ret)
+                                goto out;
+                        goto again;
+                }
+
+                kfree(name);
+                ref_ptr += namelen;
+                if (key->type == BTRFS_INODE_EXTREF_KEY)
+                        ref_ptr += sizeof(struct btrfs_inode_extref);
+                else
+                        ref_ptr += sizeof(struct btrfs_inode_ref);
+        }
+        ret = 0;
+ out:
+        btrfs_release_path(path);
+        return ret;
+}
+
+/*
  * replay one inode back reference item found in the log tree.
  * eb, slot and key refer to the buffer and key found in the log tree.
  * root is the destination we are replaying into, and path is for temp
@@ -1345,6 +1438,19 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans,
                 }
         }
 
+        /*
+         * Before we overwrite the inode reference item in the subvolume tree
+         * with the item from the log tree, we must unlink all names from the
+         * parent directory that are in the subvolume's tree inode reference
+         * item, otherwise we end up with an inconsistent subvolume tree where
+         * dir index entries exist for a name but there is no inode reference
+         * item with the same name.
+         */
+        ret = unlink_old_inode_refs(trans, root, path, BTRFS_I(inode), eb, slot,
+                                    key);
+        if (ret)
+                goto out;
+
         /* finally write the back reference in the inode */
         ret = overwrite_item(trans, root, path, eb, slot, key);
 out:
@@ -5853,7 +5959,7 @@ int btrfs_log_new_name(struct btrfs_trans_handle *trans,
          * this will force the logging code to walk the dentry chain
          * up for the file
          */
-        if (S_ISREG(inode->vfs_inode.i_mode))
+        if (!S_ISDIR(inode->vfs_inode.i_mode))
                 inode->last_unlink_trans = trans->transid;
 
         /*
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 2ceb924ca0d6..b2d05c6b1c56 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -4829,10 +4829,13 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
         ndevs = min(ndevs, devs_max);
 
         /*
-         * the primary goal is to maximize the number of stripes, so use as many
-         * devices as possible, even if the stripes are not maximum sized.
+         * The primary goal is to maximize the number of stripes, so use as
+         * many devices as possible, even if the stripes are not maximum sized.
+         *
+         * The DUP profile stores more than one stripe per device, the
+         * max_avail is the total size so we have to adjust.
          */
-        stripe_size = devices_info[ndevs-1].max_avail;
+        stripe_size = div_u64(devices_info[ndevs - 1].max_avail, dev_stripes);
         num_stripes = ndevs * dev_stripes;
 
         /*
@@ -4867,8 +4870,6 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
                         stripe_size = devices_info[ndevs-1].max_avail;
         }
 
-        stripe_size = div_u64(stripe_size, dev_stripes);
-
         /* align to BTRFS_STRIPE_LEN */
         stripe_size = round_down(stripe_size, BTRFS_STRIPE_LEN);
 
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 6582c4507e6c..0e5bd3e3344e 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -3965,6 +3965,32 @@ void ceph_put_fmode(struct ceph_inode_info *ci, int fmode)
 }
 
 /*
+ * For a soon-to-be unlinked file, drop the AUTH_RDCACHE caps. If it
+ * looks like the link count will hit 0, drop any other caps (other
+ * than PIN) we don't specifically want (due to the file still being
+ * open).
+ */
+int ceph_drop_caps_for_unlink(struct inode *inode)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        int drop = CEPH_CAP_LINK_SHARED | CEPH_CAP_LINK_EXCL;
+
+        spin_lock(&ci->i_ceph_lock);
+        if (inode->i_nlink == 1) {
+                drop |= ~(__ceph_caps_wanted(ci) | CEPH_CAP_PIN);
+
+                ci->i_ceph_flags |= CEPH_I_NODELAY;
+                if (__ceph_caps_dirty(ci)) {
+                        struct ceph_mds_client *mdsc =
+                                ceph_inode_to_client(inode)->mdsc;
+                        __cap_delay_requeue_front(mdsc, ci);
+                }
+        }
+        spin_unlock(&ci->i_ceph_lock);
+        return drop;
+}
+
+/*
  * Helpers for embedding cap and dentry lease releases into mds
  * requests.
  *
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index 0c4346806e17..f1d9c6cc0491 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -1003,26 +1003,6 @@ static int ceph_link(struct dentry *old_dentry, struct inode *dir,
 }
 
 /*
- * For a soon-to-be unlinked file, drop the AUTH_RDCACHE caps.  If it
- * looks like the link count will hit 0, drop any other caps (other
- * than PIN) we don't specifically want (due to the file still being
- * open).
- */
-static int drop_caps_for_unlink(struct inode *inode)
-{
-        struct ceph_inode_info *ci = ceph_inode(inode);
-        int drop = CEPH_CAP_LINK_SHARED | CEPH_CAP_LINK_EXCL;
-
-        spin_lock(&ci->i_ceph_lock);
-        if (inode->i_nlink == 1) {
-                drop |= ~(__ceph_caps_wanted(ci) | CEPH_CAP_PIN);
-                ci->i_ceph_flags |= CEPH_I_NODELAY;
-        }
-        spin_unlock(&ci->i_ceph_lock);
-        return drop;
-}
-
-/*
  * rmdir and unlink are differ only by the metadata op code
  */
 static int ceph_unlink(struct inode *dir, struct dentry *dentry)
@@ -1056,7 +1036,7 @@ static int ceph_unlink(struct inode *dir, struct dentry *dentry)
         set_bit(CEPH_MDS_R_PARENT_LOCKED, &req->r_req_flags);
         req->r_dentry_drop = CEPH_CAP_FILE_SHARED;
         req->r_dentry_unless = CEPH_CAP_FILE_EXCL;
-        req->r_inode_drop = drop_caps_for_unlink(inode);
+        req->r_inode_drop = ceph_drop_caps_for_unlink(inode);
         err = ceph_mdsc_do_request(mdsc, dir, req);
         if (!err && !req->r_reply_info.head->is_dentry)
                 d_delete(dentry);
@@ -1104,8 +1084,10 @@ static int ceph_rename(struct inode *old_dir, struct dentry *old_dentry,
         req->r_dentry_unless = CEPH_CAP_FILE_EXCL;
         /* release LINK_RDCACHE on source inode (mds will lock it) */
         req->r_old_inode_drop = CEPH_CAP_LINK_SHARED | CEPH_CAP_LINK_EXCL;
-        if (d_really_is_positive(new_dentry))
-                req->r_inode_drop = drop_caps_for_unlink(d_inode(new_dentry));
+        if (d_really_is_positive(new_dentry)) {
+                req->r_inode_drop =
+                        ceph_drop_caps_for_unlink(d_inode(new_dentry));
+        }
         err = ceph_mdsc_do_request(mdsc, old_dir, req);
         if (!err && !req->r_reply_info.head->is_dentry) {
                 /*
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index a62d2a9841dc..fb2bc9c15a23 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -225,6 +225,7 @@ static int parse_fsopt_token(char *c, void *private)
                         return -ENOMEM;
                 break;
         case Opt_mds_namespace:
+                kfree(fsopt->mds_namespace);
                 fsopt->mds_namespace = kstrndup(argstr[0].from,
                                                 argstr[0].to-argstr[0].from,
                                                 GFP_KERNEL);
@@ -232,6 +233,7 @@ static int parse_fsopt_token(char *c, void *private)
                         return -ENOMEM;
                 break;
         case Opt_fscache_uniq:
+                kfree(fsopt->fscache_uniq);
                 fsopt->fscache_uniq = kstrndup(argstr[0].from,
                                                argstr[0].to-argstr[0].from,
                                                GFP_KERNEL);
@@ -711,14 +713,17 @@ static int __init init_caches(void)
                 goto bad_dentry;
 
         ceph_file_cachep = KMEM_CACHE(ceph_file_info, SLAB_MEM_SPREAD);
-
         if (!ceph_file_cachep)
                 goto bad_file;
 
-        if ((error = ceph_fscache_register()))
-                goto bad_file;
+        error = ceph_fscache_register();
+        if (error)
+                goto bad_fscache;
 
         return 0;
+
+bad_fscache:
+        kmem_cache_destroy(ceph_file_cachep);
 bad_file:
         kmem_cache_destroy(ceph_dentry_cachep);
 bad_dentry:
@@ -836,7 +841,6 @@ static struct dentry *ceph_real_mount(struct ceph_fs_client *fsc)
         int err;
         unsigned long started = jiffies;  /* note the start time */
         struct dentry *root;
-        int first = 0;   /* first vfsmount for this super_block */
 
         dout("mount start %p\n", fsc);
         mutex_lock(&fsc->client->mount_mutex);
@@ -861,17 +865,17 @@ static struct dentry *ceph_real_mount(struct ceph_fs_client *fsc)
                         path = fsc->mount_options->server_path + 1;
                         dout("mount opening path %s\n", path);
                 }
+
+                err = ceph_fs_debugfs_init(fsc);
+                if (err < 0)
+                        goto out;
+
                 root = open_root_dentry(fsc, path, started);
                 if (IS_ERR(root)) {
                         err = PTR_ERR(root);
                         goto out;
                 }
                 fsc->sb->s_root = dget(root);
-                first = 1;
-
-                err = ceph_fs_debugfs_init(fsc);
-                if (err < 0)
-                        goto fail;
         } else {
                 root = dget(fsc->sb->s_root);
         }
@@ -881,11 +885,6 @@ static struct dentry *ceph_real_mount(struct ceph_fs_client *fsc)
         mutex_unlock(&fsc->client->mount_mutex);
         return root;
 
-fail:
-        if (first) {
-                dput(fsc->sb->s_root);
-                fsc->sb->s_root = NULL;
-        }
 out:
         mutex_unlock(&fsc->client->mount_mutex);
         return ERR_PTR(err);
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index 21b2e5b004eb..1c2086e0fec2 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -987,7 +987,7 @@ extern void ceph_check_caps(struct ceph_inode_info *ci, int flags,
                             struct ceph_mds_session *session);
 extern void ceph_check_delayed_caps(struct ceph_mds_client *mdsc);
 extern void ceph_flush_dirty_caps(struct ceph_mds_client *mdsc);
-
+extern int  ceph_drop_caps_for_unlink(struct inode *inode);
 extern int ceph_encode_inode_release(void **p, struct inode *inode,
                                      int mds, int drop, int unless, int force);
 extern int ceph_encode_dentry_release(void **p, struct dentry *dn,
diff --git a/fs/dcache.c b/fs/dcache.c
index 7c38f39958bc..8945e6cabd93 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -647,11 +647,16 @@ again:
                 spin_unlock(&parent->d_lock);
                 goto again;
         }
-        rcu_read_unlock();
-        if (parent != dentry)
+        if (parent != dentry) {
                 spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
-        else
+                if (unlikely(dentry->d_lockref.count < 0)) {
+                        spin_unlock(&parent->d_lock);
+                        parent = NULL;
+                }
+        } else {
                 parent = NULL;
+        }
+        rcu_read_unlock();
         return parent;
 }
 
@@ -2474,7 +2479,7 @@ struct dentry *d_alloc_parallel(struct dentry *parent,
 
 retry:
         rcu_read_lock();
-        seq = smp_load_acquire(&parent->d_inode->i_dir_seq) & ~1;
+        seq = smp_load_acquire(&parent->d_inode->i_dir_seq);
         r_seq = read_seqbegin(&rename_lock);
         dentry = __d_lookup_rcu(parent, name, &d_seq);
         if (unlikely(dentry)) {
@@ -2495,8 +2500,14 @@ retry:
                 rcu_read_unlock();
                 goto retry;
         }
+
+        if (unlikely(seq & 1)) {
+                rcu_read_unlock();
+                goto retry;
+        }
+
         hlist_bl_lock(b);
-        if (unlikely(parent->d_inode->i_dir_seq != seq)) {
+        if (unlikely(READ_ONCE(parent->d_inode->i_dir_seq) != seq)) {
                 hlist_bl_unlock(b);
                 rcu_read_unlock();
                 goto retry;
diff --git a/fs/direct-io.c b/fs/direct-io.c
index a0ca9e48e993..1357ef563893 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -1274,8 +1274,7 @@ do_blockdev_direct_IO(struct kiocb *iocb, struct inode *inode,
          */
         if (dio->is_async && iov_iter_rw(iter) == WRITE) {
                 retval = 0;
-                if ((iocb->ki_filp->f_flags & O_DSYNC) ||
-                    IS_SYNC(iocb->ki_filp->f_mapping->host))
+                if (iocb->ki_flags & IOCB_DSYNC)
                         retval = dio_set_defer_completion(dio);
                 else if (!dio->inode->i_sb->s_dio_done_wq) {
                         /*
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index 86d6a4435c87..51f940e76c5e 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -807,9 +807,6 @@ do_alloc:
                         iomap->length = hole_size(inode, lblock, &mp);
                 else
                         iomap->length = size - pos;
-        } else {
-                if (height <= ip->i_height)
-                        iomap->length = hole_size(inode, lblock, &mp);
         }
         goto out_release;
 }
diff --git a/fs/namei.c b/fs/namei.c
index 921ae32dbc80..cafa365eeb70 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -559,9 +559,10 @@ static int __nd_alloc_stack(struct nameidata *nd)
 static bool path_connected(const struct path *path)
 {
         struct vfsmount *mnt = path->mnt;
+        struct super_block *sb = mnt->mnt_sb;
 
-        /* Only bind mounts can have disconnected paths */
-        if (mnt->mnt_root == mnt->mnt_sb->s_root)
+        /* Bind mounts and multi-root filesystems can have disconnected paths */
+        if (!(sb->s_iflags & SB_I_MULTIROOT) && (mnt->mnt_root == sb->s_root))
                 return true;
 
         return is_subdir(path->dentry, mnt->mnt_root);
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 8c10b0562e75..621c517b325c 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -86,10 +86,10 @@ struct nfs_direct_req {
         struct nfs_direct_mirror mirrors[NFS_PAGEIO_DESCRIPTOR_MIRROR_MAX];
         int                     mirror_count;
 
+        loff_t                  io_start;       /* Start offset for I/O */
         ssize_t                 count,          /* bytes actually processed */
                                 max_count,      /* max expected count */
                                 bytes_left,     /* bytes left to be sent */
-                                io_start,       /* start of IO */
                                 error;          /* any reported error */
         struct completion       completion;     /* wait for i/o completion */
 
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index c13e826614b5..ee723aa153a3 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -292,8 +292,11 @@ pnfs_detach_layout_hdr(struct pnfs_layout_hdr *lo)
 void
 pnfs_put_layout_hdr(struct pnfs_layout_hdr *lo)
 {
-        struct inode *inode = lo->plh_inode;
+        struct inode *inode;
 
+        if (!lo)
+                return;
+        inode = lo->plh_inode;
         pnfs_layoutreturn_before_put_layout_hdr(lo);
 
         if (refcount_dec_and_lock(&lo->plh_refcount, &inode->i_lock)) {
@@ -1241,10 +1244,12 @@ retry:
         spin_lock(&ino->i_lock);
         lo = nfsi->layout;
         if (!lo || !pnfs_layout_is_valid(lo) ||
-            test_bit(NFS_LAYOUT_BULK_RECALL, &lo->plh_flags))
+            test_bit(NFS_LAYOUT_BULK_RECALL, &lo->plh_flags)) {
+                lo = NULL;
                 goto out_noroc;
+        }
+        pnfs_get_layout_hdr(lo);
         if (test_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags)) {
-                pnfs_get_layout_hdr(lo);
                 spin_unlock(&ino->i_lock);
                 wait_on_bit(&lo->plh_flags, NFS_LAYOUT_RETURN,
                                 TASK_UNINTERRUPTIBLE);
@@ -1312,10 +1317,12 @@ out_noroc:
                 struct pnfs_layoutdriver_type *ld = NFS_SERVER(ino)->pnfs_curr_ld;
                 if (ld->prepare_layoutreturn)
                         ld->prepare_layoutreturn(args);
+                pnfs_put_layout_hdr(lo);
                 return true;
         }
         if (layoutreturn)
                 pnfs_send_layoutreturn(lo, &stateid, iomode, true);
+        pnfs_put_layout_hdr(lo);
         return false;
 }
 
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 29bacdc56f6a..5e470e233c83 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2631,6 +2631,8 @@ struct dentry *nfs_fs_mount_common(struct nfs_server *server,
                 /* initial superblock/root creation */
                 mount_info->fill_super(s, mount_info);
                 nfs_get_cache_cookie(s, mount_info->parsed, mount_info->cloned);
+                if (!(server->flags & NFS_MOUNT_UNSHARED))
+                        s->s_iflags |= SB_I_MULTIROOT;
         }
 
         mntroot = nfs_get_root(s, mount_info->mntfh, dev_name);
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 7428a669d7a7..e7d8ceae8f26 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1876,40 +1876,43 @@ int nfs_generic_commit_list(struct inode *inode, struct list_head *head,
         return status;
 }
 
-int nfs_commit_inode(struct inode *inode, int how)
+static int __nfs_commit_inode(struct inode *inode, int how,
+                struct writeback_control *wbc)
 {
         LIST_HEAD(head);
         struct nfs_commit_info cinfo;
         int may_wait = how & FLUSH_SYNC;
-        int error = 0;
-        int res;
+        int ret, nscan;
 
         nfs_init_cinfo_from_inode(&cinfo, inode);
         nfs_commit_begin(cinfo.mds);
-        res = nfs_scan_commit(inode, &head, &cinfo);
-        if (res)
-                error = nfs_generic_commit_list(inode, &head, how, &cinfo);
+        for (;;) {
+                ret = nscan = nfs_scan_commit(inode, &head, &cinfo);
+                if (ret <= 0)
+                        break;
+                ret = nfs_generic_commit_list(inode, &head, how, &cinfo);
+                if (ret < 0)
+                        break;
+                ret = 0;
+                if (wbc && wbc->sync_mode == WB_SYNC_NONE) {
+                        if (nscan < wbc->nr_to_write)
+                                wbc->nr_to_write -= nscan;
+                        else
+                                wbc->nr_to_write = 0;
+                }
+                if (nscan < INT_MAX)
+                        break;
+                cond_resched();
+        }
         nfs_commit_end(cinfo.mds);
-        if (res == 0)
-                return res;
-        if (error < 0)
-                goto out_error;
-        if (!may_wait)
-                goto out_mark_dirty;
-        error = wait_on_commit(cinfo.mds);
-        if (error < 0)
-                return error;
-        return res;
-out_error:
-        res = error;
-        /* Note: If we exit without ensuring that the commit is complete,
-         * we must mark the inode as dirty. Otherwise, future calls to
-         * sync_inode() with the WB_SYNC_ALL flag set will fail to ensure
-         * that the data is on the disk.
-         */
-out_mark_dirty:
-        __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
-        return res;
+        if (ret || !may_wait)
+                return ret;
+        return wait_on_commit(cinfo.mds);
+}
+
+int nfs_commit_inode(struct inode *inode, int how)
+{
+        return __nfs_commit_inode(inode, how, NULL);
 }
 EXPORT_SYMBOL_GPL(nfs_commit_inode);
 
@@ -1919,11 +1922,11 @@ int nfs_write_inode(struct inode *inode, struct writeback_control *wbc)
         int flags = FLUSH_SYNC;
         int ret = 0;
 
-        /* no commits means nothing needs to be done */
-        if (!atomic_long_read(&nfsi->commit_info.ncommit))
-                return ret;
-
         if (wbc->sync_mode == WB_SYNC_NONE) {
+                /* no commits means nothing needs to be done */
+                if (!atomic_long_read(&nfsi->commit_info.ncommit))
+                        goto check_requests_outstanding;
+
                 /* Don't commit yet if this is a non-blocking flush and there
                  * are a lot of outstanding writes for this mapping.
                  */
@@ -1934,16 +1937,16 @@ int nfs_write_inode(struct inode *inode, struct writeback_control *wbc)
                 flags = 0;
         }
 
-        ret = nfs_commit_inode(inode, flags);
-        if (ret >= 0) {
-                if (wbc->sync_mode == WB_SYNC_NONE) {
-                        if (ret < wbc->nr_to_write)
-                                wbc->nr_to_write -= ret;
-                        else
-                                wbc->nr_to_write = 0;
-                }
-                return 0;
-        }
+        ret = __nfs_commit_inode(inode, flags, wbc);
+        if (!ret) {
+                if (flags & FLUSH_SYNC)
+                        return 0;
+        } else if (atomic_long_read(&nfsi->commit_info.ncommit))
+                goto out_mark_dirty;
+
+check_requests_outstanding:
+        if (!atomic_read(&nfsi->commit_info.rpcs_out))
+                return ret;
 out_mark_dirty:
         __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
         return ret;
diff --git a/fs/overlayfs/Kconfig b/fs/overlayfs/Kconfig
index 406e72de88f6..ce6ff5a0a6e4 100644
--- a/fs/overlayfs/Kconfig
+++ b/fs/overlayfs/Kconfig
@@ -24,6 +24,8 @@ config OVERLAY_FS_REDIRECT_DIR
           an overlay which has redirects on a kernel that doesn't support this
           feature will have unexpected results.
 
+          If unsure, say N.
+
 config OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW
         bool "Overlayfs: follow redirects even if redirects are turned off"
         default y
@@ -32,8 +34,13 @@ config OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW
           Disable this to get a possibly more secure configuration, but that
           might not be backward compatible with previous kernels.
 
+          If backward compatibility is not an issue, then it is safe and
+          recommended to say N here.
+
           For more information, see Documentation/filesystems/overlayfs.txt
 
+          If unsure, say Y.
+
 config OVERLAY_FS_INDEX
         bool "Overlayfs: turn on inodes index feature by default"
         depends on OVERLAY_FS
@@ -51,6 +58,8 @@ config OVERLAY_FS_INDEX
           That is, mounting an overlay which has an inodes index on a kernel
           that doesn't support this feature will have unexpected results.
 
+          If unsure, say N.
+
 config OVERLAY_FS_NFS_EXPORT
         bool "Overlayfs: turn on NFS export feature by default"
         depends on OVERLAY_FS
@@ -72,3 +81,8 @@ config OVERLAY_FS_NFS_EXPORT
           Note, that the NFS export feature is not backward compatible.
           That is, mounting an overlay which has a full index on a kernel
           that doesn't support this feature will have unexpected results.
+
+          Most users should say N here and enable this feature on a case-by-
+          case basis with the "nfs_export=on" mount option.
+
+          Say N unless you fully understand the consequences.
diff --git a/fs/overlayfs/export.c b/fs/overlayfs/export.c
index bb94ce9da5c8..87bd4148f4fb 100644
--- a/fs/overlayfs/export.c
+++ b/fs/overlayfs/export.c
@@ -19,6 +19,142 @@
 #include <linux/ratelimit.h>
 #include "overlayfs.h"
 
+static int ovl_encode_maybe_copy_up(struct dentry *dentry)
+{
+        int err;
+
+        if (ovl_dentry_upper(dentry))
+                return 0;
+
+        err = ovl_want_write(dentry);
+        if (!err) {
+                err = ovl_copy_up(dentry);
+                ovl_drop_write(dentry);
+        }
+
+        if (err) {
+                pr_warn_ratelimited("overlayfs: failed to copy up on encode (%pd2, err=%i)\n",
+                                    dentry, err);
+        }
+
+        return err;
+}
+
+/*
+ * Before encoding a non-upper directory file handle from real layer N, we need
+ * to check if it will be possible to reconnect an overlay dentry from the real
+ * lower decoded dentry. This is done by following the overlay ancestry up to a
+ * "layer N connected" ancestor and verifying that all parents along the way are
+ * "layer N connectable". If an ancestor that is NOT "layer N connectable" is
+ * found, we need to copy up an ancestor, which is "layer N connectable", thus
+ * making that ancestor "layer N connected". For example:
+ *
+ * layer 1: /a
+ * layer 2: /a/b/c
+ *
+ * The overlay dentry /a is NOT "layer 2 connectable", because if dir /a is
+ * copied up and renamed, upper dir /a will be indexed by lower dir /a from
+ * layer 1. The dir /a from layer 2 will never be indexed, so the algorithm (*)
+ * in ovl_lookup_real_ancestor() will not be able to lookup a connected overlay
+ * dentry from the connected lower dentry /a/b/c.
+ *
+ * To avoid this problem on decode time, we need to copy up an ancestor of
+ * /a/b/c, which is "layer 2 connectable", on encode time. That ancestor is
+ * /a/b. After copy up (and index) of /a/b, it will become "layer 2 connected"
+ * and when the time comes to decode the file handle from lower dentry /a/b/c,
+ * ovl_lookup_real_ancestor() will find the indexed ancestor /a/b and decoding
+ * a connected overlay dentry will be accomplished.
+ *
+ * (*) the algorithm in ovl_lookup_real_ancestor() can be improved to lookup an
+ * entry /a in the lower layers above layer N and find the indexed dir /a from
+ * layer 1. If that improvement is made, then the check for "layer N connected"
+ * will need to verify there are no redirects in lower layers above N. In the
+ * example above, /a will be "layer 2 connectable". However, if layer 2 dir /a
+ * is a target of a layer 1 redirect, then /a will NOT be "layer 2 connectable":
+ *
+ * layer 1: /A (redirect = /a)
+ * layer 2: /a/b/c
+ */
+
+/* Return the lowest layer for encoding a connectable file handle */
+static int ovl_connectable_layer(struct dentry *dentry)
+{
+        struct ovl_entry *oe = OVL_E(dentry);
+
+        /* We can get overlay root from root of any layer */
+        if (dentry == dentry->d_sb->s_root)
+                return oe->numlower;
+
+        /*
+         * If it's an unindexed merge dir, then it's not connectable with any
+         * lower layer
+         */
+        if (ovl_dentry_upper(dentry) &&
+            !ovl_test_flag(OVL_INDEX, d_inode(dentry)))
+                return 0;
+
+        /* We can get upper/overlay path from indexed/lower dentry */
+        return oe->lowerstack[0].layer->idx;
+}
+
+/*
+ * @dentry is "connected" if all ancestors up to root or a "connected" ancestor
+ * have the same uppermost lower layer as the origin's layer. We may need to
+ * copy up a "connectable" ancestor to make it "connected". A "connected" dentry
+ * cannot become non "connected", so cache positive result in dentry flags.
+ *
+ * Return the connected origin layer or < 0 on error.
+ */
+static int ovl_connect_layer(struct dentry *dentry)
+{
+        struct dentry *next, *parent = NULL;
+        int origin_layer;
+        int err = 0;
+
+        if (WARN_ON(dentry == dentry->d_sb->s_root) ||
+            WARN_ON(!ovl_dentry_lower(dentry)))
+                return -EIO;
+
+        origin_layer = OVL_E(dentry)->lowerstack[0].layer->idx;
+        if (ovl_dentry_test_flag(OVL_E_CONNECTED, dentry))
+                return origin_layer;
+
+        /* Find the topmost origin layer connectable ancestor of @dentry */
+        next = dget(dentry);
+        for (;;) {
+                parent = dget_parent(next);
+                if (WARN_ON(parent == next)) {
+                        err = -EIO;
+                        break;
+                }
+
+                /*
+                 * If @parent is not origin layer connectable, then copy up
+                 * @next which is origin layer connectable and we are done.
+                 */
+                if (ovl_connectable_layer(parent) < origin_layer) {
+                        err = ovl_encode_maybe_copy_up(next);
+                        break;
+                }
+
+                /* If @parent is connected or indexed we are done */
+                if (ovl_dentry_test_flag(OVL_E_CONNECTED, parent) ||
+                    ovl_test_flag(OVL_INDEX, d_inode(parent)))
+                        break;
+
+                dput(next);
+                next = parent;
+        }
+
+        dput(parent);
+        dput(next);
+
+        if (!err)
+                ovl_dentry_set_flag(OVL_E_CONNECTED, dentry);
+
+        return err ?: origin_layer;
+}
+
 /*
  * We only need to encode origin if there is a chance that the same object was
  * encoded pre copy up and then we need to stay consistent with the same
@@ -41,73 +177,59 @@
  * L = lower file handle
  *
  * (*) Connecting an overlay dir from real lower dentry is not always
- * possible when there are redirects in lower layers. To mitigate this case,
- * we copy up the lower dir first and then encode an upper dir file handle.
+ * possible when there are redirects in lower layers and non-indexed merge dirs.
+ * To mitigate those case, we may copy up the lower dir ancestor before encode
+ * a lower dir file handle.
+ *
+ * Return 0 for upper file handle, > 0 for lower file handle or < 0 on error.
  */
-static bool ovl_should_encode_origin(struct dentry *dentry)
+static int ovl_check_encode_origin(struct dentry *dentry)
 {
         struct ovl_fs *ofs = dentry->d_sb->s_fs_info;
 
+        /* Upper file handle for pure upper */
         if (!ovl_dentry_lower(dentry))
-                return false;
+                return 0;
 
         /*
-         * Decoding a merge dir, whose origin's parent is under a redirected
-         * lower dir is not always possible. As a simple aproximation, we do
-         * not encode lower dir file handles when overlay has multiple lower
-         * layers and origin is below the topmost lower layer.
+         * Upper file handle for non-indexed upper.
          *
-         * TODO: copy up only the parent that is under redirected lower.
+         * Root is never indexed, so if there's an upper layer, encode upper for
+         * root.
          */
-        if (d_is_dir(dentry) && ofs->upper_mnt &&
-            OVL_E(dentry)->lowerstack[0].layer->idx > 1)
-                return false;
-
-        /* Decoding a non-indexed upper from origin is not implemented */
         if (ovl_dentry_upper(dentry) &&
             !ovl_test_flag(OVL_INDEX, d_inode(dentry)))
-                return false;
-
-        return true;
-}
-
-static int ovl_encode_maybe_copy_up(struct dentry *dentry)
-{
-        int err;
-
-        if (ovl_dentry_upper(dentry))
                 return 0;
 
-        err = ovl_want_write(dentry);
-        if (err)
-                return err;
-
-        err = ovl_copy_up(dentry);
+        /*
+         * Decoding a merge dir, whose origin's ancestor is under a redirected
+         * lower dir or under a non-indexed upper is not always possible.
+         * ovl_connect_layer() will try to make origin's layer "connected" by
+         * copying up a "connectable" ancestor.
+         */
+        if (d_is_dir(dentry) && ofs->upper_mnt)
+                return ovl_connect_layer(dentry);
 
-        ovl_drop_write(dentry);
-        return err;
+        /* Lower file handle for indexed and non-upper dir/non-dir */
+        return 1;
 }
 
 static int ovl_d_to_fh(struct dentry *dentry, char *buf, int buflen)
 {
-        struct dentry *origin = ovl_dentry_lower(dentry);
         struct ovl_fh *fh = NULL;
-        int err;
+        int err, enc_lower;
 
         /*
-         * If we should not encode a lower dir file handle, copy up and encode
-         * an upper dir file handle.
+         * Check if we should encode a lower or upper file handle and maybe
+         * copy up an ancestor to make lower file handle connectable.
          */
-        if (!ovl_should_encode_origin(dentry)) {
-                err = ovl_encode_maybe_copy_up(dentry);
-                if (err)
-                        goto fail;
-
-                origin = NULL;
-        }
+        err = enc_lower = ovl_check_encode_origin(dentry);
+        if (enc_lower < 0)
+                goto fail;
 
-        /* Encode an upper or origin file handle */
-        fh = ovl_encode_fh(origin ?: ovl_dentry_upper(dentry), !origin);
+        /* Encode an upper or lower file handle */
+        fh = ovl_encode_fh(enc_lower ? ovl_dentry_lower(dentry) :
+                                       ovl_dentry_upper(dentry), !enc_lower);
         err = PTR_ERR(fh);
         if (IS_ERR(fh))
                 goto fail;
@@ -355,8 +477,8 @@ static struct dentry *ovl_lookup_real_inode(struct super_block *sb,
                 dput(upper);
         }
 
-        if (!this)
-                return NULL;
+        if (IS_ERR_OR_NULL(this))
+                return this;
 
         if (WARN_ON(ovl_dentry_real_at(this, layer->idx) != real)) {
                 dput(this);
@@ -498,7 +620,7 @@ static struct dentry *ovl_lookup_real(struct super_block *sb,
                         if (err == -ECHILD) {
                                 this = ovl_lookup_real_ancestor(sb, real,
                                                                 layer);
-                                err = IS_ERR(this) ? PTR_ERR(this) : 0;
+                                err = PTR_ERR_OR_ZERO(this);
                         }
                         if (!err) {
                                 dput(connected);
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index fcd97b783fa1..3b1bd469accd 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -669,38 +669,59 @@ struct inode *ovl_lookup_inode(struct super_block *sb, struct dentry *real,
         return inode;
 }
 
+/*
+ * Does overlay inode need to be hashed by lower inode?
+ */
+static bool ovl_hash_bylower(struct super_block *sb, struct dentry *upper,
+                             struct dentry *lower, struct dentry *index)
+{
+        struct ovl_fs *ofs = sb->s_fs_info;
+
+        /* No, if pure upper */
+        if (!lower)
+                return false;
+
+        /* Yes, if already indexed */
+        if (index)
+                return true;
+
+        /* Yes, if won't be copied up */
+        if (!ofs->upper_mnt)
+                return true;
+
+        /* No, if lower hardlink is or will be broken on copy up */
+        if ((upper || !ovl_indexdir(sb)) &&
+            !d_is_dir(lower) && d_inode(lower)->i_nlink > 1)
+                return false;
+
+        /* No, if non-indexed upper with NFS export */
+        if (sb->s_export_op && upper)
+                return false;
+
+        /* Otherwise, hash by lower inode for fsnotify */
+        return true;
+}
+
 struct inode *ovl_get_inode(struct super_block *sb, struct dentry *upperdentry,
                             struct dentry *lowerdentry, struct dentry *index,
                             unsigned int numlower)
 {
-        struct ovl_fs *ofs = sb->s_fs_info;
         struct inode *realinode = upperdentry ? d_inode(upperdentry) : NULL;
         struct inode *inode;
-        /* Already indexed or could be indexed on copy up? */
-        bool indexed = (index || (ovl_indexdir(sb) && !upperdentry));
-        struct dentry *origin = indexed ? lowerdentry : NULL;
+        bool bylower = ovl_hash_bylower(sb, upperdentry, lowerdentry, index);
         bool is_dir;
 
-        if (WARN_ON(upperdentry && indexed && !lowerdentry))
-                return ERR_PTR(-EIO);
-
         if (!realinode)
                 realinode = d_inode(lowerdentry);
 
         /*
-         * Copy up origin (lower) may exist for non-indexed non-dir upper, but
-         * we must not use lower as hash key in that case.
-         * Hash non-dir that is or could be indexed by origin inode.
-         * Hash dir that is or could be merged by origin inode.
-         * Hash pure upper and non-indexed non-dir by upper inode.
-         * Hash non-indexed dir by upper inode for NFS export.
+         * Copy up origin (lower) may exist for non-indexed upper, but we must
+         * not use lower as hash key if this is a broken hardlink.
          */
         is_dir = S_ISDIR(realinode->i_mode);
-        if (is_dir && (indexed || !sb->s_export_op || !ofs->upper_mnt))
-                origin = lowerdentry;
-
-        if (upperdentry || origin) {
-                struct inode *key = d_inode(origin ?: upperdentry);
+        if (upperdentry || bylower) {
+                struct inode *key = d_inode(bylower ? lowerdentry :
+                                                      upperdentry);
                 unsigned int nlink = is_dir ? 1 : realinode->i_nlink;
 
                 inode = iget5_locked(sb, (unsigned long) key,
@@ -728,6 +749,7 @@ struct inode *ovl_get_inode(struct super_block *sb, struct dentry *upperdentry,
                         nlink = ovl_get_nlink(lowerdentry, upperdentry, nlink);
                 set_nlink(inode, nlink);
         } else {
+                /* Lower hardlink that will be broken on copy up */
                 inode = new_inode(sb);
                 if (!inode)
                         goto out_nomem;
diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
index de3e6da1d5a5..70fcfcc684cc 100644
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -913,9 +913,6 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
                 stack[ctr].layer = lower.layer;
                 ctr++;
 
-                if (d.stop)
-                        break;
-
                 /*
                  * Following redirects can have security consequences: it's like
                  * a symlink into the lower layer without the permission checks.
@@ -933,6 +930,9 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
                         goto out_put;
                 }
 
+                if (d.stop)
+                        break;
+
                 if (d.redirect && d.redirect[0] == '/' && poe != roe) {
                         poe = roe;
                         /* Find the current layer on the root dentry */
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index 0df25a9c94bd..225ff1171147 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -40,6 +40,7 @@ enum ovl_inode_flag {
 enum ovl_entry_flag {
         OVL_E_UPPER_ALIAS,
         OVL_E_OPAQUE,
+        OVL_E_CONNECTED,
 };
 
 /*
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 9ee37c76091d..7c24619ae7fc 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -1359,6 +1359,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
 
         /* Root is always merge -> can have whiteouts */
         ovl_set_flag(OVL_WHITEOUTS, d_inode(root_dentry));
+        ovl_dentry_set_flag(OVL_E_CONNECTED, root_dentry);
         ovl_inode_init(d_inode(root_dentry), upperpath.dentry,
                        ovl_dentry_lower(root_dentry));
 
diff --git a/fs/xfs/scrub/agheader.c b/fs/xfs/scrub/agheader.c
index fd975524f460..05c66e05ae20 100644
--- a/fs/xfs/scrub/agheader.c
+++ b/fs/xfs/scrub/agheader.c
@@ -767,7 +767,7 @@ int
 xfs_scrub_agfl(
         struct xfs_scrub_context        *sc)
 {
-        struct xfs_scrub_agfl_info      sai = { 0 };
+        struct xfs_scrub_agfl_info      sai;
         struct xfs_agf                  *agf;
         xfs_agnumber_t                  agno;
         unsigned int                    agflcount;
@@ -795,6 +795,7 @@ xfs_scrub_agfl(
                 xfs_scrub_block_set_corrupt(sc, sc->sa.agf_bp);
                 goto out;
         }
+        memset(&sai, 0, sizeof(sai));
         sai.sz_entries = agflcount;
         sai.entries = kmem_zalloc(sizeof(xfs_agblock_t) * agflcount, KM_NOFS);
         if (!sai.entries) {
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index 66e1edbfb2b2..046469fcc1b8 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -955,15 +955,29 @@ static inline bool imap_needs_alloc(struct inode *inode,
                 (IS_DAX(inode) && imap->br_state == XFS_EXT_UNWRITTEN);
 }
 
+static inline bool needs_cow_for_zeroing(struct xfs_bmbt_irec *imap, int nimaps)
+{
+        return nimaps &&
+                imap->br_startblock != HOLESTARTBLOCK &&
+                imap->br_state != XFS_EXT_UNWRITTEN;
+}
+
 static inline bool need_excl_ilock(struct xfs_inode *ip, unsigned flags)
 {
         /*
-         * COW writes will allocate delalloc space, so we need to make sure
-         * to take the lock exclusively here.
+         * COW writes may allocate delalloc space or convert unwritten COW
+         * extents, so we need to make sure to take the lock exclusively here.
          */
         if (xfs_is_reflink_inode(ip) && (flags & (IOMAP_WRITE | IOMAP_ZERO)))
                 return true;
-        if ((flags & IOMAP_DIRECT) && (flags & IOMAP_WRITE))
+
+        /*
+         * Extents not yet cached requires exclusive access, don't block.
+         * This is an opencoded xfs_ilock_data_map_shared() to cater for the
+         * non-blocking behaviour.
+         */
+        if (ip->i_d.di_format == XFS_DINODE_FMT_BTREE &&
+            !(ip->i_df.if_flags & XFS_IFEXTENTS))
                 return true;
         return false;
 }
@@ -993,16 +1007,18 @@ xfs_file_iomap_begin(
                 return xfs_file_iomap_begin_delay(inode, offset, length, iomap);
         }
 
-        if (need_excl_ilock(ip, flags)) {
+        if (need_excl_ilock(ip, flags))
                 lockmode = XFS_ILOCK_EXCL;
-                xfs_ilock(ip, XFS_ILOCK_EXCL);
-        } else {
-                lockmode = xfs_ilock_data_map_shared(ip);
-        }
+        else
+                lockmode = XFS_ILOCK_SHARED;
 
-        if ((flags & IOMAP_NOWAIT) && !(ip->i_df.if_flags & XFS_IFEXTENTS)) {
-                error = -EAGAIN;
-                goto out_unlock;
+        if (flags & IOMAP_NOWAIT) {
+                if (!(ip->i_df.if_flags & XFS_IFEXTENTS))
+                        return -EAGAIN;
+                if (!xfs_ilock_nowait(ip, lockmode))
+                        return -EAGAIN;
+        } else {
+                xfs_ilock(ip, lockmode);
         }
 
         ASSERT(offset <= mp->m_super->s_maxbytes);
@@ -1024,7 +1040,9 @@ xfs_file_iomap_begin(
                         goto out_unlock;
         }
 
-        if ((flags & (IOMAP_WRITE | IOMAP_ZERO)) && xfs_is_reflink_inode(ip)) {
+        if (xfs_is_reflink_inode(ip) &&
+            ((flags & IOMAP_WRITE) ||
+             ((flags & IOMAP_ZERO) && needs_cow_for_zeroing(&imap, nimaps)))) {
                 if (flags & IOMAP_DIRECT) {
                         /*
                          * A reflinked inode will result in CoW alloc.
diff --git a/fs/xfs/xfs_refcount_item.c b/fs/xfs/xfs_refcount_item.c
index 3a55d6fc271b..7a39f40645f7 100644
--- a/fs/xfs/xfs_refcount_item.c
+++ b/fs/xfs/xfs_refcount_item.c
@@ -23,6 +23,7 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
+#include "xfs_shared.h"
 #include "xfs_mount.h"
 #include "xfs_defer.h"
 #include "xfs_trans.h"
@@ -456,10 +457,12 @@ xfs_cui_recover(
          * transaction.  Normally, any work that needs to be deferred
          * gets attached to the same defer_ops that scheduled the
          * refcount update.  However, we're in log recovery here, so we
-         * we create our own defer_ops and use that to finish up any
-         * work that doesn't fit.
+         * we use the passed in defer_ops and to finish up any work that
+         * doesn't fit.  We need to reserve enough blocks to handle a
+         * full btree split on either end of the refcount range.
          */
-        error = xfs_trans_alloc(mp, &M_RES(mp)->tr_itruncate, 0, 0, 0, &tp);
+        error = xfs_trans_alloc(mp, &M_RES(mp)->tr_itruncate,
+                        mp->m_refc_maxlevels * 2, 0, XFS_TRANS_RESERVE, &tp);
         if (error)
                 return error;
         cudp = xfs_trans_get_cud(tp, cuip);
diff --git a/fs/xfs/xfs_rmap_item.c b/fs/xfs/xfs_rmap_item.c
index f3b139c9aa16..49d3124863a8 100644
--- a/fs/xfs/xfs_rmap_item.c
+++ b/fs/xfs/xfs_rmap_item.c
@@ -23,6 +23,7 @@
 #include "xfs_log_format.h"
 #include "xfs_trans_resv.h"
 #include "xfs_bit.h"
+#include "xfs_shared.h"
 #include "xfs_mount.h"
 #include "xfs_defer.h"
 #include "xfs_trans.h"
@@ -470,7 +471,8 @@ xfs_rui_recover(
                 }
         }
 
-        error = xfs_trans_alloc(mp, &M_RES(mp)->tr_itruncate, 0, 0, 0, &tp);
+        error = xfs_trans_alloc(mp, &M_RES(mp)->tr_itruncate,
+                        mp->m_rmap_maxlevels, 0, XFS_TRANS_RESERVE, &tp);
         if (error)
                 return error;
         rudp = xfs_trans_get_rud(tp, ruip);
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index 7aba628dc527..93588ea3d3d2 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -250,6 +250,7 @@ xfs_parseargs(
                                 return -EINVAL;
                         break;
                 case Opt_logdev:
+                        kfree(mp->m_logname);
                         mp->m_logname = match_strdup(args);
                         if (!mp->m_logname)
                                 return -ENOMEM;
@@ -258,6 +259,7 @@ xfs_parseargs(
                         xfs_warn(mp, "%s option not allowed on this system", p);
                         return -EINVAL;
                 case Opt_rtdev:
+                        kfree(mp->m_rtname);
                         mp->m_rtname = match_strdup(args);
                         if (!mp->m_rtname)
                                 return -ENOMEM;
diff --git a/include/drm/drm_drv.h b/include/drm/drm_drv.h
index d32b688eb346..d23dcdd1bd95 100644
--- a/include/drm/drm_drv.h
+++ b/include/drm/drm_drv.h
@@ -56,6 +56,7 @@ struct drm_printer;
 #define DRIVER_ATOMIC                   0x10000
 #define DRIVER_KMS_LEGACY_CONTEXT       0x20000
 #define DRIVER_SYNCOBJ                  0x40000
+#define DRIVER_PREFER_XBGR_30BPP        0x80000
 
 /**
  * struct drm_driver - DRM driver structure
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index cdbd142ca7f2..02924ae2527e 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -360,6 +360,7 @@ void kvm_vgic_put(struct kvm_vcpu *vcpu);
 bool kvm_vcpu_has_pending_irqs(struct kvm_vcpu *vcpu);
 void kvm_vgic_sync_hwstate(struct kvm_vcpu *vcpu);
 void kvm_vgic_flush_hwstate(struct kvm_vcpu *vcpu);
+void kvm_vgic_reset_mapped_irq(struct kvm_vcpu *vcpu, u32 vintid);
 
 void vgic_v3_dispatch_sgi(struct kvm_vcpu *vcpu, u64 reg);
 
diff --git a/include/linux/bio.h b/include/linux/bio.h
index d0eb659fa733..ce547a25e8ae 100644
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -511,6 +511,7 @@ void zero_fill_bio(struct bio *bio);
 extern struct bio_vec *bvec_alloc(gfp_t, int, unsigned long *, mempool_t *);
 extern void bvec_free(mempool_t *, struct bio_vec *, unsigned int);
 extern unsigned int bvec_nr_vecs(unsigned short idx);
+extern const char *bio_devname(struct bio *bio, char *buffer);
 
 #define bio_set_dev(bio, bdev)                  \
 do {                                            \
@@ -529,9 +530,6 @@ do {						\
 #define bio_dev(bio) \
         disk_devt((bio)->bi_disk)
 
-#define bio_devname(bio, buf) \
-        __bdevname(bio_dev(bio), (buf))
-
 #ifdef CONFIG_BLK_CGROUP
 int bio_associate_blkcg(struct bio *bio, struct cgroup_subsys_state *blkcg_css);
 void bio_disassociate_task(struct bio *bio);
diff --git a/include/linux/compat.h b/include/linux/compat.h
index 8a9643857c4a..16c3027074a2 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -17,6 +17,7 @@
 #include <linux/if.h>
 #include <linux/fs.h>
 #include <linux/aio_abi.h>      /* for aio_context_t */
+#include <linux/uaccess.h>
 #include <linux/unistd.h>
 
 #include <asm/compat.h>
@@ -229,13 +230,13 @@ typedef struct compat_siginfo {
                                 short int _addr_lsb;    /* Valid LSB of the reported address. */
                                 /* used when si_code=SEGV_BNDERR */
                                 struct {
-                                        short _dummy_bnd;
+                                        compat_uptr_t _dummy_bnd;
                                         compat_uptr_t _lower;
                                         compat_uptr_t _upper;
                                 } _addr_bnd;
                                 /* used when si_code=SEGV_PKUERR */
                                 struct {
-                                        short _dummy_pkey;
+                                        compat_uptr_t _dummy_pkey;
                                         u32 _pkey;
                                 } _addr_pkey;
                         };
@@ -550,8 +551,29 @@ asmlinkage long compat_sys_settimeofday(struct compat_timeval __user *tv,
 asmlinkage long compat_sys_adjtimex(struct compat_timex __user *utp);
 
 extern int get_compat_sigset(sigset_t *set, const compat_sigset_t __user *compat);
-extern int put_compat_sigset(compat_sigset_t __user *compat,
-                             const sigset_t *set, unsigned int size);
+
+/*
+ * Defined inline such that size can be compile time constant, which avoids
+ * CONFIG_HARDENED_USERCOPY complaining about copies from task_struct
+ */
+static inline int
+put_compat_sigset(compat_sigset_t __user *compat, const sigset_t *set,
+                  unsigned int size)
+{
+        /* size <= sizeof(compat_sigset_t) <= sizeof(sigset_t) */
+#ifdef __BIG_ENDIAN
+        compat_sigset_t v;
+        switch (_NSIG_WORDS) {
+        case 4: v.sig[7] = (set->sig[3] >> 32); v.sig[6] = set->sig[3];
+        case 3: v.sig[5] = (set->sig[2] >> 32); v.sig[4] = set->sig[2];
+        case 2: v.sig[3] = (set->sig[1] >> 32); v.sig[2] = set->sig[1];
+        case 1: v.sig[1] = (set->sig[0] >> 32); v.sig[0] = set->sig[0];
+        }
+        return copy_to_user(compat, &v, size) ? -EFAULT : 0;
+#else
+        return copy_to_user(compat, set, size) ? -EFAULT : 0;
+#endif
+}
 
 asmlinkage long compat_sys_migrate_pages(compat_pid_t pid,
                 compat_ulong_t maxnode, const compat_ulong_t __user *old_nodes,
diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
index d02a4df3f473..d3f264a5b04d 100644
--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -27,3 +27,8 @@
 #if __has_feature(address_sanitizer)
 #define __SANITIZE_ADDRESS__
 #endif
+
+/* Clang doesn't have a way to turn it off per-function, yet. */
+#ifdef __noretpoline
+#undef __noretpoline
+#endif
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index 901c1ccb3374..e2c7f4369eff 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -93,6 +93,10 @@
 #define __weak          __attribute__((weak))
 #define __alias(symbol) __attribute__((alias(#symbol)))
 
+#ifdef RETPOLINE
+#define __noretpoline __attribute__((indirect_branch("keep")))
+#endif
+
 /*
  * it doesn't make sense on ARM (currently the only user of __naked)
  * to trace naked functions because then mcount is called without
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 2a815560fda0..c6baf767619e 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1317,6 +1317,7 @@ extern int send_sigurg(struct fown_struct *fown);
 #define SB_I_CGROUPWB   0x00000001      /* cgroup-aware writeback enabled */
 #define SB_I_NOEXEC     0x00000002      /* Ignore executables on this fs */
 #define SB_I_NODEV      0x00000004      /* Ignore devices on this fs */
+#define SB_I_MULTIROOT  0x00000008      /* Multiple roots to the dentry tree */
 
 /* sb->s_iflags to limit user namespace mounts */
 #define SB_I_USERNS_VISIBLE             0x00000010 /* fstype already mounted */
@@ -3198,7 +3199,7 @@ static inline bool vma_is_fsdax(struct vm_area_struct *vma)
         if (!vma_is_dax(vma))
                 return false;
         inode = file_inode(vma->vm_file);
-        if (inode->i_mode == S_IFCHR)
+        if (S_ISCHR(inode->i_mode))
                 return false; /* device-dax */
         return true;
 }
diff --git a/include/linux/genhd.h b/include/linux/genhd.h
index 5e3531027b51..c826b0b5232a 100644
--- a/include/linux/genhd.h
+++ b/include/linux/genhd.h
@@ -198,6 +198,7 @@ struct gendisk {
         void *private_data;
 
         int flags;
+        struct rw_semaphore lookup_sem;
         struct kobject *slave_dir;
 
         struct timer_rand_state *random;
@@ -600,8 +601,9 @@ extern void delete_partition(struct gendisk *, int);
 extern void printk_all_partitions(void);
 
 extern struct gendisk *__alloc_disk_node(int minors, int node_id);
-extern struct kobject *get_disk(struct gendisk *disk);
+extern struct kobject *get_disk_and_module(struct gendisk *disk);
 extern void put_disk(struct gendisk *disk);
+extern void put_disk_and_module(struct gendisk *disk);
 extern void blk_register_region(dev_t devt, unsigned long range,
                         struct module *module,
                         struct kobject *(*probe)(dev_t, int *, void *),
diff --git a/include/linux/init.h b/include/linux/init.h
index 506a98151131..bc27cf03c41e 100644
--- a/include/linux/init.h
+++ b/include/linux/init.h
@@ -6,10 +6,10 @@
 #include <linux/types.h>
 
 /* Built-in __init functions needn't be compiled with retpoline */
-#if defined(RETPOLINE) && !defined(MODULE)
-#define __noretpoline __attribute__((indirect_branch("keep")))
+#if defined(__noretpoline) && !defined(MODULE)
+#define __noinitretpoline __noretpoline
 #else
-#define __noretpoline
+#define __noinitretpoline
 #endif
 
 /* These macros are used to mark some functions or 
@@ -47,7 +47,7 @@
 
 /* These are for everybody (although not all archs will actually
    discard it in modules) */
-#define __init          __section(.init.text) __cold  __latent_entropy __noretpoline
+#define __init          __section(.init.text) __cold  __latent_entropy __noinitretpoline
 #define __initdata      __section(.init.data)
 #define __initconst     __section(.init.rodata)
 #define __exitdata      __section(.exit.data)
diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
index c00c4c33e432..b26eccc78fb1 100644
--- a/include/linux/irqchip/arm-gic-v3.h
+++ b/include/linux/irqchip/arm-gic-v3.h
@@ -503,6 +503,7 @@
 
 #define ICH_HCR_EN                      (1 << 0)
 #define ICH_HCR_UIE                     (1 << 1)
+#define ICH_HCR_NPIE                    (1 << 3)
 #define ICH_HCR_TC                      (1 << 10)
 #define ICH_HCR_TALL0                   (1 << 11)
 #define ICH_HCR_TALL1                   (1 << 12)
diff --git a/include/linux/irqchip/arm-gic.h b/include/linux/irqchip/arm-gic.h
index d3453ee072fc..68d8b1f73682 100644
--- a/include/linux/irqchip/arm-gic.h
+++ b/include/linux/irqchip/arm-gic.h
@@ -84,6 +84,7 @@
 
 #define GICH_HCR_EN                     (1 << 0)
 #define GICH_HCR_UIE                    (1 << 1)
+#define GICH_HCR_NPIE                   (1 << 3)
 
 #define GICH_LR_VIRTUALID               (0x3ff << 0)
 #define GICH_LR_PHYSID_CPUID_SHIFT      (10)
diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h
index b6a29c126cc4..2168cc6b8b30 100644
--- a/include/linux/jump_label.h
+++ b/include/linux/jump_label.h
@@ -151,6 +151,7 @@ extern struct jump_entry __start___jump_table[];
 extern struct jump_entry __stop___jump_table[];
 
 extern void jump_label_init(void);
+extern void jump_label_invalidate_init(void);
 extern void jump_label_lock(void);
 extern void jump_label_unlock(void);
 extern void arch_jump_label_transform(struct jump_entry *entry,
@@ -198,6 +199,8 @@ static __always_inline void jump_label_init(void)
         static_key_initialized = true;
 }
 
+static inline void jump_label_invalidate_init(void) {}
+
 static __always_inline bool static_key_false(struct static_key *key)
 {
         if (unlikely(static_key_count(key) > 0))
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index ce51455e2adf..3fd291503576 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -472,6 +472,7 @@ extern bool parse_option_str(const char *str, const char *option);
 extern char *next_arg(char *args, char **param, char **val);
 
 extern int core_kernel_text(unsigned long addr);
+extern int init_kernel_text(unsigned long addr);
 extern int core_kernel_data(unsigned long addr);
 extern int __kernel_text_address(unsigned long addr);
 extern int kernel_text_address(unsigned long addr);
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index ac0062b74aed..6930c63126c7 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -1105,7 +1105,6 @@ static inline void kvm_irq_routing_update(struct kvm *kvm)
 {
 }
 #endif
-void kvm_arch_irq_routing_update(struct kvm *kvm);
 
 static inline int kvm_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
 {
@@ -1114,6 +1113,8 @@ static inline int kvm_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
 
 #endif /* CONFIG_HAVE_KVM_EVENTFD */
 
+void kvm_arch_irq_routing_update(struct kvm *kvm);
+
 static inline void kvm_make_request(int req, struct kvm_vcpu *vcpu)
 {
         /*
@@ -1272,4 +1273,7 @@ static inline long kvm_arch_vcpu_async_ioctl(struct file *filp,
 }
 #endif /* CONFIG_HAVE_KVM_VCPU_ASYNC_IOCTL */
 
+void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm,
+                unsigned long start, unsigned long end);
+
 #endif
diff --git a/include/linux/nospec.h b/include/linux/nospec.h
index fbc98e2c8228..e791ebc65c9c 100644
--- a/include/linux/nospec.h
+++ b/include/linux/nospec.h
@@ -5,6 +5,7 @@
 
 #ifndef _LINUX_NOSPEC_H
 #define _LINUX_NOSPEC_H
+#include <asm/barrier.h>
 
 /**
  * array_index_mask_nospec() - generate a ~0 mask when index < size, 0 otherwise
@@ -30,26 +31,6 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
 #endif
 
 /*
- * Warn developers about inappropriate array_index_nospec() usage.
- *
- * Even if the CPU speculates past the WARN_ONCE branch, the
- * sign bit of @index is taken into account when generating the
- * mask.
- *
- * This warning is compiled out when the compiler can infer that
- * @index and @size are less than LONG_MAX.
- */
-#define array_index_mask_nospec_check(index, size)                              \
-({                                                                              \
-        if (WARN_ONCE(index > LONG_MAX || size > LONG_MAX,                      \
-            "array_index_nospec() limited to range of [0, LONG_MAX]\n"))        \
-                _mask = 0;                                                      \
-        else                                                                    \
-                _mask = array_index_mask_nospec(index, size);                   \
-        _mask;                                                                  \
-})
-
-/*
  * array_index_nospec - sanitize an array index after a bounds check
  *
  * For a code sequence like:
@@ -67,12 +48,11 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
 ({                                                                      \
         typeof(index) _i = (index);                                     \
         typeof(size) _s = (size);                                       \
-        unsigned long _mask = array_index_mask_nospec_check(_i, _s);    \
+        unsigned long _mask = array_index_mask_nospec(_i, _s);          \
                                                                         \
         BUILD_BUG_ON(sizeof(_i) > sizeof(long));                        \
         BUILD_BUG_ON(sizeof(_s) > sizeof(long));                        \
                                                                         \
-        _i &= _mask;                                                    \
-        _i;                                                             \
+        (typeof(_i)) (_i & _mask);                                      \
 })
 #endif /* _LINUX_NOSPEC_H */
diff --git a/include/linux/of_pci.h b/include/linux/of_pci.h
index 88865e0ebf4d..091033a6b836 100644
--- a/include/linux/of_pci.h
+++ b/include/linux/of_pci.h
@@ -13,7 +13,6 @@ struct device_node;
 struct device_node *of_pci_find_child_device(struct device_node *parent,
                                              unsigned int devfn);
 int of_pci_get_devfn(struct device_node *np);
-int of_irq_parse_and_map_pci(const struct pci_dev *dev, u8 slot, u8 pin);
 int of_pci_parse_bus_range(struct device_node *node, struct resource *res);
 int of_get_pci_domain_nr(struct device_node *node);
 int of_pci_get_max_link_speed(struct device_node *node);
@@ -34,12 +33,6 @@ static inline int of_pci_get_devfn(struct device_node *np)
 }
 
 static inline int
-of_irq_parse_and_map_pci(const struct pci_dev *dev, u8 slot, u8 pin)
-{
-        return 0;
-}
-
-static inline int
 of_pci_parse_bus_range(struct device_node *node, struct resource *res)
 {
         return -EINVAL;
@@ -67,6 +60,16 @@ of_pci_get_max_link_speed(struct device_node *node)
 static inline void of_pci_check_probe_only(void) { }
 #endif
 
+#if IS_ENABLED(CONFIG_OF_IRQ)
+int of_irq_parse_and_map_pci(const struct pci_dev *dev, u8 slot, u8 pin);
+#else
+static inline int
+of_irq_parse_and_map_pci(const struct pci_dev *dev, u8 slot, u8 pin)
+{
+        return 0;
+}
+#endif
+
 #if defined(CONFIG_OF_ADDRESS)
 int of_pci_get_host_bridge_resources(struct device_node *dev,
                         unsigned char busno, unsigned char bus_max,
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 5a0c3e53e7c2..d7069539f351 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -924,6 +924,7 @@ void phy_device_remove(struct phy_device *phydev);
 int phy_init_hw(struct phy_device *phydev);
 int phy_suspend(struct phy_device *phydev);
 int phy_resume(struct phy_device *phydev);
+int __phy_resume(struct phy_device *phydev);
 int phy_loopback(struct phy_device *phydev, bool enable);
 struct phy_device *phy_attach(struct net_device *dev, const char *bus_id,
                               phy_interface_t interface);
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index c1e66bdcf583..ddf77cf4ff2d 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -3285,8 +3285,7 @@ int skb_zerocopy(struct sk_buff *to, struct sk_buff *from,
 void skb_split(struct sk_buff *skb, struct sk_buff *skb1, const u32 len);
 int skb_shift(struct sk_buff *tgt, struct sk_buff *skb, int shiftlen);
 void skb_scrub_packet(struct sk_buff *skb, bool xnet);
-unsigned int skb_gso_transport_seglen(const struct sk_buff *skb);
-bool skb_gso_validate_mtu(const struct sk_buff *skb, unsigned int mtu);
+bool skb_gso_validate_network_len(const struct sk_buff *skb, unsigned int mtu);
 bool skb_gso_validate_mac_len(const struct sk_buff *skb, unsigned int len);
 struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features);
 struct sk_buff *skb_vlan_untag(struct sk_buff *skb);
@@ -4104,38 +4103,6 @@ static inline bool skb_head_is_locked(const struct sk_buff *skb)
         return !skb->head_frag || skb_cloned(skb);
 }
 
-/**
- * skb_gso_network_seglen - Return length of individual segments of a gso packet
- *
- * @skb: GSO skb
- *
- * skb_gso_network_seglen is used to determine the real size of the
- * individual segments, including Layer3 (IP, IPv6) and L4 headers (TCP/UDP).
- *
- * The MAC/L2 header is not accounted for.
- */
-static inline unsigned int skb_gso_network_seglen(const struct sk_buff *skb)
-{
-        unsigned int hdr_len = skb_transport_header(skb) -
-                               skb_network_header(skb);
-        return hdr_len + skb_gso_transport_seglen(skb);
-}
-
-/**
- * skb_gso_mac_seglen - Return length of individual segments of a gso packet
- *
- * @skb: GSO skb
- *
- * skb_gso_mac_seglen is used to determine the real size of the
- * individual segments, including MAC/L2, Layer3 (IP, IPv6) and L4
- * headers (TCP/UDP).
- */
-static inline unsigned int skb_gso_mac_seglen(const struct sk_buff *skb)
-{
-        unsigned int hdr_len = skb_transport_header(skb) - skb_mac_header(skb);
-        return hdr_len + skb_gso_transport_seglen(skb);
-}
-
 /* Local Checksum Offload.
  * Compute outer checksum based on the assumption that the
  * inner checksum will be offloaded later.
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 0a6c71e0ad01..47f8af22f216 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -364,6 +364,7 @@ struct tty_file_private {
 #define TTY_PTY_LOCK            16      /* pty private */
 #define TTY_NO_WRITE_SPLIT      17      /* Preserve write boundaries to driver */
 #define TTY_HUPPED              18      /* Post driver->hangup() */
+#define TTY_HUPPING             19      /* Hangup in progress */
 #define TTY_LDISC_HALTED        22      /* Line discipline is halted */
 
 /* Values for tty->flow_change */
diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
index f1fcec2fd5f8..b7a99ce56bc9 100644
--- a/include/linux/usb/quirks.h
+++ b/include/linux/usb/quirks.h
@@ -63,4 +63,7 @@
  */
 #define USB_QUIRK_DISCONNECT_SUSPEND            BIT(12)
 
+/* Device needs a pause after every control message. */
+#define USB_QUIRK_DELAY_CTRL_MSG                BIT(13)
+
 #endif /* __LINUX_USB_QUIRKS_H */
diff --git a/include/media/demux.h b/include/media/demux.h
index c4df6cee48e6..bf00a5a41a90 100644
--- a/include/media/demux.h
+++ b/include/media/demux.h
@@ -117,7 +117,7 @@ struct dmx_ts_feed {
  *                specified by @filter_value that will be used on the filter
  *                match logic.
  * @filter_mode:  Contains a 16 bytes (128 bits) filter mode.
- * @parent:       Pointer to struct dmx_section_feed.
+ * @parent:       Back-pointer to struct dmx_section_feed.
  * @priv:         Pointer to private data of the API client.
  *
  *
@@ -130,8 +130,9 @@ struct dmx_section_filter {
         u8 filter_value[DMX_MAX_FILTER_SIZE];
         u8 filter_mask[DMX_MAX_FILTER_SIZE];
         u8 filter_mode[DMX_MAX_FILTER_SIZE];
-        struct dmx_section_feed *parent; /* Back-pointer */
-        void *priv; /* Pointer to private data of the API client */
+        struct dmx_section_feed *parent;
+
+        void *priv;
 };
 
 /**
@@ -193,6 +194,10 @@ struct dmx_section_feed {
  * @buffer2:            Pointer to the tail of the filtered TS packets, or NULL.
  * @buffer2_length:     Length of the TS data in buffer2.
  * @source:             Indicates which TS feed is the source of the callback.
+ * @buffer_flags:       Address where buffer flags are stored. Those are
+ *                      used to report discontinuity users via DVB
+ *                      memory mapped API, as defined by
+ *                      &enum dmx_buffer_flags.
  *
  * This function callback prototype, provided by the client of the demux API,
  * is called from the demux code. The function is only called when filtering
@@ -245,7 +250,8 @@ typedef int (*dmx_ts_cb)(const u8 *buffer1,
                          size_t buffer1_length,
                          const u8 *buffer2,
                          size_t buffer2_length,
-                         struct dmx_ts_feed *source);
+                         struct dmx_ts_feed *source,
+                         u32 *buffer_flags);
 
 /**
  * typedef dmx_section_cb - DVB demux TS filter callback function prototype
@@ -261,6 +267,10 @@ typedef int (*dmx_ts_cb)(const u8 *buffer1,
  *                      including headers and CRC.
  * @source:             Indicates which section feed is the source of the
  *                      callback.
+ * @buffer_flags:       Address where buffer flags are stored. Those are
+ *                      used to report discontinuity users via DVB
+ *                      memory mapped API, as defined by
+ *                      &enum dmx_buffer_flags.
  *
  * This function callback prototype, provided by the client of the demux API,
  * is called from the demux code. The function is only called when
@@ -286,7 +296,8 @@ typedef int (*dmx_section_cb)(const u8 *buffer1,
                               size_t buffer1_len,
                               const u8 *buffer2,
                               size_t buffer2_len,
-                              struct dmx_section_filter *source);
+                              struct dmx_section_filter *source,
+                              u32 *buffer_flags);
 
 /*
  * DVB Front-End
diff --git a/include/media/dmxdev.h b/include/media/dmxdev.h
index 2f5cb2c7b6a7..baafa3b8aca4 100644
--- a/include/media/dmxdev.h
+++ b/include/media/dmxdev.h
@@ -163,6 +163,7 @@ struct dmxdev_filter {
  * @demux:              pointer to &struct dmx_demux.
  * @filternum:          number of filters.
  * @capabilities:       demux capabilities as defined by &enum dmx_demux_caps.
+ * @may_do_mmap:        flag used to indicate if the device may do mmap.
  * @exit:               flag to indicate that the demux is being released.
  * @dvr_orig_fe:        pointer to &struct dmx_frontend.
  * @dvr_buffer:         embedded &struct dvb_ringbuffer for DVB output.
@@ -180,6 +181,7 @@ struct dmxdev {
         int filternum;
         int capabilities;
 
+        unsigned int may_do_mmap:1;
         unsigned int exit:1;
 #define DMXDEV_CAP_DUPLEX 1
         struct dmx_frontend *dvr_orig_fe;
diff --git a/include/media/dvb_demux.h b/include/media/dvb_demux.h
index b07092038f4b..3b6aeca7a49e 100644
--- a/include/media/dvb_demux.h
+++ b/include/media/dvb_demux.h
@@ -115,6 +115,8 @@ struct dvb_demux_filter {
  * @pid:        PID to be filtered.
  * @timeout:    feed timeout.
  * @filter:     pointer to &struct dvb_demux_filter.
+ * @buffer_flags: Buffer flags used to report discontinuity users via DVB
+ *                memory mapped API, as defined by &enum dmx_buffer_flags.
  * @ts_type:    type of TS, as defined by &enum ts_filter_type.
  * @pes_type:   type of PES, as defined by &enum dmx_ts_pes.
  * @cc:         MPEG-TS packet continuity counter
@@ -145,6 +147,8 @@ struct dvb_demux_feed {
         ktime_t timeout;
         struct dvb_demux_filter *filter;
 
+        u32 buffer_flags;
+
         enum ts_filter_type ts_type;
         enum dmx_ts_pes pes_type;
 
diff --git a/include/media/dvb_vb2.h b/include/media/dvb_vb2.h
index 01d1202d1a55..8cb88452cd6c 100644
--- a/include/media/dvb_vb2.h
+++ b/include/media/dvb_vb2.h
@@ -85,6 +85,12 @@ struct dvb_buffer {
  * @nonblocking:
  *              If different than zero, device is operating on non-blocking
  *              mode.
+ * @flags:      buffer flags as defined by &enum dmx_buffer_flags.
+ *              Filled only at &DMX_DQBUF. &DMX_QBUF should zero this field.
+ * @count:      monotonic counter for filled buffers. Helps to identify
+ *              data stream loses. Filled only at &DMX_DQBUF. &DMX_QBUF should
+ *              zero this field.
+ *
  * @name:       name of the device type. Currently, it can either be
  *              "dvr" or "demux_filter".
  */
@@ -100,10 +106,14 @@ struct dvb_vb2_ctx {
         int     buf_siz;
         int     buf_cnt;
         int     nonblocking;
+
+        enum dmx_buffer_flags flags;
+        u32     count;
+
         char    name[DVB_VB2_NAME_MAX + 1];
 };
 
-#ifndef DVB_MMAP
+#ifndef CONFIG_DVB_MMAP
 static inline int dvb_vb2_init(struct dvb_vb2_ctx *ctx,
                                const char *name, int non_blocking)
 {
@@ -114,7 +124,7 @@ static inline int dvb_vb2_release(struct dvb_vb2_ctx *ctx)
         return 0;
 };
 #define dvb_vb2_is_streaming(ctx) (0)
-#define dvb_vb2_fill_buffer(ctx, file, wait) (0)
+#define dvb_vb2_fill_buffer(ctx, file, wait, flags) (0)
 
 static inline __poll_t dvb_vb2_poll(struct dvb_vb2_ctx *ctx,
                                     struct file *file,
@@ -153,9 +163,13 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx);
  * @ctx:        control struct for VB2 handler
  * @src:        place where the data is stored
  * @len:        number of bytes to be copied from @src
+ * @buffer_flags:
+ *              pointer to buffer flags as defined by &enum dmx_buffer_flags.
+ *              can be NULL.
  */
 int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
-                        const unsigned char *src, int len);
+                        const unsigned char *src, int len,
+                        enum dmx_buffer_flags *buffer_flags);
 
 /**
  * dvb_vb2_poll - Wrapper to vb2_core_streamon() for Digital TV
diff --git a/include/net/devlink.h b/include/net/devlink.h
index 6545b03e97f7..4de35ed12bcc 100644
--- a/include/net/devlink.h
+++ b/include/net/devlink.h
@@ -257,6 +257,18 @@ struct devlink_resource_size_params {
         enum devlink_resource_unit unit;
 };
 
+static inline void
+devlink_resource_size_params_init(struct devlink_resource_size_params *size_params,
+                                  u64 size_min, u64 size_max,
+                                  u64 size_granularity,
+                                  enum devlink_resource_unit unit)
+{
+        size_params->size_min = size_min;
+        size_params->size_max = size_max;
+        size_params->size_granularity = size_granularity;
+        size_params->unit = unit;
+}
+
 /**
  * struct devlink_resource - devlink resource
  * @name: name of the resource
@@ -278,7 +290,7 @@ struct devlink_resource {
         u64 size_new;
         bool size_valid;
         struct devlink_resource *parent;
-        struct devlink_resource_size_params *size_params;
+        struct devlink_resource_size_params size_params;
         struct list_head list;
         struct list_head resource_list;
         const struct devlink_resource_ops *resource_ops;
@@ -402,7 +414,7 @@ int devlink_resource_register(struct devlink *devlink,
                               u64 resource_size,
                               u64 resource_id,
                               u64 parent_resource_id,
-                              struct devlink_resource_size_params *size_params,
+                              const struct devlink_resource_size_params *size_params,
                               const struct devlink_resource_ops *resource_ops);
 void devlink_resources_unregister(struct devlink *devlink,
                                   struct devlink_resource *resource);
@@ -556,7 +568,7 @@ devlink_resource_register(struct devlink *devlink,
                           u64 resource_size,
                           u64 resource_id,
                           u64 parent_resource_id,
-                          struct devlink_resource_size_params *size_params,
+                          const struct devlink_resource_size_params *size_params,
                           const struct devlink_resource_ops *resource_ops)
 {
         return 0;
diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h
index d8d4a902a88d..2280b2351739 100644
--- a/include/scsi/scsi_cmnd.h
+++ b/include/scsi/scsi_cmnd.h
@@ -68,6 +68,9 @@ struct scsi_cmnd {
         struct list_head list;  /* scsi_cmnd participates in queue lists */
         struct list_head eh_entry; /* entry for the host eh_cmd_q */
         struct delayed_work abort_work;
+
+        struct rcu_head rcu;
+
         int eh_eflags;          /* Used by error handlr */
 
         /*
diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h
index 1a1df0d21ee3..a8b7bf879ced 100644
--- a/include/scsi/scsi_host.h
+++ b/include/scsi/scsi_host.h
@@ -571,8 +571,6 @@ struct Scsi_Host {
                 struct blk_mq_tag_set   tag_set;
         };
 
-        struct rcu_head rcu;
-
         atomic_t host_busy;                /* commands actually active on low-level */
         atomic_t host_blocked;
 
diff --git a/include/soc/arc/mcip.h b/include/soc/arc/mcip.h
index c2d1b15da136..a91f25151a5b 100644
--- a/include/soc/arc/mcip.h
+++ b/include/soc/arc/mcip.h
@@ -15,6 +15,7 @@
 
 #define ARC_REG_MCIP_BCR        0x0d0
 #define ARC_REG_MCIP_IDU_BCR    0x0D5
+#define ARC_REG_GFRC_BUILD      0x0D6
 #define ARC_REG_MCIP_CMD        0x600
 #define ARC_REG_MCIP_WDATA      0x601
 #define ARC_REG_MCIP_READBACK   0x602
@@ -36,10 +37,14 @@ struct mcip_cmd {
 #define CMD_SEMA_RELEASE                0x12
 
 #define CMD_DEBUG_SET_MASK              0x34
+#define CMD_DEBUG_READ_MASK             0x35
 #define CMD_DEBUG_SET_SELECT            0x36
+#define CMD_DEBUG_READ_SELECT           0x37
 
 #define CMD_GFRC_READ_LO                0x42
 #define CMD_GFRC_READ_HI                0x43
+#define CMD_GFRC_SET_CORE               0x47
+#define CMD_GFRC_READ_CORE              0x48
 
 #define CMD_IDU_ENABLE                  0x71
 #define CMD_IDU_DISABLE                 0x72
diff --git a/include/uapi/asm-generic/siginfo.h b/include/uapi/asm-generic/siginfo.h
index 85dc965afd89..99c902e460c2 100644
--- a/include/uapi/asm-generic/siginfo.h
+++ b/include/uapi/asm-generic/siginfo.h
@@ -102,13 +102,13 @@ typedef struct siginfo {
                                 short _addr_lsb; /* LSB of the reported address */
                                 /* used when si_code=SEGV_BNDERR */
                                 struct {
-                                        short _dummy_bnd;
+                                        void *_dummy_bnd;
                                         void __user *_lower;
                                         void __user *_upper;
                                 } _addr_bnd;
                                 /* used when si_code=SEGV_PKUERR */
                                 struct {
-                                        short _dummy_pkey;
+                                        void *_dummy_pkey;
                                         __u32 _pkey;
                                 } _addr_pkey;
                         };
diff --git a/include/uapi/drm/virtgpu_drm.h b/include/uapi/drm/virtgpu_drm.h
index 91a31ffed828..9a781f0611df 100644
--- a/include/uapi/drm/virtgpu_drm.h
+++ b/include/uapi/drm/virtgpu_drm.h
@@ -63,6 +63,7 @@ struct drm_virtgpu_execbuffer {
 };
 
 #define VIRTGPU_PARAM_3D_FEATURES 1 /* do we have 3D features in the hw */
+#define VIRTGPU_PARAM_CAPSET_QUERY_FIX 2 /* do we have the capset fix */
 
 struct drm_virtgpu_getparam {
         __u64 param;
diff --git a/include/uapi/linux/blktrace_api.h b/include/uapi/linux/blktrace_api.h
index 20d1490d6377..3c50e07ee833 100644
--- a/include/uapi/linux/blktrace_api.h
+++ b/include/uapi/linux/blktrace_api.h
@@ -131,7 +131,7 @@ enum {
 #define BLKTRACE_BDEV_SIZE      32
 
 /*
- * User setup structure passed with BLKTRACESTART
+ * User setup structure passed with BLKTRACESETUP
  */
 struct blk_user_trace_setup {
         char name[BLKTRACE_BDEV_SIZE];  /* output */
diff --git a/include/uapi/linux/dvb/dmx.h b/include/uapi/linux/dvb/dmx.h
index 5f3c5a918f00..b4112f0b6dd3 100644
--- a/include/uapi/linux/dvb/dmx.h
+++ b/include/uapi/linux/dvb/dmx.h
@@ -212,6 +212,32 @@ struct dmx_stc {
 };
 
 /**
+ * enum dmx_buffer_flags - DMX memory-mapped buffer flags
+ *
+ * @DMX_BUFFER_FLAG_HAD_CRC32_DISCARD:
+ *      Indicates that the Kernel discarded one or more frames due to wrong
+ *      CRC32 checksum.
+ * @DMX_BUFFER_FLAG_TEI:
+ *      Indicates that the Kernel has detected a Transport Error indicator
+ *      (TEI) on a filtered pid.
+ * @DMX_BUFFER_PKT_COUNTER_MISMATCH:
+ *      Indicates that the Kernel has detected a packet counter mismatch
+ *      on a filtered pid.
+ * @DMX_BUFFER_FLAG_DISCONTINUITY_DETECTED:
+ *      Indicates that the Kernel has detected one or more frame discontinuity.
+ * @DMX_BUFFER_FLAG_DISCONTINUITY_INDICATOR:
+ *      Received at least one packet with a frame discontinuity indicator.
+ */
+
+enum dmx_buffer_flags {
+        DMX_BUFFER_FLAG_HAD_CRC32_DISCARD               = 1 << 0,
+        DMX_BUFFER_FLAG_TEI                             = 1 << 1,
+        DMX_BUFFER_PKT_COUNTER_MISMATCH                 = 1 << 2,
+        DMX_BUFFER_FLAG_DISCONTINUITY_DETECTED          = 1 << 3,
+        DMX_BUFFER_FLAG_DISCONTINUITY_INDICATOR         = 1 << 4,
+};
+
+/**
  * struct dmx_buffer - dmx buffer info
  *
  * @index:      id number of the buffer
@@ -220,15 +246,24 @@ struct dmx_stc {
  *              offset from the start of the device memory for this plane,
  *              (or a "cookie" that should be passed to mmap() as offset)
  * @length:     size in bytes of the buffer
+ * @flags:      bit array of buffer flags as defined by &enum dmx_buffer_flags.
+ *              Filled only at &DMX_DQBUF.
+ * @count:      monotonic counter for filled buffers. Helps to identify
+ *              data stream loses. Filled only at &DMX_DQBUF.
  *
  * Contains data exchanged by application and driver using one of the streaming
  * I/O methods.
+ *
+ * Please notice that, for &DMX_QBUF, only @index should be filled.
+ * On &DMX_DQBUF calls, all fields will be filled by the Kernel.
  */
 struct dmx_buffer {
         __u32                   index;
         __u32                   bytesused;
         __u32                   offset;
         __u32                   length;
+        __u32                   flags;
+        __u32                   count;
 };
 
 /**
diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h
index 0fb5ef939732..7b26d4b0b052 100644
--- a/include/uapi/linux/kvm.h
+++ b/include/uapi/linux/kvm.h
@@ -761,6 +761,7 @@ struct kvm_ppc_resize_hpt {
 #define KVM_TRACE_PAUSE           __KVM_DEPRECATED_MAIN_0x07
 #define KVM_TRACE_DISABLE         __KVM_DEPRECATED_MAIN_0x08
 #define KVM_GET_EMULATED_CPUID    _IOWR(KVMIO, 0x09, struct kvm_cpuid2)
+#define KVM_GET_MSR_FEATURE_INDEX_LIST    _IOWR(KVMIO, 0x0a, struct kvm_msr_list)
 
 /*
  * Extension capability list.
@@ -934,6 +935,7 @@ struct kvm_ppc_resize_hpt {
 #define KVM_CAP_S390_AIS_MIGRATION 150
 #define KVM_CAP_PPC_GET_CPU_CHAR 151
 #define KVM_CAP_S390_BPB 152
+#define KVM_CAP_GET_MSR_FEATURES 153
 
 #ifdef KVM_CAP_IRQ_ROUTING
 
diff --git a/include/uapi/linux/psp-sev.h b/include/uapi/linux/psp-sev.h
index 3d77fe91239a..9008f31c7eb6 100644
--- a/include/uapi/linux/psp-sev.h
+++ b/include/uapi/linux/psp-sev.h
@@ -42,7 +42,7 @@ typedef enum {
         SEV_RET_INVALID_PLATFORM_STATE,
         SEV_RET_INVALID_GUEST_STATE,
         SEV_RET_INAVLID_CONFIG,
-        SEV_RET_INVALID_len,
+        SEV_RET_INVALID_LEN,
         SEV_RET_ALREADY_OWNED,
         SEV_RET_INVALID_CERTIFICATE,
         SEV_RET_POLICY_FAILURE,
diff --git a/include/uapi/misc/ocxl.h b/include/uapi/misc/ocxl.h
index 4b0b0b756f3e..0af83d80fb3e 100644
--- a/include/uapi/misc/ocxl.h
+++ b/include/uapi/misc/ocxl.h
@@ -32,6 +32,22 @@ struct ocxl_ioctl_attach {
         __u64 reserved3;
 };
 
+struct ocxl_ioctl_metadata {
+        __u16 version; // struct version, always backwards compatible
+
+        // Version 0 fields
+        __u8  afu_version_major;
+        __u8  afu_version_minor;
+        __u32 pasid;            // PASID assigned to the current context
+
+        __u64 pp_mmio_size;     // Per PASID MMIO size
+        __u64 global_mmio_size;
+
+        // End version 0 fields
+
+        __u64 reserved[13]; // Total of 16*u64
+};
+
 struct ocxl_ioctl_irq_fd {
         __u64 irq_offset;
         __s32 eventfd;
@@ -45,5 +61,6 @@ struct ocxl_ioctl_irq_fd {
 #define OCXL_IOCTL_IRQ_ALLOC    _IOR(OCXL_MAGIC, 0x11, __u64)
 #define OCXL_IOCTL_IRQ_FREE     _IOW(OCXL_MAGIC, 0x12, __u64)
 #define OCXL_IOCTL_IRQ_SET_FD   _IOW(OCXL_MAGIC, 0x13, struct ocxl_ioctl_irq_fd)
+#define OCXL_IOCTL_GET_METADATA _IOR(OCXL_MAGIC, 0x14, struct ocxl_ioctl_metadata)
 
 #endif /* _UAPI_MISC_OCXL_H */
diff --git a/init/main.c b/init/main.c
index a8100b954839..969eaf140ef0 100644
--- a/init/main.c
+++ b/init/main.c
@@ -89,6 +89,7 @@
 #include <linux/io.h>
 #include <linux/cache.h>
 #include <linux/rodata_test.h>
+#include <linux/jump_label.h>
 
 #include <asm/io.h>
 #include <asm/bugs.h>
@@ -1000,6 +1001,7 @@ static int __ref kernel_init(void *unused)
         /* need to finish all async __init code before freeing the memory */
         async_synchronize_full();
         ftrace_free_init_mem();
+        jump_label_invalidate_init();
         free_initmem();
         mark_readonly();
         system_state = SYSTEM_RUNNING;
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 5fb69a85d967..c6eff108aa99 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1356,6 +1356,13 @@ static bool is_ctx_reg(struct bpf_verifier_env *env, int regno)
         return reg->type == PTR_TO_CTX;
 }
 
+static bool is_pkt_reg(struct bpf_verifier_env *env, int regno)
+{
+        const struct bpf_reg_state *reg = cur_regs(env) + regno;
+
+        return type_is_pkt_pointer(reg->type);
+}
+
 static int check_pkt_ptr_alignment(struct bpf_verifier_env *env,
                                    const struct bpf_reg_state *reg,
                                    int off, int size, bool strict)
@@ -1416,10 +1423,10 @@ static int check_generic_ptr_alignment(struct bpf_verifier_env *env,
 }
 
 static int check_ptr_alignment(struct bpf_verifier_env *env,
-                               const struct bpf_reg_state *reg,
-                               int off, int size)
+                               const struct bpf_reg_state *reg, int off,
+                               int size, bool strict_alignment_once)
 {
-        bool strict = env->strict_alignment;
+        bool strict = env->strict_alignment || strict_alignment_once;
         const char *pointer_desc = "";
 
         switch (reg->type) {
@@ -1576,9 +1583,9 @@ static void coerce_reg_to_size(struct bpf_reg_state *reg, int size)
  * if t==write && value_regno==-1, some unknown value is stored into memory
  * if t==read && value_regno==-1, don't care what we read from memory
  */
-static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regno, int off,
-                            int bpf_size, enum bpf_access_type t,
-                            int value_regno)
+static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regno,
+                            int off, int bpf_size, enum bpf_access_type t,
+                            int value_regno, bool strict_alignment_once)
 {
         struct bpf_reg_state *regs = cur_regs(env);
         struct bpf_reg_state *reg = regs + regno;
@@ -1590,7 +1597,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
                 return size;
 
         /* alignment checks will add in reg->off themselves */
-        err = check_ptr_alignment(env, reg, off, size);
+        err = check_ptr_alignment(env, reg, off, size, strict_alignment_once);
         if (err)
                 return err;
 
@@ -1735,21 +1742,23 @@ static int check_xadd(struct bpf_verifier_env *env, int insn_idx, struct bpf_ins
                 return -EACCES;
         }
 
-        if (is_ctx_reg(env, insn->dst_reg)) {
-                verbose(env, "BPF_XADD stores into R%d context is not allowed\n",
-                        insn->dst_reg);
+        if (is_ctx_reg(env, insn->dst_reg) ||
+            is_pkt_reg(env, insn->dst_reg)) {
+                verbose(env, "BPF_XADD stores into R%d %s is not allowed\n",
+                        insn->dst_reg, is_ctx_reg(env, insn->dst_reg) ?
+                        "context" : "packet");
                 return -EACCES;
         }
 
         /* check whether atomic_add can read the memory */
         err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
-                               BPF_SIZE(insn->code), BPF_READ, -1);
+                               BPF_SIZE(insn->code), BPF_READ, -1, true);
         if (err)
                 return err;
 
         /* check whether atomic_add can write into the same memory */
         return check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
-                                BPF_SIZE(insn->code), BPF_WRITE, -1);
+                                BPF_SIZE(insn->code), BPF_WRITE, -1, true);
 }
 
 /* when register 'regno' is passed into function that will read 'access_size'
@@ -2388,7 +2397,8 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn
          * is inferred from register state.
          */
         for (i = 0; i < meta.access_size; i++) {
-                err = check_mem_access(env, insn_idx, meta.regno, i, BPF_B, BPF_WRITE, -1);
+                err = check_mem_access(env, insn_idx, meta.regno, i, BPF_B,
+                                       BPF_WRITE, -1, false);
                 if (err)
                         return err;
         }
@@ -4632,7 +4642,7 @@ static int do_check(struct bpf_verifier_env *env)
                          */
                         err = check_mem_access(env, insn_idx, insn->src_reg, insn->off,
                                                BPF_SIZE(insn->code), BPF_READ,
-                                               insn->dst_reg);
+                                               insn->dst_reg, false);
                         if (err)
                                 return err;
 
@@ -4684,7 +4694,7 @@ static int do_check(struct bpf_verifier_env *env)
                         /* check that memory (dst_reg + off) is writeable */
                         err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
                                                BPF_SIZE(insn->code), BPF_WRITE,
-                                               insn->src_reg);
+                                               insn->src_reg, false);
                         if (err)
                                 return err;
 
@@ -4719,7 +4729,7 @@ static int do_check(struct bpf_verifier_env *env)
                         /* check that memory (dst_reg + off) is writeable */
                         err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
                                                BPF_SIZE(insn->code), BPF_WRITE,
-                                               -1);
+                                               -1, false);
                         if (err)
                                 return err;
 
diff --git a/kernel/compat.c b/kernel/compat.c
index 3247fe761f60..3f5fa8902e7d 100644
--- a/kernel/compat.c
+++ b/kernel/compat.c
@@ -488,25 +488,6 @@ get_compat_sigset(sigset_t *set, const compat_sigset_t __user *compat)
 }
 EXPORT_SYMBOL_GPL(get_compat_sigset);
 
-int
-put_compat_sigset(compat_sigset_t __user *compat, const sigset_t *set,
-                  unsigned int size)
-{
-        /* size <= sizeof(compat_sigset_t) <= sizeof(sigset_t) */
-#ifdef __BIG_ENDIAN
-        compat_sigset_t v;
-        switch (_NSIG_WORDS) {
-        case 4: v.sig[7] = (set->sig[3] >> 32); v.sig[6] = set->sig[3];
-        case 3: v.sig[5] = (set->sig[2] >> 32); v.sig[4] = set->sig[2];
-        case 2: v.sig[3] = (set->sig[1] >> 32); v.sig[2] = set->sig[1];
-        case 1: v.sig[1] = (set->sig[0] >> 32); v.sig[0] = set->sig[0];
-        }
-        return copy_to_user(compat, &v, size) ? -EFAULT : 0;
-#else
-        return copy_to_user(compat, set, size) ? -EFAULT : 0;
-#endif
-}
-
 #ifdef CONFIG_NUMA
 COMPAT_SYSCALL_DEFINE6(move_pages, pid_t, pid, compat_ulong_t, nr_pages,
                        compat_uptr_t __user *, pages32,
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 96db9ae5d5af..4b838470fac4 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2246,7 +2246,7 @@ static void ctx_resched(struct perf_cpu_context *cpuctx,
                         struct perf_event_context *task_ctx,
                         enum event_type_t event_type)
 {
-        enum event_type_t ctx_event_type = event_type & EVENT_ALL;
+        enum event_type_t ctx_event_type;
         bool cpu_event = !!(event_type & EVENT_CPU);
 
         /*
@@ -2256,6 +2256,8 @@ static void ctx_resched(struct perf_cpu_context *cpuctx,
         if (event_type & EVENT_PINNED)
                 event_type |= EVENT_FLEXIBLE;
 
+        ctx_event_type = event_type & EVENT_ALL;
+
         perf_pmu_disable(cpuctx->ctx.pmu);
         if (task_ctx)
                 task_ctx_sched_out(cpuctx, task_ctx, event_type);
diff --git a/kernel/extable.c b/kernel/extable.c
index a17fdb63dc3e..6a5b61ebc66c 100644
--- a/kernel/extable.c
+++ b/kernel/extable.c
@@ -64,7 +64,7 @@ const struct exception_table_entry *search_exception_tables(unsigned long addr)
         return e;
 }
 
-static inline int init_kernel_text(unsigned long addr)
+int init_kernel_text(unsigned long addr)
 {
         if (addr >= (unsigned long)_sinittext &&
             addr < (unsigned long)_einittext)
diff --git a/kernel/jump_label.c b/kernel/jump_label.c
index b4517095db6a..e7214093dcd1 100644
--- a/kernel/jump_label.c
+++ b/kernel/jump_label.c
@@ -366,12 +366,16 @@ static void __jump_label_update(struct static_key *key,
 {
         for (; (entry < stop) && (jump_entry_key(entry) == key); entry++) {
                 /*
-                 * entry->code set to 0 invalidates module init text sections
-                 * kernel_text_address() verifies we are not in core kernel
-                 * init code, see jump_label_invalidate_module_init().
+                 * An entry->code of 0 indicates an entry which has been
+                 * disabled because it was in an init text area.
                  */
-                if (entry->code && kernel_text_address(entry->code))
-                        arch_jump_label_transform(entry, jump_label_type(entry));
+                if (entry->code) {
+                        if (kernel_text_address(entry->code))
+                                arch_jump_label_transform(entry, jump_label_type(entry));
+                        else
+                                WARN_ONCE(1, "can't patch jump_label at %pS",
+                                          (void *)(unsigned long)entry->code);
+                }
         }
 }
 
@@ -417,6 +421,19 @@ void __init jump_label_init(void)
         cpus_read_unlock();
 }
 
+/* Disable any jump label entries in __init code */
+void __init jump_label_invalidate_init(void)
+{
+        struct jump_entry *iter_start = __start___jump_table;
+        struct jump_entry *iter_stop = __stop___jump_table;
+        struct jump_entry *iter;
+
+        for (iter = iter_start; iter < iter_stop; iter++) {
+                if (init_kernel_text(iter->code))
+                        iter->code = 0;
+        }
+}
+
 #ifdef CONFIG_MODULES
 
 static enum jump_label_type jump_label_init_type(struct jump_entry *entry)
@@ -633,6 +650,7 @@ static void jump_label_del_module(struct module *mod)
         }
 }
 
+/* Disable any jump label entries in module init code */
 static void jump_label_invalidate_module_init(struct module *mod)
 {
         struct jump_entry *iter_start = mod->jump_entries;
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index 65cc0cb984e6..940633c63254 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1616,11 +1616,12 @@ bool __sched __rt_mutex_futex_unlock(struct rt_mutex *lock,
 void __sched rt_mutex_futex_unlock(struct rt_mutex *lock)
 {
         DEFINE_WAKE_Q(wake_q);
+        unsigned long flags;
         bool postunlock;
 
-        raw_spin_lock_irq(&lock->wait_lock);
+        raw_spin_lock_irqsave(&lock->wait_lock, flags);
         postunlock = __rt_mutex_futex_unlock(lock, &wake_q);
-        raw_spin_unlock_irq(&lock->wait_lock);
+        raw_spin_unlock_irqrestore(&lock->wait_lock, flags);
 
         if (postunlock)
                 rt_mutex_postunlock(&wake_q);
diff --git a/kernel/memremap.c b/kernel/memremap.c
index 4849be5f9b3c..4dd4274cabe2 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -275,8 +275,15 @@ static unsigned long pfn_end(struct dev_pagemap *pgmap)
         return (res->start + resource_size(res)) >> PAGE_SHIFT;
 }
 
+static unsigned long pfn_next(unsigned long pfn)
+{
+        if (pfn % 1024 == 0)
+                cond_resched();
+        return pfn + 1;
+}
+
 #define for_each_device_pfn(pfn, map) \
-        for (pfn = pfn_first(map); pfn < pfn_end(map); pfn++)
+        for (pfn = pfn_first(map); pfn < pfn_end(map); pfn = pfn_next(pfn))
 
 static void devm_memremap_pages_release(void *data)
 {
@@ -337,10 +344,10 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap)
         resource_size_t align_start, align_size, align_end;
         struct vmem_altmap *altmap = pgmap->altmap_valid ?
                         &pgmap->altmap : NULL;
+        struct resource *res = &pgmap->res;
         unsigned long pfn, pgoff, order;
         pgprot_t pgprot = PAGE_KERNEL;
-        int error, nid, is_ram, i = 0;
-        struct resource *res = &pgmap->res;
+        int error, nid, is_ram;
 
         align_start = res->start & ~(SECTION_SIZE - 1);
         align_size = ALIGN(res->start + resource_size(res), SECTION_SIZE)
@@ -409,8 +416,6 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap)
                 list_del(&page->lru);
                 page->pgmap = pgmap;
                 percpu_ref_get(pgmap->ref);
-                if (!(++i % 1024))
-                        cond_resched();
         }
 
         devm_add_action(dev, devm_memremap_pages_release, pgmap);
diff --git a/kernel/panic.c b/kernel/panic.c
index 2cfef408fec9..4b794f1d8561 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -640,7 +640,7 @@ device_initcall(register_warn_debugfs);
  */
 __visible void __stack_chk_fail(void)
 {
-        panic("stack-protector: Kernel stack is corrupted in: %p\n",
+        panic("stack-protector: Kernel stack is corrupted in: %pB\n",
                 __builtin_return_address(0));
 }
 EXPORT_SYMBOL(__stack_chk_fail);
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index fc1123583fa6..f274fbef821d 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -2397,7 +2397,7 @@ skip:
 
                 if (console_lock_spinning_disable_and_check()) {
                         printk_safe_exit_irqrestore(flags);
-                        return;
+                        goto out;
                 }
 
                 printk_safe_exit_irqrestore(flags);
@@ -2430,6 +2430,7 @@ skip:
         if (retry && console_trylock())
                 goto again;
 
+out:
         if (wake_klogd)
                 wake_up_klogd();
 }
diff --git a/kernel/time/timer.c b/kernel/time/timer.c
index 48150ab42de9..4a4fd567fb26 100644
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -1894,6 +1894,12 @@ int timers_dead_cpu(unsigned int cpu)
                 raw_spin_lock_irq(&new_base->lock);
                 raw_spin_lock_nested(&old_base->lock, SINGLE_DEPTH_NESTING);
 
+                /*
+                 * The current CPUs base clock might be stale. Update it
+                 * before moving the timers over.
+                 */
+                forward_timer_base(new_base);
+
                 BUG_ON(old_base->running_timer);
 
                 for (i = 0; i < WHEEL_SIZE; i++)
diff --git a/lib/btree.c b/lib/btree.c
index f93a945274af..590facba2c50 100644
--- a/lib/btree.c
+++ b/lib/btree.c
@@ -3,7 +3,7 @@
  *
  * As should be obvious for Linux kernel code, license is GPLv2
  *
- * Copyright (c) 2007-2008 Joern Engel <joern@logfs.org>
+ * Copyright (c) 2007-2008 Joern Engel <joern@purestorage.com>
  * Bits and pieces stolen from Peter Zijlstra's code, which is
  * Copyright 2007, Red Hat Inc. Peter Zijlstra
  * GPLv2
@@ -76,6 +76,8 @@ struct btree_geo btree_geo128 = {
 };
 EXPORT_SYMBOL_GPL(btree_geo128);
 
+#define MAX_KEYLEN      (2 * LONG_PER_U64)
+
 static struct kmem_cache *btree_cachep;
 
 void *btree_alloc(gfp_t gfp_mask, void *pool_data)
@@ -313,7 +315,7 @@ void *btree_get_prev(struct btree_head *head, struct btree_geo *geo,
 {
         int i, height;
         unsigned long *node, *oldnode;
-        unsigned long *retry_key = NULL, key[geo->keylen];
+        unsigned long *retry_key = NULL, key[MAX_KEYLEN];
 
         if (keyzero(geo, __key))
                 return NULL;
@@ -639,8 +641,8 @@ EXPORT_SYMBOL_GPL(btree_remove);
 int btree_merge(struct btree_head *target, struct btree_head *victim,
                 struct btree_geo *geo, gfp_t gfp)
 {
-        unsigned long key[geo->keylen];
-        unsigned long dup[geo->keylen];
+        unsigned long key[MAX_KEYLEN];
+        unsigned long dup[MAX_KEYLEN];
         void *val;
         int err;
 
diff --git a/lib/bug.c b/lib/bug.c
index c1b0fad31b10..1077366f496b 100644
--- a/lib/bug.c
+++ b/lib/bug.c
@@ -150,6 +150,8 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
                 return BUG_TRAP_TYPE_NONE;
 
         bug = find_bug(bugaddr);
+        if (!bug)
+                return BUG_TRAP_TYPE_NONE;
 
         file = NULL;
         line = 0;
@@ -191,7 +193,7 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
         if (file)
                 pr_crit("kernel BUG at %s:%u!\n", file, line);
         else
-                pr_crit("Kernel BUG at %p [verbose debug info unavailable]\n",
+                pr_crit("Kernel BUG at %pB [verbose debug info unavailable]\n",
                         (void *)bugaddr);
 
         return BUG_TRAP_TYPE_BUG;
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index 1b34d210452c..7f5cdc1e6b29 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -1491,12 +1491,12 @@ void debug_dma_alloc_coherent(struct device *dev, size_t size,
         if (unlikely(virt == NULL))
                 return;
 
-        entry = dma_entry_alloc();
-        if (!entry)
+        /* handle vmalloc and linear addresses */
+        if (!is_vmalloc_addr(virt) && !virt_addr_valid(virt))
                 return;
 
-        /* handle vmalloc and linear addresses */
-        if (!is_vmalloc_addr(virt) && !virt_to_page(virt))
+        entry = dma_entry_alloc();
+        if (!entry)
                 return;
 
         entry->type      = dma_debug_coherent;
@@ -1528,7 +1528,7 @@ void debug_dma_free_coherent(struct device *dev, size_t size,
         };
 
         /* handle vmalloc and linear addresses */
-        if (!is_vmalloc_addr(virt) && !virt_to_page(virt))
+        if (!is_vmalloc_addr(virt) && !virt_addr_valid(virt))
                 return;
 
         if (is_vmalloc_addr(virt))
diff --git a/lib/idr.c b/lib/idr.c
index 99ec5bc89d25..823b813f08f8 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -36,8 +36,8 @@ int idr_alloc_u32(struct idr *idr, void *ptr, u32 *nextid,
 {
         struct radix_tree_iter iter;
         void __rcu **slot;
-        int base = idr->idr_base;
-        int id = *nextid;
+        unsigned int base = idr->idr_base;
+        unsigned int id = *nextid;
 
         if (WARN_ON_ONCE(radix_tree_is_internal_node(ptr)))
                 return -EINVAL;
@@ -204,10 +204,11 @@ int idr_for_each(const struct idr *idr,
 
         radix_tree_for_each_slot(slot, &idr->idr_rt, &iter, 0) {
                 int ret;
+                unsigned long id = iter.index + base;
 
-                if (WARN_ON_ONCE(iter.index > INT_MAX))
+                if (WARN_ON_ONCE(id > INT_MAX))
                         break;
-                ret = fn(iter.index + base, rcu_dereference_raw(*slot), data);
+                ret = fn(id, rcu_dereference_raw(*slot), data);
                 if (ret)
                         return ret;
         }
@@ -230,8 +231,8 @@ void *idr_get_next(struct idr *idr, int *nextid)
 {
         struct radix_tree_iter iter;
         void __rcu **slot;
-        int base = idr->idr_base;
-        int id = *nextid;
+        unsigned long base = idr->idr_base;
+        unsigned long id = *nextid;
 
         id = (id < base) ? 0 : id - base;
         slot = radix_tree_iter_find(&idr->idr_rt, &iter, id);
diff --git a/lib/test_bpf.c b/lib/test_bpf.c
index b4e22345963f..2efb213716fa 100644
--- a/lib/test_bpf.c
+++ b/lib/test_bpf.c
@@ -24,10 +24,11 @@
 #include <linux/if_vlan.h>
 #include <linux/random.h>
 #include <linux/highmem.h>
+#include <linux/sched.h>
 
 /* General test specific settings */
 #define MAX_SUBTESTS    3
-#define MAX_TESTRUNS    10000
+#define MAX_TESTRUNS    1000
 #define MAX_DATA        128
 #define MAX_INSNS       512
 #define MAX_K           0xffffFFFF
@@ -6582,6 +6583,7 @@ static __init int test_bpf(void)
                 struct bpf_prog *fp;
                 int err;
 
+                cond_resched();
                 if (exclude_test(i))
                         continue;
 
diff --git a/lib/test_kmod.c b/lib/test_kmod.c
index e372b97eee13..0e5b7a61460b 100644
--- a/lib/test_kmod.c
+++ b/lib/test_kmod.c
@@ -1141,7 +1141,7 @@ static struct kmod_test_device *register_test_dev_kmod(void)
         mutex_lock(&reg_dev_mutex);
 
         /* int should suffice for number of devices, test for wrap */
-        if (unlikely(num_test_devs + 1) < 0) {
+        if (num_test_devs + 1 == INT_MAX) {
                 pr_err("reached limit of number of test devices\n");
                 goto out;
         }
diff --git a/mm/gup.c b/mm/gup.c
index 1b46e6e74881..6afae32571ca 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -516,7 +516,7 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
         }
 
         if (ret & VM_FAULT_RETRY) {
-                if (nonblocking)
+                if (nonblocking && !(fault_flags & FAULT_FLAG_RETRY_NOWAIT))
                         *nonblocking = 0;
                 return -EBUSY;
         }
@@ -890,7 +890,10 @@ static __always_inline long __get_user_pages_locked(struct task_struct *tsk,
                                 break;
                 }
                 if (*locked) {
-                        /* VM_FAULT_RETRY didn't trigger */
+                        /*
+                         * VM_FAULT_RETRY didn't trigger or it was a
+                         * FOLL_NOWAIT.
+                         */
                         if (!pages_done)
                                 pages_done = ret;
                         break;
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 7c204e3d132b..a963f2034dfc 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1583,7 +1583,7 @@ static struct page *alloc_surplus_huge_page(struct hstate *h, gfp_t gfp_mask,
                 page = NULL;
         } else {
                 h->surplus_huge_pages++;
-                h->nr_huge_pages_node[page_to_nid(page)]++;
+                h->surplus_huge_pages_node[page_to_nid(page)]++;
         }
 
 out_unlock:
diff --git a/mm/memblock.c b/mm/memblock.c
index 5a9ca2a1751b..b6ba6b7adadc 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -1107,7 +1107,7 @@ unsigned long __init_memblock memblock_next_valid_pfn(unsigned long pfn,
         struct memblock_type *type = &memblock.memory;
         unsigned int right = type->cnt;
         unsigned int mid, left = 0;
-        phys_addr_t addr = PFN_PHYS(pfn + 1);
+        phys_addr_t addr = PFN_PHYS(++pfn);
 
         do {
                 mid = (right + left) / 2;
@@ -1118,15 +1118,15 @@ unsigned long __init_memblock memblock_next_valid_pfn(unsigned long pfn,
                                   type->regions[mid].size))
                         left = mid + 1;
                 else {
-                        /* addr is within the region, so pfn + 1 is valid */
-                        return min(pfn + 1, max_pfn);
+                        /* addr is within the region, so pfn is valid */
+                        return pfn;
                 }
         } while (left < right);
 
         if (right == type->cnt)
-                return max_pfn;
+                return -1UL;
         else
-                return min(PHYS_PFN(type->regions[right].base), max_pfn);
+                return PHYS_PFN(type->regions[right].base);
 }
 
 /**
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index cb416723538f..635d7dd29d7f 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1910,7 +1910,9 @@ static int move_freepages(struct zone *zone,
          * Remove at a later date when no bug reports exist related to
          * grouping pages by mobility
          */
-        VM_BUG_ON(page_zone(start_page) != page_zone(end_page));
+        VM_BUG_ON(pfn_valid(page_to_pfn(start_page)) &&
+                  pfn_valid(page_to_pfn(end_page)) &&
+                  page_zone(start_page) != page_zone(end_page));
 #endif
 
         if (num_movable)
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 79e326383726..99abeadf416e 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -157,7 +157,7 @@ static void batadv_iv_ogm_orig_free(struct batadv_orig_node *orig_node)
  * Return: 0 on success, a negative error code otherwise.
  */
 static int batadv_iv_ogm_orig_add_if(struct batadv_orig_node *orig_node,
-                                     int max_if_num)
+                                     unsigned int max_if_num)
 {
         void *data_ptr;
         size_t old_size;
@@ -201,7 +201,8 @@ unlock:
  */
 static void
 batadv_iv_ogm_drop_bcast_own_entry(struct batadv_orig_node *orig_node,
-                                   int max_if_num, int del_if_num)
+                                   unsigned int max_if_num,
+                                   unsigned int del_if_num)
 {
         size_t chunk_size;
         size_t if_offset;
@@ -239,7 +240,8 @@ batadv_iv_ogm_drop_bcast_own_entry(struct batadv_orig_node *orig_node,
  */
 static void
 batadv_iv_ogm_drop_bcast_own_sum_entry(struct batadv_orig_node *orig_node,
-                                       int max_if_num, int del_if_num)
+                                       unsigned int max_if_num,
+                                       unsigned int del_if_num)
 {
         size_t if_offset;
         void *data_ptr;
@@ -276,7 +278,8 @@ batadv_iv_ogm_drop_bcast_own_sum_entry(struct batadv_orig_node *orig_node,
  * Return: 0 on success, a negative error code otherwise.
  */
 static int batadv_iv_ogm_orig_del_if(struct batadv_orig_node *orig_node,
-                                     int max_if_num, int del_if_num)
+                                     unsigned int max_if_num,
+                                     unsigned int del_if_num)
 {
         spin_lock_bh(&orig_node->bat_iv.ogm_cnt_lock);
 
@@ -311,7 +314,8 @@ static struct batadv_orig_node *
 batadv_iv_ogm_orig_get(struct batadv_priv *bat_priv, const u8 *addr)
 {
         struct batadv_orig_node *orig_node;
-        int size, hash_added;
+        int hash_added;
+        size_t size;
 
         orig_node = batadv_orig_hash_find(bat_priv, addr);
         if (orig_node)
@@ -893,7 +897,7 @@ batadv_iv_ogm_slide_own_bcast_window(struct batadv_hard_iface *hard_iface)
         u32 i;
         size_t word_index;
         u8 *w;
-        int if_num;
+        unsigned int if_num;
 
         for (i = 0; i < hash->size; i++) {
                 head = &hash->table[i];
@@ -1023,7 +1027,7 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
         struct batadv_neigh_node *tmp_neigh_node = NULL;
         struct batadv_neigh_node *router = NULL;
         struct batadv_orig_node *orig_node_tmp;
-        int if_num;
+        unsigned int if_num;
         u8 sum_orig, sum_neigh;
         u8 *neigh_addr;
         u8 tq_avg;
@@ -1182,7 +1186,7 @@ static bool batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node,
         u8 total_count;
         u8 orig_eq_count, neigh_rq_count, neigh_rq_inv, tq_own;
         unsigned int neigh_rq_inv_cube, neigh_rq_max_cube;
-        int if_num;
+        unsigned int if_num;
         unsigned int tq_asym_penalty, inv_asym_penalty;
         unsigned int combined_tq;
         unsigned int tq_iface_penalty;
@@ -1702,9 +1706,9 @@ static void batadv_iv_ogm_process(const struct sk_buff *skb, int ogm_offset,
 
         if (is_my_orig) {
                 unsigned long *word;
-                int offset;
+                size_t offset;
                 s32 bit_pos;
-                s16 if_num;
+                unsigned int if_num;
                 u8 *weight;
 
                 orig_neigh_node = batadv_iv_ogm_orig_get(bat_priv,
@@ -2729,7 +2733,7 @@ static int batadv_iv_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
         struct batadv_neigh_ifinfo *router_ifinfo = NULL;
         struct batadv_neigh_node *router;
         struct batadv_gw_node *curr_gw;
-        int ret = -EINVAL;
+        int ret = 0;
         void *hdr;
 
         router = batadv_orig_router_get(gw_node->orig_node, BATADV_IF_DEFAULT);
diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c
index 27e165ac9302..c74f81341dab 100644
--- a/net/batman-adv/bat_v.c
+++ b/net/batman-adv/bat_v.c
@@ -928,7 +928,7 @@ static int batadv_v_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
         struct batadv_neigh_ifinfo *router_ifinfo = NULL;
         struct batadv_neigh_node *router;
         struct batadv_gw_node *curr_gw;
-        int ret = -EINVAL;
+        int ret = 0;
         void *hdr;
 
         router = batadv_orig_router_get(gw_node->orig_node, BATADV_IF_DEFAULT);
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index fad47853ad3c..b1a08374088b 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -2161,22 +2161,25 @@ batadv_bla_claim_dump_bucket(struct sk_buff *msg, u32 portid, u32 seq,
 {
         struct batadv_bla_claim *claim;
         int idx = 0;
+        int ret = 0;
 
         rcu_read_lock();
         hlist_for_each_entry_rcu(claim, head, hash_entry) {
                 if (idx++ < *idx_skip)
                         continue;
-                if (batadv_bla_claim_dump_entry(msg, portid, seq,
-                                                primary_if, claim)) {
+
+                ret = batadv_bla_claim_dump_entry(msg, portid, seq,
+                                                  primary_if, claim);
+                if (ret) {
                         *idx_skip = idx - 1;
                         goto unlock;
                 }
         }
 
-        *idx_skip = idx;
+        *idx_skip = 0;
 unlock:
         rcu_read_unlock();
-        return 0;
+        return ret;
 }
 
 /**
@@ -2391,22 +2394,25 @@ batadv_bla_backbone_dump_bucket(struct sk_buff *msg, u32 portid, u32 seq,
 {
         struct batadv_bla_backbone_gw *backbone_gw;
         int idx = 0;
+        int ret = 0;
 
         rcu_read_lock();
         hlist_for_each_entry_rcu(backbone_gw, head, hash_entry) {
                 if (idx++ < *idx_skip)
                         continue;
-                if (batadv_bla_backbone_dump_entry(msg, portid, seq,
-                                                   primary_if, backbone_gw)) {
+
+                ret = batadv_bla_backbone_dump_entry(msg, portid, seq,
+                                                     primary_if, backbone_gw);
+                if (ret) {
                         *idx_skip = idx - 1;
                         goto unlock;
                 }
         }
 
-        *idx_skip = idx;
+        *idx_skip = 0;
 unlock:
         rcu_read_unlock();
-        return 0;
+        return ret;
 }
 
 /**
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index 22dde42fd80e..5afe641ee4b0 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -288,7 +288,8 @@ batadv_frag_merge_packets(struct hlist_head *chain)
         /* Move the existing MAC header to just before the payload. (Override
          * the fragment header.)
          */
-        skb_pull_rcsum(skb_out, hdr_size);
+        skb_pull(skb_out, hdr_size);
+        skb_out->ip_summed = CHECKSUM_NONE;
         memmove(skb_out->data - ETH_HLEN, skb_mac_header(skb_out), ETH_HLEN);
         skb_set_mac_header(skb_out, -ETH_HLEN);
         skb_reset_network_header(skb_out);
diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
index 5f186bff284a..68b54a39c51d 100644
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -763,6 +763,11 @@ int batadv_hardif_enable_interface(struct batadv_hard_iface *hard_iface,
         hard_iface->soft_iface = soft_iface;
         bat_priv = netdev_priv(hard_iface->soft_iface);
 
+        if (bat_priv->num_ifaces >= UINT_MAX) {
+                ret = -ENOSPC;
+                goto err_dev;
+        }
+
         ret = netdev_master_upper_dev_link(hard_iface->net_dev,
                                            soft_iface, NULL, NULL, NULL);
         if (ret)
@@ -876,7 +881,7 @@ void batadv_hardif_disable_interface(struct batadv_hard_iface *hard_iface,
         batadv_hardif_recalc_extra_skbroom(hard_iface->soft_iface);
 
         /* nobody uses this interface anymore */
-        if (!bat_priv->num_ifaces) {
+        if (bat_priv->num_ifaces == 0) {
                 batadv_gw_check_client_stop(bat_priv);
 
                 if (autodel == BATADV_IF_CLEANUP_AUTO)
@@ -912,7 +917,7 @@ batadv_hardif_add_interface(struct net_device *net_dev)
         if (ret)
                 goto free_if;
 
-        hard_iface->if_num = -1;
+        hard_iface->if_num = 0;
         hard_iface->net_dev = net_dev;
         hard_iface->soft_iface = NULL;
         hard_iface->if_status = BATADV_IF_NOT_IN_USE;
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 58a7d9274435..74782426bb77 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -1569,7 +1569,7 @@ int batadv_orig_dump(struct sk_buff *msg, struct netlink_callback *cb)
  * Return: 0 on success or negative error number in case of failure
  */
 int batadv_orig_hash_add_if(struct batadv_hard_iface *hard_iface,
-                            int max_if_num)
+                            unsigned int max_if_num)
 {
         struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
         struct batadv_algo_ops *bao = bat_priv->algo_ops;
@@ -1611,7 +1611,7 @@ err:
  * Return: 0 on success or negative error number in case of failure
  */
 int batadv_orig_hash_del_if(struct batadv_hard_iface *hard_iface,
-                            int max_if_num)
+                            unsigned int max_if_num)
 {
         struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
         struct batadv_hashtable *hash = bat_priv->orig_hash;
diff --git a/net/batman-adv/originator.h b/net/batman-adv/originator.h
index 8e543a3cdc6c..15d896b2de6f 100644
--- a/net/batman-adv/originator.h
+++ b/net/batman-adv/originator.h
@@ -73,9 +73,9 @@ int batadv_orig_seq_print_text(struct seq_file *seq, void *offset);
 int batadv_orig_dump(struct sk_buff *msg, struct netlink_callback *cb);
 int batadv_orig_hardif_seq_print_text(struct seq_file *seq, void *offset);
 int batadv_orig_hash_add_if(struct batadv_hard_iface *hard_iface,
-                            int max_if_num);
+                            unsigned int max_if_num);
 int batadv_orig_hash_del_if(struct batadv_hard_iface *hard_iface,
-                            int max_if_num);
+                            unsigned int max_if_num);
 struct batadv_orig_node_vlan *
 batadv_orig_node_vlan_new(struct batadv_orig_node *orig_node,
                           unsigned short vid);
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 900c5ce21cd4..367a81fb785f 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -459,13 +459,7 @@ void batadv_interface_rx(struct net_device *soft_iface,
 
         /* skb->dev & skb->pkt_type are set here */
         skb->protocol = eth_type_trans(skb, soft_iface);
-
-        /* should not be necessary anymore as we use skb_pull_rcsum()
-         * TODO: please verify this and remove this TODO
-         * -- Dec 21st 2009, Simon Wunderlich
-         */
-
-        /* skb->ip_summed = CHECKSUM_UNNECESSARY; */
+        skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
 
         batadv_inc_counter(bat_priv, BATADV_CNT_RX);
         batadv_add_counter(bat_priv, BATADV_CNT_RX_BYTES,
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index bb1578410e0c..a5aa6d61f4e2 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -167,7 +167,7 @@ struct batadv_hard_iface {
         struct list_head list;
 
         /** @if_num: identificator of the interface */
-        s16 if_num;
+        unsigned int if_num;
 
         /** @if_status: status of the interface for batman-adv */
         char if_status;
@@ -1596,7 +1596,7 @@ struct batadv_priv {
         atomic_t batman_queue_left;
 
         /** @num_ifaces: number of interfaces assigned to this mesh interface */
-        char num_ifaces;
+        unsigned int num_ifaces;
 
         /** @mesh_obj: kobject for sysfs mesh subdirectory */
         struct kobject *mesh_obj;
@@ -2186,15 +2186,16 @@ struct batadv_algo_orig_ops {
          *  orig_node due to a new hard-interface being added into the mesh
          *  (optional)
          */
-        int (*add_if)(struct batadv_orig_node *orig_node, int max_if_num);
+        int (*add_if)(struct batadv_orig_node *orig_node,
+                      unsigned int max_if_num);
 
         /**
          * @del_if: ask the routing algorithm to apply the needed changes to the
          *  orig_node due to an hard-interface being removed from the mesh
          *  (optional)
          */
-        int (*del_if)(struct batadv_orig_node *orig_node, int max_if_num,
-                      int del_if_num);
+        int (*del_if)(struct batadv_orig_node *orig_node,
+                      unsigned int max_if_num, unsigned int del_if_num);
 
 #ifdef CONFIG_BATMAN_ADV_DEBUGFS
         /** @print: print the originator table (optional) */
diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index 27f1d4f2114a..9b16eaf33819 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -214,7 +214,7 @@ static int br_validate_ipv4(struct net *net, struct sk_buff *skb)
 
         iph = ip_hdr(skb);
         if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
-                goto inhdr_error;
+                goto csum_error;
 
         len = ntohs(iph->tot_len);
         if (skb->len < len) {
@@ -236,6 +236,8 @@ static int br_validate_ipv4(struct net *net, struct sk_buff *skb)
          */
         return 0;
 
+csum_error:
+        __IP_INC_STATS(net, IPSTATS_MIB_CSUMERRORS);
 inhdr_error:
         __IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);
 drop:
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 51935270c651..9896f4975353 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -168,6 +168,8 @@ static struct net_bridge_vlan *br_vlan_get_master(struct net_bridge *br, u16 vid
                 masterv = br_vlan_find(vg, vid);
                 if (WARN_ON(!masterv))
                         return NULL;
+                refcount_set(&masterv->refcnt, 1);
+                return masterv;
         }
         refcount_inc(&masterv->refcnt);
 
diff --git a/net/bridge/netfilter/ebt_among.c b/net/bridge/netfilter/ebt_among.c
index ce7152a12bd8..c5afb4232ecb 100644
--- a/net/bridge/netfilter/ebt_among.c
+++ b/net/bridge/netfilter/ebt_among.c
@@ -172,18 +172,35 @@ ebt_among_mt(const struct sk_buff *skb, struct xt_action_param *par)
         return true;
 }
 
+static bool poolsize_invalid(const struct ebt_mac_wormhash *w)
+{
+        return w && w->poolsize >= (INT_MAX / sizeof(struct ebt_mac_wormhash_tuple));
+}
+
 static int ebt_among_mt_check(const struct xt_mtchk_param *par)
 {
         const struct ebt_among_info *info = par->matchinfo;
         const struct ebt_entry_match *em =
                 container_of(par->matchinfo, const struct ebt_entry_match, data);
-        int expected_length = sizeof(struct ebt_among_info);
+        unsigned int expected_length = sizeof(struct ebt_among_info);
         const struct ebt_mac_wormhash *wh_dst, *wh_src;
         int err;
 
+        if (expected_length > em->match_size)
+                return -EINVAL;
+
         wh_dst = ebt_among_wh_dst(info);
-        wh_src = ebt_among_wh_src(info);
+        if (poolsize_invalid(wh_dst))
+                return -EINVAL;
+
         expected_length += ebt_mac_wormhash_size(wh_dst);
+        if (expected_length > em->match_size)
+                return -EINVAL;
+
+        wh_src = ebt_among_wh_src(info);
+        if (poolsize_invalid(wh_src))
+                return -EINVAL;
+
         expected_length += ebt_mac_wormhash_size(wh_src);
 
         if (em->match_size != EBT_ALIGN(expected_length)) {
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 02c4b409d317..254ef9f49567 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1641,7 +1641,8 @@ static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
         int off = ebt_compat_match_offset(match, m->match_size);
         compat_uint_t msize = m->match_size - off;
 
-        BUG_ON(off >= m->match_size);
+        if (WARN_ON(off >= m->match_size))
+                return -EINVAL;
 
         if (copy_to_user(cm->u.name, match->name,
             strlen(match->name) + 1) || put_user(msize, &cm->match_size))
@@ -1671,7 +1672,8 @@ static int compat_target_to_user(struct ebt_entry_target *t,
         int off = xt_compat_target_offset(target);
         compat_uint_t tsize = t->target_size - off;
 
-        BUG_ON(off >= t->target_size);
+        if (WARN_ON(off >= t->target_size))
+                return -EINVAL;
 
         if (copy_to_user(cm->u.name, target->name,
             strlen(target->name) + 1) || put_user(tsize, &cm->match_size))
@@ -1902,7 +1904,8 @@ static int ebt_buf_add(struct ebt_entries_buf_state *state,
         if (state->buf_kern_start == NULL)
                 goto count_only;
 
-        BUG_ON(state->buf_kern_offset + sz > state->buf_kern_len);
+        if (WARN_ON(state->buf_kern_offset + sz > state->buf_kern_len))
+                return -EINVAL;
 
         memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz);
 
@@ -1915,7 +1918,8 @@ static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz)
 {
         char *b = state->buf_kern_start;
 
-        BUG_ON(b && state->buf_kern_offset > state->buf_kern_len);
+        if (WARN_ON(b && state->buf_kern_offset > state->buf_kern_len))
+                return -EINVAL;
 
         if (b != NULL && sz > 0)
                 memset(b + state->buf_kern_offset, 0, sz);
@@ -1992,8 +1996,10 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
         pad = XT_ALIGN(size_kern) - size_kern;
 
         if (pad > 0 && dst) {
-                BUG_ON(state->buf_kern_len <= pad);
-                BUG_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad);
+                if (WARN_ON(state->buf_kern_len <= pad))
+                        return -EINVAL;
+                if (WARN_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad))
+                        return -EINVAL;
                 memset(dst + size_kern, 0, pad);
         }
         return off + match_size;
@@ -2043,7 +2049,8 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
                 if (ret < 0)
                         return ret;
 
-                BUG_ON(ret < match32->match_size);
+                if (WARN_ON(ret < match32->match_size))
+                        return -EINVAL;
                 growth += ret - match32->match_size;
                 growth += ebt_compat_entry_padsize();
 
@@ -2053,7 +2060,9 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
                 if (match_kern)
                         match_kern->match_size = ret;
 
-                WARN_ON(type == EBT_COMPAT_TARGET && size_left);
+                if (WARN_ON(type == EBT_COMPAT_TARGET && size_left))
+                        return -EINVAL;
+
                 match32 = (struct compat_ebt_entry_mwt *) buf;
         }
 
@@ -2109,6 +2118,15 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
          *
          * offsets are relative to beginning of struct ebt_entry (i.e., 0).
          */
+        for (i = 0; i < 4 ; ++i) {
+                if (offsets[i] >= *total)
+                        return -EINVAL;
+                if (i == 0)
+                        continue;
+                if (offsets[i-1] > offsets[i])
+                        return -EINVAL;
+        }
+
         for (i = 0, j = 1 ; j < 4 ; j++, i++) {
                 struct compat_ebt_entry_mwt *match32;
                 unsigned int size;
@@ -2140,7 +2158,8 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
 
         startoff = state->buf_user_offset - startoff;
 
-        BUG_ON(*total < startoff);
+        if (WARN_ON(*total < startoff))
+                return -EINVAL;
         *total -= startoff;
         return 0;
 }
@@ -2267,7 +2286,8 @@ static int compat_do_replace(struct net *net, void __user *user,
         state.buf_kern_len = size64;
 
         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
-        BUG_ON(ret < 0);        /* parses same data again */
+        if (WARN_ON(ret < 0))
+                goto out_unlock;
 
         vfree(entries_tmp);
         tmp.entries_size = size64;
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index 1e492ef2a33d..4d4c82229e9e 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -418,6 +418,7 @@ ceph_parse_options(char *options, const char *dev_name,
                                 opt->flags |= CEPH_OPT_FSID;
                         break;
                 case Opt_name:
+                        kfree(opt->name);
                         opt->name = kstrndup(argstr[0].from,
                                               argstr[0].to-argstr[0].from,
                                               GFP_KERNEL);
@@ -427,6 +428,9 @@ ceph_parse_options(char *options, const char *dev_name,
                         }
                         break;
                 case Opt_secret:
+                        ceph_crypto_key_destroy(opt->key);
+                        kfree(opt->key);
+
                         opt->key = kzalloc(sizeof(*opt->key), GFP_KERNEL);
                         if (!opt->key) {
                                 err = -ENOMEM;
@@ -437,6 +441,9 @@ ceph_parse_options(char *options, const char *dev_name,
                                 goto out;
                         break;
                 case Opt_key:
+                        ceph_crypto_key_destroy(opt->key);
+                        kfree(opt->key);
+
                         opt->key = kzalloc(sizeof(*opt->key), GFP_KERNEL);
                         if (!opt->key) {
                                 err = -ENOMEM;
diff --git a/net/core/dev.c b/net/core/dev.c
index d4362befe7e2..2cedf520cb28 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6396,6 +6396,7 @@ static int __netdev_upper_dev_link(struct net_device *dev,
                 .linking = true,
                 .upper_info = upper_info,
         };
+        struct net_device *master_dev;
         int ret = 0;
 
         ASSERT_RTNL();
@@ -6407,11 +6408,14 @@ static int __netdev_upper_dev_link(struct net_device *dev,
         if (netdev_has_upper_dev(upper_dev, dev))
                 return -EBUSY;
 
-        if (netdev_has_upper_dev(dev, upper_dev))
-                return -EEXIST;
-
-        if (master && netdev_master_upper_dev_get(dev))
-                return -EBUSY;
+        if (!master) {
+                if (netdev_has_upper_dev(dev, upper_dev))
+                        return -EEXIST;
+        } else {
+                master_dev = netdev_master_upper_dev_get(dev);
+                if (master_dev)
+                        return master_dev == upper_dev ? -EEXIST : -EBUSY;
+        }
 
         ret = call_netdevice_notifiers_info(NETDEV_PRECHANGEUPPER,
                                             &changeupper_info.info);
diff --git a/net/core/devlink.c b/net/core/devlink.c
index 18d385ed8237..2f2307d94787 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -1695,10 +1695,11 @@ static int devlink_dpipe_table_put(struct sk_buff *skb,
                 goto nla_put_failure;
 
         if (table->resource_valid) {
-                nla_put_u64_64bit(skb, DEVLINK_ATTR_DPIPE_TABLE_RESOURCE_ID,
-                                  table->resource_id, DEVLINK_ATTR_PAD);
-                nla_put_u64_64bit(skb, DEVLINK_ATTR_DPIPE_TABLE_RESOURCE_UNITS,
-                                  table->resource_units, DEVLINK_ATTR_PAD);
+                if (nla_put_u64_64bit(skb, DEVLINK_ATTR_DPIPE_TABLE_RESOURCE_ID,
+                                      table->resource_id, DEVLINK_ATTR_PAD) ||
+                    nla_put_u64_64bit(skb, DEVLINK_ATTR_DPIPE_TABLE_RESOURCE_UNITS,
+                                      table->resource_units, DEVLINK_ATTR_PAD))
+                        goto nla_put_failure;
         }
         if (devlink_dpipe_matches_put(table, skb))
                 goto nla_put_failure;
@@ -2332,7 +2333,7 @@ devlink_resource_validate_children(struct devlink_resource *resource)
         list_for_each_entry(child_resource, &resource->resource_list, list)
                 parts_size += child_resource->size_new;
 
-        if (parts_size > resource->size)
+        if (parts_size > resource->size_new)
                 size_valid = false;
 out:
         resource->size_valid = size_valid;
@@ -2372,20 +2373,22 @@ static int devlink_nl_cmd_resource_set(struct sk_buff *skb,
         return 0;
 }
 
-static void
+static int
 devlink_resource_size_params_put(struct devlink_resource *resource,
                                  struct sk_buff *skb)
 {
         struct devlink_resource_size_params *size_params;
 
-        size_params = resource->size_params;
-        nla_put_u64_64bit(skb, DEVLINK_ATTR_RESOURCE_SIZE_GRAN,
-                          size_params->size_granularity, DEVLINK_ATTR_PAD);
-        nla_put_u64_64bit(skb, DEVLINK_ATTR_RESOURCE_SIZE_MAX,
-                          size_params->size_max, DEVLINK_ATTR_PAD);
-        nla_put_u64_64bit(skb, DEVLINK_ATTR_RESOURCE_SIZE_MIN,
-                          size_params->size_min, DEVLINK_ATTR_PAD);
-        nla_put_u8(skb, DEVLINK_ATTR_RESOURCE_UNIT, size_params->unit);
+        size_params = &resource->size_params;
+        if (nla_put_u64_64bit(skb, DEVLINK_ATTR_RESOURCE_SIZE_GRAN,
+                              size_params->size_granularity, DEVLINK_ATTR_PAD) ||
+            nla_put_u64_64bit(skb, DEVLINK_ATTR_RESOURCE_SIZE_MAX,
+                              size_params->size_max, DEVLINK_ATTR_PAD) ||
+            nla_put_u64_64bit(skb, DEVLINK_ATTR_RESOURCE_SIZE_MIN,
+                              size_params->size_min, DEVLINK_ATTR_PAD) ||
+            nla_put_u8(skb, DEVLINK_ATTR_RESOURCE_UNIT, size_params->unit))
+                return -EMSGSIZE;
+        return 0;
 }
 
 static int devlink_resource_put(struct devlink *devlink, struct sk_buff *skb,
@@ -2409,10 +2412,12 @@ static int devlink_resource_put(struct devlink *devlink, struct sk_buff *skb,
                 nla_put_u64_64bit(skb, DEVLINK_ATTR_RESOURCE_SIZE_NEW,
                                   resource->size_new, DEVLINK_ATTR_PAD);
         if (resource->resource_ops && resource->resource_ops->occ_get)
-                nla_put_u64_64bit(skb, DEVLINK_ATTR_RESOURCE_OCC,
-                                  resource->resource_ops->occ_get(devlink),
-                                  DEVLINK_ATTR_PAD);
-        devlink_resource_size_params_put(resource, skb);
+                if (nla_put_u64_64bit(skb, DEVLINK_ATTR_RESOURCE_OCC,
+                                      resource->resource_ops->occ_get(devlink),
+                                      DEVLINK_ATTR_PAD))
+                        goto nla_put_failure;
+        if (devlink_resource_size_params_put(resource, skb))
+                goto nla_put_failure;
         if (list_empty(&resource->resource_list))
                 goto out;
 
@@ -3151,7 +3156,7 @@ int devlink_resource_register(struct devlink *devlink,
                               u64 resource_size,
                               u64 resource_id,
                               u64 parent_resource_id,
-                              struct devlink_resource_size_params *size_params,
+                              const struct devlink_resource_size_params *size_params,
                               const struct devlink_resource_ops *resource_ops)
 {
         struct devlink_resource *resource;
@@ -3194,7 +3199,8 @@ int devlink_resource_register(struct devlink *devlink,
         resource->id = resource_id;
         resource->resource_ops = resource_ops;
         resource->size_valid = true;
-        resource->size_params = size_params;
+        memcpy(&resource->size_params, size_params,
+               sizeof(resource->size_params));
         INIT_LIST_HEAD(&resource->resource_list);
         list_add_tail(&resource->list, resource_list);
 out:
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 494e6a5d7306..3f89c76d5c24 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -2520,11 +2520,14 @@ static int set_phy_tunable(struct net_device *dev, void __user *useraddr)
 static int ethtool_get_fecparam(struct net_device *dev, void __user *useraddr)
 {
         struct ethtool_fecparam fecparam = { ETHTOOL_GFECPARAM };
+        int rc;
 
         if (!dev->ethtool_ops->get_fecparam)
                 return -EOPNOTSUPP;
 
-        dev->ethtool_ops->get_fecparam(dev, &fecparam);
+        rc = dev->ethtool_ops->get_fecparam(dev, &fecparam);
+        if (rc)
+                return rc;
 
         if (copy_to_user(useraddr, &fecparam, sizeof(fecparam)))
                 return -EFAULT;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 09bd89c90a71..0bb0d8877954 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4891,7 +4891,7 @@ EXPORT_SYMBOL_GPL(skb_scrub_packet);
  *
  * The MAC/L2 or network (IP, IPv6) headers are not accounted for.
  */
-unsigned int skb_gso_transport_seglen(const struct sk_buff *skb)
+static unsigned int skb_gso_transport_seglen(const struct sk_buff *skb)
 {
         const struct skb_shared_info *shinfo = skb_shinfo(skb);
         unsigned int thlen = 0;
@@ -4913,7 +4913,40 @@ unsigned int skb_gso_transport_seglen(const struct sk_buff *skb)
          */
         return thlen + shinfo->gso_size;
 }
-EXPORT_SYMBOL_GPL(skb_gso_transport_seglen);
+
+/**
+ * skb_gso_network_seglen - Return length of individual segments of a gso packet
+ *
+ * @skb: GSO skb
+ *
+ * skb_gso_network_seglen is used to determine the real size of the
+ * individual segments, including Layer3 (IP, IPv6) and L4 headers (TCP/UDP).
+ *
+ * The MAC/L2 header is not accounted for.
+ */
+static unsigned int skb_gso_network_seglen(const struct sk_buff *skb)
+{
+        unsigned int hdr_len = skb_transport_header(skb) -
+                               skb_network_header(skb);
+
+        return hdr_len + skb_gso_transport_seglen(skb);
+}
+
+/**
+ * skb_gso_mac_seglen - Return length of individual segments of a gso packet
+ *
+ * @skb: GSO skb
+ *
+ * skb_gso_mac_seglen is used to determine the real size of the
+ * individual segments, including MAC/L2, Layer3 (IP, IPv6) and L4
+ * headers (TCP/UDP).
+ */
+static unsigned int skb_gso_mac_seglen(const struct sk_buff *skb)
+{
+        unsigned int hdr_len = skb_transport_header(skb) - skb_mac_header(skb);
+
+        return hdr_len + skb_gso_transport_seglen(skb);
+}
 
 /**
  * skb_gso_size_check - check the skb size, considering GSO_BY_FRAGS
@@ -4955,19 +4988,20 @@ static inline bool skb_gso_size_check(const struct sk_buff *skb,
 }
 
 /**
- * skb_gso_validate_mtu - Return in case such skb fits a given MTU
+ * skb_gso_validate_network_len - Will a split GSO skb fit into a given MTU?
  *
  * @skb: GSO skb
  * @mtu: MTU to validate against
  *
- * skb_gso_validate_mtu validates if a given skb will fit a wanted MTU
- * once split.
+ * skb_gso_validate_network_len validates if a given skb will fit a
+ * wanted MTU once split. It considers L3 headers, L4 headers, and the
+ * payload.
  */
-bool skb_gso_validate_mtu(const struct sk_buff *skb, unsigned int mtu)
+bool skb_gso_validate_network_len(const struct sk_buff *skb, unsigned int mtu)
 {
         return skb_gso_size_check(skb, skb_gso_network_seglen(skb), mtu);
 }
-EXPORT_SYMBOL_GPL(skb_gso_validate_mtu);
+EXPORT_SYMBOL_GPL(skb_gso_validate_network_len);
 
 /**
  * skb_gso_validate_mac_len - Will a split GSO skb fit in a given length?
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 2dd21c3281a1..b54b948b0596 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -55,7 +55,7 @@ static bool ip_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
         if (skb->ignore_df)
                 return false;
 
-        if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
+        if (skb_is_gso(skb) && skb_gso_validate_network_len(skb, mtu))
                 return false;
 
         return true;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 45d97e9b2759..0901de42ed85 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -970,9 +970,6 @@ static void __gre_tunnel_init(struct net_device *dev)
 
         t_hlen = tunnel->hlen + sizeof(struct iphdr);
 
-        dev->needed_headroom    = LL_MAX_HEADER + t_hlen + 4;
-        dev->mtu                = ETH_DATA_LEN - t_hlen - 4;
-
         dev->features           |= GRE_FEATURES;
         dev->hw_features        |= GRE_FEATURES;
 
@@ -1290,8 +1287,6 @@ static int erspan_tunnel_init(struct net_device *dev)
                        erspan_hdr_len(tunnel->erspan_ver);
         t_hlen = tunnel->hlen + sizeof(struct iphdr);
 
-        dev->needed_headroom = LL_MAX_HEADER + t_hlen + 4;
-        dev->mtu = ETH_DATA_LEN - t_hlen - 4;
         dev->features           |= GRE_FEATURES;
         dev->hw_features        |= GRE_FEATURES;
         dev->priv_flags         |= IFF_LIVE_ADDR_CHANGE;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index e8e675be60ec..66340ab750e6 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -248,7 +248,7 @@ static int ip_finish_output_gso(struct net *net, struct sock *sk,
 
         /* common case: seglen is <= mtu
          */
-        if (skb_gso_validate_mtu(skb, mtu))
+        if (skb_gso_validate_network_len(skb, mtu))
                 return ip_finish_output2(net, sk, skb);
 
         /* Slowpath -  GSO segment length exceeds the egress MTU.
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index d786a8441bce..6d21068f9b55 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -710,16 +710,9 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
                 }
         }
 
-        if (tunnel->fwmark) {
-                init_tunnel_flow(&fl4, protocol, dst, tnl_params->saddr,
-                                 tunnel->parms.o_key, RT_TOS(tos), tunnel->parms.link,
-                                 tunnel->fwmark);
-        }
-        else {
-                init_tunnel_flow(&fl4, protocol, dst, tnl_params->saddr,
-                                 tunnel->parms.o_key, RT_TOS(tos), tunnel->parms.link,
-                                 skb->mark);
-        }
+        init_tunnel_flow(&fl4, protocol, dst, tnl_params->saddr,
+                         tunnel->parms.o_key, RT_TOS(tos), tunnel->parms.link,
+                         tunnel->fwmark);
 
         if (ip_tunnel_encap(skb, tunnel, &protocol, &fl4) < 0)
                 goto tx_error;
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 4b02ab39ebc5..8a8ae61cea71 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -232,7 +232,6 @@ clusterip_config_init(struct net *net, const struct ipt_clusterip_tgt_info *i,
         c->hash_mode = i->hash_mode;
         c->hash_initval = i->hash_initval;
         refcount_set(&c->refcount, 1);
-        refcount_set(&c->entries, 1);
 
         spin_lock_bh(&cn->lock);
         if (__clusterip_config_find(net, ip)) {
@@ -263,8 +262,10 @@ clusterip_config_init(struct net *net, const struct ipt_clusterip_tgt_info *i,
 
         c->notifier.notifier_call = clusterip_netdev_event;
         err = register_netdevice_notifier(&c->notifier);
-        if (!err)
+        if (!err) {
+                refcount_set(&c->entries, 1);
                 return c;
+        }
 
 #ifdef CONFIG_PROC_FS
         proc_remove(c->pde);
@@ -273,7 +274,7 @@ err:
         spin_lock_bh(&cn->lock);
         list_del_rcu(&c->list);
         spin_unlock_bh(&cn->lock);
-        kfree(c);
+        clusterip_config_put(c);
 
         return ERR_PTR(err);
 }
@@ -496,12 +497,15 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
                                 return PTR_ERR(config);
                 }
         }
-        cipinfo->config = config;
 
         ret = nf_ct_netns_get(par->net, par->family);
-        if (ret < 0)
+        if (ret < 0) {
                 pr_info("cannot load conntrack support for proto=%u\n",
                         par->family);
+                clusterip_config_entry_put(par->net, config);
+                clusterip_config_put(config);
+                return ret;
+        }
 
         if (!par->net->xt.clusterip_deprecated_warning) {
                 pr_info("ipt_CLUSTERIP is deprecated and it will removed soon, "
@@ -509,6 +513,7 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
                 par->net->xt.clusterip_deprecated_warning = true;
         }
 
+        cipinfo->config = config;
         return ret;
 }
 
diff --git a/net/ipv4/netfilter/nf_flow_table_ipv4.c b/net/ipv4/netfilter/nf_flow_table_ipv4.c
index 25d2975da156..0cd46bffa469 100644
--- a/net/ipv4/netfilter/nf_flow_table_ipv4.c
+++ b/net/ipv4/netfilter/nf_flow_table_ipv4.c
@@ -111,6 +111,7 @@ static int nf_flow_dnat_ip(const struct flow_offload *flow, struct sk_buff *skb,
         default:
                 return -1;
         }
+        csum_replace4(&iph->check, addr, new_addr);
 
         return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr);
 }
@@ -185,7 +186,7 @@ static bool __nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
         if ((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0)
                 return false;
 
-        if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
+        if (skb_is_gso(skb) && skb_gso_validate_network_len(skb, mtu))
                 return false;
 
         return true;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index a4f44d815a61..860b3fd2f54b 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -128,10 +128,11 @@ static int ip_rt_redirect_silence __read_mostly	= ((HZ / 50) << (9 + 1));
 static int ip_rt_error_cost __read_mostly       = HZ;
 static int ip_rt_error_burst __read_mostly      = 5 * HZ;
 static int ip_rt_mtu_expires __read_mostly      = 10 * 60 * HZ;
-static int ip_rt_min_pmtu __read_mostly         = 512 + 20 + 20;
+static u32 ip_rt_min_pmtu __read_mostly         = 512 + 20 + 20;
 static int ip_rt_min_advmss __read_mostly       = 256;
 
 static int ip_rt_gc_timeout __read_mostly       = RT_GC_TIMEOUT;
+
 /*
  *      Interface to generic destination cache.
  */
@@ -930,14 +931,23 @@ out_put_peer:
 
 static int ip_error(struct sk_buff *skb)
 {
-        struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
         struct rtable *rt = skb_rtable(skb);
+        struct net_device *dev = skb->dev;
+        struct in_device *in_dev;
         struct inet_peer *peer;
         unsigned long now;
         struct net *net;
         bool send;
         int code;
 
+        if (netif_is_l3_master(skb->dev)) {
+                dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif);
+                if (!dev)
+                        goto out;
+        }
+
+        in_dev = __in_dev_get_rcu(dev);
+
         /* IP on this device is disabled. */
         if (!in_dev)
                 goto out;
@@ -2818,6 +2828,7 @@ void ip_rt_multicast_event(struct in_device *in_dev)
 static int ip_rt_gc_interval __read_mostly  = 60 * HZ;
 static int ip_rt_gc_min_interval __read_mostly  = HZ / 2;
 static int ip_rt_gc_elasticity __read_mostly    = 8;
+static int ip_min_valid_pmtu __read_mostly      = IPV4_MIN_MTU;
 
 static int ipv4_sysctl_rtcache_flush(struct ctl_table *__ctl, int write,
                                         void __user *buffer,
@@ -2933,7 +2944,8 @@ static struct ctl_table ipv4_route_table[] = {
                 .data           = &ip_rt_min_pmtu,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &ip_min_valid_pmtu,
         },
         {
                 .procname       = "min_adv_mss",
diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
index 7c843578f233..faddf4f9a707 100644
--- a/net/ipv4/tcp_illinois.c
+++ b/net/ipv4/tcp_illinois.c
@@ -6,7 +6,7 @@
  * The algorithm is described in:
  * "TCP-Illinois: A Loss and Delay-Based Congestion Control Algorithm
  *  for High-Speed Networks"
- * http://www.ifp.illinois.edu/~srikant/Papers/liubassri06perf.pdf
+ * http://tamerbasar.csl.illinois.edu/LiuBasarSrikantPerfEvalArtJun2008.pdf
  *
  * Implemented from description in paper and ns-2 simulation.
  * Copyright (C) 2007 Stephen Hemminger <shemminger@linux-foundation.org>
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 575d3c1fb6e8..9a1b3c1c1c14 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1971,11 +1971,6 @@ void tcp_enter_loss(struct sock *sk)
         /* F-RTO RFC5682 sec 3.1 step 1: retransmit SND.UNA if no previous
          * loss recovery is underway except recurring timeout(s) on
          * the same SND.UNA (sec 3.2). Disable F-RTO on path MTU probing
-         *
-         * In theory F-RTO can be used repeatedly during loss recovery.
-         * In practice this interacts badly with broken middle-boxes that
-         * falsely raise the receive window, which results in repeated
-         * timeouts and stop-and-go behavior.
          */
         tp->frto = net->ipv4.sysctl_tcp_frto &&
                    (new_recovery || icsk->icsk_retransmits) &&
@@ -2631,18 +2626,14 @@ static void tcp_process_loss(struct sock *sk, int flag, bool is_dupack,
             tcp_try_undo_loss(sk, false))
                 return;
 
-        /* The ACK (s)acks some never-retransmitted data meaning not all
-         * the data packets before the timeout were lost. Therefore we
-         * undo the congestion window and state. This is essentially
-         * the operation in F-RTO (RFC5682 section 3.1 step 3.b). Since
-         * a retransmitted skb is permantly marked, we can apply such an
-         * operation even if F-RTO was not used.
-         */
-        if ((flag & FLAG_ORIG_SACK_ACKED) &&
-            tcp_try_undo_loss(sk, tp->undo_marker))
-                return;
-
         if (tp->frto) { /* F-RTO RFC5682 sec 3.1 (sack enhanced version). */
+                /* Step 3.b. A timeout is spurious if not all data are
+                 * lost, i.e., never-retransmitted data are (s)acked.
+                 */
+                if ((flag & FLAG_ORIG_SACK_ACKED) &&
+                    tcp_try_undo_loss(sk, true))
+                        return;
+
                 if (after(tp->snd_nxt, tp->high_seq)) {
                         if (flag & FLAG_DATA_SACKED || is_dupack)
                                 tp->frto = 0; /* Step 3.a. loss was real */
@@ -4001,6 +3992,7 @@ void tcp_reset(struct sock *sk)
         /* This barrier is coupled with smp_rmb() in tcp_poll() */
         smp_wmb();
 
+        tcp_write_queue_purge(sk);
         tcp_done(sk);
 
         if (!sock_flag(sk, SOCK_DEAD))
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index 94b8702603bc..be980c195fc5 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -30,7 +30,8 @@ static int xfrm4_tunnel_check_size(struct sk_buff *skb)
 
         mtu = dst_mtu(skb_dst(skb));
         if ((!skb_is_gso(skb) && skb->len > mtu) ||
-            (skb_is_gso(skb) && skb_gso_network_seglen(skb) > ip_skb_dst_mtu(skb->sk, skb))) {
+            (skb_is_gso(skb) &&
+             !skb_gso_validate_network_len(skb, ip_skb_dst_mtu(skb->sk, skb)))) {
                 skb->protocol = htons(ETH_P_IP);
 
                 if (skb->sk)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 997c7f19ad62..a8a919520090 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -412,7 +412,7 @@ static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
         if (skb->ignore_df)
                 return false;
 
-        if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
+        if (skb_is_gso(skb) && skb_gso_validate_network_len(skb, mtu))
                 return false;
 
         return true;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 4b15fe928278..6e0f21eed88a 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1982,14 +1982,14 @@ static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
 {
         struct net *net = dev_net(dev);
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
-        struct ip6_tnl *nt, *t;
         struct ip_tunnel_encap ipencap;
+        struct ip6_tnl *nt, *t;
+        int err;
 
         nt = netdev_priv(dev);
 
         if (ip6_tnl_netlink_encap_parms(data, &ipencap)) {
-                int err = ip6_tnl_encap_setup(nt, &ipencap);
-
+                err = ip6_tnl_encap_setup(nt, &ipencap);
                 if (err < 0)
                         return err;
         }
@@ -2005,7 +2005,11 @@ static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
                         return -EEXIST;
         }
 
-        return ip6_tnl_create2(dev);
+        err = ip6_tnl_create2(dev);
+        if (!err && tb[IFLA_MTU])
+                ip6_tnl_change_mtu(dev, nla_get_u32(tb[IFLA_MTU]));
+
+        return err;
 }
 
 static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[],
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index d95ceca7ff8f..531d6957af36 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -21,18 +21,19 @@
 int ip6_route_me_harder(struct net *net, struct sk_buff *skb)
 {
         const struct ipv6hdr *iph = ipv6_hdr(skb);
+        struct sock *sk = sk_to_full_sk(skb->sk);
         unsigned int hh_len;
         struct dst_entry *dst;
         struct flowi6 fl6 = {
-                .flowi6_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
+                .flowi6_oif = sk ? sk->sk_bound_dev_if : 0,
                 .flowi6_mark = skb->mark,
-                .flowi6_uid = sock_net_uid(net, skb->sk),
+                .flowi6_uid = sock_net_uid(net, sk),
                 .daddr = iph->daddr,
                 .saddr = iph->saddr,
         };
         int err;
 
-        dst = ip6_route_output(net, skb->sk, &fl6);
+        dst = ip6_route_output(net, sk, &fl6);
         err = dst->error;
         if (err) {
                 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
@@ -50,7 +51,7 @@ int ip6_route_me_harder(struct net *net, struct sk_buff *skb)
         if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
             xfrm_decode_session(skb, flowi6_to_flowi(&fl6), AF_INET6) == 0) {
                 skb_dst_set(skb, NULL);
-                dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), skb->sk, 0);
+                dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0);
                 if (IS_ERR(dst))
                         return PTR_ERR(dst);
                 skb_dst_set(skb, dst);
diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
index 94deb69bbbda..91ed25a24b79 100644
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ b/net/ipv6/netfilter/ip6t_rpfilter.c
@@ -48,10 +48,6 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
         }
 
         fl6.flowi6_mark = flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
-        if ((flags & XT_RPFILTER_LOOSE) == 0) {
-                fl6.flowi6_oif = dev->ifindex;
-                lookup_flags |= RT6_LOOKUP_F_IFACE;
-        }
 
         rt = (void *) ip6_route_lookup(net, &fl6, lookup_flags);
         if (rt->dst.error)
diff --git a/net/ipv6/netfilter/nf_flow_table_ipv6.c b/net/ipv6/netfilter/nf_flow_table_ipv6.c
index d346705d6ee6..207cb35569b1 100644
--- a/net/ipv6/netfilter/nf_flow_table_ipv6.c
+++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c
@@ -178,7 +178,7 @@ static bool __nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
         if (skb->len <= mtu)
                 return false;
 
-        if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
+        if (skb_is_gso(skb) && skb_gso_validate_network_len(skb, mtu))
                 return false;
 
         return true;
diff --git a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
index bed57ee65f7b..6b7f075f811f 100644
--- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
@@ -99,6 +99,10 @@ static bool nf_nat_ipv6_manip_pkt(struct sk_buff *skb,
             !l4proto->manip_pkt(skb, &nf_nat_l3proto_ipv6, iphdroff, hdroff,
                                 target, maniptype))
                 return false;
+
+        /* must reload, offset might have changed */
+        ipv6h = (void *)skb->data + iphdroff;
+
 manip_addr:
         if (maniptype == NF_NAT_MANIP_SRC)
                 ipv6h->saddr = target->src.u3.in6;
diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c
index cc5174c7254c..62fc84d7bdff 100644
--- a/net/ipv6/netfilter/nft_fib_ipv6.c
+++ b/net/ipv6/netfilter/nft_fib_ipv6.c
@@ -180,7 +180,6 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,
         }
 
         *dest = 0;
- again:
         rt = (void *)ip6_route_lookup(nft_net(pkt), &fl6, lookup_flags);
         if (rt->dst.error)
                 goto put_rt_err;
@@ -189,15 +188,8 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,
         if (rt->rt6i_flags & (RTF_REJECT | RTF_ANYCAST | RTF_LOCAL))
                 goto put_rt_err;
 
-        if (oif && oif != rt->rt6i_idev->dev) {
-                /* multipath route? Try again with F_IFACE */
-                if ((lookup_flags & RT6_LOOKUP_F_IFACE) == 0) {
-                        lookup_flags |= RT6_LOOKUP_F_IFACE;
-                        fl6.flowi6_oif = oif->ifindex;
-                        ip6_rt_put(rt);
-                        goto again;
-                }
-        }
+        if (oif && oif != rt->rt6i_idev->dev)
+                goto put_rt_err;
 
         switch (priv->result) {
         case NFT_FIB_RESULT_OIF:
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 3a1775a62973..0195598f7bb5 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1578,6 +1578,13 @@ static int ipip6_newlink(struct net *src_net, struct net_device *dev,
         if (err < 0)
                 return err;
 
+        if (tb[IFLA_MTU]) {
+                u32 mtu = nla_get_u32(tb[IFLA_MTU]);
+
+                if (mtu >= IPV6_MIN_MTU && mtu <= 0xFFF8 - dev->hard_header_len)
+                        dev->mtu = mtu;
+        }
+
 #ifdef CONFIG_IPV6_SIT_6RD
         if (ipip6_netlink_6rd_parms(data, &ip6rd))
                 err = ipip6_tunnel_update_6rd(nt, &ip6rd);
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 8ae87d4ec5ff..5959ce9620eb 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -82,7 +82,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
 
         if ((!skb_is_gso(skb) && skb->len > mtu) ||
             (skb_is_gso(skb) &&
-             skb_gso_network_seglen(skb) > ip6_skb_dst_mtu(skb))) {
+             !skb_gso_validate_network_len(skb, ip6_skb_dst_mtu(skb)))) {
                 skb->dev = dst->dev;
                 skb->protocol = htons(ETH_P_IPV6);
 
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 194a7483bb93..83421c6f0bef 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -136,51 +136,6 @@ l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
 
 }
 
-/* Lookup the tunnel socket, possibly involving the fs code if the socket is
- * owned by userspace.  A struct sock returned from this function must be
- * released using l2tp_tunnel_sock_put once you're done with it.
- */
-static struct sock *l2tp_tunnel_sock_lookup(struct l2tp_tunnel *tunnel)
-{
-        int err = 0;
-        struct socket *sock = NULL;
-        struct sock *sk = NULL;
-
-        if (!tunnel)
-                goto out;
-
-        if (tunnel->fd >= 0) {
-                /* Socket is owned by userspace, who might be in the process
-                 * of closing it.  Look the socket up using the fd to ensure
-                 * consistency.
-                 */
-                sock = sockfd_lookup(tunnel->fd, &err);
-                if (sock)
-                        sk = sock->sk;
-        } else {
-                /* Socket is owned by kernelspace */
-                sk = tunnel->sock;
-                sock_hold(sk);
-        }
-
-out:
-        return sk;
-}
-
-/* Drop a reference to a tunnel socket obtained via. l2tp_tunnel_sock_put */
-static void l2tp_tunnel_sock_put(struct sock *sk)
-{
-        struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
-        if (tunnel) {
-                if (tunnel->fd >= 0) {
-                        /* Socket is owned by userspace */
-                        sockfd_put(sk->sk_socket);
-                }
-                sock_put(sk);
-        }
-        sock_put(sk);
-}
-
 /* Session hash list.
  * The session_id SHOULD be random according to RFC2661, but several
  * L2TP implementations (Cisco and Microsoft) use incrementing
@@ -193,6 +148,13 @@ l2tp_session_id_hash(struct l2tp_tunnel *tunnel, u32 session_id)
         return &tunnel->session_hlist[hash_32(session_id, L2TP_HASH_BITS)];
 }
 
+void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
+{
+        sock_put(tunnel->sock);
+        /* the tunnel is freed in the socket destructor */
+}
+EXPORT_SYMBOL(l2tp_tunnel_free);
+
 /* Lookup a tunnel. A new reference is held on the returned tunnel. */
 struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id)
 {
@@ -345,13 +307,11 @@ int l2tp_session_register(struct l2tp_session *session,
                         }
 
                 l2tp_tunnel_inc_refcount(tunnel);
-                sock_hold(tunnel->sock);
                 hlist_add_head_rcu(&session->global_hlist, g_head);
 
                 spin_unlock_bh(&pn->l2tp_session_hlist_lock);
         } else {
                 l2tp_tunnel_inc_refcount(tunnel);
-                sock_hold(tunnel->sock);
         }
 
         hlist_add_head(&session->hlist, head);
@@ -969,7 +929,7 @@ int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
 {
         struct l2tp_tunnel *tunnel;
 
-        tunnel = l2tp_sock_to_tunnel(sk);
+        tunnel = l2tp_tunnel(sk);
         if (tunnel == NULL)
                 goto pass_up;
 
@@ -977,13 +937,10 @@ int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
                  tunnel->name, skb->len);
 
         if (l2tp_udp_recv_core(tunnel, skb, tunnel->recv_payload_hook))
-                goto pass_up_put;
+                goto pass_up;
 
-        sock_put(sk);
         return 0;
 
-pass_up_put:
-        sock_put(sk);
 pass_up:
         return 1;
 }
@@ -1207,14 +1164,12 @@ EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
 static void l2tp_tunnel_destruct(struct sock *sk)
 {
         struct l2tp_tunnel *tunnel = l2tp_tunnel(sk);
-        struct l2tp_net *pn;
 
         if (tunnel == NULL)
                 goto end;
 
         l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing...\n", tunnel->name);
 
-
         /* Disable udp encapsulation */
         switch (tunnel->encap) {
         case L2TP_ENCAPTYPE_UDP:
@@ -1231,18 +1186,11 @@ static void l2tp_tunnel_destruct(struct sock *sk)
         sk->sk_destruct = tunnel->old_sk_destruct;
         sk->sk_user_data = NULL;
 
-        /* Remove the tunnel struct from the tunnel list */
-        pn = l2tp_pernet(tunnel->l2tp_net);
-        spin_lock_bh(&pn->l2tp_tunnel_list_lock);
-        list_del_rcu(&tunnel->list);
-        spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
-
-        tunnel->sock = NULL;
-        l2tp_tunnel_dec_refcount(tunnel);
-
         /* Call the original destructor */
         if (sk->sk_destruct)
                 (*sk->sk_destruct)(sk);
+
+        kfree_rcu(tunnel, rcu);
 end:
         return;
 }
@@ -1303,49 +1251,43 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_closeall);
 /* Tunnel socket destroy hook for UDP encapsulation */
 static void l2tp_udp_encap_destroy(struct sock *sk)
 {
-        struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
-        if (tunnel) {
-                l2tp_tunnel_closeall(tunnel);
-                sock_put(sk);
-        }
+        struct l2tp_tunnel *tunnel = l2tp_tunnel(sk);
+
+        if (tunnel)
+                l2tp_tunnel_delete(tunnel);
 }
 
 /* Workqueue tunnel deletion function */
 static void l2tp_tunnel_del_work(struct work_struct *work)
 {
-        struct l2tp_tunnel *tunnel = NULL;
-        struct socket *sock = NULL;
-        struct sock *sk = NULL;
-
-        tunnel = container_of(work, struct l2tp_tunnel, del_work);
+        struct l2tp_tunnel *tunnel = container_of(work, struct l2tp_tunnel,
+                                                  del_work);
+        struct sock *sk = tunnel->sock;
+        struct socket *sock = sk->sk_socket;
+        struct l2tp_net *pn;
 
         l2tp_tunnel_closeall(tunnel);
 
-        sk = l2tp_tunnel_sock_lookup(tunnel);
-        if (!sk)
-                goto out;
-
-        sock = sk->sk_socket;
-
-        /* If the tunnel socket was created by userspace, then go through the
-         * inet layer to shut the socket down, and let userspace close it.
-         * Otherwise, if we created the socket directly within the kernel, use
+        /* If the tunnel socket was created within the kernel, use
          * the sk API to release it here.
-         * In either case the tunnel resources are freed in the socket
-         * destructor when the tunnel socket goes away.
          */
-        if (tunnel->fd >= 0) {
-                if (sock)
-                        inet_shutdown(sock, 2);
-        } else {
+        if (tunnel->fd < 0) {
                 if (sock) {
                         kernel_sock_shutdown(sock, SHUT_RDWR);
                         sock_release(sock);
                 }
         }
 
-        l2tp_tunnel_sock_put(sk);
-out:
+        /* Remove the tunnel struct from the tunnel list */
+        pn = l2tp_pernet(tunnel->l2tp_net);
+        spin_lock_bh(&pn->l2tp_tunnel_list_lock);
+        list_del_rcu(&tunnel->list);
+        spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
+
+        /* drop initial ref */
+        l2tp_tunnel_dec_refcount(tunnel);
+
+        /* drop workqueue ref */
         l2tp_tunnel_dec_refcount(tunnel);
 }
 
@@ -1598,13 +1540,22 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
                 sk->sk_user_data = tunnel;
         }
 
+        /* Bump the reference count. The tunnel context is deleted
+         * only when this drops to zero. A reference is also held on
+         * the tunnel socket to ensure that it is not released while
+         * the tunnel is extant. Must be done before sk_destruct is
+         * set.
+         */
+        refcount_set(&tunnel->ref_count, 1);
+        sock_hold(sk);
+        tunnel->sock = sk;
+        tunnel->fd = fd;
+
         /* Hook on the tunnel socket destructor so that we can cleanup
          * if the tunnel socket goes away.
          */
         tunnel->old_sk_destruct = sk->sk_destruct;
         sk->sk_destruct = &l2tp_tunnel_destruct;
-        tunnel->sock = sk;
-        tunnel->fd = fd;
         lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, "l2tp_sock");
 
         sk->sk_allocation = GFP_ATOMIC;
@@ -1614,11 +1565,6 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
 
         /* Add tunnel to our list */
         INIT_LIST_HEAD(&tunnel->list);
-
-        /* Bump the reference count. The tunnel context is deleted
-         * only when this drops to zero. Must be done before list insertion
-         */
-        refcount_set(&tunnel->ref_count, 1);
         spin_lock_bh(&pn->l2tp_tunnel_list_lock);
         list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
         spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
@@ -1659,8 +1605,6 @@ void l2tp_session_free(struct l2tp_session *session)
 
         if (tunnel) {
                 BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
-                sock_put(tunnel->sock);
-                session->tunnel = NULL;
                 l2tp_tunnel_dec_refcount(tunnel);
         }
 
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 9bbee90e9963..a1aa9550f04e 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -214,27 +214,8 @@ static inline void *l2tp_session_priv(struct l2tp_session *session)
         return &session->priv[0];
 }
 
-static inline struct l2tp_tunnel *l2tp_sock_to_tunnel(struct sock *sk)
-{
-        struct l2tp_tunnel *tunnel;
-
-        if (sk == NULL)
-                return NULL;
-
-        sock_hold(sk);
-        tunnel = (struct l2tp_tunnel *)(sk->sk_user_data);
-        if (tunnel == NULL) {
-                sock_put(sk);
-                goto out;
-        }
-
-        BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
-
-out:
-        return tunnel;
-}
-
 struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id);
+void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
 
 struct l2tp_session *l2tp_session_get(const struct net *net,
                                       struct l2tp_tunnel *tunnel,
@@ -283,7 +264,7 @@ static inline void l2tp_tunnel_inc_refcount(struct l2tp_tunnel *tunnel)
 static inline void l2tp_tunnel_dec_refcount(struct l2tp_tunnel *tunnel)
 {
         if (refcount_dec_and_test(&tunnel->ref_count))
-                kfree_rcu(tunnel, rcu);
+                l2tp_tunnel_free(tunnel);
 }
 
 /* Session reference counts. Incremented when code obtains a reference
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index ff61124fdf59..3428fba6f2b7 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -234,17 +234,13 @@ static void l2tp_ip_close(struct sock *sk, long timeout)
 static void l2tp_ip_destroy_sock(struct sock *sk)
 {
         struct sk_buff *skb;
-        struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
+        struct l2tp_tunnel *tunnel = sk->sk_user_data;
 
         while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL)
                 kfree_skb(skb);
 
-        if (tunnel) {
-                l2tp_tunnel_closeall(tunnel);
-                sock_put(sk);
-        }
-
-        sk_refcnt_debug_dec(sk);
+        if (tunnel)
+                l2tp_tunnel_delete(tunnel);
 }
 
 static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 192344688c06..6f009eaa5fbe 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -248,16 +248,14 @@ static void l2tp_ip6_close(struct sock *sk, long timeout)
 
 static void l2tp_ip6_destroy_sock(struct sock *sk)
 {
-        struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
+        struct l2tp_tunnel *tunnel = sk->sk_user_data;
 
         lock_sock(sk);
         ip6_flush_pending_frames(sk);
         release_sock(sk);
 
-        if (tunnel) {
-                l2tp_tunnel_closeall(tunnel);
-                sock_put(sk);
-        }
+        if (tunnel)
+                l2tp_tunnel_delete(tunnel);
 
         inet6_destroy_sock(sk);
 }
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 59f246d7b290..3b02f24ea9ec 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -416,20 +416,28 @@ abort:
  * Session (and tunnel control) socket create/destroy.
  *****************************************************************************/
 
+static void pppol2tp_put_sk(struct rcu_head *head)
+{
+        struct pppol2tp_session *ps;
+
+        ps = container_of(head, typeof(*ps), rcu);
+        sock_put(ps->__sk);
+}
+
 /* Called by l2tp_core when a session socket is being closed.
  */
 static void pppol2tp_session_close(struct l2tp_session *session)
 {
-        struct sock *sk;
-
-        BUG_ON(session->magic != L2TP_SESSION_MAGIC);
+        struct pppol2tp_session *ps;
 
-        sk = pppol2tp_session_get_sock(session);
-        if (sk) {
-                if (sk->sk_socket)
-                        inet_shutdown(sk->sk_socket, SEND_SHUTDOWN);
-                sock_put(sk);
-        }
+        ps = l2tp_session_priv(session);
+        mutex_lock(&ps->sk_lock);
+        ps->__sk = rcu_dereference_protected(ps->sk,
+                                             lockdep_is_held(&ps->sk_lock));
+        RCU_INIT_POINTER(ps->sk, NULL);
+        if (ps->__sk)
+                call_rcu(&ps->rcu, pppol2tp_put_sk);
+        mutex_unlock(&ps->sk_lock);
 }
 
 /* Really kill the session socket. (Called from sock_put() if
@@ -449,14 +457,6 @@ static void pppol2tp_session_destruct(struct sock *sk)
         }
 }
 
-static void pppol2tp_put_sk(struct rcu_head *head)
-{
-        struct pppol2tp_session *ps;
-
-        ps = container_of(head, typeof(*ps), rcu);
-        sock_put(ps->__sk);
-}
-
 /* Called when the PPPoX socket (session) is closed.
  */
 static int pppol2tp_release(struct socket *sock)
@@ -480,26 +480,17 @@ static int pppol2tp_release(struct socket *sock)
         sock_orphan(sk);
         sock->sk = NULL;
 
+        /* If the socket is associated with a session,
+         * l2tp_session_delete will call pppol2tp_session_close which
+         * will drop the session's ref on the socket.
+         */
         session = pppol2tp_sock_to_session(sk);
-
-        if (session != NULL) {
-                struct pppol2tp_session *ps;
-
+        if (session) {
                 l2tp_session_delete(session);
-
-                ps = l2tp_session_priv(session);
-                mutex_lock(&ps->sk_lock);
-                ps->__sk = rcu_dereference_protected(ps->sk,
-                                                     lockdep_is_held(&ps->sk_lock));
-                RCU_INIT_POINTER(ps->sk, NULL);
-                mutex_unlock(&ps->sk_lock);
-                call_rcu(&ps->rcu, pppol2tp_put_sk);
-
-                /* Rely on the sock_put() call at the end of the function for
-                 * dropping the reference held by pppol2tp_sock_to_session().
-                 * The last reference will be dropped by pppol2tp_put_sk().
-                 */
+                /* drop the ref obtained by pppol2tp_sock_to_session */
+                sock_put(sk);
         }
+
         release_sock(sk);
 
         /* This will delete the session context via
@@ -796,6 +787,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
 
 out_no_ppp:
         /* This is how we get the session context from the socket. */
+        sock_hold(sk);
         sk->sk_user_data = session;
         rcu_assign_pointer(ps->sk, sk);
         mutex_unlock(&ps->sk_lock);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index fd580614085b..56fe16b07538 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -3921,7 +3921,7 @@ static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
         if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |
                                               IEEE80211_FCTL_TODS)) !=
             fast_rx->expected_ds_bits)
-                goto drop;
+                return false;
 
         /* assign the key to drop unencrypted frames (later)
          * and strip the IV/MIC if necessary
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 25904af38839..69722504e3e1 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3574,6 +3574,14 @@ void __ieee80211_subif_start_xmit(struct sk_buff *skb,
         if (!IS_ERR_OR_NULL(sta)) {
                 struct ieee80211_fast_tx *fast_tx;
 
+                /* We need a bit of data queued to build aggregates properly, so
+                 * instruct the TCP stack to allow more than a single ms of data
+                 * to be queued in the stack. The value is a bit-shift of 1
+                 * second, so 8 is ~4ms of queued data. Only affects local TCP
+                 * sockets.
+                 */
+                sk_pacing_shift_update(skb->sk, 8);
+
                 fast_tx = rcu_dereference(sta->fast_tx);
 
                 if (fast_tx &&
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index e545a3c9365f..7a4de6d618b1 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -122,7 +122,7 @@ bool mpls_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
         if (skb->len <= mtu)
                 return false;
 
-        if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
+        if (skb_is_gso(skb) && skb_gso_validate_network_len(skb, mtu))
                 return false;
 
         return true;
diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index 3e17d32b629d..58d5d05aec24 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -260,7 +260,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                 buf_len = strlen(buf);
 
                 ct = nf_ct_get(skb, &ctinfo);
-                if (ct && (ct->status & IPS_NAT_MASK)) {
+                if (ct) {
                         bool mangled;
 
                         /* If mangling fails this function will return 0
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 8b9fe30de0cd..558593e6a0a3 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5037,9 +5037,9 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
 {
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         const struct nf_flowtable_type *type;
+        struct nft_flowtable *flowtable, *ft;
         u8 genmask = nft_genmask_next(net);
         int family = nfmsg->nfgen_family;
-        struct nft_flowtable *flowtable;
         struct nft_table *table;
         struct nft_ctx ctx;
         int err, i, k;
@@ -5099,6 +5099,22 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
                 goto err3;
 
         for (i = 0; i < flowtable->ops_len; i++) {
+                if (!flowtable->ops[i].dev)
+                        continue;
+
+                list_for_each_entry(ft, &table->flowtables, list) {
+                        for (k = 0; k < ft->ops_len; k++) {
+                                if (!ft->ops[k].dev)
+                                        continue;
+
+                                if (flowtable->ops[i].dev == ft->ops[k].dev &&
+                                    flowtable->ops[i].pf == ft->ops[k].pf) {
+                                        err = -EBUSY;
+                                        goto err4;
+                                }
+                        }
+                }
+
                 err = nf_register_net_hook(net, &flowtable->ops[i]);
                 if (err < 0)
                         goto err4;
@@ -5120,7 +5136,7 @@ err5:
         i = flowtable->ops_len;
 err4:
         for (k = i - 1; k >= 0; k--)
-                nf_unregister_net_hook(net, &flowtable->ops[i]);
+                nf_unregister_net_hook(net, &flowtable->ops[k]);
 
         kfree(flowtable->ops);
 err3:
@@ -5145,6 +5161,11 @@ static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
         struct nft_table *table;
         struct nft_ctx ctx;
 
+        if (!nla[NFTA_FLOWTABLE_TABLE] ||
+            (!nla[NFTA_FLOWTABLE_NAME] &&
+             !nla[NFTA_FLOWTABLE_HANDLE]))
+                return -EINVAL;
+
         table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
                                        family, genmask);
         if (IS_ERR(table))
diff --git a/net/qrtr/smd.c b/net/qrtr/smd.c
index 50615d5efac1..9cf089b9754e 100644
--- a/net/qrtr/smd.c
+++ b/net/qrtr/smd.c
@@ -114,5 +114,6 @@ static struct rpmsg_driver qcom_smd_qrtr_driver = {
 
 module_rpmsg_driver(qcom_smd_qrtr_driver);
 
+MODULE_ALIAS("rpmsg:IPCRTR");
 MODULE_DESCRIPTION("Qualcomm IPC-Router SMD interface driver");
 MODULE_LICENSE("GPL v2");
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index c061d6eb465d..22571189f21e 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 Oracle.  All rights reserved.
+ * Copyright (c) 2006, 2018 Oracle.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -142,12 +142,20 @@ int rds_tcp_accept_one(struct socket *sock)
         if (ret)
                 goto out;
 
-        new_sock->type = sock->type;
-        new_sock->ops = sock->ops;
         ret = sock->ops->accept(sock, new_sock, O_NONBLOCK, true);
         if (ret < 0)
                 goto out;
 
+        /* sock_create_lite() does not get a hold on the owner module so we
+         * need to do it here.  Note that sock_release() uses sock->ops to
+         * determine if it needs to decrement the reference count.  So set
+         * sock->ops after calling accept() in case that fails.  And there's
+         * no need to do try_module_get() as the listener should have a hold
+         * already.
+         */
+        new_sock->ops = sock->ops;
+        __module_get(new_sock->ops->owner);
+
         ret = rds_tcp_keepalive(new_sock);
         if (ret < 0)
                 goto out;
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 229172d509cc..03225a8df973 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -188,7 +188,8 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc *sch,
         int ret;
 
         if (qdisc_pkt_len(skb) > q->max_size) {
-                if (skb_is_gso(skb) && skb_gso_mac_seglen(skb) <= q->max_size)
+                if (skb_is_gso(skb) &&
+                    skb_gso_validate_mac_len(skb, q->max_size))
                         return tbf_segment(skb, sch, to_free);
                 return qdisc_drop(skb, sch, to_free);
         }
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index da1a5cdefd13..8cc97834d4f6 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -1406,8 +1406,10 @@ static int smc_create(struct net *net, struct socket *sock, int protocol,
         smc->use_fallback = false; /* assume rdma capability first */
         rc = sock_create_kern(net, PF_INET, SOCK_STREAM,
                               IPPROTO_TCP, &smc->clcsock);
-        if (rc)
+        if (rc) {
                 sk_common_release(sk);
+                goto out;
+        }
         smc->sk.sk_sndbuf = max(smc->clcsock->sk->sk_sndbuf, SMC_BUF_MIN_SIZE);
         smc->sk.sk_rcvbuf = max(smc->clcsock->sk->sk_rcvbuf, SMC_BUF_MIN_SIZE);
 
diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index 3cd086e5bd28..b42395d24cba 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -269,7 +269,7 @@ static void smc_cdc_rx_handler(struct ib_wc *wc, void *buf)
 
         if (wc->byte_len < offsetof(struct smc_cdc_msg, reserved))
                 return; /* short message */
-        if (cdc->len != sizeof(*cdc))
+        if (cdc->len != SMC_WR_TX_SIZE)
                 return; /* invalid message */
         smc_cdc_msg_recv(cdc, link, wc->wr_id);
 }
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index 2424c7100aaf..645dd226177b 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -177,6 +177,7 @@ static int smc_lgr_create(struct smc_sock *smc, __be32 peer_in_addr,
 
         lnk = &lgr->lnk[SMC_SINGLE_LINK];
         /* initialize link */
+        lnk->link_id = SMC_SINGLE_LINK;
         lnk->smcibdev = smcibdev;
         lnk->ibport = ibport;
         lnk->path_mtu = smcibdev->pattr[ibport - 1].active_mtu;
@@ -465,7 +466,7 @@ create:
                 rc = smc_link_determine_gid(conn->lgr);
         }
         conn->local_tx_ctrl.common.type = SMC_CDC_MSG_TYPE;
-        conn->local_tx_ctrl.len = sizeof(struct smc_cdc_msg);
+        conn->local_tx_ctrl.len = SMC_WR_TX_SIZE;
 #ifndef KERNEL_HAS_ATOMIC64
         spin_lock_init(&conn->acurs_lock);
 #endif
diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c
index 92fe4cc8c82c..b4aa4fcedb96 100644
--- a/net/smc/smc_llc.c
+++ b/net/smc/smc_llc.c
@@ -92,7 +92,7 @@ int smc_llc_send_confirm_link(struct smc_link *link, u8 mac[],
         memcpy(confllc->sender_mac, mac, ETH_ALEN);
         memcpy(confllc->sender_gid, gid, SMC_GID_SIZE);
         hton24(confllc->sender_qp_num, link->roce_qp->qp_num);
-        /* confllc->link_num = SMC_SINGLE_LINK; already done by memset above */
+        confllc->link_num = link->link_id;
         memcpy(confllc->link_uid, lgr->id, SMC_LGR_ID_SIZE);
         confllc->max_links = SMC_LINKS_PER_LGR_MAX;
         /* send llc message */
diff --git a/net/tipc/group.c b/net/tipc/group.c
index 122162a31816..04e516d18054 100644
--- a/net/tipc/group.c
+++ b/net/tipc/group.c
@@ -189,6 +189,7 @@ struct tipc_group *tipc_group_create(struct net *net, u32 portid,
         grp->loopback = mreq->flags & TIPC_GROUP_LOOPBACK;
         grp->events = mreq->flags & TIPC_GROUP_MEMBER_EVTS;
         grp->open = group_is_open;
+        *grp->open = false;
         filter |= global ? TIPC_SUB_CLUSTER_SCOPE : TIPC_SUB_NODE_SCOPE;
         if (tipc_topsrv_kern_subscr(net, portid, type, 0, ~0,
                                     filter, &grp->subid))
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index b0323ec7971e..7dfa9fc99ec3 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -473,6 +473,7 @@ static int tipc_sk_create(struct net *net, struct socket *sock,
         sk->sk_write_space = tipc_write_space;
         sk->sk_destruct = tipc_sock_destruct;
         tsk->conn_timeout = CONN_TIMEOUT_DEFAULT;
+        tsk->group_is_open = true;
         atomic_set(&tsk->dupl_rcvcnt, 0);
 
         /* Start out with safe limits until we receive an advertised window */
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index e9b4b53ab53e..d824d548447e 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -46,16 +46,26 @@ MODULE_DESCRIPTION("Transport Layer Security Support");
 MODULE_LICENSE("Dual BSD/GPL");
 
 enum {
+        TLSV4,
+        TLSV6,
+        TLS_NUM_PROTS,
+};
+
+enum {
         TLS_BASE_TX,
         TLS_SW_TX,
         TLS_NUM_CONFIG,
 };
 
-static struct proto tls_prots[TLS_NUM_CONFIG];
+static struct proto *saved_tcpv6_prot;
+static DEFINE_MUTEX(tcpv6_prot_mutex);
+static struct proto tls_prots[TLS_NUM_PROTS][TLS_NUM_CONFIG];
 
 static inline void update_sk_prot(struct sock *sk, struct tls_context *ctx)
 {
-        sk->sk_prot = &tls_prots[ctx->tx_conf];
+        int ip_ver = sk->sk_family == AF_INET6 ? TLSV6 : TLSV4;
+
+        sk->sk_prot = &tls_prots[ip_ver][ctx->tx_conf];
 }
 
 int wait_on_pending_writer(struct sock *sk, long *timeo)
@@ -453,8 +463,21 @@ static int tls_setsockopt(struct sock *sk, int level, int optname,
         return do_tls_setsockopt(sk, optname, optval, optlen);
 }
 
+static void build_protos(struct proto *prot, struct proto *base)
+{
+        prot[TLS_BASE_TX] = *base;
+        prot[TLS_BASE_TX].setsockopt    = tls_setsockopt;
+        prot[TLS_BASE_TX].getsockopt    = tls_getsockopt;
+        prot[TLS_BASE_TX].close         = tls_sk_proto_close;
+
+        prot[TLS_SW_TX] = prot[TLS_BASE_TX];
+        prot[TLS_SW_TX].sendmsg         = tls_sw_sendmsg;
+        prot[TLS_SW_TX].sendpage        = tls_sw_sendpage;
+}
+
 static int tls_init(struct sock *sk)
 {
+        int ip_ver = sk->sk_family == AF_INET6 ? TLSV6 : TLSV4;
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct tls_context *ctx;
         int rc = 0;
@@ -479,6 +502,17 @@ static int tls_init(struct sock *sk)
         ctx->getsockopt = sk->sk_prot->getsockopt;
         ctx->sk_proto_close = sk->sk_prot->close;
 
+        /* Build IPv6 TLS whenever the address of tcpv6_prot changes */
+        if (ip_ver == TLSV6 &&
+            unlikely(sk->sk_prot != smp_load_acquire(&saved_tcpv6_prot))) {
+                mutex_lock(&tcpv6_prot_mutex);
+                if (likely(sk->sk_prot != saved_tcpv6_prot)) {
+                        build_protos(tls_prots[TLSV6], sk->sk_prot);
+                        smp_store_release(&saved_tcpv6_prot, sk->sk_prot);
+                }
+                mutex_unlock(&tcpv6_prot_mutex);
+        }
+
         ctx->tx_conf = TLS_BASE_TX;
         update_sk_prot(sk, ctx);
 out:
@@ -493,21 +527,9 @@ static struct tcp_ulp_ops tcp_tls_ulp_ops __read_mostly = {
         .init                   = tls_init,
 };
 
-static void build_protos(struct proto *prot, struct proto *base)
-{
-        prot[TLS_BASE_TX] = *base;
-        prot[TLS_BASE_TX].setsockopt    = tls_setsockopt;
-        prot[TLS_BASE_TX].getsockopt    = tls_getsockopt;
-        prot[TLS_BASE_TX].close         = tls_sk_proto_close;
-
-        prot[TLS_SW_TX] = prot[TLS_BASE_TX];
-        prot[TLS_SW_TX].sendmsg         = tls_sw_sendmsg;
-        prot[TLS_SW_TX].sendpage        = tls_sw_sendpage;
-}
-
 static int __init tls_register(void)
 {
-        build_protos(tls_prots, &tcp_prot);
+        build_protos(tls_prots[TLSV4], &tcp_prot);
 
         tcp_register_ulp(&tcp_tls_ulp_ops);
 
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index 1abcc4fc4df1..41722046b937 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -34,9 +34,10 @@ config CFG80211
 
           When built as a module it will be called cfg80211.
 
+if CFG80211
+
 config NL80211_TESTMODE
         bool "nl80211 testmode command"
-        depends on CFG80211
         help
           The nl80211 testmode command helps implementing things like
           factory calibration or validation tools for wireless chips.
@@ -51,7 +52,6 @@ config NL80211_TESTMODE
 
 config CFG80211_DEVELOPER_WARNINGS
         bool "enable developer warnings"
-        depends on CFG80211
         default n
         help
           This option enables some additional warnings that help
@@ -68,7 +68,7 @@ config CFG80211_DEVELOPER_WARNINGS
 
 config CFG80211_CERTIFICATION_ONUS
         bool "cfg80211 certification onus"
-        depends on CFG80211 && EXPERT
+        depends on EXPERT
         default n
         ---help---
           You should disable this option unless you are both capable
@@ -159,7 +159,6 @@ config CFG80211_REG_RELAX_NO_IR
 
 config CFG80211_DEFAULT_PS
         bool "enable powersave by default"
-        depends on CFG80211
         default y
         help
           This option enables powersave mode by default.
@@ -170,7 +169,6 @@ config CFG80211_DEFAULT_PS
 
 config CFG80211_DEBUGFS
         bool "cfg80211 DebugFS entries"
-        depends on CFG80211
         depends on DEBUG_FS
         ---help---
           You can enable this if you want debugfs entries for cfg80211.
@@ -180,7 +178,6 @@ config CFG80211_DEBUGFS
 config CFG80211_CRDA_SUPPORT
         bool "support CRDA" if EXPERT
         default y
-        depends on CFG80211
         help
           You should enable this option unless you know for sure you have no
           need for it, for example when using internal regdb (above) or the
@@ -190,7 +187,6 @@ config CFG80211_CRDA_SUPPORT
 
 config CFG80211_WEXT
         bool "cfg80211 wireless extensions compatibility" if !CFG80211_WEXT_EXPORT
-        depends on CFG80211
         select WEXT_CORE
         default y if CFG80211_WEXT_EXPORT
         help
@@ -199,11 +195,12 @@ config CFG80211_WEXT
 
 config CFG80211_WEXT_EXPORT
         bool
-        depends on CFG80211
         help
           Drivers should select this option if they require cfg80211's
           wext compatibility symbols to be exported.
 
+endif # CFG80211
+
 config LIB80211
         tristate
         default n
diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
index 8e70291e586a..e87d6c4dd5b6 100644
--- a/net/xfrm/xfrm_device.c
+++ b/net/xfrm/xfrm_device.c
@@ -217,7 +217,7 @@ bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x)
                 if (skb->len <= mtu)
                         goto ok;
 
-                if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
+                if (skb_is_gso(skb) && skb_gso_validate_network_len(skb, mtu))
                         goto ok;
         }
 
diff --git a/samples/seccomp/Makefile b/samples/seccomp/Makefile
index 0e349b80686e..ba942e3ead89 100644
--- a/samples/seccomp/Makefile
+++ b/samples/seccomp/Makefile
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0
+ifndef CROSS_COMPILE
 hostprogs-$(CONFIG_SAMPLE_SECCOMP) := bpf-fancy dropper bpf-direct
 
 HOSTCFLAGS_bpf-fancy.o += -I$(objtree)/usr/include
@@ -16,7 +17,6 @@ HOSTCFLAGS_bpf-direct.o += -idirafter $(objtree)/include
 bpf-direct-objs := bpf-direct.o
 
 # Try to match the kernel target.
-ifndef CROSS_COMPILE
 ifndef CONFIG_64BIT
 
 # s390 has -m31 flag to build 31 bit binaries
@@ -35,12 +35,4 @@ HOSTLOADLIBES_bpf-fancy += $(MFLAG)
 HOSTLOADLIBES_dropper += $(MFLAG)
 endif
 always := $(hostprogs-m)
-else
-# MIPS system calls are defined based on the -mabi that is passed
-# to the toolchain which may or may not be a valid option
-# for the host toolchain. So disable tests if target architecture
-# is MIPS but the host isn't.
-ifndef CONFIG_MIPS
-always := $(hostprogs-m)
-endif
 endif
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index 47cddf32aeba..4f2b25d43ec9 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -256,6 +256,8 @@ __objtool_obj := $(objtree)/tools/objtool/objtool
 
 objtool_args = $(if $(CONFIG_UNWINDER_ORC),orc generate,check)
 
+objtool_args += $(if $(part-of-module), --module,)
+
 ifndef CONFIG_FRAME_POINTER
 objtool_args += --no-fp
 endif
@@ -264,6 +266,12 @@ objtool_args += --no-unreachable
 else
 objtool_args += $(call cc-ifversion, -lt, 0405, --no-unreachable)
 endif
+ifdef CONFIG_RETPOLINE
+ifneq ($(RETPOLINE_CFLAGS),)
+  objtool_args += --retpoline
+endif
+endif
+
 
 ifdef CONFIG_MODVERSIONS
 objtool_o = $(@D)/.tmp_$(@F)
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 5589bae34af6..a6f538b31ad6 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -297,11 +297,11 @@ cmd_dt_S_dtb=						\
         echo '\#include <asm-generic/vmlinux.lds.h>';   \
         echo '.section .dtb.init.rodata,"a"';           \
         echo '.balign STRUCT_ALIGNMENT';                \
-        echo '.global __dtb_$(*F)_begin';               \
-        echo '__dtb_$(*F)_begin:';                      \
+        echo '.global __dtb_$(subst -,_,$(*F))_begin';  \
+        echo '__dtb_$(subst -,_,$(*F))_begin:';         \
         echo '.incbin "$<" ';                           \
-        echo '__dtb_$(*F)_end:';                        \
-        echo '.global __dtb_$(*F)_end';                 \
+        echo '__dtb_$(subst -,_,$(*F))_end:';           \
+        echo '.global __dtb_$(subst -,_,$(*F))_end';    \
         echo '.balign STRUCT_ALIGNMENT';                \
 ) > $@
 
diff --git a/scripts/basic/fixdep.c b/scripts/basic/fixdep.c
index fa3d39b6f23b..449b68c4c90c 100644
--- a/scripts/basic/fixdep.c
+++ b/scripts/basic/fixdep.c
@@ -93,14 +93,6 @@
  * (Note: it'd be easy to port over the complete mkdep state machine,
  *  but I don't think the added complexity is worth it)
  */
-/*
- * Note 2: if somebody writes HELLO_CONFIG_BOOM in a file, it will depend onto
- * CONFIG_BOOM. This could seem a bug (not too hard to fix), but please do not
- * fix it! Some UserModeLinux files (look at arch/um/) call CONFIG_BOOM as
- * UML_CONFIG_BOOM, to avoid conflicts with /usr/include/linux/autoconf.h,
- * through arch/um/include/uml-config.h; this fixdep "bug" makes sure that
- * those files will have correct dependencies.
- */
 
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -233,8 +225,13 @@ static int str_ends_with(const char *s, int slen, const char *sub)
 static void parse_config_file(const char *p)
 {
         const char *q, *r;
+        const char *start = p;
 
         while ((p = strstr(p, "CONFIG_"))) {
+                if (p > start && (isalnum(p[-1]) || p[-1] == '_')) {
+                        p += 7;
+                        continue;
+                }
                 p += 7;
                 q = p;
                 while (*q && (isalnum(*q) || *q == '_'))
@@ -286,8 +283,6 @@ static int is_ignored_file(const char *s, int len)
 {
         return str_ends_with(s, len, "include/generated/autoconf.h") ||
                str_ends_with(s, len, "include/generated/autoksyms.h") ||
-               str_ends_with(s, len, "arch/um/include/uml-config.h") ||
-               str_ends_with(s, len, "include/linux/kconfig.h") ||
                str_ends_with(s, len, ".ver");
 }
 
diff --git a/scripts/bloat-o-meter b/scripts/bloat-o-meter
index 94b664817ad9..d84a5674e95e 100755
--- a/scripts/bloat-o-meter
+++ b/scripts/bloat-o-meter
@@ -15,7 +15,7 @@ signal(SIGPIPE, SIG_DFL)
 if len(sys.argv) < 3:
     sys.stderr.write("usage: %s [option] file1 file2\n" % sys.argv[0])
     sys.stderr.write("The options are:\n")
-    sys.stderr.write("-c        cateogrize output based on symbole type\n")
+    sys.stderr.write("-c        categorize output based on symbol type\n")
     sys.stderr.write("-d        Show delta of Data Section\n")
     sys.stderr.write("-t        Show delta of text Section\n")
     sys.exit(-1)
diff --git a/scripts/coccinelle/api/memdup.cocci b/scripts/coccinelle/api/memdup.cocci
index 1249b727644b..8fd6437beda8 100644
--- a/scripts/coccinelle/api/memdup.cocci
+++ b/scripts/coccinelle/api/memdup.cocci
@@ -56,10 +56,10 @@ statement S;
 p << r.p;
 @@
 
-coccilib.org.print_todo(p[0], "WARNING opportunity for kmemdep")
+coccilib.org.print_todo(p[0], "WARNING opportunity for kmemdup")
 
 @script:python depends on report@
 p << r.p;
 @@
 
-coccilib.report.print_report(p[0], "WARNING opportunity for kmemdep")
+coccilib.report.print_report(p[0], "WARNING opportunity for kmemdup")
diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
index 9ee9bf7fd1a2..65792650c630 100644
--- a/scripts/kallsyms.c
+++ b/scripts/kallsyms.c
@@ -595,7 +595,7 @@ static void optimize_result(void)
                  * original char code */
                 if (!best_table_len[i]) {
 
-                        /* find the token with the breates profit value */
+                        /* find the token with the best profit value */
                         best = find_best_token();
                         if (token_profit[best] == 0)
                                 break;
diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
index 5c12dc91ef34..df26c7b0fe13 100644
--- a/scripts/kconfig/confdata.c
+++ b/scripts/kconfig/confdata.c
@@ -178,7 +178,7 @@ static int conf_set_sym_val(struct symbol *sym, int def, int def_flags, char *p)
         case S_HEX:
         done:
                 if (sym_string_valid(sym, p)) {
-                        sym->def[def].val = strdup(p);
+                        sym->def[def].val = xstrdup(p);
                         sym->flags |= def_flags;
                 } else {
                         if (def != S_DEF_AUTO)
diff --git a/scripts/kconfig/kxgettext.c b/scripts/kconfig/kxgettext.c
index 2858738b22d5..240880a89111 100644
--- a/scripts/kconfig/kxgettext.c
+++ b/scripts/kconfig/kxgettext.c
@@ -101,7 +101,7 @@ static struct message *message__new(const char *msg, char *option,
         if (self->files == NULL)
                 goto out_fail;
 
-        self->msg = strdup(msg);
+        self->msg = xstrdup(msg);
         if (self->msg == NULL)
                 goto out_fail_msg;
 
diff --git a/scripts/kconfig/lkc.h b/scripts/kconfig/lkc.h
index 4e23febbe4b2..2d5ec2d0e952 100644
--- a/scripts/kconfig/lkc.h
+++ b/scripts/kconfig/lkc.h
@@ -115,6 +115,7 @@ int file_write_dep(const char *name);
 void *xmalloc(size_t size);
 void *xcalloc(size_t nmemb, size_t size);
 void *xrealloc(void *p, size_t size);
+char *xstrdup(const char *s);
 
 struct gstr {
         size_t len;
diff --git a/scripts/kconfig/lxdialog/check-lxdialog.sh b/scripts/kconfig/lxdialog/check-lxdialog.sh
index a10bd9d6fafd..6c0bcd9c472d 100755
--- a/scripts/kconfig/lxdialog/check-lxdialog.sh
+++ b/scripts/kconfig/lxdialog/check-lxdialog.sh
@@ -55,7 +55,8 @@ EOF
             echo " *** required header files."                            1>&2
             echo " *** 'make menuconfig' requires the ncurses libraries." 1>&2
             echo " *** "                                                  1>&2
-            echo " *** Install ncurses (ncurses-devel) and try again."    1>&2
+            echo " *** Install ncurses (ncurses-devel or libncurses-dev " 1>&2
+            echo " *** depending on your distribution) and try again."    1>&2
             echo " *** "                                                  1>&2
             exit 1
         fi
diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
index 99222855544c..36cd3e1f1c28 100644
--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -212,6 +212,7 @@ void menu_add_option(int token, char *arg)
                         sym_defconfig_list = current_entry->sym;
                 else if (sym_defconfig_list != current_entry->sym)
                         zconf_error("trying to redefine defconfig symbol");
+                sym_defconfig_list->flags |= SYMBOL_AUTO;
                 break;
         case T_OPT_ENV:
                 prop_add_env(arg);
diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c
index cca9663be5dd..2220bc4b051b 100644
--- a/scripts/kconfig/symbol.c
+++ b/scripts/kconfig/symbol.c
@@ -183,7 +183,7 @@ static void sym_validate_range(struct symbol *sym)
                 sprintf(str, "%lld", val2);
         else
                 sprintf(str, "0x%llx", val2);
-        sym->curr.val = strdup(str);
+        sym->curr.val = xstrdup(str);
 }
 
 static void sym_set_changed(struct symbol *sym)
@@ -849,7 +849,7 @@ struct symbol *sym_lookup(const char *name, int flags)
                                    : !(symbol->flags & (SYMBOL_CONST|SYMBOL_CHOICE))))
                                 return symbol;
                 }
-                new_name = strdup(name);
+                new_name = xstrdup(name);
         } else {
                 new_name = NULL;
                 hash = 0;
diff --git a/scripts/kconfig/util.c b/scripts/kconfig/util.c
index b98a79e30e04..c6f6e21b809f 100644
--- a/scripts/kconfig/util.c
+++ b/scripts/kconfig/util.c
@@ -154,3 +154,14 @@ void *xrealloc(void *p, size_t size)
         fprintf(stderr, "Out of memory.\n");
         exit(1);
 }
+
+char *xstrdup(const char *s)
+{
+        char *p;
+
+        p = strdup(s);
+        if (p)
+                return p;
+        fprintf(stderr, "Out of memory.\n");
+        exit(1);
+}
diff --git a/scripts/kconfig/zconf.l b/scripts/kconfig/zconf.l
index 02de6fe302a9..88b650eb9cc9 100644
--- a/scripts/kconfig/zconf.l
+++ b/scripts/kconfig/zconf.l
@@ -332,16 +332,12 @@ void zconf_nextfile(const char *name)
                                 "Inclusion path:\n  current file : '%s'\n",
                                 zconf_curname(), zconf_lineno(),
                                 zconf_curname());
-                        iter = current_file->parent;
-                        while (iter && \
-                               strcmp(iter->name,current_file->name)) {
-                                fprintf(stderr, "  included from: '%s:%d'\n",
-                                        iter->name, iter->lineno-1);
+                        iter = current_file;
+                        do {
                                 iter = iter->parent;
-                        }
-                        if (iter)
                                 fprintf(stderr, "  included from: '%s:%d'\n",
-                                        iter->name, iter->lineno+1);
+                                        iter->name, iter->lineno - 1);
+                        } while (strcmp(iter->name, current_file->name));
                         exit(1);
                 }
         }
diff --git a/scripts/kconfig/zconf.y b/scripts/kconfig/zconf.y
index 4be98050b961..ad6305b0f40c 100644
--- a/scripts/kconfig/zconf.y
+++ b/scripts/kconfig/zconf.y
@@ -127,7 +127,7 @@ no_mainmenu_stmt: /* empty */
          * later regardless of whether it comes from the 'prompt' in
          * mainmenu_stmt or here
          */
-        menu_add_prompt(P_MENU, strdup("Linux Kernel Configuration"), NULL);
+        menu_add_prompt(P_MENU, xstrdup("Linux Kernel Configuration"), NULL);
 };
 
 
@@ -276,6 +276,7 @@ choice: T_CHOICE word_opt T_EOL
         sym->flags |= SYMBOL_AUTO;
         menu_add_entry(sym);
         menu_add_expr(P_CHOICE, NULL, NULL);
+        free($2);
         printd(DEBUG_PARSE, "%s:%d:choice\n", zconf_curname(), zconf_lineno());
 };
 
diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
index c0d129d7f430..be56a1153014 100755
--- a/scripts/link-vmlinux.sh
+++ b/scripts/link-vmlinux.sh
@@ -246,7 +246,7 @@ else
 fi;
 
 # final build of init/
-${MAKE} -f "${srctree}/scripts/Makefile.build" obj=init GCC_PLUGINS_CFLAGS="${GCC_PLUGINS_CFLAGS}"
+${MAKE} -f "${srctree}/scripts/Makefile.build" obj=init
 
 archive_builtin
 
diff --git a/sound/core/control.c b/sound/core/control.c
index 0b3026d937b1..8a77620a3854 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -889,7 +889,7 @@ static int snd_ctl_elem_read(struct snd_card *card,
 
         index_offset = snd_ctl_get_ioff(kctl, &control->id);
         vd = &kctl->vd[index_offset];
-        if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) && kctl->get == NULL)
+        if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || kctl->get == NULL)
                 return -EPERM;
 
         snd_ctl_build_ioff(&control->id, kctl, index_offset);
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index b044c0a5a674..02298c9c6020 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1762,10 +1762,9 @@ static int snd_pcm_oss_get_formats(struct snd_pcm_oss_file *pcm_oss_file)
                 return -ENOMEM;
         _snd_pcm_hw_params_any(params);
         err = snd_pcm_hw_refine(substream, params);
-        format_mask = hw_param_mask_c(params, SNDRV_PCM_HW_PARAM_FORMAT);
-        kfree(params);
         if (err < 0)
-                return err;
+                goto error;
+        format_mask = hw_param_mask_c(params, SNDRV_PCM_HW_PARAM_FORMAT);
         for (fmt = 0; fmt < 32; ++fmt) {
                 if (snd_mask_test(format_mask, fmt)) {
                         int f = snd_pcm_oss_format_to(fmt);
@@ -1773,7 +1772,10 @@ static int snd_pcm_oss_get_formats(struct snd_pcm_oss_file *pcm_oss_file)
                                 formats |= f;
                 }
         }
-        return formats;
+
+ error:
+        kfree(params);
+        return err < 0 ? err : formats;
 }
 
 static int snd_pcm_oss_set_format(struct snd_pcm_oss_file *pcm_oss_file, int format)
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 04d4db44fae5..61a07fe34cd2 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -255,12 +255,12 @@ static int seq_free_client1(struct snd_seq_client *client)
 
         if (!client)
                 return 0;
-        snd_seq_delete_all_ports(client);
-        snd_seq_queue_client_leave(client->number);
         spin_lock_irqsave(&clients_lock, flags);
         clienttablock[client->number] = 1;
         clienttab[client->number] = NULL;
         spin_unlock_irqrestore(&clients_lock, flags);
+        snd_seq_delete_all_ports(client);
+        snd_seq_queue_client_leave(client->number);
         snd_use_lock_sync(&client->use_lock);
         snd_seq_queue_client_termination(client->number);
         if (client->pool)
@@ -910,7 +910,8 @@ int snd_seq_dispatch_event(struct snd_seq_event_cell *cell, int atomic, int hop)
 static int snd_seq_client_enqueue_event(struct snd_seq_client *client,
                                         struct snd_seq_event *event,
                                         struct file *file, int blocking,
-                                        int atomic, int hop)
+                                        int atomic, int hop,
+                                        struct mutex *mutexp)
 {
         struct snd_seq_event_cell *cell;
         int err;
@@ -948,7 +949,8 @@ static int snd_seq_client_enqueue_event(struct snd_seq_client *client,
                 return -ENXIO; /* queue is not allocated */
 
         /* allocate an event cell */
-        err = snd_seq_event_dup(client->pool, event, &cell, !blocking || atomic, file);
+        err = snd_seq_event_dup(client->pool, event, &cell, !blocking || atomic,
+                                file, mutexp);
         if (err < 0)
                 return err;
 
@@ -1017,12 +1019,11 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
                 return -ENXIO;
 
         /* allocate the pool now if the pool is not allocated yet */ 
+        mutex_lock(&client->ioctl_mutex);
         if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) {
-                mutex_lock(&client->ioctl_mutex);
                 err = snd_seq_pool_init(client->pool);
-                mutex_unlock(&client->ioctl_mutex);
                 if (err < 0)
-                        return -ENOMEM;
+                        goto out;
         }
 
         /* only process whole events */
@@ -1073,7 +1074,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
                 /* ok, enqueue it */
                 err = snd_seq_client_enqueue_event(client, &event, file,
                                                    !(file->f_flags & O_NONBLOCK),
-                                                   0, 0);
+                                                   0, 0, &client->ioctl_mutex);
                 if (err < 0)
                         break;
 
@@ -1084,6 +1085,8 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
                 written += len;
         }
 
+ out:
+        mutex_unlock(&client->ioctl_mutex);
         return written ? written : err;
 }
 
@@ -1838,9 +1841,11 @@ static int snd_seq_ioctl_set_client_pool(struct snd_seq_client *client,
             (! snd_seq_write_pool_allocated(client) ||
              info->output_pool != client->pool->size)) {
                 if (snd_seq_write_pool_allocated(client)) {
+                        /* is the pool in use? */
+                        if (atomic_read(&client->pool->counter))
+                                return -EBUSY;
                         /* remove all existing cells */
                         snd_seq_pool_mark_closing(client->pool);
-                        snd_seq_queue_client_leave_cells(client->number);
                         snd_seq_pool_done(client->pool);
                 }
                 client->pool->size = info->output_pool;
@@ -2260,7 +2265,8 @@ static int kernel_client_enqueue(int client, struct snd_seq_event *ev,
         if (! cptr->accept_output)
                 result = -EPERM;
         else /* send it */
-                result = snd_seq_client_enqueue_event(cptr, ev, file, blocking, atomic, hop);
+                result = snd_seq_client_enqueue_event(cptr, ev, file, blocking,
+                                                      atomic, hop, NULL);
 
         snd_seq_client_unlock(cptr);
         return result;
diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
index a8c2822e0198..72c0302a55d2 100644
--- a/sound/core/seq/seq_fifo.c
+++ b/sound/core/seq/seq_fifo.c
@@ -125,7 +125,7 @@ int snd_seq_fifo_event_in(struct snd_seq_fifo *f,
                 return -EINVAL;
 
         snd_use_lock_use(&f->use_lock);
-        err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL); /* always non-blocking */
+        err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL, NULL); /* always non-blocking */
         if (err < 0) {
                 if ((err == -ENOMEM) || (err == -EAGAIN))
                         atomic_inc(&f->overflow);
diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
index f763682584a8..ab1112e90f88 100644
--- a/sound/core/seq/seq_memory.c
+++ b/sound/core/seq/seq_memory.c
@@ -220,7 +220,8 @@ void snd_seq_cell_free(struct snd_seq_event_cell * cell)
  */
 static int snd_seq_cell_alloc(struct snd_seq_pool *pool,
                               struct snd_seq_event_cell **cellp,
-                              int nonblock, struct file *file)
+                              int nonblock, struct file *file,
+                              struct mutex *mutexp)
 {
         struct snd_seq_event_cell *cell;
         unsigned long flags;
@@ -244,7 +245,11 @@ static int snd_seq_cell_alloc(struct snd_seq_pool *pool,
                 set_current_state(TASK_INTERRUPTIBLE);
                 add_wait_queue(&pool->output_sleep, &wait);
                 spin_unlock_irq(&pool->lock);
+                if (mutexp)
+                        mutex_unlock(mutexp);
                 schedule();
+                if (mutexp)
+                        mutex_lock(mutexp);
                 spin_lock_irq(&pool->lock);
                 remove_wait_queue(&pool->output_sleep, &wait);
                 /* interrupted? */
@@ -287,7 +292,7 @@ __error:
  */
 int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event,
                       struct snd_seq_event_cell **cellp, int nonblock,
-                      struct file *file)
+                      struct file *file, struct mutex *mutexp)
 {
         int ncells, err;
         unsigned int extlen;
@@ -304,7 +309,7 @@ int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event,
         if (ncells >= pool->total_elements)
                 return -ENOMEM;
 
-        err = snd_seq_cell_alloc(pool, &cell, nonblock, file);
+        err = snd_seq_cell_alloc(pool, &cell, nonblock, file, mutexp);
         if (err < 0)
                 return err;
 
@@ -330,7 +335,8 @@ int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event,
                         int size = sizeof(struct snd_seq_event);
                         if (len < size)
                                 size = len;
-                        err = snd_seq_cell_alloc(pool, &tmp, nonblock, file);
+                        err = snd_seq_cell_alloc(pool, &tmp, nonblock, file,
+                                                 mutexp);
                         if (err < 0)
                                 goto __error;
                         if (cell->event.data.ext.ptr == NULL)
diff --git a/sound/core/seq/seq_memory.h b/sound/core/seq/seq_memory.h
index 32f959c17786..3abe306c394a 100644
--- a/sound/core/seq/seq_memory.h
+++ b/sound/core/seq/seq_memory.h
@@ -66,7 +66,8 @@ struct snd_seq_pool {
 void snd_seq_cell_free(struct snd_seq_event_cell *cell);
 
 int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event,
-                      struct snd_seq_event_cell **cellp, int nonblock, struct file *file);
+                      struct snd_seq_event_cell **cellp, int nonblock,
+                      struct file *file, struct mutex *mutexp);
 
 /* return number of unused (free) cells */
 static inline int snd_seq_unused_cells(struct snd_seq_pool *pool)
diff --git a/sound/core/seq/seq_prioq.c b/sound/core/seq/seq_prioq.c
index bc1c8488fc2a..2bc6759e4adc 100644
--- a/sound/core/seq/seq_prioq.c
+++ b/sound/core/seq/seq_prioq.c
@@ -87,7 +87,7 @@ void snd_seq_prioq_delete(struct snd_seq_prioq **fifo)
         if (f->cells > 0) {
                 /* drain prioQ */
                 while (f->cells > 0)
-                        snd_seq_cell_free(snd_seq_prioq_cell_out(f));
+                        snd_seq_cell_free(snd_seq_prioq_cell_out(f, NULL));
         }
         
         kfree(f);
@@ -214,8 +214,18 @@ int snd_seq_prioq_cell_in(struct snd_seq_prioq * f,
         return 0;
 }
 
+/* return 1 if the current time >= event timestamp */
+static int event_is_ready(struct snd_seq_event *ev, void *current_time)
+{
+        if ((ev->flags & SNDRV_SEQ_TIME_STAMP_MASK) == SNDRV_SEQ_TIME_STAMP_TICK)
+                return snd_seq_compare_tick_time(current_time, &ev->time.tick);
+        else
+                return snd_seq_compare_real_time(current_time, &ev->time.time);
+}
+
 /* dequeue cell from prioq */
-struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f)
+struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f,
+                                                  void *current_time)
 {
         struct snd_seq_event_cell *cell;
         unsigned long flags;
@@ -227,6 +237,8 @@ struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f)
         spin_lock_irqsave(&f->lock, flags);
 
         cell = f->head;
+        if (cell && current_time && !event_is_ready(&cell->event, current_time))
+                cell = NULL;
         if (cell) {
                 f->head = cell->next;
 
@@ -252,18 +264,6 @@ int snd_seq_prioq_avail(struct snd_seq_prioq * f)
         return f->cells;
 }
 
-
-/* peek at cell at the head of the prioq */
-struct snd_seq_event_cell *snd_seq_prioq_cell_peek(struct snd_seq_prioq * f)
-{
-        if (f == NULL) {
-                pr_debug("ALSA: seq: snd_seq_prioq_cell_in() called with NULL prioq\n");
-                return NULL;
-        }
-        return f->head;
-}
-
-
 static inline int prioq_match(struct snd_seq_event_cell *cell,
                               int client, int timestamp)
 {
diff --git a/sound/core/seq/seq_prioq.h b/sound/core/seq/seq_prioq.h
index d38bb78d9345..2c315ca10fc4 100644
--- a/sound/core/seq/seq_prioq.h
+++ b/sound/core/seq/seq_prioq.h
@@ -44,14 +44,12 @@ void snd_seq_prioq_delete(struct snd_seq_prioq **fifo);
 int snd_seq_prioq_cell_in(struct snd_seq_prioq *f, struct snd_seq_event_cell *cell);
 
 /* dequeue cell from prioq */ 
-struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f);
+struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f,
+                                                  void *current_time);
 
 /* return number of events available in prioq */
 int snd_seq_prioq_avail(struct snd_seq_prioq *f);
 
-/* peek at cell at the head of the prioq */
-struct snd_seq_event_cell *snd_seq_prioq_cell_peek(struct snd_seq_prioq *f);
-
 /* client left queue */
 void snd_seq_prioq_leave(struct snd_seq_prioq *f, int client, int timestamp);        
 
diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
index 0428e9061b47..b377f5048352 100644
--- a/sound/core/seq/seq_queue.c
+++ b/sound/core/seq/seq_queue.c
@@ -277,30 +277,20 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop)
 
       __again:
         /* Process tick queue... */
-        while ((cell = snd_seq_prioq_cell_peek(q->tickq)) != NULL) {
-                if (snd_seq_compare_tick_time(&q->timer->tick.cur_tick,
-                                              &cell->event.time.tick)) {
-                        cell = snd_seq_prioq_cell_out(q->tickq);
-                        if (cell)
-                                snd_seq_dispatch_event(cell, atomic, hop);
-                } else {
-                        /* event remains in the queue */
+        for (;;) {
+                cell = snd_seq_prioq_cell_out(q->tickq,
+                                              &q->timer->tick.cur_tick);
+                if (!cell)
                         break;
-                }
+                snd_seq_dispatch_event(cell, atomic, hop);
         }
 
-
         /* Process time queue... */
-        while ((cell = snd_seq_prioq_cell_peek(q->timeq)) != NULL) {
-                if (snd_seq_compare_real_time(&q->timer->cur_time,
-                                              &cell->event.time.time)) {
-                        cell = snd_seq_prioq_cell_out(q->timeq);
-                        if (cell)
-                                snd_seq_dispatch_event(cell, atomic, hop);
-                } else {
-                        /* event remains in the queue */
+        for (;;) {
+                cell = snd_seq_prioq_cell_out(q->timeq, &q->timer->cur_time);
+                if (!cell)
                         break;
-                }
+                snd_seq_dispatch_event(cell, atomic, hop);
         }
 
         /* free lock */
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index c71dcacea807..d5017adf9feb 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -186,6 +186,10 @@ module_param(power_save, xint, 0644);
 MODULE_PARM_DESC(power_save, "Automatic power-saving timeout "
                  "(in second, 0 = disable).");
 
+static bool pm_blacklist = true;
+module_param(pm_blacklist, bool, 0644);
+MODULE_PARM_DESC(pm_blacklist, "Enable power-management blacklist");
+
 /* reset the HD-audio controller in power save mode.
  * this may give more power-saving, but will take longer time to
  * wake up.
@@ -2186,6 +2190,24 @@ out_free:
         return err;
 }
 
+#ifdef CONFIG_PM
+/* On some boards setting power_save to a non 0 value leads to clicking /
+ * popping sounds when ever we enter/leave powersaving mode. Ideally we would
+ * figure out how to avoid these sounds, but that is not always feasible.
+ * So we keep a list of devices where we disable powersaving as its known
+ * to causes problems on these devices.
+ */
+static struct snd_pci_quirk power_save_blacklist[] = {
+        /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
+        SND_PCI_QUIRK(0x1849, 0x0c0c, "Asrock B85M-ITX", 0),
+        /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
+        SND_PCI_QUIRK(0x1043, 0x8733, "Asus Prime X370-Pro", 0),
+        /* https://bugzilla.kernel.org/show_bug.cgi?id=198611 */
+        SND_PCI_QUIRK(0x17aa, 0x2227, "Lenovo X1 Carbon 3rd Gen", 0),
+        {}
+};
+#endif /* CONFIG_PM */
+
 /* number of codec slots for each chipset: 0 = default slots (i.e. 4) */
 static unsigned int azx_max_codecs[AZX_NUM_DRIVERS] = {
         [AZX_DRIVER_NVIDIA] = 8,
@@ -2198,6 +2220,7 @@ static int azx_probe_continue(struct azx *chip)
         struct hdac_bus *bus = azx_bus(chip);
         struct pci_dev *pci = chip->pci;
         int dev = chip->dev_index;
+        int val;
         int err;
 
         hda->probe_continued = 1;
@@ -2278,7 +2301,21 @@ static int azx_probe_continue(struct azx *chip)
 
         chip->running = 1;
         azx_add_card_list(chip);
-        snd_hda_set_power_save(&chip->bus, power_save * 1000);
+
+        val = power_save;
+#ifdef CONFIG_PM
+        if (pm_blacklist) {
+                const struct snd_pci_quirk *q;
+
+                q = snd_pci_quirk_lookup(chip->pci, power_save_blacklist);
+                if (q && val) {
+                        dev_info(chip->card->dev, "device %04x:%04x is on the power_save blacklist, forcing power_save to 0\n",
+                                 q->subvendor, q->subdevice);
+                        val = 0;
+                }
+        }
+#endif /* CONFIG_PM */
+        snd_hda_set_power_save(&chip->bus, val * 1000);
         if (azx_has_pm_runtime(chip) || hda->use_vga_switcheroo)
                 pm_runtime_put_autosuspend(&pci->dev);
 
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 37e1cf8218ff..5b4dbcec6de8 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -957,6 +957,8 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
         SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC),
         SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC),
         SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK),
+        SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK),
+        SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK),
         SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
         SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC),
         SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO),
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index ce28f7ce64e6..9af301c6bba2 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4997,13 +4997,14 @@ static void alc_fixup_tpt470_dock(struct hda_codec *codec,
 
         if (action == HDA_FIXUP_ACT_PRE_PROBE) {
                 spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
+                snd_hda_apply_pincfgs(codec, pincfgs);
+        } else if (action == HDA_FIXUP_ACT_INIT) {
                 /* Enable DOCK device */
                 snd_hda_codec_write(codec, 0x17, 0,
                             AC_VERB_SET_CONFIG_DEFAULT_BYTES_3, 0);
                 /* Enable DOCK device */
                 snd_hda_codec_write(codec, 0x19, 0,
                             AC_VERB_SET_CONFIG_DEFAULT_BYTES_3, 0);
-                snd_hda_apply_pincfgs(codec, pincfgs);
         }
 }
 
@@ -5273,6 +5274,16 @@ static void alc298_fixup_speaker_volume(struct hda_codec *codec,
         }
 }
 
+/* disable DAC3 (0x06) selection on NID 0x17 as it has no volume amp control */
+static void alc295_fixup_disable_dac3(struct hda_codec *codec,
+                                      const struct hda_fixup *fix, int action)
+{
+        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+                hda_nid_t conn[2] = { 0x02, 0x03 };
+                snd_hda_override_conn_list(codec, 0x17, 2, conn);
+        }
+}
+
 /* Hook to update amp GPIO4 for automute */
 static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec,
                                           struct hda_jack_callback *jack)
@@ -5465,6 +5476,7 @@ enum {
         ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY,
         ALC255_FIXUP_DELL_SPK_NOISE,
         ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+        ALC295_FIXUP_DISABLE_DAC3,
         ALC280_FIXUP_HP_HEADSET_MIC,
         ALC221_FIXUP_HP_FRONT_MIC,
         ALC292_FIXUP_TPT460,
@@ -5479,10 +5491,12 @@ enum {
         ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE,
         ALC233_FIXUP_LENOVO_MULTI_CODECS,
         ALC294_FIXUP_LENOVO_MIC_LOCATION,
+        ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE,
         ALC700_FIXUP_INTEL_REFERENCE,
         ALC274_FIXUP_DELL_BIND_DACS,
         ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
         ALC298_FIXUP_TPT470_DOCK,
+        ALC255_FIXUP_DUMMY_LINEOUT_VERB,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -6197,6 +6211,10 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE,
         },
+        [ALC295_FIXUP_DISABLE_DAC3] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc295_fixup_disable_dac3,
+        },
         [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = {
                 .type = HDA_FIXUP_PINS,
                 .v.pins = (const struct hda_pintbl[]) {
@@ -6282,6 +6300,18 @@ static const struct hda_fixup alc269_fixups[] = {
                         { }
                 },
         },
+        [ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x16, 0x0101102f }, /* Rear Headset HP */
+                        { 0x19, 0x02a1913c }, /* use as Front headset mic, without its own jack detect */
+                        { 0x1a, 0x01a19030 }, /* Rear Headset MIC */
+                        { 0x1b, 0x02011020 },
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
+        },
         [ALC700_FIXUP_INTEL_REFERENCE] = {
                 .type = HDA_FIXUP_VERBS,
                 .v.verbs = (const struct hda_verb[]) {
@@ -6318,6 +6348,15 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE
         },
+        [ALC255_FIXUP_DUMMY_LINEOUT_VERB] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x14, 0x0201101f },
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -6366,10 +6405,13 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
         SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
         SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
+        SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3),
         SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+        SND_PCI_QUIRK(0x1028, 0x080c, "Dell WYSE", ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
         SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
         SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+        SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB),
         SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
@@ -6507,9 +6549,11 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x2245, "Thinkpad T470", ALC298_FIXUP_TPT470_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2246, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2247, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x2249, "Thinkpad", ALC292_FIXUP_TPT460),
         SND_PCI_QUIRK(0x17aa, 0x224b, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x225d, "Thinkpad T480", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
@@ -6871,7 +6915,7 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x12, 0x90a60120},
                 {0x14, 0x90170110},
                 {0x21, 0x0321101f}),
-        SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+        SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
                 {0x12, 0xb7a60130},
                 {0x14, 0x90170110},
                 {0x21, 0x04211020}),
diff --git a/sound/soc/amd/acp-pcm-dma.c b/sound/soc/amd/acp-pcm-dma.c
index c33a512283a4..9fb356db3ab2 100644
--- a/sound/soc/amd/acp-pcm-dma.c
+++ b/sound/soc/amd/acp-pcm-dma.c
@@ -579,13 +579,6 @@ static int acp_init(void __iomem *acp_mmio, u32 asic_type)
                 for (bank = 1; bank < 48; bank++)
                         acp_set_sram_bank_state(acp_mmio, bank, false);
         }
-
-        /* Stoney supports 16bit resolution */
-        if (asic_type == CHIP_STONEY) {
-                val = acp_reg_read(acp_mmio, mmACP_I2S_16BIT_RESOLUTION_EN);
-                val |= 0x03;
-                acp_reg_write(val, acp_mmio, mmACP_I2S_16BIT_RESOLUTION_EN);
-        }
         return 0;
 }
 
@@ -774,6 +767,7 @@ static int acp_dma_hw_params(struct snd_pcm_substream *substream,
 {
         int status;
         uint64_t size;
+        u32 val = 0;
         struct page *pg;
         struct snd_pcm_runtime *runtime;
         struct audio_substream_data *rtd;
@@ -786,6 +780,14 @@ static int acp_dma_hw_params(struct snd_pcm_substream *substream,
         if (WARN_ON(!rtd))
                 return -EINVAL;
 
+        if (adata->asic_type == CHIP_STONEY) {
+                val = acp_reg_read(adata->acp_mmio, mmACP_I2S_16BIT_RESOLUTION_EN);
+                if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+                        val |= ACP_I2S_SP_16BIT_RESOLUTION_EN;
+                else
+                        val |= ACP_I2S_MIC_16BIT_RESOLUTION_EN;
+                acp_reg_write(val, adata->acp_mmio, mmACP_I2S_16BIT_RESOLUTION_EN);
+        }
         size = params_buffer_bytes(params);
         status = snd_pcm_lib_malloc_pages(substream, size);
         if (status < 0)
diff --git a/sound/soc/amd/acp.h b/sound/soc/amd/acp.h
index ecb458935d1e..9293f179f272 100644
--- a/sound/soc/amd/acp.h
+++ b/sound/soc/amd/acp.h
@@ -70,6 +70,8 @@
 #define CAPTURE_END_DMA_DESCR_CH15 7
 
 #define mmACP_I2S_16BIT_RESOLUTION_EN       0x5209
+#define ACP_I2S_MIC_16BIT_RESOLUTION_EN 0x01
+#define ACP_I2S_SP_16BIT_RESOLUTION_EN  0x02
 enum acp_dma_priority_level {
         /* 0x0 Specifies the DMA channel is given normal priority */
         ACP_DMA_PRIORITY_LEVEL_NORMAL = 0x0,
diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
index 5672e516bec3..c1830ccd3bb8 100644
--- a/sound/soc/codecs/hdmi-codec.c
+++ b/sound/soc/codecs/hdmi-codec.c
@@ -798,12 +798,7 @@ static int hdmi_codec_probe(struct platform_device *pdev)
 
 static int hdmi_codec_remove(struct platform_device *pdev)
 {
-        struct device *dev = &pdev->dev;
-        struct hdmi_codec_priv *hcp;
-
-        hcp = dev_get_drvdata(dev);
-        kfree(hcp->chmap_info);
-        snd_soc_unregister_codec(dev);
+        snd_soc_unregister_codec(&pdev->dev);
 
         return 0;
 }
diff --git a/sound/soc/codecs/rt5651.c b/sound/soc/codecs/rt5651.c
index 831b297978a4..45a73049cf64 100644
--- a/sound/soc/codecs/rt5651.c
+++ b/sound/soc/codecs/rt5651.c
@@ -1722,6 +1722,7 @@ static const struct regmap_config rt5651_regmap = {
         .num_reg_defaults = ARRAY_SIZE(rt5651_reg),
         .ranges = rt5651_ranges,
         .num_ranges = ARRAY_SIZE(rt5651_ranges),
+        .use_single_rw = true,
 };
 
 #if defined(CONFIG_OF)
diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
index e1ab5537d27a..c5c76ab8ccf1 100644
--- a/sound/soc/codecs/sgtl5000.c
+++ b/sound/soc/codecs/sgtl5000.c
@@ -529,10 +529,15 @@ static const struct snd_kcontrol_new sgtl5000_snd_controls[] = {
 static int sgtl5000_digital_mute(struct snd_soc_dai *codec_dai, int mute)
 {
         struct snd_soc_codec *codec = codec_dai->codec;
-        u16 adcdac_ctrl = SGTL5000_DAC_MUTE_LEFT | SGTL5000_DAC_MUTE_RIGHT;
+        u16 i2s_pwr = SGTL5000_I2S_IN_POWERUP;
 
-        snd_soc_update_bits(codec, SGTL5000_CHIP_ADCDAC_CTRL,
-                        adcdac_ctrl, mute ? adcdac_ctrl : 0);
+        /*
+         * During 'digital mute' do not mute DAC
+         * because LINE_IN would be muted aswell. We want to mute
+         * only I2S block - this can be done by powering it off
+         */
+        snd_soc_update_bits(codec, SGTL5000_CHIP_DIG_POWER,
+                        i2s_pwr, mute ? 0 : i2s_pwr);
 
         return 0;
 }
@@ -871,15 +876,26 @@ static int sgtl5000_pcm_hw_params(struct snd_pcm_substream *substream,
 static int sgtl5000_set_bias_level(struct snd_soc_codec *codec,
                                    enum snd_soc_bias_level level)
 {
+        struct sgtl5000_priv *sgtl = snd_soc_codec_get_drvdata(codec);
+        int ret;
+
         switch (level) {
         case SND_SOC_BIAS_ON:
         case SND_SOC_BIAS_PREPARE:
         case SND_SOC_BIAS_STANDBY:
+                regcache_cache_only(sgtl->regmap, false);
+                ret = regcache_sync(sgtl->regmap);
+                if (ret) {
+                        regcache_cache_only(sgtl->regmap, true);
+                        return ret;
+                }
+
                 snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER,
                                     SGTL5000_REFTOP_POWERUP,
                                     SGTL5000_REFTOP_POWERUP);
                 break;
         case SND_SOC_BIAS_OFF:
+                regcache_cache_only(sgtl->regmap, true);
                 snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER,
                                     SGTL5000_REFTOP_POWERUP, 0);
                 break;
@@ -1237,6 +1253,10 @@ static int sgtl5000_probe(struct snd_soc_codec *codec)
          */
         snd_soc_write(codec, SGTL5000_DAP_CTRL, 0);
 
+        /* Unmute DAC after start */
+        snd_soc_update_bits(codec, SGTL5000_CHIP_ADCDAC_CTRL,
+                SGTL5000_DAC_MUTE_LEFT | SGTL5000_DAC_MUTE_RIGHT, 0);
+
         return 0;
 
 err:
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index 66e32f5d2917..989d093abda7 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -1204,12 +1204,14 @@ static int wmfw_add_ctl(struct wm_adsp *dsp, struct wm_coeff_ctl *ctl)
                 kcontrol->put = wm_coeff_put_acked;
                 break;
         default:
-                kcontrol->get = wm_coeff_get;
-                kcontrol->put = wm_coeff_put;
-
-                ctl->bytes_ext.max = ctl->len;
-                ctl->bytes_ext.get = wm_coeff_tlv_get;
-                ctl->bytes_ext.put = wm_coeff_tlv_put;
+                if (kcontrol->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) {
+                        ctl->bytes_ext.max = ctl->len;
+                        ctl->bytes_ext.get = wm_coeff_tlv_get;
+                        ctl->bytes_ext.put = wm_coeff_tlv_put;
+                } else {
+                        kcontrol->get = wm_coeff_get;
+                        kcontrol->put = wm_coeff_put;
+                }
                 break;
         }
 
diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c
index dca1143c1150..a4aa931ebfae 100644
--- a/sound/soc/sunxi/sun4i-i2s.c
+++ b/sound/soc/sunxi/sun4i-i2s.c
@@ -104,7 +104,7 @@
 
 #define SUN8I_I2S_CHAN_CFG_REG          0x30
 #define SUN8I_I2S_CHAN_CFG_RX_SLOT_NUM_MASK     GENMASK(6, 4)
-#define SUN8I_I2S_CHAN_CFG_RX_SLOT_NUM(chan)    (chan - 1)
+#define SUN8I_I2S_CHAN_CFG_RX_SLOT_NUM(chan)    ((chan - 1) << 4)
 #define SUN8I_I2S_CHAN_CFG_TX_SLOT_NUM_MASK     GENMASK(2, 0)
 #define SUN8I_I2S_CHAN_CFG_TX_SLOT_NUM(chan)    (chan - 1)
 
diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index 50252046b01d..754e632a27bd 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -3325,4 +3325,51 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
         }
 },
 
+{
+        /*
+         * Bower's & Wilkins PX headphones only support the 48 kHz sample rate
+         * even though it advertises more. The capture interface doesn't work
+         * even on windows.
+         */
+        USB_DEVICE(0x19b5, 0x0021),
+        .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+                .ifnum = QUIRK_ANY_INTERFACE,
+                .type = QUIRK_COMPOSITE,
+                .data = (const struct snd_usb_audio_quirk[]) {
+                        {
+                                .ifnum = 0,
+                                .type = QUIRK_AUDIO_STANDARD_MIXER,
+                        },
+                        /* Capture */
+                        {
+                                .ifnum = 1,
+                                .type = QUIRK_IGNORE_INTERFACE,
+                        },
+                        /* Playback */
+                        {
+                                .ifnum = 2,
+                                .type = QUIRK_AUDIO_FIXED_ENDPOINT,
+                                .data = &(const struct audioformat) {
+                                        .formats = SNDRV_PCM_FMTBIT_S16_LE,
+                                        .channels = 2,
+                                        .iface = 2,
+                                        .altsetting = 1,
+                                        .altset_idx = 1,
+                                        .attributes = UAC_EP_CS_ATTR_FILL_MAX |
+                                                UAC_EP_CS_ATTR_SAMPLE_RATE,
+                                        .endpoint = 0x03,
+                                        .ep_attr = USB_ENDPOINT_XFER_ISOC,
+                                        .rates = SNDRV_PCM_RATE_48000,
+                                        .rate_min = 48000,
+                                        .rate_max = 48000,
+                                        .nr_rates = 1,
+                                        .rate_table = (unsigned int[]) {
+                                                48000
+                                        }
+                                }
+                        },
+                }
+        }
+},
+
 #undef USB_DEVICE_VENDOR_SPEC
diff --git a/sound/x86/intel_hdmi_audio.c b/sound/x86/intel_hdmi_audio.c
index a0951505c7f5..4ed9d0c41843 100644
--- a/sound/x86/intel_hdmi_audio.c
+++ b/sound/x86/intel_hdmi_audio.c
@@ -50,6 +50,7 @@
 /*standard module options for ALSA. This module supports only one card*/
 static int hdmi_card_index = SNDRV_DEFAULT_IDX1;
 static char *hdmi_card_id = SNDRV_DEFAULT_STR1;
+static bool single_port;
 
 module_param_named(index, hdmi_card_index, int, 0444);
 MODULE_PARM_DESC(index,
@@ -57,6 +58,9 @@ MODULE_PARM_DESC(index,
 module_param_named(id, hdmi_card_id, charp, 0444);
 MODULE_PARM_DESC(id,
                 "ID string for INTEL Intel HDMI Audio controller.");
+module_param(single_port, bool, 0444);
+MODULE_PARM_DESC(single_port,
+                "Single-port mode (for compatibility)");
 
 /*
  * ELD SA bits in the CEA Speaker Allocation data block
@@ -1579,7 +1583,11 @@ static irqreturn_t display_pipe_interrupt_handler(int irq, void *dev_id)
 static void notify_audio_lpe(struct platform_device *pdev, int port)
 {
         struct snd_intelhad_card *card_ctx = platform_get_drvdata(pdev);
-        struct snd_intelhad *ctx = &card_ctx->pcm_ctx[port];
+        struct snd_intelhad *ctx;
+
+        ctx = &card_ctx->pcm_ctx[single_port ? 0 : port];
+        if (single_port)
+                ctx->port = port;
 
         schedule_work(&ctx->hdmi_audio_wq);
 }
@@ -1743,6 +1751,7 @@ static int hdmi_lpe_audio_probe(struct platform_device *pdev)
 {
         struct snd_card *card;
         struct snd_intelhad_card *card_ctx;
+        struct snd_intelhad *ctx;
         struct snd_pcm *pcm;
         struct intel_hdmi_lpe_audio_pdata *pdata;
         int irq;
@@ -1787,6 +1796,21 @@ static int hdmi_lpe_audio_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, card_ctx);
 
+        card_ctx->num_pipes = pdata->num_pipes;
+        card_ctx->num_ports = single_port ? 1 : pdata->num_ports;
+
+        for_each_port(card_ctx, port) {
+                ctx = &card_ctx->pcm_ctx[port];
+                ctx->card_ctx = card_ctx;
+                ctx->dev = card_ctx->dev;
+                ctx->port = single_port ? -1 : port;
+                ctx->pipe = -1;
+
+                spin_lock_init(&ctx->had_spinlock);
+                mutex_init(&ctx->mutex);
+                INIT_WORK(&ctx->hdmi_audio_wq, had_audio_wq);
+        }
+
         dev_dbg(&pdev->dev, "%s: mmio_start = 0x%x, mmio_end = 0x%x\n",
                 __func__, (unsigned int)res_mmio->start,
                 (unsigned int)res_mmio->end);
@@ -1816,19 +1840,12 @@ static int hdmi_lpe_audio_probe(struct platform_device *pdev)
         init_channel_allocations();
 
         card_ctx->num_pipes = pdata->num_pipes;
-        card_ctx->num_ports = pdata->num_ports;
+        card_ctx->num_ports = single_port ? 1 : pdata->num_ports;
 
         for_each_port(card_ctx, port) {
-                struct snd_intelhad *ctx = &card_ctx->pcm_ctx[port];
                 int i;
 
-                ctx->card_ctx = card_ctx;
-                ctx->dev = card_ctx->dev;
-                ctx->port = port;
-                ctx->pipe = -1;
-
-                INIT_WORK(&ctx->hdmi_audio_wq, had_audio_wq);
-
+                ctx = &card_ctx->pcm_ctx[port];
                 ret = snd_pcm_new(card, INTEL_HAD, port, MAX_PB_STREAMS,
                                   MAX_CAP_STREAMS, &pcm);
                 if (ret)
diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
index 0dfe4d3f74e2..f41079da38c5 100644
--- a/tools/arch/x86/include/asm/cpufeatures.h
+++ b/tools/arch/x86/include/asm/cpufeatures.h
@@ -213,6 +213,7 @@
 #define X86_FEATURE_SEV                 ( 7*32+20) /* AMD Secure Encrypted Virtualization */
 
 #define X86_FEATURE_USE_IBPB            ( 7*32+21) /* "" Indirect Branch Prediction Barrier enabled */
+#define X86_FEATURE_USE_IBRS_FW         ( 7*32+22) /* "" Use IBRS during runtime firmware calls */
 
 /* Virtualization flags: Linux defined, word 8 */
 #define X86_FEATURE_TPR_SHADOW          ( 8*32+ 0) /* Intel TPR Shadow */
diff --git a/tools/include/uapi/linux/kvm.h b/tools/include/uapi/linux/kvm.h
index 0fb5ef939732..7b26d4b0b052 100644
--- a/tools/include/uapi/linux/kvm.h
+++ b/tools/include/uapi/linux/kvm.h
@@ -761,6 +761,7 @@ struct kvm_ppc_resize_hpt {
 #define KVM_TRACE_PAUSE           __KVM_DEPRECATED_MAIN_0x07
 #define KVM_TRACE_DISABLE         __KVM_DEPRECATED_MAIN_0x08
 #define KVM_GET_EMULATED_CPUID    _IOWR(KVMIO, 0x09, struct kvm_cpuid2)
+#define KVM_GET_MSR_FEATURE_INDEX_LIST    _IOWR(KVMIO, 0x0a, struct kvm_msr_list)
 
 /*
  * Extension capability list.
@@ -934,6 +935,7 @@ struct kvm_ppc_resize_hpt {
 #define KVM_CAP_S390_AIS_MIGRATION 150
 #define KVM_CAP_PPC_GET_CPU_CHAR 151
 #define KVM_CAP_S390_BPB 152
+#define KVM_CAP_GET_MSR_FEATURES 153
 
 #ifdef KVM_CAP_IRQ_ROUTING
 
diff --git a/tools/kvm/kvm_stat/kvm_stat b/tools/kvm/kvm_stat/kvm_stat
index a5684d0968b4..5898c22ba310 100755
--- a/tools/kvm/kvm_stat/kvm_stat
+++ b/tools/kvm/kvm_stat/kvm_stat
@@ -33,7 +33,7 @@ import resource
 import struct
 import re
 import subprocess
-from collections import defaultdict
+from collections import defaultdict, namedtuple
 
 VMX_EXIT_REASONS = {
     'EXCEPTION_NMI':        0,
@@ -228,6 +228,7 @@ IOCTL_NUMBERS = {
 }
 
 ENCODING = locale.getpreferredencoding(False)
+TRACE_FILTER = re.compile(r'^[^\(]*$')
 
 
 class Arch(object):
@@ -260,6 +261,11 @@ class Arch(object):
                     return ArchX86(SVM_EXIT_REASONS)
                 return
 
+    def tracepoint_is_child(self, field):
+        if (TRACE_FILTER.match(field)):
+            return None
+        return field.split('(', 1)[0]
+
 
 class ArchX86(Arch):
     def __init__(self, exit_reasons):
@@ -267,6 +273,10 @@ class ArchX86(Arch):
         self.ioctl_numbers = IOCTL_NUMBERS
         self.exit_reasons = exit_reasons
 
+    def debugfs_is_child(self, field):
+        """ Returns name of parent if 'field' is a child, None otherwise """
+        return None
+
 
 class ArchPPC(Arch):
     def __init__(self):
@@ -282,6 +292,10 @@ class ArchPPC(Arch):
         self.ioctl_numbers['SET_FILTER'] = 0x80002406 | char_ptr_size << 16
         self.exit_reasons = {}
 
+    def debugfs_is_child(self, field):
+        """ Returns name of parent if 'field' is a child, None otherwise """
+        return None
+
 
 class ArchA64(Arch):
     def __init__(self):
@@ -289,6 +303,10 @@ class ArchA64(Arch):
         self.ioctl_numbers = IOCTL_NUMBERS
         self.exit_reasons = AARCH64_EXIT_REASONS
 
+    def debugfs_is_child(self, field):
+        """ Returns name of parent if 'field' is a child, None otherwise """
+        return None
+
 
 class ArchS390(Arch):
     def __init__(self):
@@ -296,6 +314,12 @@ class ArchS390(Arch):
         self.ioctl_numbers = IOCTL_NUMBERS
         self.exit_reasons = None
 
+    def debugfs_is_child(self, field):
+        """ Returns name of parent if 'field' is a child, None otherwise """
+        if field.startswith('instruction_'):
+            return 'exit_instruction'
+
+
 ARCH = Arch.get_arch()
 
 
@@ -331,9 +355,6 @@ class perf_event_attr(ctypes.Structure):
 PERF_TYPE_TRACEPOINT = 2
 PERF_FORMAT_GROUP = 1 << 3
 
-PATH_DEBUGFS_TRACING = '/sys/kernel/debug/tracing'
-PATH_DEBUGFS_KVM = '/sys/kernel/debug/kvm'
-
 
 class Group(object):
     """Represents a perf event group."""
@@ -376,8 +397,8 @@ class Event(object):
         self.syscall = self.libc.syscall
         self.name = name
         self.fd = None
-        self.setup_event(group, trace_cpu, trace_pid, trace_point,
-                         trace_filter, trace_set)
+        self._setup_event(group, trace_cpu, trace_pid, trace_point,
+                          trace_filter, trace_set)
 
     def __del__(self):
         """Closes the event's file descriptor.
@@ -390,7 +411,7 @@ class Event(object):
         if self.fd:
             os.close(self.fd)
 
-    def perf_event_open(self, attr, pid, cpu, group_fd, flags):
+    def _perf_event_open(self, attr, pid, cpu, group_fd, flags):
         """Wrapper for the sys_perf_evt_open() syscall.
 
         Used to set up performance events, returns a file descriptor or -1
@@ -409,7 +430,7 @@ class Event(object):
                             ctypes.c_int(pid), ctypes.c_int(cpu),
                             ctypes.c_int(group_fd), ctypes.c_long(flags))
 
-    def setup_event_attribute(self, trace_set, trace_point):
+    def _setup_event_attribute(self, trace_set, trace_point):
         """Returns an initialized ctype perf_event_attr struct."""
 
         id_path = os.path.join(PATH_DEBUGFS_TRACING, 'events', trace_set,
@@ -419,8 +440,8 @@ class Event(object):
         event_attr.config = int(open(id_path).read())
         return event_attr
 
-    def setup_event(self, group, trace_cpu, trace_pid, trace_point,
-                    trace_filter, trace_set):
+    def _setup_event(self, group, trace_cpu, trace_pid, trace_point,
+                     trace_filter, trace_set):
         """Sets up the perf event in Linux.
 
         Issues the syscall to register the event in the kernel and
@@ -428,7 +449,7 @@ class Event(object):
 
         """
 
-        event_attr = self.setup_event_attribute(trace_set, trace_point)
+        event_attr = self._setup_event_attribute(trace_set, trace_point)
 
         # First event will be group leader.
         group_leader = -1
@@ -437,8 +458,8 @@ class Event(object):
         if group.events:
             group_leader = group.events[0].fd
 
-        fd = self.perf_event_open(event_attr, trace_pid,
-                                  trace_cpu, group_leader, 0)
+        fd = self._perf_event_open(event_attr, trace_pid,
+                                   trace_cpu, group_leader, 0)
         if fd == -1:
             err = ctypes.get_errno()
             raise OSError(err, os.strerror(err),
@@ -475,6 +496,10 @@ class Event(object):
 
 class Provider(object):
     """Encapsulates functionalities used by all providers."""
+    def __init__(self, pid):
+        self.child_events = False
+        self.pid = pid
+
     @staticmethod
     def is_field_wanted(fields_filter, field):
         """Indicate whether field is valid according to fields_filter."""
@@ -500,12 +525,12 @@ class TracepointProvider(Provider):
     """
     def __init__(self, pid, fields_filter):
         self.group_leaders = []
-        self.filters = self.get_filters()
+        self.filters = self._get_filters()
         self.update_fields(fields_filter)
-        self.pid = pid
+        super(TracepointProvider, self).__init__(pid)
 
     @staticmethod
-    def get_filters():
+    def _get_filters():
         """Returns a dict of trace events, their filter ids and
         the values that can be filtered.
 
@@ -521,8 +546,8 @@ class TracepointProvider(Provider):
             filters['kvm_exit'] = ('exit_reason', ARCH.exit_reasons)
         return filters
 
-    def get_available_fields(self):
-        """Returns a list of available event's of format 'event name(filter
+    def _get_available_fields(self):
+        """Returns a list of available events of format 'event name(filter
         name)'.
 
         All available events have directories under
@@ -549,11 +574,12 @@ class TracepointProvider(Provider):
 
     def update_fields(self, fields_filter):
         """Refresh fields, applying fields_filter"""
-        self.fields = [field for field in self.get_available_fields()
-                       if self.is_field_wanted(fields_filter, field)]
+        self.fields = [field for field in self._get_available_fields()
+                       if self.is_field_wanted(fields_filter, field) or
+                       ARCH.tracepoint_is_child(field)]
 
     @staticmethod
-    def get_online_cpus():
+    def _get_online_cpus():
         """Returns a list of cpu id integers."""
         def parse_int_list(list_string):
             """Returns an int list from a string of comma separated integers and
@@ -575,17 +601,17 @@ class TracepointProvider(Provider):
             cpu_string = cpu_list.readline()
             return parse_int_list(cpu_string)
 
-    def setup_traces(self):
+    def _setup_traces(self):
         """Creates all event and group objects needed to be able to retrieve
         data."""
-        fields = self.get_available_fields()
+        fields = self._get_available_fields()
         if self._pid > 0:
             # Fetch list of all threads of the monitored pid, as qemu
             # starts a thread for each vcpu.
             path = os.path.join('/proc', str(self._pid), 'task')
             groupids = self.walkdir(path)[1]
         else:
-            groupids = self.get_online_cpus()
+            groupids = self._get_online_cpus()
 
         # The constant is needed as a buffer for python libs, std
         # streams and other files that the script opens.
@@ -663,7 +689,7 @@ class TracepointProvider(Provider):
         # The garbage collector will get rid of all Event/Group
         # objects and open files after removing the references.
         self.group_leaders = []
-        self.setup_traces()
+        self._setup_traces()
         self.fields = self._fields
 
     def read(self, by_guest=0):
@@ -671,8 +697,12 @@ class TracepointProvider(Provider):
         ret = defaultdict(int)
         for group in self.group_leaders:
             for name, val in group.read().items():
-                if name in self._fields:
-                    ret[name] += val
+                if name not in self._fields:
+                    continue
+                parent = ARCH.tracepoint_is_child(name)
+                if parent:
+                    name += ' ' + parent
+                ret[name] += val
         return ret
 
     def reset(self):
@@ -690,11 +720,11 @@ class DebugfsProvider(Provider):
         self._baseline = {}
         self.do_read = True
         self.paths = []
-        self.pid = pid
+        super(DebugfsProvider, self).__init__(pid)
         if include_past:
-            self.restore()
+            self._restore()
 
-    def get_available_fields(self):
+    def _get_available_fields(self):
         """"Returns a list of available fields.
 
         The fields are all available KVM debugfs files
@@ -704,8 +734,9 @@ class DebugfsProvider(Provider):
 
     def update_fields(self, fields_filter):
         """Refresh fields, applying fields_filter"""
-        self._fields = [field for field in self.get_available_fields()
-                        if self.is_field_wanted(fields_filter, field)]
+        self._fields = [field for field in self._get_available_fields()
+                        if self.is_field_wanted(fields_filter, field) or
+                        ARCH.debugfs_is_child(field)]
 
     @property
     def fields(self):
@@ -758,7 +789,7 @@ class DebugfsProvider(Provider):
                     paths.append(dir)
         for path in paths:
             for field in self._fields:
-                value = self.read_field(field, path)
+                value = self._read_field(field, path)
                 key = path + field
                 if reset == 1:
                     self._baseline[key] = value
@@ -766,20 +797,21 @@ class DebugfsProvider(Provider):
                     self._baseline[key] = 0
                 if self._baseline.get(key, -1) == -1:
                     self._baseline[key] = value
-                increment = (results.get(field, 0) + value -
-                             self._baseline.get(key, 0))
-                if by_guest:
-                    pid = key.split('-')[0]
-                    if pid in results:
-                        results[pid] += increment
-                    else:
-                        results[pid] = increment
+                parent = ARCH.debugfs_is_child(field)
+                if parent:
+                    field = field + ' ' + parent
+                else:
+                    if by_guest:
+                        field = key.split('-')[0]    # set 'field' to 'pid'
+                increment = value - self._baseline.get(key, 0)
+                if field in results:
+                    results[field] += increment
                 else:
                     results[field] = increment
 
         return results
 
-    def read_field(self, field, path):
+    def _read_field(self, field, path):
         """Returns the value of a single field from a specific VM."""
         try:
             return int(open(os.path.join(PATH_DEBUGFS_KVM,
@@ -794,12 +826,15 @@ class DebugfsProvider(Provider):
         self._baseline = {}
         self.read(1)
 
-    def restore(self):
+    def _restore(self):
         """Reset field counters"""
         self._baseline = {}
         self.read(2)
 
 
+EventStat = namedtuple('EventStat', ['value', 'delta'])
+
+
 class Stats(object):
     """Manages the data providers and the data they provide.
 
@@ -808,13 +843,13 @@ class Stats(object):
 
     """
     def __init__(self, options):
-        self.providers = self.get_providers(options)
+        self.providers = self._get_providers(options)
         self._pid_filter = options.pid
         self._fields_filter = options.fields
         self.values = {}
+        self._child_events = False
 
-    @staticmethod
-    def get_providers(options):
+    def _get_providers(self, options):
         """Returns a list of data providers depending on the passed options."""
         providers = []
 
@@ -826,7 +861,7 @@ class Stats(object):
 
         return providers
 
-    def update_provider_filters(self):
+    def _update_provider_filters(self):
         """Propagates fields filters to providers."""
         # As we reset the counters when updating the fields we can
         # also clear the cache of old values.
@@ -847,7 +882,7 @@ class Stats(object):
     def fields_filter(self, fields_filter):
         if fields_filter != self._fields_filter:
             self._fields_filter = fields_filter
-            self.update_provider_filters()
+            self._update_provider_filters()
 
     @property
     def pid_filter(self):
@@ -861,16 +896,33 @@ class Stats(object):
             for provider in self.providers:
                 provider.pid = self._pid_filter
 
+    @property
+    def child_events(self):
+        return self._child_events
+
+    @child_events.setter
+    def child_events(self, val):
+        self._child_events = val
+        for provider in self.providers:
+            provider.child_events = val
+
     def get(self, by_guest=0):
         """Returns a dict with field -> (value, delta to last value) of all
-        provider data."""
+        provider data.
+        Key formats:
+          * plain: 'key' is event name
+          * child-parent: 'key' is in format '<child> <parent>'
+          * pid: 'key' is the pid of the guest, and the record contains the
+               aggregated event data
+        These formats are generated by the providers, and handled in class TUI.
+        """
         for provider in self.providers:
             new = provider.read(by_guest=by_guest)
-            for key in new if by_guest else provider.fields:
-                oldval = self.values.get(key, (0, 0))[0]
+            for key in new:
+                oldval = self.values.get(key, EventStat(0, 0)).value
                 newval = new.get(key, 0)
                 newdelta = newval - oldval
-                self.values[key] = (newval, newdelta)
+                self.values[key] = EventStat(newval, newdelta)
         return self.values
 
     def toggle_display_guests(self, to_pid):
@@ -899,10 +951,10 @@ class Stats(object):
         self.get(to_pid)
         return 0
 
+
 DELAY_DEFAULT = 3.0
 MAX_GUEST_NAME_LEN = 48
 MAX_REGEX_LEN = 44
-DEFAULT_REGEX = r'^[^\(]*$'
 SORT_DEFAULT = 0
 
 
@@ -969,7 +1021,7 @@ class Tui(object):
 
         return res
 
-    def print_all_gnames(self, row):
+    def _print_all_gnames(self, row):
         """Print a list of all running guests along with their pids."""
         self.screen.addstr(row, 2, '%8s  %-60s' %
                            ('Pid', 'Guest Name (fuzzy list, might be '
@@ -1032,19 +1084,13 @@ class Tui(object):
 
         return name
 
-    def update_drilldown(self):
-        """Sets or removes a filter that only allows fields without braces."""
-        if not self.stats.fields_filter:
-            self.stats.fields_filter = DEFAULT_REGEX
-
-        elif self.stats.fields_filter == DEFAULT_REGEX:
-            self.stats.fields_filter = None
-
-    def update_pid(self, pid):
+    def _update_pid(self, pid):
         """Propagates pid selection to stats object."""
+        self.screen.addstr(4, 1, 'Updating pid filter...')
+        self.screen.refresh()
         self.stats.pid_filter = pid
 
-    def refresh_header(self, pid=None):
+    def _refresh_header(self, pid=None):
         """Refreshes the header."""
         if pid is None:
             pid = self.stats.pid_filter
@@ -1059,8 +1105,7 @@ class Tui(object):
                                .format(pid, gname), curses.A_BOLD)
         else:
             self.screen.addstr(0, 0, 'kvm statistics - summary', curses.A_BOLD)
-        if self.stats.fields_filter and self.stats.fields_filter \
-           != DEFAULT_REGEX:
+        if self.stats.fields_filter:
             regex = self.stats.fields_filter
             if len(regex) > MAX_REGEX_LEN:
                 regex = regex[:MAX_REGEX_LEN] + '...'
@@ -1075,56 +1120,99 @@ class Tui(object):
         self.screen.addstr(4, 1, 'Collecting data...')
         self.screen.refresh()
 
-    def refresh_body(self, sleeptime):
+    def _refresh_body(self, sleeptime):
+        def is_child_field(field):
+            return field.find('(') != -1
+
+        def insert_child(sorted_items, child, values, parent):
+            num = len(sorted_items)
+            for i in range(0, num):
+                # only add child if parent is present
+                if parent.startswith(sorted_items[i][0]):
+                    sorted_items.insert(i + 1, ('  ' + child, values))
+
+        def get_sorted_events(self, stats):
+            """ separate parent and child events """
+            if self._sorting == SORT_DEFAULT:
+                def sortkey((_k, v)):
+                    # sort by (delta value, overall value)
+                    return (v.delta, v.value)
+            else:
+                def sortkey((_k, v)):
+                    # sort by overall value
+                    return v.value
+
+            childs = []
+            sorted_items = []
+            # we can't rule out child events to appear prior to parents even
+            # when sorted - separate out all children first, and add in later
+            for key, values in sorted(stats.items(), key=sortkey,
+                                      reverse=True):
+                if values == (0, 0):
+                    continue
+                if key.find(' ') != -1:
+                    if not self.stats.child_events:
+                        continue
+                    childs.insert(0, (key, values))
+                else:
+                    sorted_items.append((key, values))
+            if self.stats.child_events:
+                for key, values in childs:
+                    (child, parent) = key.split(' ')
+                    insert_child(sorted_items, child, values, parent)
+
+            return sorted_items
+
         row = 3
         self.screen.move(row, 0)
         self.screen.clrtobot()
         stats = self.stats.get(self._display_guests)
-
-        def sortCurAvg(x):
-            # sort by current events if available
-            if stats[x][1]:
-                return (-stats[x][1], -stats[x][0])
+        total = 0.
+        ctotal = 0.
+        for key, values in stats.items():
+            if self._display_guests:
+                if self.get_gname_from_pid(key):
+                    total += values.value
+                continue
+            if not key.find(' ') != -1:
+                total += values.value
             else:
-                return (0, -stats[x][0])
+                ctotal += values.value
+        if total == 0.:
+            # we don't have any fields, or all non-child events are filtered
+            total = ctotal
 
-        def sortTotal(x):
-            # sort by totals
-            return (0, -stats[x][0])
-        total = 0.
-        for key in stats.keys():
-            if key.find('(') is -1:
-                total += stats[key][0]
-        if self._sorting == SORT_DEFAULT:
-            sortkey = sortCurAvg
-        else:
-            sortkey = sortTotal
+        # print events
         tavg = 0
-        for key in sorted(stats.keys(), key=sortkey):
-            if row >= self.screen.getmaxyx()[0] - 1:
-                break
-            values = stats[key]
-            if not values[0] and not values[1]:
+        tcur = 0
+        for key, values in get_sorted_events(self, stats):
+            if row >= self.screen.getmaxyx()[0] - 1 or values == (0, 0):
                 break
-            if values[0] is not None:
-                cur = int(round(values[1] / sleeptime)) if values[1] else ''
-                if self._display_guests:
-                    key = self.get_gname_from_pid(key)
-                self.screen.addstr(row, 1, '%-40s %10d%7.1f %8s' %
-                                   (key, values[0], values[0] * 100 / total,
-                                    cur))
-                if cur is not '' and key.find('(') is -1:
-                    tavg += cur
+            if self._display_guests:
+                key = self.get_gname_from_pid(key)
+                if not key:
+                    continue
+            cur = int(round(values.delta / sleeptime)) if values.delta else ''
+            if key[0] != ' ':
+                if values.delta:
+                    tcur += values.delta
+                ptotal = values.value
+                ltotal = total
+            else:
+                ltotal = ptotal
+            self.screen.addstr(row, 1, '%-40s %10d%7.1f %8s' % (key,
+                               values.value,
+                               values.value * 100 / float(ltotal), cur))
             row += 1
         if row == 3:
             self.screen.addstr(4, 1, 'No matching events reported yet')
-        else:
+        if row > 4:
+            tavg = int(round(tcur / sleeptime)) if tcur > 0 else ''
             self.screen.addstr(row, 1, '%-40s %10d        %8s' %
-                               ('Total', total, tavg if tavg else ''),
-                               curses.A_BOLD)
+                               ('Total', total, tavg), curses.A_BOLD)
         self.screen.refresh()
 
-    def show_msg(self, text):
+    def _show_msg(self, text):
         """Display message centered text and exit on key press"""
         hint = 'Press any key to continue'
         curses.cbreak()
@@ -1139,16 +1227,16 @@ class Tui(object):
                            curses.A_STANDOUT)
         self.screen.getkey()
 
-    def show_help_interactive(self):
+    def _show_help_interactive(self):
         """Display help with list of interactive commands"""
         msg = ('   b     toggle events by guests (debugfs only, honors'
                ' filters)',
                '   c     clear filter',
                '   f     filter by regular expression',
-               '   g     filter by guest name',
+               '   g     filter by guest name/PID',
                '   h     display interactive commands reference',
                '   o     toggle sorting order (Total vs CurAvg/s)',
-               '   p     filter by PID',
+               '   p     filter by guest name/PID',
                '   q     quit',
                '   r     reset stats',
                '   s     set update interval',
@@ -1165,14 +1253,15 @@ class Tui(object):
             self.screen.addstr(row, 0, line)
             row += 1
         self.screen.getkey()
-        self.refresh_header()
+        self._refresh_header()
 
-    def show_filter_selection(self):
+    def _show_filter_selection(self):
         """Draws filter selection mask.
 
         Asks for a valid regex and sets the fields filter accordingly.
 
         """
+        msg = ''
         while True:
             self.screen.erase()
             self.screen.addstr(0, 0,
@@ -1181,61 +1270,25 @@ class Tui(object):
             self.screen.addstr(2, 0,
                                "Current regex: {0}"
                                .format(self.stats.fields_filter))
+            self.screen.addstr(5, 0, msg)
             self.screen.addstr(3, 0, "New regex: ")
             curses.echo()
             regex = self.screen.getstr().decode(ENCODING)
             curses.noecho()
             if len(regex) == 0:
-                self.stats.fields_filter = DEFAULT_REGEX
-                self.refresh_header()
+                self.stats.fields_filter = ''
+                self._refresh_header()
                 return
             try:
                 re.compile(regex)
                 self.stats.fields_filter = regex
-                self.refresh_header()
+                self._refresh_header()
                 return
             except re.error:
+                msg = '"' + regex + '": Not a valid regular expression'
                 continue
 
-    def show_vm_selection_by_pid(self):
-        """Draws PID selection mask.
-
-        Asks for a pid until a valid pid or 0 has been entered.
-
-        """
-        msg = ''
-        while True:
-            self.screen.erase()
-            self.screen.addstr(0, 0,
-                               'Show statistics for specific pid.',
-                               curses.A_BOLD)
-            self.screen.addstr(1, 0,
-                               'This might limit the shown data to the trace '
-                               'statistics.')
-            self.screen.addstr(5, 0, msg)
-            self.print_all_gnames(7)
-
-            curses.echo()
-            self.screen.addstr(3, 0, "Pid [0 or pid]: ")
-            pid = self.screen.getstr().decode(ENCODING)
-            curses.noecho()
-
-            try:
-                if len(pid) > 0:
-                    pid = int(pid)
-                    if pid != 0 and not os.path.isdir(os.path.join('/proc/',
-                                                                   str(pid))):
-                        msg = '"' + str(pid) + '": Not a running process'
-                        continue
-                else:
-                    pid = 0
-                self.refresh_header(pid)
-                self.update_pid(pid)
-                break
-            except ValueError:
-                msg = '"' + str(pid) + '": Not a valid pid'
-
-    def show_set_update_interval(self):
+    def _show_set_update_interval(self):
         """Draws update interval selection mask."""
         msg = ''
         while True:
@@ -1265,60 +1318,67 @@ class Tui(object):
 
             except ValueError:
                 msg = '"' + str(val) + '": Invalid value'
-        self.refresh_header()
+        self._refresh_header()
 
-    def show_vm_selection_by_guest_name(self):
+    def _show_vm_selection_by_guest(self):
         """Draws guest selection mask.
 
-        Asks for a guest name until a valid guest name or '' is entered.
+        Asks for a guest name or pid until a valid guest name or '' is entered.
 
         """
         msg = ''
         while True:
             self.screen.erase()
             self.screen.addstr(0, 0,
-                               'Show statistics for specific guest.',
+                               'Show statistics for specific guest or pid.',
                                curses.A_BOLD)
             self.screen.addstr(1, 0,
                                'This might limit the shown data to the trace '
                                'statistics.')
             self.screen.addstr(5, 0, msg)
-            self.print_all_gnames(7)
+            self._print_all_gnames(7)
             curses.echo()
-            self.screen.addstr(3, 0, "Guest [ENTER or guest]: ")
-            gname = self.screen.getstr().decode(ENCODING)
+            curses.curs_set(1)
+            self.screen.addstr(3, 0, "Guest or pid [ENTER exits]: ")
+            guest = self.screen.getstr().decode(ENCODING)
             curses.noecho()
 
-            if not gname:
-                self.refresh_header(0)
-                self.update_pid(0)
+            pid = 0
+            if not guest or guest == '0':
                 break
-            else:
-                pids = []
-                try:
-                    pids = self.get_pid_from_gname(gname)
-                except:
-                    msg = '"' + gname + '": Internal error while searching, ' \
-                          'use pid filter instead'
-                    continue
-                if len(pids) == 0:
-                    msg = '"' + gname + '": Not an active guest'
+            if guest.isdigit():
+                if not os.path.isdir(os.path.join('/proc/', guest)):
+                    msg = '"' + guest + '": Not a running process'
                     continue
-                if len(pids) > 1:
-                    msg = '"' + gname + '": Multiple matches found, use pid ' \
-                          'filter instead'
-                    continue
-                self.refresh_header(pids[0])
-                self.update_pid(pids[0])
+                pid = int(guest)
                 break
+            pids = []
+            try:
+                pids = self.get_pid_from_gname(guest)
+            except:
+                msg = '"' + guest + '": Internal error while searching, ' \
+                      'use pid filter instead'
+                continue
+            if len(pids) == 0:
+                msg = '"' + guest + '": Not an active guest'
+                continue
+            if len(pids) > 1:
+                msg = '"' + guest + '": Multiple matches found, use pid ' \
+                      'filter instead'
+                continue
+            pid = pids[0]
+            break
+        curses.curs_set(0)
+        self._refresh_header(pid)
+        self._update_pid(pid)
 
     def show_stats(self):
         """Refreshes the screen and processes user input."""
         sleeptime = self._delay_initial
-        self.refresh_header()
+        self._refresh_header()
         start = 0.0  # result based on init value never appears on screen
         while True:
-            self.refresh_body(time.time() - start)
+            self._refresh_body(time.time() - start)
             curses.halfdelay(int(sleeptime * 10))
             start = time.time()
             sleeptime = self._delay_regular
@@ -1327,47 +1387,39 @@ class Tui(object):
                 if char == 'b':
                     self._display_guests = not self._display_guests
                     if self.stats.toggle_display_guests(self._display_guests):
-                        self.show_msg(['Command not available with tracepoints'
-                                       ' enabled', 'Restart with debugfs only '
-                                       '(see option \'-d\') and try again!'])
+                        self._show_msg(['Command not available with '
+                                        'tracepoints enabled', 'Restart with '
+                                        'debugfs only (see option \'-d\') and '
+                                        'try again!'])
                         self._display_guests = not self._display_guests
-                    self.refresh_header()
+                    self._refresh_header()
                 if char == 'c':
-                    self.stats.fields_filter = DEFAULT_REGEX
-                    self.refresh_header(0)
-                    self.update_pid(0)
+                    self.stats.fields_filter = ''
+                    self._refresh_header(0)
+                    self._update_pid(0)
                 if char == 'f':
                     curses.curs_set(1)
-                    self.show_filter_selection()
+                    self._show_filter_selection()
                     curses.curs_set(0)
                     sleeptime = self._delay_initial
-                if char == 'g':
-                    curses.curs_set(1)
-                    self.show_vm_selection_by_guest_name()
-                    curses.curs_set(0)
+                if char == 'g' or char == 'p':
+                    self._show_vm_selection_by_guest()
                     sleeptime = self._delay_initial
                 if char == 'h':
-                    self.show_help_interactive()
+                    self._show_help_interactive()
                 if char == 'o':
                     self._sorting = not self._sorting
-                if char == 'p':
-                    curses.curs_set(1)
-                    self.show_vm_selection_by_pid()
-                    curses.curs_set(0)
-                    sleeptime = self._delay_initial
                 if char == 'q':
                     break
                 if char == 'r':
                     self.stats.reset()
                 if char == 's':
                     curses.curs_set(1)
-                    self.show_set_update_interval()
+                    self._show_set_update_interval()
                     curses.curs_set(0)
                     sleeptime = self._delay_initial
                 if char == 'x':
-                    self.update_drilldown()
-                    # prevents display of current values on next refresh
-                    self.stats.get(self._display_guests)
+                    self.stats.child_events = not self.stats.child_events
             except KeyboardInterrupt:
                 break
             except curses.error:
@@ -1380,9 +1432,9 @@ def batch(stats):
         s = stats.get()
         time.sleep(1)
         s = stats.get()
-        for key in sorted(s.keys()):
-            values = s[key]
-            print('%-42s%10d%10d' % (key, values[0], values[1]))
+        for key, values in sorted(s.items()):
+            print('%-42s%10d%10d' % (key.split(' ')[0], values.value,
+                  values.delta))
     except KeyboardInterrupt:
         pass
 
@@ -1392,14 +1444,14 @@ def log(stats):
     keys = sorted(stats.get().keys())
 
     def banner():
-        for k in keys:
-            print(k, end=' ')
+        for key in keys:
+            print(key.split(' ')[0], end=' ')
         print()
 
     def statline():
         s = stats.get()
-        for k in keys:
-            print(' %9d' % s[k][1], end=' ')
+        for key in keys:
+            print(' %9d' % s[key].delta, end=' ')
         print()
     line = 0
     banner_repeat = 20
@@ -1504,7 +1556,7 @@ Press any other key to refresh statistics immediately.
                          )
     optparser.add_option('-f', '--fields',
                          action='store',
-                         default=DEFAULT_REGEX,
+                         default='',
                          dest='fields',
                          help='''fields to display (regex)
                                  "-f help" for a list of available events''',
@@ -1539,17 +1591,6 @@ Press any other key to refresh statistics immediately.
 
 def check_access(options):
     """Exits if the current user can't access all needed directories."""
-    if not os.path.exists('/sys/kernel/debug'):
-        sys.stderr.write('Please enable CONFIG_DEBUG_FS in your kernel.')
-        sys.exit(1)
-
-    if not os.path.exists(PATH_DEBUGFS_KVM):
-        sys.stderr.write("Please make sure, that debugfs is mounted and "
-                         "readable by the current user:\n"
-                         "('mount -t debugfs debugfs /sys/kernel/debug')\n"
-                         "Also ensure, that the kvm modules are loaded.\n")
-        sys.exit(1)
-
     if not os.path.exists(PATH_DEBUGFS_TRACING) and (options.tracepoints or
                                                      not options.debugfs):
         sys.stderr.write("Please enable CONFIG_TRACING in your kernel "
@@ -1567,7 +1608,33 @@ def check_access(options):
     return options
 
 
+def assign_globals():
+    global PATH_DEBUGFS_KVM
+    global PATH_DEBUGFS_TRACING
+
+    debugfs = ''
+    for line in file('/proc/mounts'):
+        if line.split(' ')[0] == 'debugfs':
+            debugfs = line.split(' ')[1]
+            break
+    if debugfs == '':
+        sys.stderr.write("Please make sure that CONFIG_DEBUG_FS is enabled in "
+                         "your kernel, mounted and\nreadable by the current "
+                         "user:\n"
+                         "('mount -t debugfs debugfs /sys/kernel/debug')\n")
+        sys.exit(1)
+
+    PATH_DEBUGFS_KVM = os.path.join(debugfs, 'kvm')
+    PATH_DEBUGFS_TRACING = os.path.join(debugfs, 'tracing')
+
+    if not os.path.exists(PATH_DEBUGFS_KVM):
+        sys.stderr.write("Please make sure that CONFIG_KVM is enabled in "
+                         "your kernel and that the modules are loaded.\n")
+        sys.exit(1)
+
+
 def main():
+    assign_globals()
     options = get_options()
     options = check_access(options)
 
diff --git a/tools/kvm/kvm_stat/kvm_stat.txt b/tools/kvm/kvm_stat/kvm_stat.txt
index b5b3810c9e94..0811d860fe75 100644
--- a/tools/kvm/kvm_stat/kvm_stat.txt
+++ b/tools/kvm/kvm_stat/kvm_stat.txt
@@ -35,13 +35,13 @@ INTERACTIVE COMMANDS
 
 *f*::   filter by regular expression
 
-*g*::   filter by guest name
+*g*::   filter by guest name/PID
 
 *h*::   display interactive commands reference
 
 *o*::   toggle sorting order (Total vs CurAvg/s)
 
-*p*::   filter by PID
+*p*::   filter by guest name/PID
 
 *q*::   quit
 
diff --git a/tools/objtool/builtin-check.c b/tools/objtool/builtin-check.c
index 57254f5b2779..694abc628e9b 100644
--- a/tools/objtool/builtin-check.c
+++ b/tools/objtool/builtin-check.c
@@ -29,7 +29,7 @@
 #include "builtin.h"
 #include "check.h"
 
-bool no_fp, no_unreachable;
+bool no_fp, no_unreachable, retpoline, module;
 
 static const char * const check_usage[] = {
         "objtool check [<options>] file.o",
@@ -39,6 +39,8 @@ static const char * const check_usage[] = {
 const struct option check_options[] = {
         OPT_BOOLEAN('f', "no-fp", &no_fp, "Skip frame pointer validation"),
         OPT_BOOLEAN('u', "no-unreachable", &no_unreachable, "Skip 'unreachable instruction' warnings"),
+        OPT_BOOLEAN('r', "retpoline", &retpoline, "Validate retpoline assumptions"),
+        OPT_BOOLEAN('m', "module", &module, "Indicates the object will be part of a kernel module"),
         OPT_END(),
 };
 
@@ -53,5 +55,5 @@ int cmd_check(int argc, const char **argv)
 
         objname = argv[0];
 
-        return check(objname, no_fp, no_unreachable, false);
+        return check(objname, false);
 }
diff --git a/tools/objtool/builtin-orc.c b/tools/objtool/builtin-orc.c
index 91e8e19ff5e0..77ea2b97117d 100644
--- a/tools/objtool/builtin-orc.c
+++ b/tools/objtool/builtin-orc.c
@@ -25,7 +25,6 @@
  */
 
 #include <string.h>
-#include <subcmd/parse-options.h>
 #include "builtin.h"
 #include "check.h"
 
@@ -36,9 +35,6 @@ static const char *orc_usage[] = {
         NULL,
 };
 
-extern const struct option check_options[];
-extern bool no_fp, no_unreachable;
-
 int cmd_orc(int argc, const char **argv)
 {
         const char *objname;
@@ -54,7 +50,7 @@ int cmd_orc(int argc, const char **argv)
 
                 objname = argv[0];
 
-                return check(objname, no_fp, no_unreachable, true);
+                return check(objname, true);
         }
 
         if (!strcmp(argv[0], "dump")) {
diff --git a/tools/objtool/builtin.h b/tools/objtool/builtin.h
index dd526067fed5..28ff40e19a14 100644
--- a/tools/objtool/builtin.h
+++ b/tools/objtool/builtin.h
@@ -17,6 +17,11 @@
 #ifndef _BUILTIN_H
 #define _BUILTIN_H
 
+#include <subcmd/parse-options.h>
+
+extern const struct option check_options[];
+extern bool no_fp, no_unreachable, retpoline, module;
+
 extern int cmd_check(int argc, const char **argv);
 extern int cmd_orc(int argc, const char **argv);
 
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index a8cb69a26576..92b6a2c21631 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -18,6 +18,7 @@
 #include <string.h>
 #include <stdlib.h>
 
+#include "builtin.h"
 #include "check.h"
 #include "elf.h"
 #include "special.h"
@@ -33,7 +34,6 @@ struct alternative {
 };
 
 const char *objname;
-static bool no_fp;
 struct cfi_state initial_func_cfi;
 
 struct instruction *find_insn(struct objtool_file *file,
@@ -497,6 +497,7 @@ static int add_jump_destinations(struct objtool_file *file)
                          * disguise, so convert them accordingly.
                          */
                         insn->type = INSN_JUMP_DYNAMIC;
+                        insn->retpoline_safe = true;
                         continue;
                 } else {
                         /* sibling call */
@@ -548,7 +549,8 @@ static int add_call_destinations(struct objtool_file *file)
                         if (!insn->call_dest && !insn->ignore) {
                                 WARN_FUNC("unsupported intra-function call",
                                           insn->sec, insn->offset);
-                                WARN("If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE.");
+                                if (retpoline)
+                                        WARN("If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE.");
                                 return -1;
                         }
 
@@ -923,7 +925,11 @@ static struct rela *find_switch_table(struct objtool_file *file,
                 if (find_symbol_containing(file->rodata, text_rela->addend))
                         continue;
 
-                return find_rela_by_dest(file->rodata, text_rela->addend);
+                rodata_rela = find_rela_by_dest(file->rodata, text_rela->addend);
+                if (!rodata_rela)
+                        continue;
+
+                return rodata_rela;
         }
 
         return NULL;
@@ -1108,6 +1114,41 @@ static int read_unwind_hints(struct objtool_file *file)
         return 0;
 }
 
+static int read_retpoline_hints(struct objtool_file *file)
+{
+        struct section *sec;
+        struct instruction *insn;
+        struct rela *rela;
+
+        sec = find_section_by_name(file->elf, ".rela.discard.retpoline_safe");
+        if (!sec)
+                return 0;
+
+        list_for_each_entry(rela, &sec->rela_list, list) {
+                if (rela->sym->type != STT_SECTION) {
+                        WARN("unexpected relocation symbol type in %s", sec->name);
+                        return -1;
+                }
+
+                insn = find_insn(file, rela->sym->sec, rela->addend);
+                if (!insn) {
+                        WARN("bad .discard.retpoline_safe entry");
+                        return -1;
+                }
+
+                if (insn->type != INSN_JUMP_DYNAMIC &&
+                    insn->type != INSN_CALL_DYNAMIC) {
+                        WARN_FUNC("retpoline_safe hint not an indirect jump/call",
+                                  insn->sec, insn->offset);
+                        return -1;
+                }
+
+                insn->retpoline_safe = true;
+        }
+
+        return 0;
+}
+
 static int decode_sections(struct objtool_file *file)
 {
         int ret;
@@ -1146,6 +1187,10 @@ static int decode_sections(struct objtool_file *file)
         if (ret)
                 return ret;
 
+        ret = read_retpoline_hints(file);
+        if (ret)
+                return ret;
+
         return 0;
 }
 
@@ -1891,6 +1936,38 @@ static int validate_unwind_hints(struct objtool_file *file)
         return warnings;
 }
 
+static int validate_retpoline(struct objtool_file *file)
+{
+        struct instruction *insn;
+        int warnings = 0;
+
+        for_each_insn(file, insn) {
+                if (insn->type != INSN_JUMP_DYNAMIC &&
+                    insn->type != INSN_CALL_DYNAMIC)
+                        continue;
+
+                if (insn->retpoline_safe)
+                        continue;
+
+                /*
+                 * .init.text code is ran before userspace and thus doesn't
+                 * strictly need retpolines, except for modules which are
+                 * loaded late, they very much do need retpoline in their
+                 * .init.text
+                 */
+                if (!strcmp(insn->sec->name, ".init.text") && !module)
+                        continue;
+
+                WARN_FUNC("indirect %s found in RETPOLINE build",
+                          insn->sec, insn->offset,
+                          insn->type == INSN_JUMP_DYNAMIC ? "jump" : "call");
+
+                warnings++;
+        }
+
+        return warnings;
+}
+
 static bool is_kasan_insn(struct instruction *insn)
 {
         return (insn->type == INSN_CALL &&
@@ -2022,13 +2099,12 @@ static void cleanup(struct objtool_file *file)
         elf_close(file->elf);
 }
 
-int check(const char *_objname, bool _no_fp, bool no_unreachable, bool orc)
+int check(const char *_objname, bool orc)
 {
         struct objtool_file file;
         int ret, warnings = 0;
 
         objname = _objname;
-        no_fp = _no_fp;
 
         file.elf = elf_open(objname, orc ? O_RDWR : O_RDONLY);
         if (!file.elf)
@@ -2052,6 +2128,13 @@ int check(const char *_objname, bool _no_fp, bool no_unreachable, bool orc)
         if (list_empty(&file.insn_list))
                 goto out;
 
+        if (retpoline) {
+                ret = validate_retpoline(&file);
+                if (ret < 0)
+                        return ret;
+                warnings += ret;
+        }
+
         ret = validate_functions(&file);
         if (ret < 0)
                 goto out;
diff --git a/tools/objtool/check.h b/tools/objtool/check.h
index 23a1d065cae1..c6b68fcb926f 100644
--- a/tools/objtool/check.h
+++ b/tools/objtool/check.h
@@ -45,6 +45,7 @@ struct instruction {
         unsigned char type;
         unsigned long immediate;
         bool alt_group, visited, dead_end, ignore, hint, save, restore, ignore_alts;
+        bool retpoline_safe;
         struct symbol *call_dest;
         struct instruction *jump_dest;
         struct instruction *first_jump_src;
@@ -63,7 +64,7 @@ struct objtool_file {
         bool ignore_unreachables, c_file, hints;
 };
 
-int check(const char *objname, bool no_fp, bool no_unreachable, bool orc);
+int check(const char *objname, bool orc);
 
 struct instruction *find_insn(struct objtool_file *file,
                               struct section *sec, unsigned long offset);
diff --git a/tools/perf/Documentation/perf-kallsyms.txt b/tools/perf/Documentation/perf-kallsyms.txt
index 954ea9e21236..cf9f4040ea5c 100644
--- a/tools/perf/Documentation/perf-kallsyms.txt
+++ b/tools/perf/Documentation/perf-kallsyms.txt
@@ -8,7 +8,7 @@ perf-kallsyms - Searches running kernel for symbols
 SYNOPSIS
 --------
 [verse]
-'perf kallsyms <options> symbol_name[,symbol_name...]'
+'perf kallsyms' [<options>] symbol_name[,symbol_name...]
 
 DESCRIPTION
 -----------
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index bf4ca749d1ac..a217623fec2e 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -881,6 +881,15 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)
                 }
         }
 
+        /*
+         * If we have just single event and are sending data
+         * through pipe, we need to force the ids allocation,
+         * because we synthesize event name through the pipe
+         * and need the id for that.
+         */
+        if (data->is_pipe && rec->evlist->nr_entries == 1)
+                rec->opts.sample_id = true;
+
         if (record__open(rec) != 0) {
                 err = -1;
                 goto out_child;
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 98bf9d32f222..54a4c152edb3 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -917,7 +917,7 @@ static void print_metric_csv(void *ctx,
         char buf[64], *vals, *ends;
 
         if (unit == NULL || fmt == NULL) {
-                fprintf(out, "%s%s%s%s", csv_sep, csv_sep, csv_sep, csv_sep);
+                fprintf(out, "%s%s", csv_sep, csv_sep);
                 return;
         }
         snprintf(buf, sizeof(buf), fmt, val);
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index b7c823ba8374..35ac016fcb98 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -991,7 +991,7 @@ static int perf_top_overwrite_fallback(struct perf_top *top,
         evlist__for_each_entry(evlist, counter)
                 counter->attr.write_backward = false;
         opts->overwrite = false;
-        ui__warning("fall back to non-overwrite mode\n");
+        pr_debug2("fall back to non-overwrite mode\n");
         return 1;
 }
 
diff --git a/tools/perf/perf.h b/tools/perf/perf.h
index cfe46236a5e5..57b9b342d533 100644
--- a/tools/perf/perf.h
+++ b/tools/perf/perf.h
@@ -61,6 +61,7 @@ struct record_opts {
         bool         tail_synthesize;
         bool         overwrite;
         bool         ignore_missing_thread;
+        bool         sample_id;
         unsigned int freq;
         unsigned int mmap_pages;
         unsigned int auxtrace_mmap_pages;
diff --git a/tools/perf/ui/browsers/annotate.c b/tools/perf/ui/browsers/annotate.c
index 286427975112..fbf927cf775d 100644
--- a/tools/perf/ui/browsers/annotate.c
+++ b/tools/perf/ui/browsers/annotate.c
@@ -327,7 +327,32 @@ static void annotate_browser__draw_current_jump(struct ui_browser *browser)
         if (!disasm_line__is_valid_jump(cursor, sym))
                 return;
 
+        /*
+         * This first was seen with a gcc function, _cpp_lex_token, that
+         * has the usual jumps:
+         *
+         *  │1159e6c: ↓ jne    115aa32 <_cpp_lex_token@@Base+0xf92>
+         *
+         * I.e. jumps to a label inside that function (_cpp_lex_token), and
+         * those works, but also this kind:
+         *
+         *  │1159e8b: ↓ jne    c469be <cpp_named_operator2name@@Base+0xa72>
+         *
+         *  I.e. jumps to another function, outside _cpp_lex_token, which
+         *  are not being correctly handled generating as a side effect references
+         *  to ab->offset[] entries that are set to NULL, so to make this code
+         *  more robust, check that here.
+         *
+         *  A proper fix for will be put in place, looking at the function
+         *  name right after the '<' token and probably treating this like a
+         *  'call' instruction.
+         */
         target = ab->offsets[cursor->ops.target.offset];
+        if (target == NULL) {
+                ui_helpline__printf("WARN: jump target inconsistency, press 'o', ab->offsets[%#x] = NULL\n",
+                                    cursor->ops.target.offset);
+                return;
+        }
 
         bcursor = browser_line(&cursor->al);
         btarget = browser_line(target);
diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
index 9faf3b5367db..6470ea2aa25e 100644
--- a/tools/perf/util/auxtrace.c
+++ b/tools/perf/util/auxtrace.c
@@ -60,6 +60,12 @@
 #include "sane_ctype.h"
 #include "symbol/kallsyms.h"
 
+static bool auxtrace__dont_decode(struct perf_session *session)
+{
+        return !session->itrace_synth_opts ||
+               session->itrace_synth_opts->dont_decode;
+}
+
 int auxtrace_mmap__mmap(struct auxtrace_mmap *mm,
                         struct auxtrace_mmap_params *mp,
                         void *userpg, int fd)
@@ -762,6 +768,9 @@ int auxtrace_queues__process_index(struct auxtrace_queues *queues,
         size_t i;
         int err;
 
+        if (auxtrace__dont_decode(session))
+                return 0;
+
         list_for_each_entry(auxtrace_index, &session->auxtrace_index, list) {
                 for (i = 0; i < auxtrace_index->nr; i++) {
                         ent = &auxtrace_index->entries[i];
@@ -892,12 +901,6 @@ out_free:
         return err;
 }
 
-static bool auxtrace__dont_decode(struct perf_session *session)
-{
-        return !session->itrace_synth_opts ||
-               session->itrace_synth_opts->dont_decode;
-}
-
 int perf_event__process_auxtrace_info(struct perf_tool *tool __maybe_unused,
                                       union perf_event *event,
                                       struct perf_session *session)
diff --git a/tools/perf/util/record.c b/tools/perf/util/record.c
index 1e97937b03a9..6f09e4962dad 100644
--- a/tools/perf/util/record.c
+++ b/tools/perf/util/record.c
@@ -137,6 +137,7 @@ void perf_evlist__config(struct perf_evlist *evlist, struct record_opts *opts,
         struct perf_evsel *evsel;
         bool use_sample_identifier = false;
         bool use_comm_exec;
+        bool sample_id = opts->sample_id;
 
         /*
          * Set the evsel leader links before we configure attributes,
@@ -163,8 +164,7 @@ void perf_evlist__config(struct perf_evlist *evlist, struct record_opts *opts,
                  * match the id.
                  */
                 use_sample_identifier = perf_can_sample_identifier();
-                evlist__for_each_entry(evlist, evsel)
-                        perf_evsel__set_sample_id(evsel, use_sample_identifier);
+                sample_id = true;
         } else if (evlist->nr_entries > 1) {
                 struct perf_evsel *first = perf_evlist__first(evlist);
 
@@ -174,6 +174,10 @@ void perf_evlist__config(struct perf_evlist *evlist, struct record_opts *opts,
                         use_sample_identifier = perf_can_sample_identifier();
                         break;
                 }
+                sample_id = true;
+        }
+
+        if (sample_id) {
                 evlist__for_each_entry(evlist, evsel)
                         perf_evsel__set_sample_id(evsel, use_sample_identifier);
         }
diff --git a/tools/perf/util/trigger.h b/tools/perf/util/trigger.h
index 370138e7e35c..88223bc7c82b 100644
--- a/tools/perf/util/trigger.h
+++ b/tools/perf/util/trigger.h
@@ -12,7 +12,7 @@
  * States and transits:
  *
  *
- *  OFF--(on)--> READY --(hit)--> HIT
+ *  OFF--> ON --> READY --(hit)--> HIT
  *                 ^               |
  *                 |            (ready)
  *                 |               |
@@ -27,8 +27,9 @@ struct trigger {
         volatile enum {
                 TRIGGER_ERROR           = -2,
                 TRIGGER_OFF             = -1,
-                TRIGGER_READY           = 0,
-                TRIGGER_HIT             = 1,
+                TRIGGER_ON              = 0,
+                TRIGGER_READY           = 1,
+                TRIGGER_HIT             = 2,
         } state;
         const char *name;
 };
@@ -50,7 +51,7 @@ static inline bool trigger_is_error(struct trigger *t)
 static inline void trigger_on(struct trigger *t)
 {
         TRIGGER_WARN_ONCE(t, TRIGGER_OFF);
-        t->state = TRIGGER_READY;
+        t->state = TRIGGER_ON;
 }
 
 static inline void trigger_ready(struct trigger *t)
diff --git a/tools/testing/radix-tree/idr-test.c b/tools/testing/radix-tree/idr-test.c
index 44ef9eba5a7a..6c645eb77d42 100644
--- a/tools/testing/radix-tree/idr-test.c
+++ b/tools/testing/radix-tree/idr-test.c
@@ -178,6 +178,55 @@ void idr_get_next_test(int base)
         idr_destroy(&idr);
 }
 
+int idr_u32_cb(int id, void *ptr, void *data)
+{
+        BUG_ON(id < 0);
+        BUG_ON(ptr != DUMMY_PTR);
+        return 0;
+}
+
+void idr_u32_test1(struct idr *idr, u32 handle)
+{
+        static bool warned = false;
+        u32 id = handle;
+        int sid = 0;
+        void *ptr;
+
+        BUG_ON(idr_alloc_u32(idr, DUMMY_PTR, &id, id, GFP_KERNEL));
+        BUG_ON(id != handle);
+        BUG_ON(idr_alloc_u32(idr, DUMMY_PTR, &id, id, GFP_KERNEL) != -ENOSPC);
+        BUG_ON(id != handle);
+        if (!warned && id > INT_MAX)
+                printk("vvv Ignore these warnings\n");
+        ptr = idr_get_next(idr, &sid);
+        if (id > INT_MAX) {
+                BUG_ON(ptr != NULL);
+                BUG_ON(sid != 0);
+        } else {
+                BUG_ON(ptr != DUMMY_PTR);
+                BUG_ON(sid != id);
+        }
+        idr_for_each(idr, idr_u32_cb, NULL);
+        if (!warned && id > INT_MAX) {
+                printk("^^^ Warnings over\n");
+                warned = true;
+        }
+        BUG_ON(idr_remove(idr, id) != DUMMY_PTR);
+        BUG_ON(!idr_is_empty(idr));
+}
+
+void idr_u32_test(int base)
+{
+        DEFINE_IDR(idr);
+        idr_init_base(&idr, base);
+        idr_u32_test1(&idr, 10);
+        idr_u32_test1(&idr, 0x7fffffff);
+        idr_u32_test1(&idr, 0x80000000);
+        idr_u32_test1(&idr, 0x80000001);
+        idr_u32_test1(&idr, 0xffe00000);
+        idr_u32_test1(&idr, 0xffffffff);
+}
+
 void idr_checks(void)
 {
         unsigned long i;
@@ -248,6 +297,9 @@ void idr_checks(void)
         idr_get_next_test(0);
         idr_get_next_test(1);
         idr_get_next_test(4);
+        idr_u32_test(4);
+        idr_u32_test(1);
+        idr_u32_test(0);
 }
 
 /*
diff --git a/tools/testing/radix-tree/linux.c b/tools/testing/radix-tree/linux.c
index 6903ccf35595..44a0d1ad4408 100644
--- a/tools/testing/radix-tree/linux.c
+++ b/tools/testing/radix-tree/linux.c
@@ -29,7 +29,7 @@ void *kmem_cache_alloc(struct kmem_cache *cachep, int flags)
 {
         struct radix_tree_node *node;
 
-        if (flags & __GFP_NOWARN)
+        if (!(flags & __GFP_DIRECT_RECLAIM))
                 return NULL;
 
         pthread_mutex_lock(&cachep->lock);
@@ -73,10 +73,17 @@ void kmem_cache_free(struct kmem_cache *cachep, void *objp)
 
 void *kmalloc(size_t size, gfp_t gfp)
 {
-        void *ret = malloc(size);
+        void *ret;
+
+        if (!(gfp & __GFP_DIRECT_RECLAIM))
+                return NULL;
+
+        ret = malloc(size);
         uatomic_inc(&nr_allocated);
         if (kmalloc_verbose)
                 printf("Allocating %p from malloc\n", ret);
+        if (gfp & __GFP_ZERO)
+                memset(ret, 0, size);
         return ret;
 }
 
diff --git a/tools/testing/radix-tree/linux/compiler_types.h b/tools/testing/radix-tree/linux/compiler_types.h
new file mode 100644
index 000000000000..e69de29bb2d1
--- /dev/null
+++ b/tools/testing/radix-tree/linux/compiler_types.h
diff --git a/tools/testing/radix-tree/linux/gfp.h b/tools/testing/radix-tree/linux/gfp.h
index e9fff59dfd8a..e3201ccf54c3 100644
--- a/tools/testing/radix-tree/linux/gfp.h
+++ b/tools/testing/radix-tree/linux/gfp.h
@@ -11,6 +11,7 @@
 #define __GFP_IO                0x40u
 #define __GFP_FS                0x80u
 #define __GFP_NOWARN            0x200u
+#define __GFP_ZERO              0x8000u
 #define __GFP_ATOMIC            0x80000u
 #define __GFP_ACCOUNT           0x100000u
 #define __GFP_DIRECT_RECLAIM    0x400000u
diff --git a/tools/testing/radix-tree/linux/slab.h b/tools/testing/radix-tree/linux/slab.h
index 979baeec7e70..a037def0dec6 100644
--- a/tools/testing/radix-tree/linux/slab.h
+++ b/tools/testing/radix-tree/linux/slab.h
@@ -3,6 +3,7 @@
 #define SLAB_H
 
 #include <linux/types.h>
+#include <linux/gfp.h>
 
 #define SLAB_HWCACHE_ALIGN 1
 #define SLAB_PANIC 2
@@ -11,6 +12,11 @@
 void *kmalloc(size_t size, gfp_t);
 void kfree(void *);
 
+static inline void *kzalloc(size_t size, gfp_t gfp)
+{
+        return kmalloc(size, gfp | __GFP_ZERO);
+}
+
 void *kmem_cache_alloc(struct kmem_cache *cachep, int flags);
 void kmem_cache_free(struct kmem_cache *cachep, void *objp);
 
diff --git a/tools/testing/selftests/android/Makefile b/tools/testing/selftests/android/Makefile
index 1a7492268993..f6304d2be90c 100644
--- a/tools/testing/selftests/android/Makefile
+++ b/tools/testing/selftests/android/Makefile
@@ -11,11 +11,11 @@ all:
                 BUILD_TARGET=$(OUTPUT)/$$DIR;   \
                 mkdir $$BUILD_TARGET  -p;       \
                 make OUTPUT=$$BUILD_TARGET -C $$DIR $@;\
-                #SUBDIR test prog name should be in the form: SUBDIR_test.sh
+                #SUBDIR test prog name should be in the form: SUBDIR_test.sh \
                 TEST=$$DIR"_test.sh"; \
-                if [ -e $$DIR/$$TEST ]; then
-                        rsync -a $$DIR/$$TEST $$BUILD_TARGET/;
-                fi
+                if [ -e $$DIR/$$TEST ]; then \
+                        rsync -a $$DIR/$$TEST $$BUILD_TARGET/; \
+                fi \
         done
 
 override define RUN_TESTS
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index c73592fa3d41..437c0b1c9d21 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -11163,6 +11163,64 @@ static struct bpf_test tests[] = {
                 .result = REJECT,
                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
         },
+        {
+                "xadd/w check unaligned stack",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
+                        BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -7),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
+                        BPF_EXIT_INSN(),
+                },
+                .result = REJECT,
+                .errstr = "misaligned stack access off",
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+        },
+        {
+                "xadd/w check unaligned map",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_MOV64_IMM(BPF_REG_1, 1),
+                        BPF_STX_XADD(BPF_W, BPF_REG_0, BPF_REG_1, 3),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 3),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .result = REJECT,
+                .errstr = "misaligned value access off",
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+        },
+        {
+                "xadd/w check unaligned pkt",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 99),
+                        BPF_JMP_IMM(BPF_JA, 0, 0, 6),
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
+                        BPF_ST_MEM(BPF_W, BPF_REG_2, 3, 0),
+                        BPF_STX_XADD(BPF_W, BPF_REG_2, BPF_REG_0, 1),
+                        BPF_STX_XADD(BPF_W, BPF_REG_2, BPF_REG_0, 2),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 1),
+                        BPF_EXIT_INSN(),
+                },
+                .result = REJECT,
+                .errstr = "BPF_XADD stores into R2 packet",
+                .prog_type = BPF_PROG_TYPE_XDP,
+        },
 };
 
 static int probe_filter_length(const struct bpf_insn *fp)
diff --git a/tools/testing/selftests/futex/Makefile b/tools/testing/selftests/futex/Makefile
index cea4adcd42b8..a63e8453984d 100644
--- a/tools/testing/selftests/futex/Makefile
+++ b/tools/testing/selftests/futex/Makefile
@@ -12,9 +12,9 @@ all:
                 BUILD_TARGET=$(OUTPUT)/$$DIR;   \
                 mkdir $$BUILD_TARGET  -p;       \
                 make OUTPUT=$$BUILD_TARGET -C $$DIR $@;\
-                if [ -e $$DIR/$(TEST_PROGS) ]; then
-                        rsync -a $$DIR/$(TEST_PROGS) $$BUILD_TARGET/;
-                fi
+                if [ -e $$DIR/$(TEST_PROGS) ]; then \
+                        rsync -a $$DIR/$(TEST_PROGS) $$BUILD_TARGET/; \
+                fi \
         done
 
 override define RUN_TESTS
diff --git a/tools/testing/selftests/memfd/config b/tools/testing/selftests/memfd/config
new file mode 100644
index 000000000000..835c7f4dadcd
--- /dev/null
+++ b/tools/testing/selftests/memfd/config
@@ -0,0 +1 @@
+CONFIG_FUSE_FS=m
diff --git a/tools/testing/selftests/memory-hotplug/Makefile b/tools/testing/selftests/memory-hotplug/Makefile
index 86636d207adf..686da510f989 100644
--- a/tools/testing/selftests/memory-hotplug/Makefile
+++ b/tools/testing/selftests/memory-hotplug/Makefile
@@ -4,8 +4,9 @@ all:
 include ../lib.mk
 
 TEST_PROGS := mem-on-off-test.sh
-override RUN_TESTS := ./mem-on-off-test.sh -r 2 && echo "selftests: memory-hotplug [PASS]" || echo "selftests: memory-hotplug [FAIL]"
-override EMIT_TESTS := echo "$(RUN_TESTS)"
+override RUN_TESTS := @./mem-on-off-test.sh -r 2 && echo "selftests: memory-hotplug [PASS]" || echo "selftests: memory-hotplug [FAIL]"
+
+override EMIT_TESTS := echo "$(subst @,,$(RUN_TESTS))"
 
 run_full_test:
         @/bin/bash ./mem-on-off-test.sh && echo "memory-hotplug selftests: [PASS]" || echo "memory-hotplug selftests: [FAIL]"
diff --git a/tools/testing/selftests/powerpc/mm/subpage_prot.c b/tools/testing/selftests/powerpc/mm/subpage_prot.c
index 35ade7406dcd..3ae77ba93208 100644
--- a/tools/testing/selftests/powerpc/mm/subpage_prot.c
+++ b/tools/testing/selftests/powerpc/mm/subpage_prot.c
@@ -135,6 +135,16 @@ static int run_test(void *addr, unsigned long size)
         return 0;
 }
 
+static int syscall_available(void)
+{
+        int rc;
+
+        errno = 0;
+        rc = syscall(__NR_subpage_prot, 0, 0, 0);
+
+        return rc == 0 || (errno != ENOENT && errno != ENOSYS);
+}
+
 int test_anon(void)
 {
         unsigned long align;
@@ -145,6 +155,8 @@ int test_anon(void)
         void *mallocblock;
         unsigned long mallocsize;
 
+        SKIP_IF(!syscall_available());
+
         if (getpagesize() != 0x10000) {
                 fprintf(stderr, "Kernel page size must be 64K!\n");
                 return 1;
@@ -180,6 +192,8 @@ int test_file(void)
         off_t filesize;
         int fd;
 
+        SKIP_IF(!syscall_available());
+
         fd = open(file_name, O_RDWR);
         if (fd == -1) {
                 perror("failed to open file");
diff --git a/tools/testing/selftests/powerpc/tm/Makefile b/tools/testing/selftests/powerpc/tm/Makefile
index a23453943ad2..5c72ff978f27 100644
--- a/tools/testing/selftests/powerpc/tm/Makefile
+++ b/tools/testing/selftests/powerpc/tm/Makefile
@@ -16,7 +16,7 @@ $(OUTPUT)/tm-syscall: tm-syscall-asm.S
 $(OUTPUT)/tm-syscall: CFLAGS += -I../../../../../usr/include
 $(OUTPUT)/tm-tmspr: CFLAGS += -pthread
 $(OUTPUT)/tm-vmx-unavail: CFLAGS += -pthread -m64
-$(OUTPUT)/tm-resched-dscr: ../pmu/lib.o
+$(OUTPUT)/tm-resched-dscr: ../pmu/lib.c
 $(OUTPUT)/tm-unavailable: CFLAGS += -O0 -pthread -m64 -Wno-error=uninitialized -mvsx
 $(OUTPUT)/tm-trap: CFLAGS += -O0 -pthread -m64
 
diff --git a/tools/testing/selftests/powerpc/tm/tm-trap.c b/tools/testing/selftests/powerpc/tm/tm-trap.c
index 5d92c23ee6cb..179d592f0073 100644
--- a/tools/testing/selftests/powerpc/tm/tm-trap.c
+++ b/tools/testing/selftests/powerpc/tm/tm-trap.c
@@ -255,6 +255,8 @@ int tm_trap_test(void)
 
         struct sigaction trap_sa;
 
+        SKIP_IF(!have_htm());
+
         trap_sa.sa_flags = SA_SIGINFO;
         trap_sa.sa_sigaction = trap_signal_handler;
         sigaction(SIGTRAP, &trap_sa, NULL);
diff --git a/tools/testing/selftests/pstore/config b/tools/testing/selftests/pstore/config
index 6a8e5a9bfc10..d148f9f89fb6 100644
--- a/tools/testing/selftests/pstore/config
+++ b/tools/testing/selftests/pstore/config
@@ -2,3 +2,4 @@ CONFIG_MISC_FILESYSTEMS=y
 CONFIG_PSTORE=y
 CONFIG_PSTORE_PMSG=y
 CONFIG_PSTORE_CONSOLE=y
+CONFIG_PSTORE_RAM=m
diff --git a/tools/testing/selftests/sync/Makefile b/tools/testing/selftests/sync/Makefile
index b3c8ba3cb668..d0121a8a3523 100644
--- a/tools/testing/selftests/sync/Makefile
+++ b/tools/testing/selftests/sync/Makefile
@@ -30,7 +30,7 @@ $(TEST_CUSTOM_PROGS): $(TESTS) $(OBJS)
         $(CC) -o $(TEST_CUSTOM_PROGS) $(OBJS) $(TESTS) $(CFLAGS) $(LDFLAGS)
 
 $(OBJS): $(OUTPUT)/%.o: %.c
-        $(CC) -c $^ -o $@
+        $(CC) -c $^ -o $@ $(CFLAGS)
 
 $(TESTS): $(OUTPUT)/%.o: %.c
         $(CC) -c $^ -o $@
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/skbmod.json b/tools/testing/selftests/tc-testing/tc-tests/actions/skbmod.json
index e34075059c26..90bba48c3f07 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/actions/skbmod.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/skbmod.json
@@ -315,7 +315,7 @@
         "cmdUnderTest": "$TC actions ls action skbmod",
         "expExitCode": "0",
         "verifyCmd": "$TC actions get action skbmod index 4",
-        "matchPattern": "action order [0-9]*: skbmod pipe set etype 0x0031",
+        "matchPattern": "action order [0-9]*: skbmod pipe set etype 0x31",
         "matchCount": "1",
         "teardown": [
             "$TC actions flush action skbmod"
diff --git a/tools/testing/selftests/vDSO/Makefile b/tools/testing/selftests/vDSO/Makefile
index 3d5a62ff7d31..f5d7a7851e21 100644
--- a/tools/testing/selftests/vDSO/Makefile
+++ b/tools/testing/selftests/vDSO/Makefile
@@ -1,4 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
+include ../lib.mk
+
 ifndef CROSS_COMPILE
 CFLAGS := -std=gnu99
 CFLAGS_vdso_standalone_test_x86 := -nostdlib -fno-asynchronous-unwind-tables -fno-stack-protector
@@ -6,16 +8,14 @@ ifeq ($(CONFIG_X86_32),y)
 LDLIBS += -lgcc_s
 endif
 
-TEST_PROGS := vdso_test vdso_standalone_test_x86
+TEST_PROGS := $(OUTPUT)/vdso_test $(OUTPUT)/vdso_standalone_test_x86
 
 all: $(TEST_PROGS)
-vdso_test: parse_vdso.c vdso_test.c
-vdso_standalone_test_x86: vdso_standalone_test_x86.c parse_vdso.c
+$(OUTPUT)/vdso_test: parse_vdso.c vdso_test.c
+$(OUTPUT)/vdso_standalone_test_x86: vdso_standalone_test_x86.c parse_vdso.c
         $(CC) $(CFLAGS) $(CFLAGS_vdso_standalone_test_x86) \
                 vdso_standalone_test_x86.c parse_vdso.c \
-                -o vdso_standalone_test_x86
+                -o $@
 
-include ../lib.mk
-clean:
-        rm -fr $(TEST_PROGS)
+EXTRA_CLEAN := $(TEST_PROGS)
 endif
diff --git a/tools/testing/selftests/vm/.gitignore b/tools/testing/selftests/vm/.gitignore
index 63c94d776e89..342c7bc9dc8c 100644
--- a/tools/testing/selftests/vm/.gitignore
+++ b/tools/testing/selftests/vm/.gitignore
@@ -11,3 +11,4 @@ mlock-intersect-test
 mlock-random-test
 virtual_address_range
 gup_benchmark
+va_128TBswitch
diff --git a/tools/testing/selftests/vm/run_vmtests b/tools/testing/selftests/vm/run_vmtests
index d2561895a021..22d564673830 100755
--- a/tools/testing/selftests/vm/run_vmtests
+++ b/tools/testing/selftests/vm/run_vmtests
@@ -2,25 +2,33 @@
 # SPDX-License-Identifier: GPL-2.0
 #please run as root
 
-#we need 256M, below is the size in kB
-needmem=262144
 mnt=./huge
 exitcode=0
 
-#get pagesize and freepages from /proc/meminfo
+#get huge pagesize and freepages from /proc/meminfo
 while read name size unit; do
         if [ "$name" = "HugePages_Free:" ]; then
                 freepgs=$size
         fi
         if [ "$name" = "Hugepagesize:" ]; then
-                pgsize=$size
+                hpgsize_KB=$size
         fi
 done < /proc/meminfo
 
+# Simple hugetlbfs tests have a hardcoded minimum requirement of
+# huge pages totaling 256MB (262144KB) in size.  The userfaultfd
+# hugetlb test requires a minimum of 2 * nr_cpus huge pages.  Take
+# both of these requirements into account and attempt to increase
+# number of huge pages available.
+nr_cpus=$(nproc)
+hpgsize_MB=$((hpgsize_KB / 1024))
+half_ufd_size_MB=$((((nr_cpus * hpgsize_MB + 127) / 128) * 128))
+needmem_KB=$((half_ufd_size_MB * 2 * 1024))
+
 #set proper nr_hugepages
-if [ -n "$freepgs" ] && [ -n "$pgsize" ]; then
+if [ -n "$freepgs" ] && [ -n "$hpgsize_KB" ]; then
         nr_hugepgs=`cat /proc/sys/vm/nr_hugepages`
-        needpgs=`expr $needmem / $pgsize`
+        needpgs=$((needmem_KB / hpgsize_KB))
         tries=2
         while [ $tries -gt 0 ] && [ $freepgs -lt $needpgs ]; do
                 lackpgs=$(( $needpgs - $freepgs ))
@@ -107,8 +115,9 @@ fi
 echo "---------------------------"
 echo "running userfaultfd_hugetlb"
 echo "---------------------------"
-# 256MB total huge pages == 128MB src and 128MB dst
-./userfaultfd hugetlb 128 32 $mnt/ufd_test_file
+# Test requires source and destination huge pages.  Size of source
+# (half_ufd_size_MB) is passed as argument to test.
+./userfaultfd hugetlb $half_ufd_size_MB 32 $mnt/ufd_test_file
 if [ $? -ne 0 ]; then
         echo "[FAIL]"
         exitcode=1
diff --git a/tools/testing/selftests/x86/entry_from_vm86.c b/tools/testing/selftests/x86/entry_from_vm86.c
index 361466a2eaef..ade443a88421 100644
--- a/tools/testing/selftests/x86/entry_from_vm86.c
+++ b/tools/testing/selftests/x86/entry_from_vm86.c
@@ -95,6 +95,10 @@ asm (
         "int3\n\t"
         "vmcode_int80:\n\t"
         "int $0x80\n\t"
+        "vmcode_popf_hlt:\n\t"
+        "push %ax\n\t"
+        "popf\n\t"
+        "hlt\n\t"
         "vmcode_umip:\n\t"
         /* addressing via displacements */
         "smsw (2052)\n\t"
@@ -124,8 +128,8 @@ asm (
 
 extern unsigned char vmcode[], end_vmcode[];
 extern unsigned char vmcode_bound[], vmcode_sysenter[], vmcode_syscall[],
-        vmcode_sti[], vmcode_int3[], vmcode_int80[], vmcode_umip[],
-        vmcode_umip_str[], vmcode_umip_sldt[];
+        vmcode_sti[], vmcode_int3[], vmcode_int80[], vmcode_popf_hlt[],
+        vmcode_umip[], vmcode_umip_str[], vmcode_umip_sldt[];
 
 /* Returns false if the test was skipped. */
 static bool do_test(struct vm86plus_struct *v86, unsigned long eip,
@@ -175,7 +179,7 @@ static bool do_test(struct vm86plus_struct *v86, unsigned long eip,
             (VM86_TYPE(ret) == rettype && VM86_ARG(ret) == retarg)) {
                 printf("[OK]\tReturned correctly\n");
         } else {
-                printf("[FAIL]\tIncorrect return reason\n");
+                printf("[FAIL]\tIncorrect return reason (started at eip = 0x%lx, ended at eip = 0x%lx)\n", eip, v86->regs.eip);
                 nerrs++;
         }
 
@@ -264,6 +268,9 @@ int main(void)
         v86.regs.ds = load_addr / 16;
         v86.regs.es = load_addr / 16;
 
+        /* Use the end of the page as our stack. */
+        v86.regs.esp = 4096;
+
         assert((v86.regs.cs & 3) == 0); /* Looks like RPL = 0 */
 
         /* #BR -- should deliver SIG??? */
@@ -295,6 +302,23 @@ int main(void)
         v86.regs.eflags &= ~X86_EFLAGS_IF;
         do_test(&v86, vmcode_sti - vmcode, VM86_STI, 0, "STI with VIP set");
 
+        /* POPF with VIP set but IF clear: should not trap */
+        v86.regs.eflags = X86_EFLAGS_VIP;
+        v86.regs.eax = 0;
+        do_test(&v86, vmcode_popf_hlt - vmcode, VM86_UNKNOWN, 0, "POPF with VIP set and IF clear");
+
+        /* POPF with VIP set and IF set: should trap */
+        v86.regs.eflags = X86_EFLAGS_VIP;
+        v86.regs.eax = X86_EFLAGS_IF;
+        do_test(&v86, vmcode_popf_hlt - vmcode, VM86_STI, 0, "POPF with VIP and IF set");
+
+        /* POPF with VIP clear and IF set: should not trap */
+        v86.regs.eflags = 0;
+        v86.regs.eax = X86_EFLAGS_IF;
+        do_test(&v86, vmcode_popf_hlt - vmcode, VM86_UNKNOWN, 0, "POPF with VIP clear and IF set");
+
+        v86.regs.eflags = 0;
+
         /* INT3 -- should cause #BP */
         do_test(&v86, vmcode_int3 - vmcode, VM86_TRAP, 3, "INT3");
 
@@ -318,7 +342,7 @@ int main(void)
         clearhandler(SIGSEGV);
 
         /* Make sure nothing explodes if we fork. */
-        if (fork() > 0)
+        if (fork() == 0)
                 return 0;
 
         return (nerrs == 0 ? 0 : 1);
diff --git a/tools/testing/selftests/x86/test_vsyscall.c b/tools/testing/selftests/x86/test_vsyscall.c
index be81621446f0..0b4f1cc2291c 100644
--- a/tools/testing/selftests/x86/test_vsyscall.c
+++ b/tools/testing/selftests/x86/test_vsyscall.c
@@ -450,7 +450,7 @@ static void sigtrap(int sig, siginfo_t *info, void *ctx_void)
                 num_vsyscall_traps++;
 }
 
-static int test_native_vsyscall(void)
+static int test_emulation(void)
 {
         time_t tmp;
         bool is_native;
@@ -458,7 +458,7 @@ static int test_native_vsyscall(void)
         if (!vtime)
                 return 0;
 
-        printf("[RUN]\tchecking for native vsyscall\n");
+        printf("[RUN]\tchecking that vsyscalls are emulated\n");
         sethandler(SIGTRAP, sigtrap, 0);
         set_eflags(get_eflags() | X86_EFLAGS_TF);
         vtime(&tmp);
@@ -474,11 +474,12 @@ static int test_native_vsyscall(void)
          */
         is_native = (num_vsyscall_traps > 1);
 
-        printf("\tvsyscalls are %s (%d instructions in vsyscall page)\n",
+        printf("[%s]\tvsyscalls are %s (%d instructions in vsyscall page)\n",
+               (is_native ? "FAIL" : "OK"),
                (is_native ? "native" : "emulated"),
                (int)num_vsyscall_traps);
 
-        return 0;
+        return is_native;
 }
 #endif
 
@@ -498,7 +499,7 @@ int main(int argc, char **argv)
         nerrs += test_vsys_r();
 
 #ifdef __x86_64__
-        nerrs += test_native_vsyscall();
+        nerrs += test_emulation();
 #endif
 
         return nerrs ? 1 : 0;
diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c
index 70268c0bec79..282389eb204f 100644
--- a/virt/kvm/arm/arch_timer.c
+++ b/virt/kvm/arm/arch_timer.c
@@ -36,6 +36,8 @@ static struct timecounter *timecounter;
 static unsigned int host_vtimer_irq;
 static u32 host_vtimer_irq_flags;
 
+static DEFINE_STATIC_KEY_FALSE(has_gic_active_state);
+
 static const struct kvm_irq_level default_ptimer_irq = {
         .irq    = 30,
         .level  = 1,
@@ -56,6 +58,12 @@ u64 kvm_phys_timer_read(void)
         return timecounter->cc->read(timecounter->cc);
 }
 
+static inline bool userspace_irqchip(struct kvm *kvm)
+{
+        return static_branch_unlikely(&userspace_irqchip_in_use) &&
+                unlikely(!irqchip_in_kernel(kvm));
+}
+
 static void soft_timer_start(struct hrtimer *hrt, u64 ns)
 {
         hrtimer_start(hrt, ktime_add_ns(ktime_get(), ns),
@@ -69,25 +77,6 @@ static void soft_timer_cancel(struct hrtimer *hrt, struct work_struct *work)
                 cancel_work_sync(work);
 }
 
-static void kvm_vtimer_update_mask_user(struct kvm_vcpu *vcpu)
-{
-        struct arch_timer_context *vtimer = vcpu_vtimer(vcpu);
-
-        /*
-         * When using a userspace irqchip with the architected timers, we must
-         * prevent continuously exiting from the guest, and therefore mask the
-         * physical interrupt by disabling it on the host interrupt controller
-         * when the virtual level is high, such that the guest can make
-         * forward progress.  Once we detect the output level being
-         * de-asserted, we unmask the interrupt again so that we exit from the
-         * guest when the timer fires.
-         */
-        if (vtimer->irq.level)
-                disable_percpu_irq(host_vtimer_irq);
-        else
-                enable_percpu_irq(host_vtimer_irq, 0);
-}
-
 static irqreturn_t kvm_arch_timer_handler(int irq, void *dev_id)
 {
         struct kvm_vcpu *vcpu = *(struct kvm_vcpu **)dev_id;
@@ -106,9 +95,9 @@ static irqreturn_t kvm_arch_timer_handler(int irq, void *dev_id)
         if (kvm_timer_should_fire(vtimer))
                 kvm_timer_update_irq(vcpu, true, vtimer);
 
-        if (static_branch_unlikely(&userspace_irqchip_in_use) &&
-            unlikely(!irqchip_in_kernel(vcpu->kvm)))
-                kvm_vtimer_update_mask_user(vcpu);
+        if (userspace_irqchip(vcpu->kvm) &&
+            !static_branch_unlikely(&has_gic_active_state))
+                disable_percpu_irq(host_vtimer_irq);
 
         return IRQ_HANDLED;
 }
@@ -290,8 +279,7 @@ static void kvm_timer_update_irq(struct kvm_vcpu *vcpu, bool new_level,
         trace_kvm_timer_update_irq(vcpu->vcpu_id, timer_ctx->irq.irq,
                                    timer_ctx->irq.level);
 
-        if (!static_branch_unlikely(&userspace_irqchip_in_use) ||
-            likely(irqchip_in_kernel(vcpu->kvm))) {
+        if (!userspace_irqchip(vcpu->kvm)) {
                 ret = kvm_vgic_inject_irq(vcpu->kvm, vcpu->vcpu_id,
                                           timer_ctx->irq.irq,
                                           timer_ctx->irq.level,
@@ -350,12 +338,6 @@ static void kvm_timer_update_state(struct kvm_vcpu *vcpu)
         phys_timer_emulate(vcpu);
 }
 
-static void __timer_snapshot_state(struct arch_timer_context *timer)
-{
-        timer->cnt_ctl = read_sysreg_el0(cntv_ctl);
-        timer->cnt_cval = read_sysreg_el0(cntv_cval);
-}
-
 static void vtimer_save_state(struct kvm_vcpu *vcpu)
 {
         struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
@@ -367,8 +349,10 @@ static void vtimer_save_state(struct kvm_vcpu *vcpu)
         if (!vtimer->loaded)
                 goto out;
 
-        if (timer->enabled)
-                __timer_snapshot_state(vtimer);
+        if (timer->enabled) {
+                vtimer->cnt_ctl = read_sysreg_el0(cntv_ctl);
+                vtimer->cnt_cval = read_sysreg_el0(cntv_cval);
+        }
 
         /* Disable the virtual timer */
         write_sysreg_el0(0, cntv_ctl);
@@ -460,23 +444,43 @@ static void set_cntvoff(u64 cntvoff)
         kvm_call_hyp(__kvm_timer_set_cntvoff, low, high);
 }
 
-static void kvm_timer_vcpu_load_vgic(struct kvm_vcpu *vcpu)
+static inline void set_vtimer_irq_phys_active(struct kvm_vcpu *vcpu, bool active)
+{
+        int r;
+        r = irq_set_irqchip_state(host_vtimer_irq, IRQCHIP_STATE_ACTIVE, active);
+        WARN_ON(r);
+}
+
+static void kvm_timer_vcpu_load_gic(struct kvm_vcpu *vcpu)
 {
         struct arch_timer_context *vtimer = vcpu_vtimer(vcpu);
         bool phys_active;
-        int ret;
-
-        phys_active = kvm_vgic_map_is_active(vcpu, vtimer->irq.irq);
 
-        ret = irq_set_irqchip_state(host_vtimer_irq,
-                                    IRQCHIP_STATE_ACTIVE,
-                                    phys_active);
-        WARN_ON(ret);
+        if (irqchip_in_kernel(vcpu->kvm))
+                phys_active = kvm_vgic_map_is_active(vcpu, vtimer->irq.irq);
+        else
+                phys_active = vtimer->irq.level;
+        set_vtimer_irq_phys_active(vcpu, phys_active);
 }
 
-static void kvm_timer_vcpu_load_user(struct kvm_vcpu *vcpu)
+static void kvm_timer_vcpu_load_nogic(struct kvm_vcpu *vcpu)
 {
-        kvm_vtimer_update_mask_user(vcpu);
+        struct arch_timer_context *vtimer = vcpu_vtimer(vcpu);
+
+        /*
+         * When using a userspace irqchip with the architected timers and a
+         * host interrupt controller that doesn't support an active state, we
+         * must still prevent continuously exiting from the guest, and
+         * therefore mask the physical interrupt by disabling it on the host
+         * interrupt controller when the virtual level is high, such that the
+         * guest can make forward progress.  Once we detect the output level
+         * being de-asserted, we unmask the interrupt again so that we exit
+         * from the guest when the timer fires.
+         */
+        if (vtimer->irq.level)
+                disable_percpu_irq(host_vtimer_irq);
+        else
+                enable_percpu_irq(host_vtimer_irq, host_vtimer_irq_flags);
 }
 
 void kvm_timer_vcpu_load(struct kvm_vcpu *vcpu)
@@ -487,10 +491,10 @@ void kvm_timer_vcpu_load(struct kvm_vcpu *vcpu)
         if (unlikely(!timer->enabled))
                 return;
 
-        if (unlikely(!irqchip_in_kernel(vcpu->kvm)))
-                kvm_timer_vcpu_load_user(vcpu);
+        if (static_branch_likely(&has_gic_active_state))
+                kvm_timer_vcpu_load_gic(vcpu);
         else
-                kvm_timer_vcpu_load_vgic(vcpu);
+                kvm_timer_vcpu_load_nogic(vcpu);
 
         set_cntvoff(vtimer->cntvoff);
 
@@ -555,22 +559,29 @@ static void unmask_vtimer_irq_user(struct kvm_vcpu *vcpu)
 {
         struct arch_timer_context *vtimer = vcpu_vtimer(vcpu);
 
-        if (unlikely(!irqchip_in_kernel(vcpu->kvm))) {
-                __timer_snapshot_state(vtimer);
-                if (!kvm_timer_should_fire(vtimer)) {
-                        kvm_timer_update_irq(vcpu, false, vtimer);
-                        kvm_vtimer_update_mask_user(vcpu);
-                }
+        if (!kvm_timer_should_fire(vtimer)) {
+                kvm_timer_update_irq(vcpu, false, vtimer);
+                if (static_branch_likely(&has_gic_active_state))
+                        set_vtimer_irq_phys_active(vcpu, false);
+                else
+                        enable_percpu_irq(host_vtimer_irq, host_vtimer_irq_flags);
         }
 }
 
 void kvm_timer_sync_hwstate(struct kvm_vcpu *vcpu)
 {
-        unmask_vtimer_irq_user(vcpu);
+        struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
+
+        if (unlikely(!timer->enabled))
+                return;
+
+        if (unlikely(!irqchip_in_kernel(vcpu->kvm)))
+                unmask_vtimer_irq_user(vcpu);
 }
 
 int kvm_timer_vcpu_reset(struct kvm_vcpu *vcpu)
 {
+        struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
         struct arch_timer_context *vtimer = vcpu_vtimer(vcpu);
         struct arch_timer_context *ptimer = vcpu_ptimer(vcpu);
 
@@ -584,6 +595,9 @@ int kvm_timer_vcpu_reset(struct kvm_vcpu *vcpu)
         ptimer->cnt_ctl = 0;
         kvm_timer_update_state(vcpu);
 
+        if (timer->enabled && irqchip_in_kernel(vcpu->kvm))
+                kvm_vgic_reset_mapped_irq(vcpu, vtimer->irq.irq);
+
         return 0;
 }
 
@@ -753,9 +767,11 @@ int kvm_timer_hyp_init(bool has_gic)
                         kvm_err("kvm_arch_timer: error setting vcpu affinity\n");
                         goto out_free_irq;
                 }
+
+                static_branch_enable(&has_gic_active_state);
         }
 
-        kvm_info("virtual timer IRQ%d\n", host_vtimer_irq);
+        kvm_debug("virtual timer IRQ%d\n", host_vtimer_irq);
 
         cpuhp_setup_state(CPUHP_AP_KVM_ARM_TIMER_STARTING,
                           "kvm/arm/timer:starting", kvm_timer_starting_cpu,
diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
index 86941f6181bb..53572304843b 100644
--- a/virt/kvm/arm/arm.c
+++ b/virt/kvm/arm/arm.c
@@ -384,14 +384,11 @@ static void vcpu_power_off(struct kvm_vcpu *vcpu)
 int kvm_arch_vcpu_ioctl_get_mpstate(struct kvm_vcpu *vcpu,
                                     struct kvm_mp_state *mp_state)
 {
-        vcpu_load(vcpu);
-
         if (vcpu->arch.power_off)
                 mp_state->mp_state = KVM_MP_STATE_STOPPED;
         else
                 mp_state->mp_state = KVM_MP_STATE_RUNNABLE;
 
-        vcpu_put(vcpu);
         return 0;
 }
 
@@ -400,8 +397,6 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
 {
         int ret = 0;
 
-        vcpu_load(vcpu);
-
         switch (mp_state->mp_state) {
         case KVM_MP_STATE_RUNNABLE:
                 vcpu->arch.power_off = false;
@@ -413,7 +408,6 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
                 ret = -EINVAL;
         }
 
-        vcpu_put(vcpu);
         return ret;
 }
 
@@ -1036,8 +1030,6 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
         struct kvm_device_attr attr;
         long r;
 
-        vcpu_load(vcpu);
-
         switch (ioctl) {
         case KVM_ARM_VCPU_INIT: {
                 struct kvm_vcpu_init init;
@@ -1114,7 +1106,6 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
                 r = -EINVAL;
         }
 
-        vcpu_put(vcpu);
         return r;
 }
 
diff --git a/virt/kvm/arm/hyp/vgic-v3-sr.c b/virt/kvm/arm/hyp/vgic-v3-sr.c
index f5c3d6d7019e..b89ce5432214 100644
--- a/virt/kvm/arm/hyp/vgic-v3-sr.c
+++ b/virt/kvm/arm/hyp/vgic-v3-sr.c
@@ -215,7 +215,8 @@ void __hyp_text __vgic_v3_save_state(struct kvm_vcpu *vcpu)
          * are now visible to the system register interface.
          */
         if (!cpu_if->vgic_sre) {
-                dsb(st);
+                dsb(sy);
+                isb();
                 cpu_if->vgic_vmcr = read_gicreg(ICH_VMCR_EL2);
         }
 
diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
index ec62d1cccab7..b960acdd0c05 100644
--- a/virt/kvm/arm/mmu.c
+++ b/virt/kvm/arm/mmu.c
@@ -1810,9 +1810,9 @@ int kvm_mmu_init(void)
          */
         BUG_ON((hyp_idmap_start ^ (hyp_idmap_end - 1)) & PAGE_MASK);
 
-        kvm_info("IDMAP page: %lx\n", hyp_idmap_start);
-        kvm_info("HYP VA range: %lx:%lx\n",
-                 kern_hyp_va(PAGE_OFFSET), kern_hyp_va(~0UL));
+        kvm_debug("IDMAP page: %lx\n", hyp_idmap_start);
+        kvm_debug("HYP VA range: %lx:%lx\n",
+                  kern_hyp_va(PAGE_OFFSET), kern_hyp_va(~0UL));
 
         if (hyp_idmap_start >= kern_hyp_va(PAGE_OFFSET) &&
             hyp_idmap_start <  kern_hyp_va(~0UL) &&
diff --git a/virt/kvm/arm/vgic/vgic-mmio.c b/virt/kvm/arm/vgic/vgic-mmio.c
index 83d82bd7dc4e..dbe99d635c80 100644
--- a/virt/kvm/arm/vgic/vgic-mmio.c
+++ b/virt/kvm/arm/vgic/vgic-mmio.c
@@ -113,9 +113,12 @@ unsigned long vgic_mmio_read_pending(struct kvm_vcpu *vcpu,
         /* Loop over all IRQs affected by this read */
         for (i = 0; i < len * 8; i++) {
                 struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
+                unsigned long flags;
 
+                spin_lock_irqsave(&irq->irq_lock, flags);
                 if (irq_is_pending(irq))
                         value |= (1U << i);
+                spin_unlock_irqrestore(&irq->irq_lock, flags);
 
                 vgic_put_irq(vcpu->kvm, irq);
         }
diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
index c32d7b93ffd1..29556f71b691 100644
--- a/virt/kvm/arm/vgic/vgic-v2.c
+++ b/virt/kvm/arm/vgic/vgic-v2.c
@@ -37,6 +37,13 @@ void vgic_v2_init_lrs(void)
                 vgic_v2_write_lr(i, 0);
 }
 
+void vgic_v2_set_npie(struct kvm_vcpu *vcpu)
+{
+        struct vgic_v2_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v2;
+
+        cpuif->vgic_hcr |= GICH_HCR_NPIE;
+}
+
 void vgic_v2_set_underflow(struct kvm_vcpu *vcpu)
 {
         struct vgic_v2_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v2;
@@ -64,7 +71,7 @@ void vgic_v2_fold_lr_state(struct kvm_vcpu *vcpu)
         int lr;
         unsigned long flags;
 
-        cpuif->vgic_hcr &= ~GICH_HCR_UIE;
+        cpuif->vgic_hcr &= ~(GICH_HCR_UIE | GICH_HCR_NPIE);
 
         for (lr = 0; lr < vgic_cpu->used_lrs; lr++) {
                 u32 val = cpuif->vgic_lr[lr];
@@ -410,7 +417,7 @@ int vgic_v2_probe(const struct gic_kvm_info *info)
         kvm_vgic_global_state.type = VGIC_V2;
         kvm_vgic_global_state.max_gic_vcpus = VGIC_V2_MAX_CPUS;
 
-        kvm_info("vgic-v2@%llx\n", info->vctrl.start);
+        kvm_debug("vgic-v2@%llx\n", info->vctrl.start);
 
         return 0;
 out:
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 6b329414e57a..0ff2006f3781 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -26,6 +26,13 @@ static bool group1_trap;
 static bool common_trap;
 static bool gicv4_enable;
 
+void vgic_v3_set_npie(struct kvm_vcpu *vcpu)
+{
+        struct vgic_v3_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v3;
+
+        cpuif->vgic_hcr |= ICH_HCR_NPIE;
+}
+
 void vgic_v3_set_underflow(struct kvm_vcpu *vcpu)
 {
         struct vgic_v3_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v3;
@@ -47,7 +54,7 @@ void vgic_v3_fold_lr_state(struct kvm_vcpu *vcpu)
         int lr;
         unsigned long flags;
 
-        cpuif->vgic_hcr &= ~ICH_HCR_UIE;
+        cpuif->vgic_hcr &= ~(ICH_HCR_UIE | ICH_HCR_NPIE);
 
         for (lr = 0; lr < vgic_cpu->used_lrs; lr++) {
                 u64 val = cpuif->vgic_lr[lr];
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index c7c5ef190afa..8201899126f6 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -495,6 +495,32 @@ int kvm_vgic_map_phys_irq(struct kvm_vcpu *vcpu, unsigned int host_irq,
         return ret;
 }
 
+/**
+ * kvm_vgic_reset_mapped_irq - Reset a mapped IRQ
+ * @vcpu: The VCPU pointer
+ * @vintid: The INTID of the interrupt
+ *
+ * Reset the active and pending states of a mapped interrupt.  Kernel
+ * subsystems injecting mapped interrupts should reset their interrupt lines
+ * when we are doing a reset of the VM.
+ */
+void kvm_vgic_reset_mapped_irq(struct kvm_vcpu *vcpu, u32 vintid)
+{
+        struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, vintid);
+        unsigned long flags;
+
+        if (!irq->hw)
+                goto out;
+
+        spin_lock_irqsave(&irq->irq_lock, flags);
+        irq->active = false;
+        irq->pending_latch = false;
+        irq->line_level = false;
+        spin_unlock_irqrestore(&irq->irq_lock, flags);
+out:
+        vgic_put_irq(vcpu->kvm, irq);
+}
+
 int kvm_vgic_unmap_phys_irq(struct kvm_vcpu *vcpu, unsigned int vintid)
 {
         struct vgic_irq *irq;
@@ -684,22 +710,37 @@ static inline void vgic_set_underflow(struct kvm_vcpu *vcpu)
                 vgic_v3_set_underflow(vcpu);
 }
 
+static inline void vgic_set_npie(struct kvm_vcpu *vcpu)
+{
+        if (kvm_vgic_global_state.type == VGIC_V2)
+                vgic_v2_set_npie(vcpu);
+        else
+                vgic_v3_set_npie(vcpu);
+}
+
 /* Requires the ap_list_lock to be held. */
-static int compute_ap_list_depth(struct kvm_vcpu *vcpu)
+static int compute_ap_list_depth(struct kvm_vcpu *vcpu,
+                                 bool *multi_sgi)
 {
         struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
         struct vgic_irq *irq;
         int count = 0;
 
+        *multi_sgi = false;
+
         DEBUG_SPINLOCK_BUG_ON(!spin_is_locked(&vgic_cpu->ap_list_lock));
 
         list_for_each_entry(irq, &vgic_cpu->ap_list_head, ap_list) {
                 spin_lock(&irq->irq_lock);
                 /* GICv2 SGIs can count for more than one... */
-                if (vgic_irq_is_sgi(irq->intid) && irq->source)
-                        count += hweight8(irq->source);
-                else
+                if (vgic_irq_is_sgi(irq->intid) && irq->source) {
+                        int w = hweight8(irq->source);
+
+                        count += w;
+                        *multi_sgi |= (w > 1);
+                } else {
                         count++;
+                }
                 spin_unlock(&irq->irq_lock);
         }
         return count;
@@ -710,28 +751,43 @@ static void vgic_flush_lr_state(struct kvm_vcpu *vcpu)
 {
         struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
         struct vgic_irq *irq;
-        int count = 0;
+        int count;
+        bool npie = false;
+        bool multi_sgi;
+        u8 prio = 0xff;
 
         DEBUG_SPINLOCK_BUG_ON(!spin_is_locked(&vgic_cpu->ap_list_lock));
 
-        if (compute_ap_list_depth(vcpu) > kvm_vgic_global_state.nr_lr)
+        count = compute_ap_list_depth(vcpu, &multi_sgi);
+        if (count > kvm_vgic_global_state.nr_lr || multi_sgi)
                 vgic_sort_ap_list(vcpu);
 
+        count = 0;
+
         list_for_each_entry(irq, &vgic_cpu->ap_list_head, ap_list) {
                 spin_lock(&irq->irq_lock);
 
-                if (unlikely(vgic_target_oracle(irq) != vcpu))
-                        goto next;
-
                 /*
-                 * If we get an SGI with multiple sources, try to get
-                 * them in all at once.
+                 * If we have multi-SGIs in the pipeline, we need to
+                 * guarantee that they are all seen before any IRQ of
+                 * lower priority. In that case, we need to filter out
+                 * these interrupts by exiting early. This is easy as
+                 * the AP list has been sorted already.
                  */
-                do {
+                if (multi_sgi && irq->priority > prio) {
+                        spin_unlock(&irq->irq_lock);
+                        break;
+                }
+
+                if (likely(vgic_target_oracle(irq) == vcpu)) {
                         vgic_populate_lr(vcpu, irq, count++);
-                } while (irq->source && count < kvm_vgic_global_state.nr_lr);
 
-next:
+                        if (irq->source) {
+                                npie = true;
+                                prio = irq->priority;
+                        }
+                }
+
                 spin_unlock(&irq->irq_lock);
 
                 if (count == kvm_vgic_global_state.nr_lr) {
@@ -742,6 +798,9 @@ next:
                 }
         }
 
+        if (npie)
+                vgic_set_npie(vcpu);
+
         vcpu->arch.vgic_cpu.used_lrs = count;
 
         /* Nuke remaining LRs */
diff --git a/virt/kvm/arm/vgic/vgic.h b/virt/kvm/arm/vgic/vgic.h
index 12c37b89f7a3..f5b8519e5546 100644
--- a/virt/kvm/arm/vgic/vgic.h
+++ b/virt/kvm/arm/vgic/vgic.h
@@ -96,6 +96,7 @@
 /* we only support 64 kB translation table page size */
 #define KVM_ITS_L1E_ADDR_MASK           GENMASK_ULL(51, 16)
 
+/* Requires the irq_lock to be held by the caller. */
 static inline bool irq_is_pending(struct vgic_irq *irq)
 {
         if (irq->config == VGIC_CONFIG_EDGE)
@@ -159,6 +160,7 @@ void vgic_v2_fold_lr_state(struct kvm_vcpu *vcpu);
 void vgic_v2_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr);
 void vgic_v2_clear_lr(struct kvm_vcpu *vcpu, int lr);
 void vgic_v2_set_underflow(struct kvm_vcpu *vcpu);
+void vgic_v2_set_npie(struct kvm_vcpu *vcpu);
 int vgic_v2_has_attr_regs(struct kvm_device *dev, struct kvm_device_attr *attr);
 int vgic_v2_dist_uaccess(struct kvm_vcpu *vcpu, bool is_write,
                          int offset, u32 *val);
@@ -188,6 +190,7 @@ void vgic_v3_fold_lr_state(struct kvm_vcpu *vcpu);
 void vgic_v3_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr);
 void vgic_v3_clear_lr(struct kvm_vcpu *vcpu, int lr);
 void vgic_v3_set_underflow(struct kvm_vcpu *vcpu);
+void vgic_v3_set_npie(struct kvm_vcpu *vcpu);
 void vgic_v3_set_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcr);
 void vgic_v3_get_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcr);
 void vgic_v3_enable(struct kvm_vcpu *vcpu);
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 4501e658e8d6..65dea3ffef68 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -969,8 +969,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
                 /* Check for overlaps */
                 r = -EEXIST;
                 kvm_for_each_memslot(slot, __kvm_memslots(kvm, as_id)) {
-                        if ((slot->id >= KVM_USER_MEM_SLOTS) ||
-                            (slot->id == id))
+                        if (slot->id == id)
                                 continue;
                         if (!((base_gfn + npages <= slot->base_gfn) ||
                               (base_gfn >= slot->base_gfn + slot->npages)))