799 files changed, 13402 insertions, 6842 deletions

diff --git a/Documentation/ABI/obsolete/sysfs-class-dax b/Documentation/ABI/obsolete/sysfs-class-dax
new file mode 100644
index 000000000000..2cb9fc5e8bd1
--- /dev/null
+++ b/Documentation/ABI/obsolete/sysfs-class-dax
@@ -0,0 +1,22 @@
+What:           /sys/class/dax/
+Date:           May, 2016
+KernelVersion:  v4.7
+Contact:        linux-nvdimm@lists.01.org
+Description:    Device DAX is the device-centric analogue of Filesystem
+                DAX (CONFIG_FS_DAX).  It allows memory ranges to be
+                allocated and mapped without need of an intervening file
+                system.  Device DAX is strict, precise and predictable.
+                Specifically this interface:
+
+                1/ Guarantees fault granularity with respect to a given
+                page size (pte, pmd, or pud) set at configuration time.
+
+                2/ Enforces deterministic behavior by being strict about
+                what fault scenarios are supported.
+
+                The /sys/class/dax/ interface enumerates all the
+                device-dax instances in the system. The ABI is
+                deprecated and will be removed after 2020. It is
+                replaced with the DAX bus interface /sys/bus/dax/ where
+                device-dax instances can be found under
+                /sys/bus/dax/devices/
diff --git a/Documentation/ABI/testing/sysfs-fs-f2fs b/Documentation/ABI/testing/sysfs-fs-f2fs
index a7ce33199457..91822ce25831 100644
--- a/Documentation/ABI/testing/sysfs-fs-f2fs
+++ b/Documentation/ABI/testing/sysfs-fs-f2fs
@@ -86,6 +86,13 @@ Description:
                 The unit size is one block, now only support configuring in range
                 of [1, 512].
 
+What:          /sys/fs/f2fs/<disk>/umount_discard_timeout
+Date:          January 2019
+Contact:       "Jaegeuk Kim" <jaegeuk@kernel.org>
+Description:
+                Set timeout to issue discard commands during umount.
+                Default: 5 secs
+
 What:           /sys/fs/f2fs/<disk>/max_victim_search
 Date:           January 2014
 Contact:        "Jaegeuk Kim" <jaegeuk.kim@samsung.com>
diff --git a/Documentation/admin-guide/md.rst b/Documentation/admin-guide/md.rst
index 84de718f24a4..3c51084ffd37 100644
--- a/Documentation/admin-guide/md.rst
+++ b/Documentation/admin-guide/md.rst
@@ -756,3 +756,6 @@ These currently include:
       The cache mode for raid5. raid5 could include an extra disk for
       caching. The mode can be "write-throuth" and "write-back". The
       default is "write-through".
+
+  ppl_write_hint
+      NVMe stream ID to be set for each PPL write request.
diff --git a/Documentation/arm/kernel_mode_neon.txt b/Documentation/arm/kernel_mode_neon.txt
index 525452726d31..b9e060c5b61e 100644
--- a/Documentation/arm/kernel_mode_neon.txt
+++ b/Documentation/arm/kernel_mode_neon.txt
@@ -6,7 +6,7 @@ TL;DR summary
 * Use only NEON instructions, or VFP instructions that don't rely on support
   code
 * Isolate your NEON code in a separate compilation unit, and compile it with
-  '-mfpu=neon -mfloat-abi=softfp'
+  '-march=armv7-a -mfpu=neon -mfloat-abi=softfp'
 * Put kernel_neon_begin() and kernel_neon_end() calls around the calls into your
   NEON code
 * Don't sleep in your NEON code, and be aware that it will be executed with
@@ -87,7 +87,7 @@ instructions appearing in unexpected places if no special care is taken.
 Therefore, the recommended and only supported way of using NEON/VFP in the
 kernel is by adhering to the following rules:
 * isolate the NEON code in a separate compilation unit and compile it with
-  '-mfpu=neon -mfloat-abi=softfp';
+  '-march=armv7-a -mfpu=neon -mfloat-abi=softfp';
 * issue the calls to kernel_neon_begin(), kernel_neon_end() as well as the calls
   into the unit containing the NEON code from a compilation unit which is *not*
   built with the GCC flag '-mfpu=neon' set.
diff --git a/Documentation/devicetree/bindings/display/ssd1307fb.txt b/Documentation/devicetree/bindings/display/ssd1307fb.txt
index 209d931ef16c..b67f8caa212c 100644
--- a/Documentation/devicetree/bindings/display/ssd1307fb.txt
+++ b/Documentation/devicetree/bindings/display/ssd1307fb.txt
@@ -36,7 +36,6 @@ ssd1307: oled@3c {
         reg = <0x3c>;
         pwms = <&pwm 4 3000>;
         reset-gpios = <&gpio2 7>;
-        reset-active-low;
 };
 
 ssd1306: oled@3c {
@@ -44,7 +43,6 @@ ssd1306: oled@3c {
         reg = <0x3c>;
         pwms = <&pwm 4 3000>;
         reset-gpios = <&gpio2 7>;
-        reset-active-low;
         solomon,com-lrremap;
         solomon,com-invdir;
         solomon,com-offset = <32>;
diff --git a/Documentation/devicetree/bindings/interrupt-controller/renesas,irqc.txt b/Documentation/devicetree/bindings/interrupt-controller/renesas,irqc.txt
index 8de96a4fb2d5..f977ea7617f6 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/renesas,irqc.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/renesas,irqc.txt
@@ -16,6 +16,7 @@ Required properties:
     - "renesas,irqc-r8a7793" (R-Car M2-N)
     - "renesas,irqc-r8a7794" (R-Car E2)
     - "renesas,intc-ex-r8a774a1" (RZ/G2M)
+    - "renesas,intc-ex-r8a774c0" (RZ/G2E)
     - "renesas,intc-ex-r8a7795" (R-Car H3)
     - "renesas,intc-ex-r8a7796" (R-Car M3-W)
     - "renesas,intc-ex-r8a77965" (R-Car M3-N)
diff --git a/Documentation/filesystems/cifs/TODO b/Documentation/filesystems/cifs/TODO
index 66b3f54aa6dc..9267f3fb131f 100644
--- a/Documentation/filesystems/cifs/TODO
+++ b/Documentation/filesystems/cifs/TODO
@@ -111,7 +111,8 @@ negotiated size) and send larger write sizes to modern servers.
 
 5) Continue to extend the smb3 "buildbot" which does automated xfstesting
 against Windows, Samba and Azure currently - to add additional tests and
-to allow the buildbot to execute the tests faster.
+to allow the buildbot to execute the tests faster. The URL for the
+buildbot is: http://smb3-test-rhel-75.southcentralus.cloudapp.azure.com
 
 6) Address various coverity warnings (most are not bugs per-se, but
 the more warnings are addressed, the easier it is to spot real
diff --git a/Documentation/filesystems/cifs/cifs.txt b/Documentation/filesystems/cifs/cifs.txt
index 67756607246e..1be3d21c286e 100644
--- a/Documentation/filesystems/cifs/cifs.txt
+++ b/Documentation/filesystems/cifs/cifs.txt
@@ -1,16 +1,21 @@
   This is the client VFS module for the SMB3 NAS protocol as well
-  older dialects such as the Common Internet File System (CIFS)
+  as for older dialects such as the Common Internet File System (CIFS)
   protocol which was the successor to the Server Message Block
   (SMB) protocol, the native file sharing mechanism for most early
   PC operating systems. New and improved versions of CIFS are now
-  called SMB2 and SMB3. These dialects are also supported by the
-  CIFS VFS module. CIFS is fully supported by network
-  file servers such as Windows 2000, 2003, 2008, 2012 and 2016
-  as well by Samba (which provides excellent CIFS
-  server support for Linux and many other operating systems), Apple
-  systems, as well as most Network Attached Storage vendors, so
-  this network filesystem client can mount to a wide variety of
-  servers.
+  called SMB2 and SMB3. Use of SMB3 (and later, including SMB3.1.1)
+  is strongly preferred over using older dialects like CIFS due to
+  security reaasons. All modern dialects, including the most recent,
+  SMB3.1.1 are supported by the CIFS VFS module. The SMB3 protocol
+  is implemented and supported by all major file servers
+  such as all modern versions of Windows (including Windows 2016
+  Server), as well as by Samba (which provides excellent
+  CIFS/SMB2/SMB3 server support and tools for Linux and many other
+  operating systems).  Apple systems also support SMB3 well, as
+  do most Network Attached Storage vendors, so this network
+  filesystem client can mount to a wide variety of systems.
+  It also supports mounting to the cloud (for example
+  Microsoft Azure), including the necessary security features.
 
   The intent of this module is to provide the most advanced network
   file system function for SMB3 compliant servers, including advanced
@@ -24,12 +29,17 @@
   cluster file systems for fileserving in some Linux to Linux environments,
   not just in Linux to Windows (or Linux to Mac) environments.
 
-  This filesystem has an mount utility (mount.cifs) that can be obtained from
+  This filesystem has a mount utility (mount.cifs) and various user space
+  tools (including smbinfo and setcifsacl) that can be obtained from
 
-      https://ftp.samba.org/pub/linux-cifs/cifs-utils/
+      https://git.samba.org/?p=cifs-utils.git
+  or
+      git://git.samba.org/cifs-utils.git
 
-  It must be installed in the directory with the other mount helpers.
+  mount.cifs should be installed in the directory with the other mount helpers.
 
   For more information on the module see the project wiki page at
 
+      https://wiki.samba.org/index.php/LinuxCIFS
+  and
       https://wiki.samba.org/index.php/LinuxCIFS_utils
diff --git a/Documentation/filesystems/f2fs.txt b/Documentation/filesystems/f2fs.txt
index e46c2147ddf8..f7b5e4ff0de3 100644
--- a/Documentation/filesystems/f2fs.txt
+++ b/Documentation/filesystems/f2fs.txt
@@ -126,6 +126,8 @@ disable_ext_identify   Disable the extension list configured by mkfs, so f2fs
                        does not aware of cold files such as media files.
 inline_xattr           Enable the inline xattrs feature.
 noinline_xattr         Disable the inline xattrs feature.
+inline_xattr_size=%u   Support configuring inline xattr size, it depends on
+                       flexible inline xattr feature.
 inline_data            Enable the inline data feature: New created small(<~3.4k)
                        files can be written into inode block.
 inline_dentry          Enable the inline dir feature: data in new created
diff --git a/Documentation/kbuild/makefiles.txt b/Documentation/kbuild/makefiles.txt
index f124be6e4c3a..03c065855eaf 100644
--- a/Documentation/kbuild/makefiles.txt
+++ b/Documentation/kbuild/makefiles.txt
@@ -1274,7 +1274,7 @@ See subsequent chapter for the syntax of the Kbuild file.
 
 --- 7.4 mandatory-y
 
-        mandatory-y is essentially used by include/(uapi/)asm-generic/Kbuild.asm
+        mandatory-y is essentially used by include/(uapi/)asm-generic/Kbuild
         to define the minimum set of ASM headers that all architectures must have.
 
         This works like optional generic-y. If a mandatory header is missing
diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
index 356156f5c52d..7de9eee73fcd 100644
--- a/Documentation/virtual/kvm/api.txt
+++ b/Documentation/virtual/kvm/api.txt
@@ -45,6 +45,23 @@ the API.  The only supported use is one virtual machine per process,
 and one vcpu per thread.
 
 
+It is important to note that althought VM ioctls may only be issued from
+the process that created the VM, a VM's lifecycle is associated with its
+file descriptor, not its creator (process).  In other words, the VM and
+its resources, *including the associated address space*, are not freed
+until the last reference to the VM's file descriptor has been released.
+For example, if fork() is issued after ioctl(KVM_CREATE_VM), the VM will
+not be freed until both the parent (original) process and its child have
+put their references to the VM's file descriptor.
+
+Because a VM's resources are not freed until the last reference to its
+file descriptor is released, creating additional references to a VM via
+via fork(), dup(), etc... without careful consideration is strongly
+discouraged and may have unwanted side effects, e.g. memory allocated
+by and on behalf of the VM's process may not be freed/unaccounted when
+the VM is shut down.
+
+
 3. Extensions
 -------------
 
diff --git a/Documentation/virtual/kvm/halt-polling.txt b/Documentation/virtual/kvm/halt-polling.txt
index 4a8418318769..4f791b128dd2 100644
--- a/Documentation/virtual/kvm/halt-polling.txt
+++ b/Documentation/virtual/kvm/halt-polling.txt
@@ -53,7 +53,8 @@ the global max polling interval then the polling interval can be increased in
 the hope that next time during the longer polling interval the wake up source
 will be received while the host is polling and the latency benefits will be
 received. The polling interval is grown in the function grow_halt_poll_ns() and
-is multiplied by the module parameter halt_poll_ns_grow.
+is multiplied by the module parameters halt_poll_ns_grow and
+halt_poll_ns_grow_start.
 
 In the event that the total block time was greater than the global max polling
 interval then the host will never poll for long enough (limited by the global
@@ -80,22 +81,30 @@ shrunk. These variables are defined in include/linux/kvm_host.h and as module
 parameters in virt/kvm/kvm_main.c, or arch/powerpc/kvm/book3s_hv.c in the
 powerpc kvm-hv case.
 
-Module Parameter    |        Description              |      Default Value
+Module Parameter        |   Description             |        Default Value
 --------------------------------------------------------------------------------
-halt_poll_ns        | The global max polling interval | KVM_HALT_POLL_NS_DEFAULT
-                    | which defines the ceiling value |
-                    | of the polling interval for     | (per arch value)
-                    | each vcpu.                      |
+halt_poll_ns            | The global max polling    | KVM_HALT_POLL_NS_DEFAULT
+                        | interval which defines    |
+                        | the ceiling value of the  |
+                        | polling interval for      | (per arch value)
+                        | each vcpu.                |
 --------------------------------------------------------------------------------
-halt_poll_ns_grow   | The value by which the halt     | 2
-                    | polling interval is multiplied  |
-                    | in the grow_halt_poll_ns()      |
-                    | function.                       |
+halt_poll_ns_grow       | The value by which the    | 2
+                        | halt polling interval is  |
+                        | multiplied in the         |
+                        | grow_halt_poll_ns()       |
+                        | function.                 |
 --------------------------------------------------------------------------------
-halt_poll_ns_shrink | The value by which the halt     | 0
-                    | polling interval is divided in  |
-                    | the shrink_halt_poll_ns()       |
-                    | function.                       |
+halt_poll_ns_grow_start | The initial value to grow | 10000
+                        | to from zero in the       |
+                        | grow_halt_poll_ns()       |
+                        | function.                 |
+--------------------------------------------------------------------------------
+halt_poll_ns_shrink     | The value by which the    | 0
+                        | halt polling interval is  |
+                        | divided in the            |
+                        | shrink_halt_poll_ns()     |
+                        | function.                 |
 --------------------------------------------------------------------------------
 
 These module parameters can be set from the debugfs files in:
diff --git a/Documentation/virtual/kvm/mmu.txt b/Documentation/virtual/kvm/mmu.txt
index e507a9e0421e..f365102c80f5 100644
--- a/Documentation/virtual/kvm/mmu.txt
+++ b/Documentation/virtual/kvm/mmu.txt
@@ -224,10 +224,6 @@ Shadow pages contain the following information:
     A bitmap indicating which sptes in spt point (directly or indirectly) at
     pages that may be unsynchronized.  Used to quickly locate all unsychronized
     pages reachable from a given page.
-  mmu_valid_gen:
-    Generation number of the page.  It is compared with kvm->arch.mmu_valid_gen
-    during hash table lookup, and used to skip invalidated shadow pages (see
-    "Zapping all pages" below.)
   clear_spte_count:
     Only present on 32-bit hosts, where a 64-bit spte cannot be written
     atomically.  The reader uses this while running out of the MMU lock
@@ -402,27 +398,6 @@ causes its disallow_lpage to be incremented, thus preventing instantiation of
 a large spte.  The frames at the end of an unaligned memory slot have
 artificially inflated ->disallow_lpages so they can never be instantiated.
 
-Zapping all pages (page generation count)
-=========================================
-
-For the large memory guests, walking and zapping all pages is really slow
-(because there are a lot of pages), and also blocks memory accesses of
-all VCPUs because it needs to hold the MMU lock.
-
-To make it be more scalable, kvm maintains a global generation number
-which is stored in kvm->arch.mmu_valid_gen.  Every shadow page stores
-the current global generation-number into sp->mmu_valid_gen when it
-is created.  Pages with a mismatching generation number are "obsolete".
-
-When KVM need zap all shadow pages sptes, it just simply increases the global
-generation-number then reload root shadow pages on all vcpus.  As the VCPUs
-create new shadow page tables, the old pages are not used because of the
-mismatching generation number.
-
-KVM then walks through all pages and zaps obsolete pages.  While the zap
-operation needs to take the MMU lock, the lock can be released periodically
-so that the VCPUs can make progress.
-
 Fast invalidation of MMIO sptes
 ===============================
 
@@ -435,8 +410,7 @@ shadow pages, and is made more scalable with a similar technique.
 MMIO sptes have a few spare bits, which are used to store a
 generation number.  The global generation number is stored in
 kvm_memslots(kvm)->generation, and increased whenever guest memory info
-changes.  This generation number is distinct from the one described in
-the previous section.
+changes.
 
 When KVM finds an MMIO spte, it checks the generation number of the spte.
 If the generation number of the spte does not equal the global generation
@@ -452,13 +426,16 @@ stored into the MMIO spte.  Thus, the MMIO spte might be created based on
 out-of-date information, but with an up-to-date generation number.
 
 To avoid this, the generation number is incremented again after synchronize_srcu
-returns; thus, the low bit of kvm_memslots(kvm)->generation is only 1 during a
+returns; thus, bit 63 of kvm_memslots(kvm)->generation set to 1 only during a
 memslot update, while some SRCU readers might be using the old copy.  We do not
 want to use an MMIO sptes created with an odd generation number, and we can do
-this without losing a bit in the MMIO spte.  The low bit of the generation
-is not stored in MMIO spte, and presumed zero when it is extracted out of the
-spte.  If KVM is unlucky and creates an MMIO spte while the low bit is 1,
-the next access to the spte will always be a cache miss.
+this without losing a bit in the MMIO spte.  The "update in-progress" bit of the
+generation is not stored in MMIO spte, and is so is implicitly zero when the
+generation is extracted out of the spte.  If KVM is unlucky and creates an MMIO
+spte while an update is in-progress, the next access to the spte will always be
+a cache miss.  For example, a subsequent access during the update window will
+miss due to the in-progress flag diverging, while an access after the update
+window closes will have a higher generation number (as compared to the spte).
 
 
 Further reading
diff --git a/MAINTAINERS b/MAINTAINERS
index f8ff9ae52c21..3e5a5d263f29 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -5278,7 +5278,7 @@ DRM DRIVERS FOR VIVANTE GPU IP
 M:      Lucas Stach <l.stach@pengutronix.de>
 R:      Russell King <linux+etnaviv@armlinux.org.uk>
 R:      Christian Gmeiner <christian.gmeiner@gmail.com>
-L:      etnaviv@lists.freedesktop.org
+L:      etnaviv@lists.freedesktop.org (moderated for non-subscribers)
 L:      dri-devel@lists.freedesktop.org
 S:      Maintained
 F:      drivers/gpu/drm/etnaviv/
@@ -8096,6 +8096,16 @@ F:	include/linux/iommu.h
 F:      include/linux/of_iommu.h
 F:      include/linux/iova.h
 
+IO_URING
+M:      Jens Axboe <axboe@kernel.dk>
+L:      linux-block@vger.kernel.org
+L:      linux-fsdevel@vger.kernel.org
+T:      git git://git.kernel.dk/linux-block
+T:      git git://git.kernel.dk/liburing
+S:      Maintained
+F:      fs/io_uring.c
+F:      include/uapi/linux/io_uring.h
+
 IP MASQUERADING
 M:      Juanjo Ciarlante <jjciarla@raiz.uncu.edu.ar>
 S:      Maintained
@@ -8461,6 +8471,7 @@ F:	include/linux/kvm*
 F:      include/kvm/iodev.h
 F:      virt/kvm/*
 F:      tools/kvm/
+F:      tools/testing/selftests/kvm/
 
 KERNEL VIRTUAL MACHINE FOR AMD-V (KVM/amd)
 M:      Joerg Roedel <joro@8bytes.org>
@@ -8470,29 +8481,25 @@ S:	Maintained
 F:      arch/x86/include/asm/svm.h
 F:      arch/x86/kvm/svm.c
 
-KERNEL VIRTUAL MACHINE FOR ARM (KVM/arm)
+KERNEL VIRTUAL MACHINE FOR ARM/ARM64 (KVM/arm, KVM/arm64)
 M:      Christoffer Dall <christoffer.dall@arm.com>
 M:      Marc Zyngier <marc.zyngier@arm.com>
+R:      James Morse <james.morse@arm.com>
+R:      Julien Thierry <julien.thierry@arm.com>
+R:      Suzuki K Pouloze <suzuki.poulose@arm.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      kvmarm@lists.cs.columbia.edu
 W:      http://systems.cs.columbia.edu/projects/kvm-arm
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm.git
-S:      Supported
+S:      Maintained
 F:      arch/arm/include/uapi/asm/kvm*
 F:      arch/arm/include/asm/kvm*
 F:      arch/arm/kvm/
-F:      virt/kvm/arm/
-F:      include/kvm/arm_*
-
-KERNEL VIRTUAL MACHINE FOR ARM64 (KVM/arm64)
-M:      Christoffer Dall <christoffer.dall@arm.com>
-M:      Marc Zyngier <marc.zyngier@arm.com>
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-L:      kvmarm@lists.cs.columbia.edu
-S:      Maintained
 F:      arch/arm64/include/uapi/asm/kvm*
 F:      arch/arm64/include/asm/kvm*
 F:      arch/arm64/kvm/
+F:      virt/kvm/arm/
+F:      include/kvm/arm_*
 
 KERNEL VIRTUAL MACHINE FOR MIPS (KVM/mips)
 M:      James Hogan <jhogan@kernel.org>
diff --git a/Makefile b/Makefile
index 9ef547fc7ffe..c0a34064c574 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
-PATCHLEVEL = 0
+PATCHLEVEL = 1
 SUBLEVEL = 0
-EXTRAVERSION =
+EXTRAVERSION = -rc2
 NAME = Shy Crocodile
 
 # *DOCUMENTATION*
@@ -31,6 +31,16 @@ _all:
 # descending is started. They are now explicitly listed as the
 # prepare rule.
 
+# Ugly workaround for Debian make-kpkg:
+# make-kpkg directly includes the top Makefile of Linux kernel. In such a case,
+# skip sub-make to support debian_* targets in ruleset/kernel_version.mk, but
+# displays warning to discourage such abusage.
+ifneq ($(word 2, $(MAKEFILE_LIST)),)
+$(warning Do not include top Makefile of Linux Kernel)
+sub-make-done := 1
+MAKEFLAGS += -rR
+endif
+
 ifneq ($(sub-make-done),1)
 
 # Do not use make's built-in rules and variables
@@ -402,7 +412,7 @@ CHECK		= sparse
 
 CHECKFLAGS     := -D__linux__ -Dlinux -D__STDC__ -Dunix -D__unix__ \
                   -Wbitwise -Wno-return-void -Wno-unknown-attribute $(CF)
-NOSTDINC_FLAGS  =
+NOSTDINC_FLAGS :=
 CFLAGS_MODULE   =
 AFLAGS_MODULE   =
 LDFLAGS_MODULE  =
@@ -1088,9 +1098,11 @@ asm-generic := -f $(srctree)/scripts/Makefile.asm-generic obj
 
 PHONY += asm-generic uapi-asm-generic
 asm-generic: uapi-asm-generic
-        $(Q)$(MAKE) $(asm-generic)=arch/$(SRCARCH)/include/generated/asm
+        $(Q)$(MAKE) $(asm-generic)=arch/$(SRCARCH)/include/generated/asm \
+        generic=include/asm-generic
 uapi-asm-generic:
-        $(Q)$(MAKE) $(asm-generic)=arch/$(SRCARCH)/include/generated/uapi/asm
+        $(Q)$(MAKE) $(asm-generic)=arch/$(SRCARCH)/include/generated/uapi/asm \
+        generic=include/uapi/asm-generic
 
 PHONY += prepare-objtool
 prepare-objtool: $(objtool_target)
diff --git a/arch/alpha/include/uapi/asm/Kbuild b/arch/alpha/include/uapi/asm/Kbuild
index 439f5157aa35..7417847dc438 100644
--- a/arch/alpha/include/uapi/asm/Kbuild
+++ b/arch/alpha/include/uapi/asm/Kbuild
@@ -1,3 +1 @@
-include include/uapi/asm-generic/Kbuild.asm
-
 generated-y += unistd_32.h
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index df55672c59e6..c781e45d1d99 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -144,11 +144,11 @@ config ARC_CPU_770
           Support for ARC770 core introduced with Rel 4.10 (Summer 2011)
           This core has a bunch of cool new features:
           -MMU-v3: Variable Page Sz (4k, 8k, 16k), bigger J-TLB (128x4)
-                   Shared Address Spaces (for sharing TLB entries in MMU)
+                   Shared Address Spaces (for sharing TLB entries in MMU)
           -Caches: New Prog Model, Region Flush
           -Insns: endian swap, load-locked/store-conditional, time-stamp-ctr
 
-endif   #ISA_ARCOMPACT
+endif #ISA_ARCOMPACT
 
 config ARC_CPU_HS
         bool "ARC-HS"
@@ -198,7 +198,7 @@ config ARC_SMP_HALT_ON_RESET
           at designated entry point. For other case, all jump to common
           entry point and spin wait for Master's signal.
 
-endif   #SMP
+endif #SMP
 
 config ARC_MCIP
         bool "ARConnect Multicore IP (MCIP) Support "
@@ -249,7 +249,7 @@ config ARC_CACHE_VIPT_ALIASING
         bool "Support VIPT Aliasing D$"
         depends on ARC_HAS_DCACHE && ISA_ARCOMPACT
 
-endif   #ARC_CACHE
+endif #ARC_CACHE
 
 config ARC_HAS_ICCM
         bool "Use ICCM"
@@ -370,7 +370,7 @@ config ARC_FPU_SAVE_RESTORE
           based on actual usage of FPU by a task. Thus our implemn does
           this for all tasks in system.
 
-endif   #ISA_ARCOMPACT
+endif #ISA_ARCOMPACT
 
 config ARC_CANT_LLSC
         def_bool n
@@ -386,6 +386,15 @@ config ARC_HAS_SWAPE
 
 if ISA_ARCV2
 
+config ARC_USE_UNALIGNED_MEM_ACCESS
+        bool "Enable unaligned access in HW"
+        default y
+        select HAVE_EFFICIENT_UNALIGNED_ACCESS
+        help
+          The ARC HS architecture supports unaligned memory access
+          which is disabled by default. Enable unaligned access in
+          hardware and use software to use it
+
 config ARC_HAS_LL64
         bool "Insn: 64bit LDD/STD"
         help
@@ -414,7 +423,7 @@ config ARC_IRQ_NO_AUTOSAVE
           This is programmable and can be optionally disabled in which case
           software INTERRUPT_PROLOGUE/EPILGUE do the needed work
 
-endif   # ISA_ARCV2
+endif # ISA_ARCV2
 
 endmenu   # "ARC CPU Configuration"
 
diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index df00578c279d..e2b991f75bc5 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -28,6 +28,12 @@ cflags-$(CONFIG_ARC_HAS_SWAPE)		+= -mswape
 
 ifdef CONFIG_ISA_ARCV2
 
+ifdef CONFIG_ARC_USE_UNALIGNED_MEM_ACCESS
+cflags-y                                += -munaligned-access
+else
+cflags-y                                += -mno-unaligned-access
+endif
+
 ifndef CONFIG_ARC_HAS_LL64
 cflags-y                                += -mno-ll64
 endif
diff --git a/arch/arc/boot/dts/abilis_tb100.dtsi b/arch/arc/boot/dts/abilis_tb100.dtsi
index 02410b211433..c0bcd97522bb 100644
--- a/arch/arc/boot/dts/abilis_tb100.dtsi
+++ b/arch/arc/boot/dts/abilis_tb100.dtsi
@@ -38,7 +38,7 @@
                         clock-div = <6>;
                 };
 
-                iomux: iomux@FF10601c {
+                iomux: iomux@ff10601c {
                         /* Port 1 */
                         pctl_tsin_s0: pctl-tsin-s0 {   /* Serial TS-in 0 */
                                 abilis,function = "mis0";
@@ -162,182 +162,182 @@
                         };
                 };
 
-                gpioa: gpio@FF140000 {
+                gpioa: gpio@ff140000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF140000 0x1000>;
+                        reg = <0xff140000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <3>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpioa";
                 };
-                gpiob: gpio@FF141000 {
+                gpiob: gpio@ff141000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF141000 0x1000>;
+                        reg = <0xff141000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <2>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpiob";
                 };
-                gpioc: gpio@FF142000 {
+                gpioc: gpio@ff142000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF142000 0x1000>;
+                        reg = <0xff142000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <3>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpioc";
                 };
-                gpiod: gpio@FF143000 {
+                gpiod: gpio@ff143000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF143000 0x1000>;
+                        reg = <0xff143000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <2>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpiod";
                 };
-                gpioe: gpio@FF144000 {
+                gpioe: gpio@ff144000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF144000 0x1000>;
+                        reg = <0xff144000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <3>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpioe";
                 };
-                gpiof: gpio@FF145000 {
+                gpiof: gpio@ff145000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF145000 0x1000>;
+                        reg = <0xff145000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <2>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpiof";
                 };
-                gpiog: gpio@FF146000 {
+                gpiog: gpio@ff146000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF146000 0x1000>;
+                        reg = <0xff146000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <3>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpiog";
                 };
-                gpioh: gpio@FF147000 {
+                gpioh: gpio@ff147000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF147000 0x1000>;
+                        reg = <0xff147000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <2>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpioh";
                 };
-                gpioi: gpio@FF148000 {
+                gpioi: gpio@ff148000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF148000 0x1000>;
+                        reg = <0xff148000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <12>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpioi";
                 };
-                gpioj: gpio@FF149000 {
+                gpioj: gpio@ff149000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF149000 0x1000>;
+                        reg = <0xff149000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <32>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpioj";
                 };
-                gpiok: gpio@FF14a000 {
+                gpiok: gpio@ff14a000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF14A000 0x1000>;
+                        reg = <0xff14a000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <22>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpiok";
                 };
-                gpiol: gpio@FF14b000 {
+                gpiol: gpio@ff14b000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF14B000 0x1000>;
+                        reg = <0xff14b000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <4>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpiol";
                 };
-                gpiom: gpio@FF14c000 {
+                gpiom: gpio@ff14c000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF14C000 0x1000>;
+                        reg = <0xff14c000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <4>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpiom";
                 };
-                gpion: gpio@FF14d000 {
+                gpion: gpio@ff14d000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF14D000 0x1000>;
+                        reg = <0xff14d000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <5>;
diff --git a/arch/arc/boot/dts/abilis_tb100_dvk.dts b/arch/arc/boot/dts/abilis_tb100_dvk.dts
index 3acf04db8030..c968e677db46 100644
--- a/arch/arc/boot/dts/abilis_tb100_dvk.dts
+++ b/arch/arc/boot/dts/abilis_tb100_dvk.dts
@@ -37,27 +37,27 @@
         };
 
         soc100 {
-                uart@FF100000 {
+                uart@ff100000 {
                         pinctrl-names = "default";
                         pinctrl-0 = <&pctl_uart0>;
                 };
-                ethernet@FE100000 {
+                ethernet@fe100000 {
                         phy-mode = "rgmii";
                 };
 
-                i2c0: i2c@FF120000 {
+                i2c0: i2c@ff120000 {
                         i2c-sda-hold-time-ns = <432>;
                 };
-                i2c1: i2c@FF121000 {
+                i2c1: i2c@ff121000 {
                         i2c-sda-hold-time-ns = <432>;
                 };
-                i2c2: i2c@FF122000 {
+                i2c2: i2c@ff122000 {
                         i2c-sda-hold-time-ns = <432>;
                 };
-                i2c3: i2c@FF123000 {
+                i2c3: i2c@ff123000 {
                         i2c-sda-hold-time-ns = <432>;
                 };
-                i2c4: i2c@FF124000 {
+                i2c4: i2c@ff124000 {
                         i2c-sda-hold-time-ns = <432>;
                 };
 
diff --git a/arch/arc/boot/dts/abilis_tb101.dtsi b/arch/arc/boot/dts/abilis_tb101.dtsi
index f9e7686044eb..6a1615f58f05 100644
--- a/arch/arc/boot/dts/abilis_tb101.dtsi
+++ b/arch/arc/boot/dts/abilis_tb101.dtsi
@@ -38,7 +38,7 @@
                         clock-div = <6>;
                 };
 
-                iomux: iomux@FF10601c {
+                iomux: iomux@ff10601c {
                         /* Port 1 */
                         pctl_tsin_s0: pctl-tsin-s0 {   /* Serial TS-in 0 */
                                 abilis,function = "mis0";
@@ -171,182 +171,182 @@
                         };
                 };
 
-                gpioa: gpio@FF140000 {
+                gpioa: gpio@ff140000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF140000 0x1000>;
+                        reg = <0xff140000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <3>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpioa";
                 };
-                gpiob: gpio@FF141000 {
+                gpiob: gpio@ff141000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF141000 0x1000>;
+                        reg = <0xff141000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <2>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpiob";
                 };
-                gpioc: gpio@FF142000 {
+                gpioc: gpio@ff142000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF142000 0x1000>;
+                        reg = <0xff142000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <3>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpioc";
                 };
-                gpiod: gpio@FF143000 {
+                gpiod: gpio@ff143000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF143000 0x1000>;
+                        reg = <0xff143000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <2>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpiod";
                 };
-                gpioe: gpio@FF144000 {
+                gpioe: gpio@ff144000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF144000 0x1000>;
+                        reg = <0xff144000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <3>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpioe";
                 };
-                gpiof: gpio@FF145000 {
+                gpiof: gpio@ff145000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF145000 0x1000>;
+                        reg = <0xff145000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <2>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpiof";
                 };
-                gpiog: gpio@FF146000 {
+                gpiog: gpio@ff146000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF146000 0x1000>;
+                        reg = <0xff146000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <3>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpiog";
                 };
-                gpioh: gpio@FF147000 {
+                gpioh: gpio@ff147000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF147000 0x1000>;
+                        reg = <0xff147000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <2>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpioh";
                 };
-                gpioi: gpio@FF148000 {
+                gpioi: gpio@ff148000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF148000 0x1000>;
+                        reg = <0xff148000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <12>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpioi";
                 };
-                gpioj: gpio@FF149000 {
+                gpioj: gpio@ff149000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF149000 0x1000>;
+                        reg = <0xff149000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <32>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpioj";
                 };
-                gpiok: gpio@FF14a000 {
+                gpiok: gpio@ff14a000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF14A000 0x1000>;
+                        reg = <0xff14a000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <22>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpiok";
                 };
-                gpiol: gpio@FF14b000 {
+                gpiol: gpio@ff14b000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF14B000 0x1000>;
+                        reg = <0xff14b000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <4>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpiol";
                 };
-                gpiom: gpio@FF14c000 {
+                gpiom: gpio@ff14c000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF14C000 0x1000>;
+                        reg = <0xff14c000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <4>;
                         gpio-ranges = <&iomux 0 0 0>;
                         gpio-ranges-group-names = "gpiom";
                 };
-                gpion: gpio@FF14d000 {
+                gpion: gpio@ff14d000 {
                         compatible = "abilis,tb10x-gpio";
                         interrupt-controller;
                         #interrupt-cells = <1>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <27 2>;
-                        reg = <0xFF14D000 0x1000>;
+                        reg = <0xff14d000 0x1000>;
                         gpio-controller;
                         #gpio-cells = <2>;
                         abilis,ngpio = <5>;
diff --git a/arch/arc/boot/dts/abilis_tb101_dvk.dts b/arch/arc/boot/dts/abilis_tb101_dvk.dts
index 37d88c5dd181..05143ce9c120 100644
--- a/arch/arc/boot/dts/abilis_tb101_dvk.dts
+++ b/arch/arc/boot/dts/abilis_tb101_dvk.dts
@@ -37,27 +37,27 @@
         };
 
         soc100 {
-                uart@FF100000 {
+                uart@ff100000 {
                         pinctrl-names = "default";
                         pinctrl-0 = <&pctl_uart0>;
                 };
-                ethernet@FE100000 {
+                ethernet@fe100000 {
                         phy-mode = "rgmii";
                 };
 
-                i2c0: i2c@FF120000 {
+                i2c0: i2c@ff120000 {
                         i2c-sda-hold-time-ns = <432>;
                 };
-                i2c1: i2c@FF121000 {
+                i2c1: i2c@ff121000 {
                         i2c-sda-hold-time-ns = <432>;
                 };
-                i2c2: i2c@FF122000 {
+                i2c2: i2c@ff122000 {
                         i2c-sda-hold-time-ns = <432>;
                 };
-                i2c3: i2c@FF123000 {
+                i2c3: i2c@ff123000 {
                         i2c-sda-hold-time-ns = <432>;
                 };
-                i2c4: i2c@FF124000 {
+                i2c4: i2c@ff124000 {
                         i2c-sda-hold-time-ns = <432>;
                 };
 
diff --git a/arch/arc/boot/dts/abilis_tb10x.dtsi b/arch/arc/boot/dts/abilis_tb10x.dtsi
index 3121536b25a3..2fbf1bdfe6de 100644
--- a/arch/arc/boot/dts/abilis_tb10x.dtsi
+++ b/arch/arc/boot/dts/abilis_tb10x.dtsi
@@ -54,7 +54,7 @@
                 #size-cells     = <1>;
                 device_type     = "soc";
                 ranges          = <0xfe000000 0xfe000000 0x02000000
-                                0x000F0000 0x000F0000 0x00010000>;
+                                0x000f0000 0x000f0000 0x00010000>;
                 compatible      = "abilis,tb10x", "simple-bus";
 
                 pll0: oscillator {
@@ -75,10 +75,10 @@
                         clock-output-names = "ahb_clk";
                 };
 
-                iomux: iomux@FF10601c {
+                iomux: iomux@ff10601c {
                         compatible = "abilis,tb10x-iomux";
                         #gpio-range-cells = <3>;
-                        reg = <0xFF10601c 0x4>;
+                        reg = <0xff10601c 0x4>;
                 };
 
                 intc: interrupt-controller {
@@ -88,7 +88,7 @@
                 };
                 tb10x_ictl: pic@fe002000 {
                         compatible = "abilis,tb10x-ictl";
-                        reg = <0xFE002000 0x20>;
+                        reg = <0xfe002000 0x20>;
                         interrupt-controller;
                         #interrupt-cells = <2>;
                         interrupt-parent = <&intc>;
@@ -96,27 +96,27 @@
                                         20 21 22 23 24 25 26 27 28 29 30 31>;
                 };
 
-                uart@FF100000 {
+                uart@ff100000 {
                         compatible = "snps,dw-apb-uart";
-                        reg = <0xFF100000 0x100>;
+                        reg = <0xff100000 0x100>;
                         clock-frequency = <166666666>;
                         interrupts = <25 8>;
                         reg-shift = <2>;
                         reg-io-width = <4>;
                         interrupt-parent = <&tb10x_ictl>;
                 };
-                ethernet@FE100000 {
+                ethernet@fe100000 {
                         compatible = "snps,dwmac-3.70a","snps,dwmac";
-                        reg = <0xFE100000 0x1058>;
+                        reg = <0xfe100000 0x1058>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <6 8>;
                         interrupt-names = "macirq";
                         clocks = <&ahb_clk>;
                         clock-names = "stmmaceth";
                 };
-                dma@FE000000 {
+                dma@fe000000 {
                         compatible = "snps,dma-spear1340";
-                        reg = <0xFE000000 0x400>;
+                        reg = <0xfe000000 0x400>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <14 8>;
                         dma-channels = <6>;
@@ -132,70 +132,70 @@
                         multi-block = <1 1 1 1 1 1>;
                 };
 
-                i2c0: i2c@FF120000 {
+                i2c0: i2c@ff120000 {
                         #address-cells = <1>;
                         #size-cells = <0>;
                         compatible = "snps,designware-i2c";
-                        reg = <0xFF120000 0x1000>;
+                        reg = <0xff120000 0x1000>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <12 8>;
                         clocks = <&ahb_clk>;
                 };
-                i2c1: i2c@FF121000 {
+                i2c1: i2c@ff121000 {
                         #address-cells = <1>;
                         #size-cells = <0>;
                         compatible = "snps,designware-i2c";
-                        reg = <0xFF121000 0x1000>;
+                        reg = <0xff121000 0x1000>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <12 8>;
                         clocks = <&ahb_clk>;
                 };
-                i2c2: i2c@FF122000 {
+                i2c2: i2c@ff122000 {
                         #address-cells = <1>;
                         #size-cells = <0>;
                         compatible = "snps,designware-i2c";
-                        reg = <0xFF122000 0x1000>;
+                        reg = <0xff122000 0x1000>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <12 8>;
                         clocks = <&ahb_clk>;
                 };
-                i2c3: i2c@FF123000 {
+                i2c3: i2c@ff123000 {
                         #address-cells = <1>;
                         #size-cells = <0>;
                         compatible = "snps,designware-i2c";
-                        reg = <0xFF123000 0x1000>;
+                        reg = <0xff123000 0x1000>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <12 8>;
                         clocks = <&ahb_clk>;
                 };
-                i2c4: i2c@FF124000 {
+                i2c4: i2c@ff124000 {
                         #address-cells = <1>;
                         #size-cells = <0>;
                         compatible = "snps,designware-i2c";
-                        reg = <0xFF124000 0x1000>;
+                        reg = <0xff124000 0x1000>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <12 8>;
                         clocks = <&ahb_clk>;
                 };
 
-                spi0: spi@0xFE010000 {
+                spi0: spi@fe010000 {
                         #address-cells = <1>;
                         #size-cells = <0>;
                         cell-index = <0>;
                         compatible = "abilis,tb100-spi";
                         num-cs = <1>;
-                        reg = <0xFE010000 0x20>;
+                        reg = <0xfe010000 0x20>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <26 8>;
                         clocks = <&ahb_clk>;
                 };
-                spi1: spi@0xFE011000 {
+                spi1: spi@fe011000 {
                         #address-cells = <1>;
                         #size-cells = <0>;
                         cell-index = <1>;
                         compatible = "abilis,tb100-spi";
                         num-cs = <2>;
-                        reg = <0xFE011000 0x20>;
+                        reg = <0xfe011000 0x20>;
                         interrupt-parent = <&tb10x_ictl>;
                         interrupts = <10 8>;
                         clocks = <&ahb_clk>;
@@ -226,23 +226,23 @@
                         interrupts = <20 2>, <19 2>;
                         interrupt-names = "cmd_irq", "event_irq";
                 };
-                tb10x_mdsc0: tb10x-mdscr@FF300000 {
+                tb10x_mdsc0: tb10x-mdscr@ff300000 {
                         compatible = "abilis,tb100-mdscr";
-                        reg = <0xFF300000 0x7000>;
+                        reg = <0xff300000 0x7000>;
                         tb100-mdscr-manage-tsin;
                 };
-                tb10x_mscr0: tb10x-mdscr@FF307000 {
+                tb10x_mscr0: tb10x-mdscr@ff307000 {
                         compatible = "abilis,tb100-mdscr";
-                        reg = <0xFF307000 0x7000>;
+                        reg = <0xff307000 0x7000>;
                 };
                 tb10x_scr0: tb10x-mdscr@ff30e000 {
                         compatible = "abilis,tb100-mdscr";
-                        reg = <0xFF30e000 0x4000>;
+                        reg = <0xff30e000 0x4000>;
                         tb100-mdscr-manage-tsin;
                 };
                 tb10x_scr1: tb10x-mdscr@ff312000 {
                         compatible = "abilis,tb100-mdscr";
-                        reg = <0xFF312000 0x4000>;
+                        reg = <0xff312000 0x4000>;
                         tb100-mdscr-manage-tsin;
                 };
                 tb10x_wfb: tb10x-wfb@ff319000 {
diff --git a/arch/arc/boot/dts/axc001.dtsi b/arch/arc/boot/dts/axc001.dtsi
index fdc266504ada..37be3bf03ad6 100644
--- a/arch/arc/boot/dts/axc001.dtsi
+++ b/arch/arc/boot/dts/axc001.dtsi
@@ -41,7 +41,7 @@
                  * this GPIO block ORs all interrupts on CPU card (creg,..)
                  * to uplink only 1 IRQ to ARC core intc
                  */
-                dw-apb-gpio@0x2000 {
+                dw-apb-gpio@2000 {
                         compatible = "snps,dw-apb-gpio";
                         reg = < 0x2000 0x80 >;
                         #address-cells = <1>;
@@ -60,7 +60,7 @@
                         };
                 };
 
-                debug_uart: dw-apb-uart@0x5000 {
+                debug_uart: dw-apb-uart@5000 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x5000 0x100>;
                         clock-frequency = <33333000>;
@@ -88,7 +88,7 @@
          * avoid duplicating the MB dtsi file given that IRQ from
          * this intc to cpu intc are different for axs101 and axs103
          */
-        mb_intc: dw-apb-ictl@0xe0012000 {
+        mb_intc: dw-apb-ictl@e0012000 {
                 #interrupt-cells = <1>;
                 compatible = "snps,dw-apb-ictl";
                 reg = < 0x0 0xe0012000 0x0 0x200 >;
diff --git a/arch/arc/boot/dts/axc003.dtsi b/arch/arc/boot/dts/axc003.dtsi
index d75d65ddf8e3..effa37536d7a 100644
--- a/arch/arc/boot/dts/axc003.dtsi
+++ b/arch/arc/boot/dts/axc003.dtsi
@@ -55,7 +55,7 @@
                  * this GPIO block ORs all interrupts on CPU card (creg,..)
                  * to uplink only 1 IRQ to ARC core intc
                  */
-                dw-apb-gpio@0x2000 {
+                dw-apb-gpio@2000 {
                         compatible = "snps,dw-apb-gpio";
                         reg = < 0x2000 0x80 >;
                         #address-cells = <1>;
@@ -74,7 +74,7 @@
                         };
                 };
 
-                debug_uart: dw-apb-uart@0x5000 {
+                debug_uart: dw-apb-uart@5000 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x5000 0x100>;
                         clock-frequency = <33333000>;
@@ -102,19 +102,19 @@
          * external DMA buffer located outside of IOC aperture.
          */
         axs10x_mb {
-                ethernet@0x18000 {
+                ethernet@18000 {
                         dma-coherent;
                 };
 
-                ehci@0x40000 {
+                ehci@40000 {
                         dma-coherent;
                 };
 
-                ohci@0x60000 {
+                ohci@60000 {
                         dma-coherent;
                 };
 
-                mmc@0x15000 {
+                mmc@15000 {
                         dma-coherent;
                 };
         };
@@ -132,7 +132,7 @@
          * avoid duplicating the MB dtsi file given that IRQ from
          * this intc to cpu intc are different for axs101 and axs103
          */
-        mb_intc: dw-apb-ictl@0xe0012000 {
+        mb_intc: dw-apb-ictl@e0012000 {
                 #interrupt-cells = <1>;
                 compatible = "snps,dw-apb-ictl";
                 reg = < 0x0 0xe0012000 0x0 0x200 >;
@@ -153,7 +153,7 @@
                 #size-cells = <2>;
                 ranges;
                 /*
-                 * Move frame buffer out of IOC aperture (0x8z-0xAz).
+                 * Move frame buffer out of IOC aperture (0x8z-0xaz).
                  */
                 frame_buffer: frame_buffer@be000000 {
                         compatible = "shared-dma-pool";
diff --git a/arch/arc/boot/dts/axc003_idu.dtsi b/arch/arc/boot/dts/axc003_idu.dtsi
index a05bb737ea63..e401e59f6180 100644
--- a/arch/arc/boot/dts/axc003_idu.dtsi
+++ b/arch/arc/boot/dts/axc003_idu.dtsi
@@ -62,7 +62,7 @@
                  * this GPIO block ORs all interrupts on CPU card (creg,..)
                  * to uplink only 1 IRQ to ARC core intc
                  */
-                dw-apb-gpio@0x2000 {
+                dw-apb-gpio@2000 {
                         compatible = "snps,dw-apb-gpio";
                         reg = < 0x2000 0x80 >;
                         #address-cells = <1>;
@@ -81,7 +81,7 @@
                         };
                 };
 
-                debug_uart: dw-apb-uart@0x5000 {
+                debug_uart: dw-apb-uart@5000 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x5000 0x100>;
                         clock-frequency = <33333000>;
@@ -109,19 +109,19 @@
          * external DMA buffer located outside of IOC aperture.
          */
         axs10x_mb {
-                ethernet@0x18000 {
+                ethernet@18000 {
                         dma-coherent;
                 };
 
-                ehci@0x40000 {
+                ehci@40000 {
                         dma-coherent;
                 };
 
-                ohci@0x60000 {
+                ohci@60000 {
                         dma-coherent;
                 };
 
-                mmc@0x15000 {
+                mmc@15000 {
                         dma-coherent;
                 };
         };
@@ -138,7 +138,7 @@
          * avoid duplicating the MB dtsi file given that IRQ from
          * this intc to cpu intc are different for axs101 and axs103
          */
-        mb_intc: dw-apb-ictl@0xe0012000 {
+        mb_intc: dw-apb-ictl@e0012000 {
                 #interrupt-cells = <1>;
                 compatible = "snps,dw-apb-ictl";
                 reg = < 0x0 0xe0012000 0x0 0x200 >;
@@ -159,7 +159,7 @@
                 #size-cells = <2>;
                 ranges;
                 /*
-                 * Move frame buffer out of IOC aperture (0x8z-0xAz).
+                 * Move frame buffer out of IOC aperture (0x8z-0xaz).
                  */
                 frame_buffer: frame_buffer@be000000 {
                         compatible = "shared-dma-pool";
diff --git a/arch/arc/boot/dts/axs10x_mb.dtsi b/arch/arc/boot/dts/axs10x_mb.dtsi
index 37bafd44e36d..4ead6dc9af2f 100644
--- a/arch/arc/boot/dts/axs10x_mb.dtsi
+++ b/arch/arc/boot/dts/axs10x_mb.dtsi
@@ -72,7 +72,7 @@
                         };
                 };
 
-                gmac: ethernet@0x18000 {
+                gmac: ethernet@18000 {
                         #interrupt-cells = <1>;
                         compatible = "snps,dwmac";
                         reg = < 0x18000 0x2000 >;
@@ -88,13 +88,13 @@
                         mac-address = [00 00 00 00 00 00]; /* Filled in by U-Boot */
                 };
 
-                ehci@0x40000 {
+                ehci@40000 {
                         compatible = "generic-ehci";
                         reg = < 0x40000 0x100 >;
                         interrupts = < 8 >;
                 };
 
-                ohci@0x60000 {
+                ohci@60000 {
                         compatible = "generic-ohci";
                         reg = < 0x60000 0x100 >;
                         interrupts = < 8 >;
@@ -118,7 +118,7 @@
                  * dw_mci_pltfm_prepare_command() is used in generic platform
                  * code.
                  */
-                mmc@0x15000 {
+                mmc@15000 {
                         compatible = "altr,socfpga-dw-mshc";
                         reg = < 0x15000 0x400 >;
                         fifo-depth = < 16 >;
@@ -129,7 +129,7 @@
                         bus-width = < 4 >;
                 };
 
-                uart@0x20000 {
+                uart@20000 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x20000 0x100>;
                         clock-frequency = <33333333>;
@@ -139,7 +139,7 @@
                         reg-io-width = <4>;
                 };
 
-                uart@0x21000 {
+                uart@21000 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x21000 0x100>;
                         clock-frequency = <33333333>;
@@ -150,7 +150,7 @@
                 };
 
                 /* UART muxed with USB data port (ttyS3) */
-                uart@0x22000 {
+                uart@22000 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x22000 0x100>;
                         clock-frequency = <33333333>;
@@ -160,7 +160,7 @@
                         reg-io-width = <4>;
                 };
 
-                i2c@0x1d000 {
+                i2c@1d000 {
                         compatible = "snps,designware-i2c";
                         reg = <0x1d000 0x100>;
                         clock-frequency = <400000>;
@@ -177,7 +177,7 @@
                         #sound-dai-cells = <0>;
                 };
 
-                i2c@0x1f000 {
+                i2c@1f000 {
                         compatible = "snps,designware-i2c";
                         #address-cells = <1>;
                         #size-cells = <0>;
@@ -218,13 +218,13 @@
                                 };
                         };
 
-                        eeprom@0x54{
+                        eeprom@54{
                                 compatible = "atmel,24c01";
                                 reg = <0x54>;
                                 pagesize = <0x8>;
                         };
 
-                        eeprom@0x57{
+                        eeprom@57{
                                 compatible = "atmel,24c04";
                                 reg = <0x57>;
                                 pagesize = <0x8>;
diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts
index 43f17b51ee89..69bc1c9e8e50 100644
--- a/arch/arc/boot/dts/hsdk.dts
+++ b/arch/arc/boot/dts/hsdk.dts
@@ -110,12 +110,12 @@
                 cgu_rst: reset-controller@8a0 {
                         compatible = "snps,hsdk-reset";
                         #reset-cells = <1>;
-                        reg = <0x8A0 0x4>, <0xFF0 0x4>;
+                        reg = <0x8a0 0x4>, <0xff0 0x4>;
                 };
 
                 core_clk: core-clk@0 {
                         compatible = "snps,hsdk-core-pll-clock";
-                        reg = <0x00 0x10>, <0x14B8 0x4>;
+                        reg = <0x00 0x10>, <0x14b8 0x4>;
                         #clock-cells = <0>;
                         clocks = <&input_clk>;
 
@@ -167,6 +167,18 @@
                         #clock-cells = <0>;
                 };
 
+                dmac_core_clk: dmac-core-clk {
+                        compatible = "fixed-clock";
+                        clock-frequency = <400000000>;
+                        #clock-cells = <0>;
+                };
+
+                dmac_cfg_clk: dmac-gpu-cfg-clk {
+                        compatible = "fixed-clock";
+                        clock-frequency = <200000000>;
+                        #clock-cells = <0>;
+                };
+
                 gmac: ethernet@8000 {
                         #interrupt-cells = <1>;
                         compatible = "snps,dwmac";
@@ -200,6 +212,7 @@
                         compatible = "snps,hsdk-v1.0-ohci", "generic-ohci";
                         reg = <0x60000 0x100>;
                         interrupts = <15>;
+                        resets = <&cgu_rst HSDK_USB_RESET>;
                         dma-coherent;
                 };
 
@@ -207,6 +220,7 @@
                         compatible = "snps,hsdk-v1.0-ehci", "generic-ehci";
                         reg = <0x40000 0x100>;
                         interrupts = <15>;
+                        resets = <&cgu_rst HSDK_USB_RESET>;
                         dma-coherent;
                 };
 
@@ -237,6 +251,21 @@
                                 reg = <0>;
                         };
                 };
+
+                dmac: dmac@80000 {
+                        compatible = "snps,axi-dma-1.01a";
+                        reg = <0x80000 0x400>;
+                        interrupts = <27>;
+                        clocks = <&dmac_core_clk>, <&dmac_cfg_clk>;
+                        clock-names = "core-clk", "cfgr-clk";
+
+                        dma-channels = <4>;
+                        snps,dma-masters = <2>;
+                        snps,data-width = <3>;
+                        snps,block-size = <4096 4096 4096 4096>;
+                        snps,priority = <0 1 2 3>;
+                        snps,axi-max-burst-len = <16>;
+                };
         };
 
         memory@80000000 {
diff --git a/arch/arc/boot/dts/vdk_axc003.dtsi b/arch/arc/boot/dts/vdk_axc003.dtsi
index 0fd6ba985b16..84e8766c8ca2 100644
--- a/arch/arc/boot/dts/vdk_axc003.dtsi
+++ b/arch/arc/boot/dts/vdk_axc003.dtsi
@@ -36,7 +36,7 @@
                         #interrupt-cells = <1>;
                 };
 
-                debug_uart: dw-apb-uart@0x5000 {
+                debug_uart: dw-apb-uart@5000 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x5000 0x100>;
                         clock-frequency = <2403200>;
@@ -49,7 +49,7 @@
 
         };
 
-        mb_intc: dw-apb-ictl@0xe0012000 {
+        mb_intc: dw-apb-ictl@e0012000 {
                 #interrupt-cells = <1>;
                 compatible = "snps,dw-apb-ictl";
                 reg = < 0xe0012000 0x200 >;
diff --git a/arch/arc/boot/dts/vdk_axc003_idu.dtsi b/arch/arc/boot/dts/vdk_axc003_idu.dtsi
index 28956f9a9f3d..eb7e705e8a27 100644
--- a/arch/arc/boot/dts/vdk_axc003_idu.dtsi
+++ b/arch/arc/boot/dts/vdk_axc003_idu.dtsi
@@ -44,7 +44,7 @@
                         #interrupt-cells = <1>;
                 };
 
-                debug_uart: dw-apb-uart@0x5000 {
+                debug_uart: dw-apb-uart@5000 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x5000 0x100>;
                         clock-frequency = <2403200>;
@@ -57,7 +57,7 @@
 
         };
 
-        mb_intc: dw-apb-ictl@0xe0012000 {
+        mb_intc: dw-apb-ictl@e0012000 {
                 #interrupt-cells = <1>;
                 compatible = "snps,dw-apb-ictl";
                 reg = < 0xe0012000 0x200 >;
diff --git a/arch/arc/boot/dts/vdk_axs10x_mb.dtsi b/arch/arc/boot/dts/vdk_axs10x_mb.dtsi
index 48bb4b4cd234..925d5cc95dbb 100644
--- a/arch/arc/boot/dts/vdk_axs10x_mb.dtsi
+++ b/arch/arc/boot/dts/vdk_axs10x_mb.dtsi
@@ -36,7 +36,7 @@
                         };
                 };
 
-                ethernet@0x18000 {
+                ethernet@18000 {
                         #interrupt-cells = <1>;
                         compatible = "snps,dwmac";
                         reg = < 0x18000 0x2000 >;
@@ -49,13 +49,13 @@
                         clock-names = "stmmaceth";
                 };
 
-                ehci@0x40000 {
+                ehci@40000 {
                         compatible = "generic-ehci";
                         reg = < 0x40000 0x100 >;
                         interrupts = < 8 >;
                 };
 
-                uart@0x20000 {
+                uart@20000 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x20000 0x100>;
                         clock-frequency = <2403200>;
@@ -65,7 +65,7 @@
                         reg-io-width = <4>;
                 };
 
-                uart@0x21000 {
+                uart@21000 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x21000 0x100>;
                         clock-frequency = <2403200>;
@@ -75,7 +75,7 @@
                         reg-io-width = <4>;
                 };
 
-                uart@0x22000 {
+                uart@22000 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x22000 0x100>;
                         clock-frequency = <2403200>;
@@ -101,7 +101,7 @@
                         interrupt-names = "arc_ps2_irq";
                 };
 
-                mmc@0x15000 {
+                mmc@15000 {
                         compatible = "snps,dw-mshc";
                         reg = <0x15000 0x400>;
                         fifo-depth = <1024>;
@@ -117,11 +117,11 @@
          * Embedded Vision subsystem UIO mappings; only relevant for EV VDK
          *
          * This node is intentionally put outside of MB above becase
-         * it maps areas outside of MB's 0xEz-0xFz.
+         * it maps areas outside of MB's 0xez-0xfz.
          */
-        uio_ev: uio@0xD0000000 {
+        uio_ev: uio@d0000000 {
                 compatible = "generic-uio";
-                reg = <0xD0000000 0x2000 0xD1000000 0x2000 0x90000000 0x10000000 0xC0000000 0x10000000>;
+                reg = <0xd0000000 0x2000 0xd1000000 0x2000 0x90000000 0x10000000 0xc0000000 0x10000000>;
                 reg-names = "ev_gsa", "ev_ctrl", "ev_shared_mem", "ev_code_mem";
                 interrupt-parent = <&mb_intc>;
                 interrupts = <23>;
diff --git a/arch/arc/configs/hsdk_defconfig b/arch/arc/configs/hsdk_defconfig
index 6fd3d29546af..0e5fd29ed238 100644
--- a/arch/arc/configs/hsdk_defconfig
+++ b/arch/arc/configs/hsdk_defconfig
@@ -8,6 +8,7 @@ CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
 # CONFIG_PID_NS is not set
 CONFIG_BLK_DEV_INITRD=y
+CONFIG_BLK_DEV_RAM=y
 CONFIG_EMBEDDED=y
 CONFIG_PERF_EVENTS=y
 # CONFIG_VM_EVENT_COUNTERS is not set
diff --git a/arch/arc/include/asm/arcregs.h b/arch/arc/include/asm/arcregs.h
index a27eafdc8260..a7d4be87b2f0 100644
--- a/arch/arc/include/asm/arcregs.h
+++ b/arch/arc/include/asm/arcregs.h
@@ -82,6 +82,7 @@
 #define ECR_V_DTLB_MISS                 0x05
 #define ECR_V_PROTV                     0x06
 #define ECR_V_TRAP                      0x09
+#define ECR_V_MISALIGN                  0x0d
 #endif
 
 /* DTLB Miss and Protection Violation Cause Codes */
@@ -167,14 +168,6 @@ struct bcr_mpy {
 #endif
 };
 
-struct bcr_extn_xymem {
-#ifdef CONFIG_CPU_BIG_ENDIAN
-        unsigned int ram_org:2, num_banks:4, bank_sz:4, ver:8;
-#else
-        unsigned int ver:8, bank_sz:4, num_banks:4, ram_org:2;
-#endif
-};
-
 struct bcr_iccm_arcompact {
 #ifdef CONFIG_CPU_BIG_ENDIAN
         unsigned int base:16, pad:5, sz:3, ver:8;
@@ -312,7 +305,7 @@ struct cpuinfo_arc {
         struct cpuinfo_arc_bpu bpu;
         struct bcr_identity core;
         struct bcr_isa_arcv2 isa;
-        const char *details, *name;
+        const char *release, *name;
         unsigned int vec_base;
         struct cpuinfo_arc_ccm iccm, dccm;
         struct {
@@ -322,7 +315,6 @@ struct cpuinfo_arc {
                              timer0:1, timer1:1, rtc:1, gfrc:1, pad4:4;
         } extn;
         struct bcr_mpy extn_mpy;
-        struct bcr_extn_xymem extn_xymem;
 };
 
 extern struct cpuinfo_arc cpuinfo_arc700[];
diff --git a/arch/arc/include/asm/irqflags-arcv2.h b/arch/arc/include/asm/irqflags-arcv2.h
index 8a4f77ea3238..e66d0339e1d8 100644
--- a/arch/arc/include/asm/irqflags-arcv2.h
+++ b/arch/arc/include/asm/irqflags-arcv2.h
@@ -44,7 +44,13 @@
 #define ARCV2_IRQ_DEF_PRIO      1
 
 /* seed value for status register */
-#define ISA_INIT_STATUS_BITS    (STATUS_IE_MASK | STATUS_AD_MASK | \
+#ifdef CONFIG_ARC_USE_UNALIGNED_MEM_ACCESS
+#define __AD_ENB        STATUS_AD_MASK
+#else
+#define __AD_ENB        0
+#endif
+
+#define ISA_INIT_STATUS_BITS    (STATUS_IE_MASK | __AD_ENB | \
                                         (ARCV2_IRQ_DEF_PRIO << 1))
 
 #ifndef __ASSEMBLY__
diff --git a/arch/arc/include/asm/perf_event.h b/arch/arc/include/asm/perf_event.h
index 6958545390f0..9cd7ee4fad39 100644
--- a/arch/arc/include/asm/perf_event.h
+++ b/arch/arc/include/asm/perf_event.h
@@ -105,10 +105,10 @@ static const char * const arc_pmu_ev_hw_map[] = {
         [PERF_COUNT_HW_INSTRUCTIONS] = "iall",
         /* All jump instructions that are taken */
         [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = "ijmptak",
-        [PERF_COUNT_ARC_BPOK]         = "bpok",   /* NP-NT, PT-T, PNT-NT */
 #ifdef CONFIG_ISA_ARCV2
         [PERF_COUNT_HW_BRANCH_MISSES] = "bpmp",
 #else
+        [PERF_COUNT_ARC_BPOK]         = "bpok",   /* NP-NT, PT-T, PNT-NT */
         [PERF_COUNT_HW_BRANCH_MISSES] = "bpfail", /* NP-T, PT-NT, PNT-T */
 #endif
         [PERF_COUNT_ARC_LDC] = "imemrdc",       /* Instr: mem read cached */
diff --git a/arch/arc/include/asm/spinlock.h b/arch/arc/include/asm/spinlock.h
index 2ba04a7db621..daa914da7968 100644
--- a/arch/arc/include/asm/spinlock.h
+++ b/arch/arc/include/asm/spinlock.h
@@ -21,8 +21,6 @@ static inline void arch_spin_lock(arch_spinlock_t *lock)
 {
         unsigned int val;
 
-        smp_mb();
-
         __asm__ __volatile__(
         "1:     llock   %[val], [%[slock]]      \n"
         "       breq    %[val], %[LOCKED], 1b   \n"     /* spin while LOCKED */
@@ -34,6 +32,14 @@ static inline void arch_spin_lock(arch_spinlock_t *lock)
           [LOCKED]      "r"     (__ARCH_SPIN_LOCK_LOCKED__)
         : "memory", "cc");
 
+        /*
+         * ACQUIRE barrier to ensure load/store after taking the lock
+         * don't "bleed-up" out of the critical section (leak-in is allowed)
+         * http://www.spinics.net/lists/kernel/msg2010409.html
+         *
+         * ARCv2 only has load-load, store-store and all-all barrier
+         * thus need the full all-all barrier
+         */
         smp_mb();
 }
 
@@ -42,8 +48,6 @@ static inline int arch_spin_trylock(arch_spinlock_t *lock)
 {
         unsigned int val, got_it = 0;
 
-        smp_mb();
-
         __asm__ __volatile__(
         "1:     llock   %[val], [%[slock]]      \n"
         "       breq    %[val], %[LOCKED], 4f   \n"     /* already LOCKED, just bail */
@@ -67,9 +71,7 @@ static inline void arch_spin_unlock(arch_spinlock_t *lock)
 {
         smp_mb();
 
-        lock->slock = __ARCH_SPIN_LOCK_UNLOCKED__;
-
-        smp_mb();
+        WRITE_ONCE(lock->slock, __ARCH_SPIN_LOCK_UNLOCKED__);
 }
 
 /*
@@ -81,8 +83,6 @@ static inline void arch_read_lock(arch_rwlock_t *rw)
 {
         unsigned int val;
 
-        smp_mb();
-
         /*
          * zero means writer holds the lock exclusively, deny Reader.
          * Otherwise grant lock to first/subseq reader
@@ -113,8 +113,6 @@ static inline int arch_read_trylock(arch_rwlock_t *rw)
 {
         unsigned int val, got_it = 0;
 
-        smp_mb();
-
         __asm__ __volatile__(
         "1:     llock   %[val], [%[rwlock]]     \n"
         "       brls    %[val], %[WR_LOCKED], 4f\n"     /* <= 0: already write locked, bail */
@@ -140,8 +138,6 @@ static inline void arch_write_lock(arch_rwlock_t *rw)
 {
         unsigned int val;
 
-        smp_mb();
-
         /*
          * If reader(s) hold lock (lock < __ARCH_RW_LOCK_UNLOCKED__),
          * deny writer. Otherwise if unlocked grant to writer
@@ -175,8 +171,6 @@ static inline int arch_write_trylock(arch_rwlock_t *rw)
 {
         unsigned int val, got_it = 0;
 
-        smp_mb();
-
         __asm__ __volatile__(
         "1:     llock   %[val], [%[rwlock]]     \n"
         "       brne    %[val], %[UNLOCKED], 4f \n"     /* !UNLOCKED, bail */
@@ -217,17 +211,13 @@ static inline void arch_read_unlock(arch_rwlock_t *rw)
         : [val]         "=&r"   (val)
         : [rwlock]      "r"     (&(rw->counter))
         : "memory", "cc");
-
-        smp_mb();
 }
 
 static inline void arch_write_unlock(arch_rwlock_t *rw)
 {
         smp_mb();
 
-        rw->counter = __ARCH_RW_LOCK_UNLOCKED__;
-
-        smp_mb();
+        WRITE_ONCE(rw->counter, __ARCH_RW_LOCK_UNLOCKED__);
 }
 
 #else   /* !CONFIG_ARC_HAS_LLSC */
@@ -237,10 +227,9 @@ static inline void arch_spin_lock(arch_spinlock_t *lock)
         unsigned int val = __ARCH_SPIN_LOCK_LOCKED__;
 
         /*
-         * This smp_mb() is technically superfluous, we only need the one
-         * after the lock for providing the ACQUIRE semantics.
-         * However doing the "right" thing was regressing hackbench
-         * so keeping this, pending further investigation
+         * Per lkmm, smp_mb() is only required after _lock (and before_unlock)
+         * for ACQ and REL semantics respectively. However EX based spinlocks
+         * need the extra smp_mb to workaround a hardware quirk.
          */
         smp_mb();
 
@@ -257,14 +246,6 @@ static inline void arch_spin_lock(arch_spinlock_t *lock)
 #endif
         : "memory");
 
-        /*
-         * ACQUIRE barrier to ensure load/store after taking the lock
-         * don't "bleed-up" out of the critical section (leak-in is allowed)
-         * http://www.spinics.net/lists/kernel/msg2010409.html
-         *
-         * ARCv2 only has load-load, store-store and all-all barrier
-         * thus need the full all-all barrier
-         */
         smp_mb();
 }
 
@@ -309,8 +290,7 @@ static inline void arch_spin_unlock(arch_spinlock_t *lock)
         : "memory");
 
         /*
-         * superfluous, but keeping for now - see pairing version in
-         * arch_spin_lock above
+         * see pairing version/comment in arch_spin_lock above
          */
         smp_mb();
 }
@@ -344,7 +324,6 @@ static inline int arch_read_trylock(arch_rwlock_t *rw)
         arch_spin_unlock(&(rw->lock_mutex));
         local_irq_restore(flags);
 
-        smp_mb();
         return ret;
 }
 
diff --git a/arch/arc/include/uapi/asm/Kbuild b/arch/arc/include/uapi/asm/Kbuild
index 0febf1a07c30..755bb11323d8 100644
--- a/arch/arc/include/uapi/asm/Kbuild
+++ b/arch/arc/include/uapi/asm/Kbuild
@@ -1,4 +1,2 @@
-include include/uapi/asm-generic/Kbuild.asm
-
 generic-y += kvm_para.h
 generic-y += ucontext.h
diff --git a/arch/arc/kernel/head.S b/arch/arc/kernel/head.S
index 30e090625916..8f6e0447dd17 100644
--- a/arch/arc/kernel/head.S
+++ b/arch/arc/kernel/head.S
@@ -54,7 +54,12 @@
         ; gcc 7.3.1 (ARC GNU 2018.03) onwards generates unaligned access
         ; by default
         lr      r5, [status32]
+#ifdef CONFIG_ARC_USE_UNALIGNED_MEM_ACCESS
         bset    r5, r5, STATUS_AD_BIT
+#else
+        ; Although disabled at reset, bootloader might have enabled it
+        bclr    r5, r5, STATUS_AD_BIT
+#endif
         kflag   r5
 #endif
 .endm
@@ -106,6 +111,7 @@ ENTRY(stext)
         ;    r2 = pointer to uboot provided cmdline or external DTB in mem
         ; These are handled later in handle_uboot_args()
         st      r0, [@uboot_tag]
+        st      r1, [@uboot_magic]
         st      r2, [@uboot_arg]
 
         ; setup "current" tsk and optionally cache it in dedicated r25
diff --git a/arch/arc/kernel/intc-arcv2.c b/arch/arc/kernel/intc-arcv2.c
index cf18b3e5a934..c0d0124de089 100644
--- a/arch/arc/kernel/intc-arcv2.c
+++ b/arch/arc/kernel/intc-arcv2.c
@@ -95,7 +95,7 @@ void arc_init_IRQ(void)
 
         /* setup status32, don't enable intr yet as kernel doesn't want */
         tmp = read_aux_reg(ARC_REG_STATUS32);
-        tmp |= STATUS_AD_MASK | (ARCV2_IRQ_DEF_PRIO << 1);
+        tmp |= ARCV2_IRQ_DEF_PRIO << 1;
         tmp &= ~STATUS_IE_MASK;
         asm volatile("kflag %0  \n"::"r"(tmp));
 }
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index 7b2340996cf8..a9c88b7e9182 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -36,6 +36,7 @@ unsigned int intr_to_DE_cnt;
 
 /* Part of U-boot ABI: see head.S */
 int __initdata uboot_tag;
+int __initdata uboot_magic;
 char __initdata *uboot_arg;
 
 const struct machine_desc *machine_desc;
@@ -44,29 +45,24 @@ struct task_struct *_current_task[NR_CPUS];	/* For stack switching */
 
 struct cpuinfo_arc cpuinfo_arc700[NR_CPUS];
 
-static const struct id_to_str arc_cpu_rel[] = {
+static const struct id_to_str arc_legacy_rel[] = {
+        /* ID.ARCVER,   Release */
 #ifdef CONFIG_ISA_ARCOMPACT
-        { 0x34, "R4.10"},
-        { 0x35, "R4.11"},
+        { 0x34,         "R4.10"},
+        { 0x35,         "R4.11"},
 #else
-        { 0x51, "R2.0" },
-        { 0x52, "R2.1" },
-        { 0x53, "R3.0" },
-        { 0x54, "R3.10a" },
+        { 0x51,         "R2.0" },
+        { 0x52,         "R2.1" },
+        { 0x53,         "R3.0" },
 #endif
-        { 0x00, NULL   }
+        { 0x00,         NULL   }
 };
 
-static const struct id_to_str arc_cpu_nm[] = {
-#ifdef CONFIG_ISA_ARCOMPACT
-        { 0x20, "ARC 600"   },
-        { 0x30, "ARC 770"   },  /* 750 identified seperately */
-#else
-        { 0x40, "ARC EM"  },
-        { 0x50, "ARC HS38"  },
-        { 0x54, "ARC HS48"  },
-#endif
-        { 0x00, "Unknown"   }
+static const struct id_to_str arc_cpu_rel[] = {
+        /* UARCH.MAJOR, Release */
+        {  0,           "R3.10a"},
+        {  1,           "R3.50a"},
+        {  0xFF,        NULL   }
 };
 
 static void read_decode_ccm_bcr(struct cpuinfo_arc *cpu)
@@ -116,31 +112,72 @@ static void read_decode_ccm_bcr(struct cpuinfo_arc *cpu)
         }
 }
 
+static void decode_arc_core(struct cpuinfo_arc *cpu)
+{
+        struct bcr_uarch_build_arcv2 uarch;
+        const struct id_to_str *tbl;
+
+        /*
+         * Up until (including) the first core4 release (0x54) things were
+         * simple: AUX IDENTITY.ARCVER was sufficient to identify arc family
+         * and release: 0x50 to 0x53 was HS38, 0x54 was HS48 (dual issue)
+         */
+
+        if (cpu->core.family < 0x54) { /* includes arc700 */
+
+                for (tbl = &arc_legacy_rel[0]; tbl->id != 0; tbl++) {
+                        if (cpu->core.family == tbl->id) {
+                                cpu->release = tbl->str;
+                                break;
+                        }
+                }
+
+                if (is_isa_arcompact())
+                        cpu->name = "ARC700";
+                else if (tbl->str)
+                        cpu->name = "HS38";
+                else
+                        cpu->name = cpu->release = "Unknown";
+
+                return;
+        }
+
+        /*
+         * However the subsequent HS release (same 0x54) allow HS38 or HS48
+         * configurations and encode this info in a different BCR.
+         * The BCR was introduced in 0x54 so can't be read unconditionally.
+         */
+
+        READ_BCR(ARC_REG_MICRO_ARCH_BCR, uarch);
+
+        if (uarch.prod == 4) {
+                cpu->name = "HS48";
+                cpu->extn.dual = 1;
+
+        } else {
+                cpu->name = "HS38";
+        }
+
+        for (tbl = &arc_cpu_rel[0]; tbl->id != 0xFF; tbl++) {
+                if (uarch.maj == tbl->id) {
+                        cpu->release = tbl->str;
+                        break;
+                }
+        }
+}
+
 static void read_arc_build_cfg_regs(void)
 {
         struct bcr_timer timer;
         struct bcr_generic bcr;
         struct cpuinfo_arc *cpu = &cpuinfo_arc700[smp_processor_id()];
-        const struct id_to_str *tbl;
         struct bcr_isa_arcv2 isa;
         struct bcr_actionpoint ap;
 
         FIX_PTR(cpu);
 
         READ_BCR(AUX_IDENTITY, cpu->core);
-
-        for (tbl = &arc_cpu_rel[0]; tbl->id != 0; tbl++) {
-                if (cpu->core.family == tbl->id) {
-                        cpu->details = tbl->str;
-                        break;
-                }
-        }
-
-        for (tbl = &arc_cpu_nm[0]; tbl->id != 0; tbl++) {
-                if ((cpu->core.family & 0xF4) == tbl->id)
-                        break;
-        }
-        cpu->name = tbl->str;
+        decode_arc_core(cpu);
 
         READ_BCR(ARC_REG_TIMERS_BCR, timer);
         cpu->extn.timer0 = timer.t0;
@@ -151,16 +188,6 @@ static void read_arc_build_cfg_regs(void)
 
         READ_BCR(ARC_REG_MUL_BCR, cpu->extn_mpy);
 
-        cpu->extn.norm = read_aux_reg(ARC_REG_NORM_BCR) > 1 ? 1 : 0; /* 2,3 */
-        cpu->extn.barrel = read_aux_reg(ARC_REG_BARREL_BCR) > 1 ? 1 : 0; /* 2,3 */
-        cpu->extn.swap = read_aux_reg(ARC_REG_SWAP_BCR) ? 1 : 0;        /* 1,3 */
-        cpu->extn.crc = read_aux_reg(ARC_REG_CRC_BCR) ? 1 : 0;
-        cpu->extn.minmax = read_aux_reg(ARC_REG_MIXMAX_BCR) > 1 ? 1 : 0; /* 2 */
-        cpu->extn.swape = (cpu->core.family >= 0x34) ? 1 :
-                                IS_ENABLED(CONFIG_ARC_HAS_SWAPE);
-
-        READ_BCR(ARC_REG_XY_MEM_BCR, cpu->extn_xymem);
-
         /* Read CCM BCRs for boot reporting even if not enabled in Kconfig */
         read_decode_ccm_bcr(cpu);
 
@@ -198,30 +225,12 @@ static void read_arc_build_cfg_regs(void)
                 cpu->bpu.num_pred = 2048 << bpu.pte;
                 cpu->bpu.ret_stk = 4 << bpu.rse;
 
-                if (cpu->core.family >= 0x54) {
-
-                        struct bcr_uarch_build_arcv2 uarch;
-
-                        /*
-                         * The first 0x54 core (uarch maj:min 0:1 or 0:2) was
-                         * dual issue only (HS4x). But next uarch rev (1:0)
-                         * allows it be configured for single issue (HS3x)
-                         * Ensure we fiddle with dual issue only on HS4x
-                         */
-                        READ_BCR(ARC_REG_MICRO_ARCH_BCR, uarch);
-
-                        if (uarch.prod == 4) {
-                                unsigned int exec_ctrl;
-
-                                /* dual issue hardware always present */
-                                cpu->extn.dual = 1;
-
-                                READ_BCR(AUX_EXEC_CTRL, exec_ctrl);
+                /* if dual issue hardware, is it enabled ? */
+                if (cpu->extn.dual) {
+                        unsigned int exec_ctrl;
 
-                                /* dual issue hardware enabled ? */
-                                cpu->extn.dual_enb = !(exec_ctrl & 1);
-
-                        }
+                        READ_BCR(AUX_EXEC_CTRL, exec_ctrl);
+                        cpu->extn.dual_enb = !(exec_ctrl & 1);
                 }
         }
 
@@ -263,7 +272,8 @@ static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len)
 {
         struct cpuinfo_arc *cpu = &cpuinfo_arc700[cpu_id];
         struct bcr_identity *core = &cpu->core;
-        int i, n = 0, ua = 0;
+        char mpy_opt[16];
+        int n = 0;
 
         FIX_PTR(cpu);
 
@@ -272,7 +282,7 @@ static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len)
                        core->family, core->cpu_id, core->chip_id);
 
         n += scnprintf(buf + n, len - n, "processor [%d]\t: %s %s (%s ISA) %s%s%s\n",
-                       cpu_id, cpu->name, cpu->details,
+                       cpu_id, cpu->name, cpu->release,
                        is_isa_arcompact() ? "ARCompact" : "ARCv2",
                        IS_AVAIL1(cpu->isa.be, "[Big-Endian]"),
                        IS_AVAIL3(cpu->extn.dual, cpu->extn.dual_enb, " Dual-Issue "));
@@ -283,61 +293,50 @@ static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len)
                        IS_AVAIL2(cpu->extn.rtc, "RTC [UP 64-bit] ", CONFIG_ARC_TIMERS_64BIT),
                        IS_AVAIL2(cpu->extn.gfrc, "GFRC [SMP 64-bit] ", CONFIG_ARC_TIMERS_64BIT));
 
-#ifdef __ARC_UNALIGNED__
-        ua = 1;
-#endif
-        n += i = scnprintf(buf + n, len - n, "%s%s%s%s%s%s",
-                           IS_AVAIL2(cpu->isa.atomic, "atomic ", CONFIG_ARC_HAS_LLSC),
-                           IS_AVAIL2(cpu->isa.ldd, "ll64 ", CONFIG_ARC_HAS_LL64),
-                           IS_AVAIL1(cpu->isa.unalign, "unalign "), IS_USED_RUN(ua));
-
-        if (i)
-                n += scnprintf(buf + n, len - n, "\n\t\t: ");
-
         if (cpu->extn_mpy.ver) {
-                if (cpu->extn_mpy.ver <= 0x2) { /* ARCompact */
-                        n += scnprintf(buf + n, len - n, "mpy ");
+                if (is_isa_arcompact()) {
+                        scnprintf(mpy_opt, 16, "mpy");
                 } else {
+
                         int opt = 2;    /* stock MPY/MPYH */
 
                         if (cpu->extn_mpy.dsp)  /* OPT 7-9 */
                                 opt = cpu->extn_mpy.dsp + 6;
 
-                        n += scnprintf(buf + n, len - n, "mpy[opt %d] ", opt);
+                        scnprintf(mpy_opt, 16, "mpy[opt %d] ", opt);
                 }
         }
 
         n += scnprintf(buf + n, len - n, "%s%s%s%s%s%s%s%s\n",
-                       IS_AVAIL1(cpu->isa.div_rem, "div_rem "),
-                       IS_AVAIL1(cpu->extn.norm, "norm "),
-                       IS_AVAIL1(cpu->extn.barrel, "barrel-shift "),
-                       IS_AVAIL1(cpu->extn.swap, "swap "),
-                       IS_AVAIL1(cpu->extn.minmax, "minmax "),
-                       IS_AVAIL1(cpu->extn.crc, "crc "),
-                       IS_AVAIL2(cpu->extn.swape, "swape", CONFIG_ARC_HAS_SWAPE));
-
-        if (cpu->bpu.ver)
+                       IS_AVAIL2(cpu->isa.atomic, "atomic ", CONFIG_ARC_HAS_LLSC),
+                       IS_AVAIL2(cpu->isa.ldd, "ll64 ", CONFIG_ARC_HAS_LL64),
+                       IS_AVAIL2(cpu->isa.unalign, "unalign ", CONFIG_ARC_USE_UNALIGNED_MEM_ACCESS),
+                       IS_AVAIL1(cpu->extn_mpy.ver, mpy_opt),
+                       IS_AVAIL1(cpu->isa.div_rem, "div_rem "));
+
+        if (cpu->bpu.ver) {
                 n += scnprintf(buf + n, len - n,
                               "BPU\t\t: %s%s match, cache:%d, Predict Table:%d Return stk: %d",
                               IS_AVAIL1(cpu->bpu.full, "full"),
                               IS_AVAIL1(!cpu->bpu.full, "partial"),
                               cpu->bpu.num_cache, cpu->bpu.num_pred, cpu->bpu.ret_stk);
 
-        if (is_isa_arcv2()) {
-                struct bcr_lpb lpb;
+                if (is_isa_arcv2()) {
+                        struct bcr_lpb lpb;
 
-                READ_BCR(ARC_REG_LPB_BUILD, lpb);
-                if (lpb.ver) {
-                        unsigned int ctl;
-                        ctl = read_aux_reg(ARC_REG_LPB_CTRL);
+                        READ_BCR(ARC_REG_LPB_BUILD, lpb);
+                        if (lpb.ver) {
+                                unsigned int ctl;
+                                ctl = read_aux_reg(ARC_REG_LPB_CTRL);
 
-                        n += scnprintf(buf + n, len - n, " Loop Buffer:%d %s",
-                                lpb.entries,
-                                IS_DISABLED_RUN(!ctl));
+                                n += scnprintf(buf + n, len - n, " Loop Buffer:%d %s",
+                                               lpb.entries,
+                                               IS_DISABLED_RUN(!ctl));
+                        }
                 }
+                n += scnprintf(buf + n, len - n, "\n");
         }
 
-        n += scnprintf(buf + n, len - n, "\n");
         return buf;
 }
 
@@ -390,11 +389,6 @@ static char *arc_extn_mumbojumbo(int cpu_id, char *buf, int len)
                 }
         }
 
-        n += scnprintf(buf + n, len - n, "OS ABI [v%d]\t: %s\n",
-                        EF_ARC_OSABI_CURRENT >> 8,
-                        EF_ARC_OSABI_CURRENT == EF_ARC_OSABI_V3 ?
-                        "no-legacy-syscalls" : "64-bit data any register aligned");
-
         return buf;
 }
 
@@ -497,6 +491,8 @@ static inline bool uboot_arg_invalid(unsigned long addr)
 #define UBOOT_TAG_NONE          0
 #define UBOOT_TAG_CMDLINE       1
 #define UBOOT_TAG_DTB           2
+/* We always pass 0 as magic from U-boot */
+#define UBOOT_MAGIC_VALUE       0
 
 void __init handle_uboot_args(void)
 {
@@ -511,6 +507,11 @@ void __init handle_uboot_args(void)
                 goto ignore_uboot_args;
         }
 
+        if (uboot_magic != UBOOT_MAGIC_VALUE) {
+                pr_warn(IGNORE_ARGS "non zero uboot magic\n");
+                goto ignore_uboot_args;
+        }
+
         if (uboot_tag != UBOOT_TAG_NONE &&
             uboot_arg_invalid((unsigned long)uboot_arg)) {
                 pr_warn(IGNORE_ARGS "invalid uboot arg: '%px'\n", uboot_arg);
diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c
index 215f515442e0..b0aa8c028331 100644
--- a/arch/arc/kernel/troubleshoot.c
+++ b/arch/arc/kernel/troubleshoot.c
@@ -145,7 +145,8 @@ static void show_ecr_verbose(struct pt_regs *regs)
         } else if (vec == ECR_V_PROTV) {
                 if (cause_code == ECR_C_PROTV_INST_FETCH)
                         pr_cont("Execute from Non-exec Page\n");
-                else if (cause_code == ECR_C_PROTV_MISALIG_DATA)
+                else if (cause_code == ECR_C_PROTV_MISALIG_DATA &&
+                         IS_ENABLED(CONFIG_ISA_ARCOMPACT))
                         pr_cont("Misaligned r/w from 0x%08lx\n", address);
                 else
                         pr_cont("%s access not allowed on page\n",
@@ -161,6 +162,8 @@ static void show_ecr_verbose(struct pt_regs *regs)
                         pr_cont("Bus Error from Data Mem\n");
                 else
                         pr_cont("Bus Error, check PRM\n");
+        } else if (vec == ECR_V_MISALIGN) {
+                pr_cont("Misaligned r/w from 0x%08lx\n", address);
 #endif
         } else if (vec == ECR_V_TRAP) {
                 if (regs->ecr_param == 5)
diff --git a/arch/arc/lib/Makefile b/arch/arc/lib/Makefile
index b1656d156097..f7537b466b23 100644
--- a/arch/arc/lib/Makefile
+++ b/arch/arc/lib/Makefile
@@ -8,4 +8,10 @@
 lib-y   := strchr-700.o strcpy-700.o strlen.o memcmp.o
 
 lib-$(CONFIG_ISA_ARCOMPACT)     += memcpy-700.o memset.o strcmp.o
-lib-$(CONFIG_ISA_ARCV2)         += memcpy-archs.o memset-archs.o strcmp-archs.o
+lib-$(CONFIG_ISA_ARCV2)         += memset-archs.o strcmp-archs.o
+
+ifdef CONFIG_ARC_USE_UNALIGNED_MEM_ACCESS
+lib-$(CONFIG_ISA_ARCV2)         +=memcpy-archs-unaligned.o
+else
+lib-$(CONFIG_ISA_ARCV2)         +=memcpy-archs.o
+endif
diff --git a/arch/arc/lib/memcpy-archs-unaligned.S b/arch/arc/lib/memcpy-archs-unaligned.S
new file mode 100644
index 000000000000..28993a73fdde
--- /dev/null
+++ b/arch/arc/lib/memcpy-archs-unaligned.S
@@ -0,0 +1,47 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * ARCv2 memcpy implementation optimized for unaligned memory access using.
+ *
+ * Copyright (C) 2019 Synopsys
+ * Author: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
+ */
+
+#include <linux/linkage.h>
+
+#ifdef CONFIG_ARC_HAS_LL64
+# define LOADX(DST,RX)          ldd.ab  DST, [RX, 8]
+# define STOREX(SRC,RX)         std.ab  SRC, [RX, 8]
+# define ZOLSHFT                5
+# define ZOLAND                 0x1F
+#else
+# define LOADX(DST,RX)          ld.ab   DST, [RX, 4]
+# define STOREX(SRC,RX)         st.ab   SRC, [RX, 4]
+# define ZOLSHFT                4
+# define ZOLAND                 0xF
+#endif
+
+ENTRY_CFI(memcpy)
+        mov     r3, r0          ; don;t clobber ret val
+
+        lsr.f   lp_count, r2, ZOLSHFT
+        lpnz    @.Lcopy32_64bytes
+        ;; LOOP START
+        LOADX   (r6, r1)
+        LOADX   (r8, r1)
+        LOADX   (r10, r1)
+        LOADX   (r4, r1)
+        STOREX  (r6, r3)
+        STOREX  (r8, r3)
+        STOREX  (r10, r3)
+        STOREX  (r4, r3)
+.Lcopy32_64bytes:
+
+        and.f   lp_count, r2, ZOLAND ;Last remaining 31 bytes
+        lpnz    @.Lcopyremainingbytes
+        ;; LOOP START
+        ldb.ab  r5, [r1, 1]
+        stb.ab  r5, [r3, 1]
+.Lcopyremainingbytes:
+
+        j       [blink]
+END_CFI(memcpy)
diff --git a/arch/arc/plat-eznps/Kconfig b/arch/arc/plat-eznps/Kconfig
index 8eff057efcae..2eaecfb063a7 100644
--- a/arch/arc/plat-eznps/Kconfig
+++ b/arch/arc/plat-eznps/Kconfig
@@ -26,8 +26,8 @@ config EZNPS_MTM_EXT
         help
           Here we add new hierarchy for CPUs topology.
           We got:
-                Core
-                Thread
+            Core
+            Thread
           At the new thread level each CPU represent one HW thread.
           At highest hierarchy each core contain 16 threads,
           any of them seem like CPU from Linux point of view.
@@ -35,10 +35,10 @@ config EZNPS_MTM_EXT
           core and HW scheduler round robin between them.
 
 config EZNPS_MEM_ERROR_ALIGN
-       bool "ARC-EZchip Memory error as an exception"
-       depends on EZNPS_MTM_EXT
-       default n
-       help
+        bool "ARC-EZchip Memory error as an exception"
+        depends on EZNPS_MTM_EXT
+        default n
+        help
           On the real chip of the NPS, user memory errors are handled
           as a machine check exception, which is fatal, whereas on
           simulator platform for NPS, is handled as a Level 2 interrupt
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 5085a1eab9fc..054ead960f98 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1310,7 +1310,7 @@ config SCHED_SMT
 config HAVE_ARM_SCU
         bool
         help
-          This option enables support for the ARM system coherency unit
+          This option enables support for the ARM snoop control unit
 
 config HAVE_ARM_ARCH_TIMER
         bool "Architected timer support"
@@ -1322,7 +1322,6 @@ config HAVE_ARM_ARCH_TIMER
 
 config HAVE_ARM_TWD
         bool
-        select TIMER_OF if OF
         help
           This options enables support for the ARM timer and watchdog unit
 
diff --git a/arch/arm/Kconfig-nommu b/arch/arm/Kconfig-nommu
index 1168a03c8525..36c80d3dd93f 100644
--- a/arch/arm/Kconfig-nommu
+++ b/arch/arm/Kconfig-nommu
@@ -20,10 +20,12 @@ config DRAM_SIZE
 
 config FLASH_MEM_BASE
         hex 'FLASH Base Address' if SET_MEM_PARAM
+        depends on CPU_ARM740T || CPU_ARM946E || CPU_ARM940T
         default 0x00400000
 
 config FLASH_SIZE
         hex 'FLASH Size' if SET_MEM_PARAM
+        depends on CPU_ARM740T || CPU_ARM946E || CPU_ARM940T
         default 0x00400000
 
 config PROCESSOR_ID
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 00000e91ad65..807a7d06c2a0 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -10,7 +10,7 @@
 #
 # Copyright (C) 1995-2001 by Russell King
 
-LDFLAGS_vmlinux :=-p --no-undefined -X --pic-veneer
+LDFLAGS_vmlinux := --no-undefined -X --pic-veneer
 ifeq ($(CONFIG_CPU_ENDIAN_BE8),y)
 LDFLAGS_vmlinux += --be8
 KBUILD_LDFLAGS_MODULE   += --be8
diff --git a/arch/arm/boot/bootp/Makefile b/arch/arm/boot/bootp/Makefile
index 83e1a076a5d6..981a8d03f064 100644
--- a/arch/arm/boot/bootp/Makefile
+++ b/arch/arm/boot/bootp/Makefile
@@ -8,7 +8,7 @@
 
 GCOV_PROFILE    := n
 
-LDFLAGS_bootp   :=-p --no-undefined -X \
+LDFLAGS_bootp   := --no-undefined -X \
                  --defsym initrd_phys=$(INITRD_PHYS) \
                  --defsym params_phys=$(PARAMS_PHYS) -T
 AFLAGS_initrd.o :=-DINITRD=\"$(INITRD)\"
diff --git a/arch/arm/boot/bootp/init.S b/arch/arm/boot/bootp/init.S
index 78b508075161..142927e5f485 100644
--- a/arch/arm/boot/bootp/init.S
+++ b/arch/arm/boot/bootp/init.S
@@ -44,7 +44,7 @@ _start:		add	lr, pc, #-0x8		@ lr = current load addr
  */
                 movne   r10, #0                 @ terminator
                 movne   r4, #2                  @ Size of this entry (2 words)
-                stmneia r9, {r4, r5, r10}       @ Size, ATAG_CORE, terminator
+                stmiane r9, {r4, r5, r10}       @ Size, ATAG_CORE, terminator
 
 /*
  * find the end of the tag list, and then add an INITRD tag on the end.
diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile
index 6114ae6ea466..9219389bbe61 100644
--- a/arch/arm/boot/compressed/Makefile
+++ b/arch/arm/boot/compressed/Makefile
@@ -132,8 +132,6 @@ endif
 ifeq ($(CONFIG_CPU_ENDIAN_BE8),y)
 LDFLAGS_vmlinux += --be8
 endif
-# ?
-LDFLAGS_vmlinux += -p
 # Report unresolved symbol references
 LDFLAGS_vmlinux += --no-undefined
 # Delete all temporary local symbols
diff --git a/arch/arm/boot/compressed/ll_char_wr.S b/arch/arm/boot/compressed/ll_char_wr.S
index 8517c8606b4a..b1dcdb9f4030 100644
--- a/arch/arm/boot/compressed/ll_char_wr.S
+++ b/arch/arm/boot/compressed/ll_char_wr.S
@@ -75,7 +75,7 @@ Lrow4bpplp:
         tst     r1, #7                          @ avoid using r7 directly after
         str     r7, [r0, -r5]!
         subne   r1, r1, #1
-        ldrneb  r7, [r6, r1]
+        ldrbne  r7, [r6, r1]
         bne     Lrow4bpplp
         ldmfd   sp!, {r4 - r7, pc}
 
@@ -103,7 +103,7 @@ Lrow8bpplp:
         sub     r0, r0, r5                      @ avoid ip
         stmia   r0, {r4, ip}
         subne   r1, r1, #1
-        ldrneb  r7, [r6, r1]
+        ldrbne  r7, [r6, r1]
         bne     Lrow8bpplp
         ldmfd   sp!, {r4 - r7, pc}
 
diff --git a/arch/arm/boot/dts/imx28-cfa10036.dts b/arch/arm/boot/dts/imx28-cfa10036.dts
index d3e3622979c5..de48b5808ef6 100644
--- a/arch/arm/boot/dts/imx28-cfa10036.dts
+++ b/arch/arm/boot/dts/imx28-cfa10036.dts
@@ -11,6 +11,7 @@
 
 /dts-v1/;
 #include "imx28.dtsi"
+#include <dt-bindings/gpio/gpio.h>
 
 / {
         model = "Crystalfontz CFA-10036 Board";
@@ -96,7 +97,7 @@
                                         pinctrl-names = "default";
                                         pinctrl-0 = <&ssd1306_cfa10036>;
                                         reg = <0x3c>;
-                                        reset-gpios = <&gpio2 7 0>;
+                                        reset-gpios = <&gpio2 7 GPIO_ACTIVE_LOW>;
                                         solomon,height = <32>;
                                         solomon,width = <128>;
                                         solomon,page-offset = <0>;
diff --git a/arch/arm/common/mcpm_entry.c b/arch/arm/common/mcpm_entry.c
index ad574d20415c..1b1b82b37ce0 100644
--- a/arch/arm/common/mcpm_entry.c
+++ b/arch/arm/common/mcpm_entry.c
@@ -381,7 +381,7 @@ static int __init nocache_trampoline(unsigned long _arg)
         unsigned int cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1);
         phys_reset_t phys_reset;
 
-        mcpm_set_entry_vector(cpu, cluster, cpu_resume);
+        mcpm_set_entry_vector(cpu, cluster, cpu_resume_no_hyp);
         setup_mm_for_reboot();
 
         __mcpm_cpu_going_down(cpu, cluster);
diff --git a/arch/arm/include/asm/Kbuild b/arch/arm/include/asm/Kbuild
index 1d66db9c9db5..a8a4eb7f6dae 100644
--- a/arch/arm/include/asm/Kbuild
+++ b/arch/arm/include/asm/Kbuild
@@ -18,7 +18,6 @@ generic-y += segment.h
 generic-y += serial.h
 generic-y += simd.h
 generic-y += sizes.h
-generic-y += timex.h
 generic-y += trace_clock.h
 
 generated-y += mach-types.h
diff --git a/arch/arm/include/asm/arch_gicv3.h b/arch/arm/include/asm/arch_gicv3.h
index f6f485f4744e..d15b8c99f1b3 100644
--- a/arch/arm/include/asm/arch_gicv3.h
+++ b/arch/arm/include/asm/arch_gicv3.h
@@ -55,7 +55,7 @@
 #define ICH_VTR                         __ACCESS_CP15(c12, 4, c11, 1)
 #define ICH_MISR                        __ACCESS_CP15(c12, 4, c11, 2)
 #define ICH_EISR                        __ACCESS_CP15(c12, 4, c11, 3)
-#define ICH_ELSR                        __ACCESS_CP15(c12, 4, c11, 5)
+#define ICH_ELRSR                       __ACCESS_CP15(c12, 4, c11, 5)
 #define ICH_VMCR                        __ACCESS_CP15(c12, 4, c11, 7)
 
 #define __LR0(x)                        __ACCESS_CP15(c12, 4, c12, x)
@@ -152,7 +152,7 @@ CPUIF_MAP(ICH_HCR, ICH_HCR_EL2)
 CPUIF_MAP(ICH_VTR, ICH_VTR_EL2)
 CPUIF_MAP(ICH_MISR, ICH_MISR_EL2)
 CPUIF_MAP(ICH_EISR, ICH_EISR_EL2)
-CPUIF_MAP(ICH_ELSR, ICH_ELSR_EL2)
+CPUIF_MAP(ICH_ELRSR, ICH_ELRSR_EL2)
 CPUIF_MAP(ICH_VMCR, ICH_VMCR_EL2)
 CPUIF_MAP(ICH_AP0R3, ICH_AP0R3_EL2)
 CPUIF_MAP(ICH_AP0R2, ICH_AP0R2_EL2)
diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
index 28a48e0d4cca..b59921a560da 100644
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -376,9 +376,9 @@ THUMB(	orr	\reg , \reg , #PSR_T_BIT	)
         .macro  usraccoff, instr, reg, ptr, inc, off, cond, abort, t=TUSER()
 9999:
         .if     \inc == 1
-        \instr\cond\()b\()\t\().w \reg, [\ptr, #\off]
+        \instr\()b\t\cond\().w \reg, [\ptr, #\off]
         .elseif \inc == 4
-        \instr\cond\()\t\().w \reg, [\ptr, #\off]
+        \instr\t\cond\().w \reg, [\ptr, #\off]
         .else
         .error  "Unsupported inc macro argument"
         .endif
@@ -417,9 +417,9 @@ THUMB(	orr	\reg , \reg , #PSR_T_BIT	)
         .rept   \rept
 9999:
         .if     \inc == 1
-        \instr\cond\()b\()\t \reg, [\ptr], #\inc
+        \instr\()b\t\cond \reg, [\ptr], #\inc
         .elseif \inc == 4
-        \instr\cond\()\t \reg, [\ptr], #\inc
+        \instr\t\cond \reg, [\ptr], #\inc
         .else
         .error  "Unsupported inc macro argument"
         .endif
@@ -460,7 +460,7 @@ THUMB(	orr	\reg , \reg , #PSR_T_BIT	)
         .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req
 #ifndef CONFIG_CPU_USE_DOMAINS
         adds    \tmp, \addr, #\size - 1
-        sbcccs  \tmp, \tmp, \limit
+        sbcscc  \tmp, \tmp, \limit
         bcs     \bad
 #ifdef CONFIG_CPU_SPECTRE
         movcs   \addr, #0
@@ -474,7 +474,7 @@ THUMB(	orr	\reg , \reg , #PSR_T_BIT	)
         sub     \tmp, \limit, #1
         subs    \tmp, \tmp, \addr       @ tmp = limit - 1 - addr
         addhs   \tmp, \tmp, #1          @ if (tmp >= 0) {
-        subhss  \tmp, \tmp, \size       @ tmp = limit - (addr + size) }
+        subshs  \tmp, \tmp, \size       @ tmp = limit - (addr + size) }
         movlo   \addr, #0               @ if (tmp < 0) addr = NULL
         csdb
 #endif
diff --git a/arch/arm/include/asm/barrier.h b/arch/arm/include/asm/barrier.h
index 69772e742a0a..83ae97c049d9 100644
--- a/arch/arm/include/asm/barrier.h
+++ b/arch/arm/include/asm/barrier.h
@@ -11,6 +11,8 @@
 #define sev()   __asm__ __volatile__ ("sev" : : : "memory")
 #define wfe()   __asm__ __volatile__ ("wfe" : : : "memory")
 #define wfi()   __asm__ __volatile__ ("wfi" : : : "memory")
+#else
+#define wfe()   do { } while (0)
 #endif
 
 #if __LINUX_ARM_ARCH__ >= 7
diff --git a/arch/arm/include/asm/hardware/entry-macro-iomd.S b/arch/arm/include/asm/hardware/entry-macro-iomd.S
index 8c215acd9b57..f7692731e514 100644
--- a/arch/arm/include/asm/hardware/entry-macro-iomd.S
+++ b/arch/arm/include/asm/hardware/entry-macro-iomd.S
@@ -16,25 +16,25 @@
                 ldr     \tmp, =irq_prio_h
                 teq     \irqstat, #0
 #ifdef IOMD_BASE
-                ldreqb  \irqstat, [\base, #IOMD_DMAREQ] @ get dma
+                ldrbeq  \irqstat, [\base, #IOMD_DMAREQ] @ get dma
                 addeq   \tmp, \tmp, #256                @ irq_prio_h table size
                 teqeq   \irqstat, #0
                 bne     2406f
 #endif
-                ldreqb  \irqstat, [\base, #IOMD_IRQREQA]        @ get low priority
+                ldrbeq  \irqstat, [\base, #IOMD_IRQREQA]        @ get low priority
                 addeq   \tmp, \tmp, #256                @ irq_prio_d table size
                 teqeq   \irqstat, #0
 #ifdef IOMD_IRQREQC
-                ldreqb  \irqstat, [\base, #IOMD_IRQREQC]
+                ldrbeq  \irqstat, [\base, #IOMD_IRQREQC]
                 addeq   \tmp, \tmp, #256                @ irq_prio_l table size
                 teqeq   \irqstat, #0
 #endif
 #ifdef IOMD_IRQREQD
-                ldreqb  \irqstat, [\base, #IOMD_IRQREQD]
+                ldrbeq  \irqstat, [\base, #IOMD_IRQREQD]
                 addeq   \tmp, \tmp, #256                @ irq_prio_lc table size
                 teqeq   \irqstat, #0
 #endif
-2406:           ldrneb  \irqnr, [\tmp, \irqstat]        @ get IRQ number
+2406:           ldrbne  \irqnr, [\tmp, \irqstat]        @ get IRQ number
                 .endm
 
 /*
diff --git a/arch/arm/include/asm/kvm_emulate.h b/arch/arm/include/asm/kvm_emulate.h
index 77121b713bef..8927cae7c966 100644
--- a/arch/arm/include/asm/kvm_emulate.h
+++ b/arch/arm/include/asm/kvm_emulate.h
@@ -265,6 +265,14 @@ static inline bool kvm_vcpu_dabt_isextabt(struct kvm_vcpu *vcpu)
         }
 }
 
+static inline bool kvm_is_write_fault(struct kvm_vcpu *vcpu)
+{
+        if (kvm_vcpu_trap_is_iabt(vcpu))
+                return false;
+
+        return kvm_vcpu_dabt_iswrite(vcpu);
+}
+
 static inline u32 kvm_vcpu_hvc_get_imm(struct kvm_vcpu *vcpu)
 {
         return kvm_vcpu_get_hsr(vcpu) & HSR_HVC_IMM_MASK;
diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h
index 50e89869178a..770d73257ad9 100644
--- a/arch/arm/include/asm/kvm_host.h
+++ b/arch/arm/include/asm/kvm_host.h
@@ -26,6 +26,7 @@
 #include <asm/kvm_asm.h>
 #include <asm/kvm_mmio.h>
 #include <asm/fpstate.h>
+#include <asm/smp_plat.h>
 #include <kvm/arm_arch_timer.h>
 
 #define __KVM_HAVE_ARCH_INTC_INITIALIZED
@@ -57,10 +58,13 @@ int __attribute_const__ kvm_target_cpu(void);
 int kvm_reset_vcpu(struct kvm_vcpu *vcpu);
 void kvm_reset_coprocs(struct kvm_vcpu *vcpu);
 
-struct kvm_arch {
-        /* VTTBR value associated with below pgd and vmid */
-        u64    vttbr;
+struct kvm_vmid {
+        /* The VMID generation used for the virt. memory system */
+        u64    vmid_gen;
+        u32    vmid;
+};
 
+struct kvm_arch {
         /* The last vcpu id that ran on each physical CPU */
         int __percpu *last_vcpu_ran;
 
@@ -70,11 +74,11 @@ struct kvm_arch {
          */
 
         /* The VMID generation used for the virt. memory system */
-        u64    vmid_gen;
-        u32    vmid;
+        struct kvm_vmid vmid;
 
         /* Stage-2 page table */
         pgd_t *pgd;
+        phys_addr_t pgd_phys;
 
         /* Interrupt controller */
         struct vgic_dist        vgic;
@@ -148,6 +152,13 @@ struct kvm_cpu_context {
 
 typedef struct kvm_cpu_context kvm_cpu_context_t;
 
+static inline void kvm_init_host_cpu_context(kvm_cpu_context_t *cpu_ctxt,
+                                             int cpu)
+{
+        /* The host's MPIDR is immutable, so let's set it up at boot time */
+        cpu_ctxt->cp15[c0_MPIDR] = cpu_logical_map(cpu);
+}
+
 struct vcpu_reset_state {
         unsigned long   pc;
         unsigned long   r0;
@@ -224,7 +235,35 @@ unsigned long kvm_arm_num_regs(struct kvm_vcpu *vcpu);
 int kvm_arm_copy_reg_indices(struct kvm_vcpu *vcpu, u64 __user *indices);
 int kvm_arm_get_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg);
 int kvm_arm_set_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg);
-unsigned long kvm_call_hyp(void *hypfn, ...);
+
+unsigned long __kvm_call_hyp(void *hypfn, ...);
+
+/*
+ * The has_vhe() part doesn't get emitted, but is used for type-checking.
+ */
+#define kvm_call_hyp(f, ...)                                            \
+        do {                                                            \
+                if (has_vhe()) {                                        \
+                        f(__VA_ARGS__);                                 \
+                } else {                                                \
+                        __kvm_call_hyp(kvm_ksym_ref(f), ##__VA_ARGS__); \
+                }                                                       \
+        } while(0)
+
+#define kvm_call_hyp_ret(f, ...)                                        \
+        ({                                                              \
+                typeof(f(__VA_ARGS__)) ret;                             \
+                                                                        \
+                if (has_vhe()) {                                        \
+                        ret = f(__VA_ARGS__);                           \
+                } else {                                                \
+                        ret = __kvm_call_hyp(kvm_ksym_ref(f),           \
+                                             ##__VA_ARGS__);            \
+                }                                                       \
+                                                                        \
+                ret;                                                    \
+        })
+
 void force_vm_exit(const cpumask_t *mask);
 int __kvm_arm_vcpu_get_events(struct kvm_vcpu *vcpu,
                               struct kvm_vcpu_events *events);
@@ -275,7 +314,7 @@ static inline void __cpu_init_hyp_mode(phys_addr_t pgd_ptr,
          * compliant with the PCS!).
          */
 
-        kvm_call_hyp((void*)hyp_stack_ptr, vector_ptr, pgd_ptr);
+        __kvm_call_hyp((void*)hyp_stack_ptr, vector_ptr, pgd_ptr);
 }
 
 static inline void __cpu_init_stage2(void)
diff --git a/arch/arm/include/asm/kvm_hyp.h b/arch/arm/include/asm/kvm_hyp.h
index e93a0cac9add..87bcd18df8d5 100644
--- a/arch/arm/include/asm/kvm_hyp.h
+++ b/arch/arm/include/asm/kvm_hyp.h
@@ -40,6 +40,7 @@
 #define TTBR1           __ACCESS_CP15_64(1, c2)
 #define VTTBR           __ACCESS_CP15_64(6, c2)
 #define PAR             __ACCESS_CP15_64(0, c7)
+#define CNTP_CVAL       __ACCESS_CP15_64(2, c14)
 #define CNTV_CVAL       __ACCESS_CP15_64(3, c14)
 #define CNTVOFF         __ACCESS_CP15_64(4, c14)
 
@@ -85,6 +86,7 @@
 #define TID_PRIV        __ACCESS_CP15(c13, 0, c0, 4)
 #define HTPIDR          __ACCESS_CP15(c13, 4, c0, 2)
 #define CNTKCTL         __ACCESS_CP15(c14, 0, c1, 0)
+#define CNTP_CTL        __ACCESS_CP15(c14, 0, c2, 1)
 #define CNTV_CTL        __ACCESS_CP15(c14, 0, c3, 1)
 #define CNTHCTL         __ACCESS_CP15(c14, 4, c1, 0)
 
@@ -94,6 +96,8 @@
 #define read_sysreg_el0(r)              read_sysreg(r##_el0)
 #define write_sysreg_el0(v, r)          write_sysreg(v, r##_el0)
 
+#define cntp_ctl_el0                    CNTP_CTL
+#define cntp_cval_el0                   CNTP_CVAL
 #define cntv_ctl_el0                    CNTV_CTL
 #define cntv_cval_el0                   CNTV_CVAL
 #define cntvoff_el2                     CNTVOFF
diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h
index 3a875fc1b63c..2de96a180166 100644
--- a/arch/arm/include/asm/kvm_mmu.h
+++ b/arch/arm/include/asm/kvm_mmu.h
@@ -421,9 +421,14 @@ static inline int hyp_map_aux_data(void)
 
 static inline void kvm_set_ipa_limit(void) {}
 
-static inline bool kvm_cpu_has_cnp(void)
+static __always_inline u64 kvm_get_vttbr(struct kvm *kvm)
 {
-        return false;
+        struct kvm_vmid *vmid = &kvm->arch.vmid;
+        u64 vmid_field, baddr;
+
+        baddr = kvm->arch.pgd_phys;
+        vmid_field = (u64)vmid->vmid << VTTBR_VMID_SHIFT;
+        return kvm_phys_to_vttbr(baddr) | vmid_field;
 }
 
 #endif  /* !__ASSEMBLY__ */
diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
index a757401129f9..48ce1b19069b 100644
--- a/arch/arm/include/asm/pgtable.h
+++ b/arch/arm/include/asm/pgtable.h
@@ -125,6 +125,9 @@ extern pgprot_t		pgprot_s2_device;
 #define pgprot_stronglyordered(prot) \
         __pgprot_modify(prot, L_PTE_MT_MASK, L_PTE_MT_UNCACHED)
 
+#define pgprot_device(prot) \
+        __pgprot_modify(prot, L_PTE_MT_MASK, L_PTE_MT_DEV_SHARED | L_PTE_SHARED | L_PTE_DIRTY | L_PTE_XN)
+
 #ifdef CONFIG_ARM_DMA_MEM_BUFFERABLE
 #define pgprot_dmacoherent(prot) \
         __pgprot_modify(prot, L_PTE_MT_MASK, L_PTE_MT_BUFFERABLE | L_PTE_XN)
diff --git a/arch/arm/include/asm/processor.h b/arch/arm/include/asm/processor.h
index 120f4c9bbfde..57fe73ea0f72 100644
--- a/arch/arm/include/asm/processor.h
+++ b/arch/arm/include/asm/processor.h
@@ -89,7 +89,11 @@ extern void release_thread(struct task_struct *);
 unsigned long get_wchan(struct task_struct *p);
 
 #if __LINUX_ARM_ARCH__ == 6 || defined(CONFIG_ARM_ERRATA_754327)
-#define cpu_relax()                     smp_mb()
+#define cpu_relax()                                             \
+        do {                                                    \
+                smp_mb();                                       \
+                __asm__ __volatile__("nop; nop; nop; nop; nop; nop; nop; nop; nop; nop;");      \
+        } while (0)
 #else
 #define cpu_relax()                     barrier()
 #endif
diff --git a/arch/arm/include/asm/smp.h b/arch/arm/include/asm/smp.h
index 709a55989cb0..451ae684aaf4 100644
--- a/arch/arm/include/asm/smp.h
+++ b/arch/arm/include/asm/smp.h
@@ -67,7 +67,6 @@ struct secondary_data {
         void *stack;
 };
 extern struct secondary_data secondary_data;
-extern volatile int pen_release;
 extern void secondary_startup(void);
 extern void secondary_startup_arm(void);
 
diff --git a/arch/arm/include/asm/smp_twd.h b/arch/arm/include/asm/smp_twd.h
index 312784ee9936..c729d2113a24 100644
--- a/arch/arm/include/asm/smp_twd.h
+++ b/arch/arm/include/asm/smp_twd.h
@@ -19,20 +19,4 @@
 #define TWD_TIMER_CONTROL_PERIODIC      (1 << 1)
 #define TWD_TIMER_CONTROL_IT_ENABLE     (1 << 2)
 
-#include <linux/ioport.h>
-
-struct twd_local_timer {
-        struct resource res[2];
-};
-
-#define DEFINE_TWD_LOCAL_TIMER(name,base,irq)   \
-struct twd_local_timer name __initdata = {      \
-        .res    = {                             \
-                DEFINE_RES_MEM(base, 0x10),     \
-                DEFINE_RES_IRQ(irq),            \
-        },                                      \
-};
-
-int twd_local_timer_register(struct twd_local_timer *);
-
 #endif
diff --git a/arch/arm/include/asm/spinlock.h b/arch/arm/include/asm/spinlock.h
index 099c78fcf62d..8f009e788ad4 100644
--- a/arch/arm/include/asm/spinlock.h
+++ b/arch/arm/include/asm/spinlock.h
@@ -210,11 +210,12 @@ static inline void arch_read_lock(arch_rwlock_t *rw)
 
         prefetchw(&rw->lock);
         __asm__ __volatile__(
+"       .syntax unified\n"
 "1:     ldrex   %0, [%2]\n"
 "       adds    %0, %0, #1\n"
 "       strexpl %1, %0, [%2]\n"
         WFE("mi")
-"       rsbpls  %0, %1, #0\n"
+"       rsbspl  %0, %1, #0\n"
 "       bmi     1b"
         : "=&r" (tmp), "=&r" (tmp2)
         : "r" (&rw->lock)
diff --git a/arch/arm/include/asm/suspend.h b/arch/arm/include/asm/suspend.h
index 452bbdcbcc83..506314265c6f 100644
--- a/arch/arm/include/asm/suspend.h
+++ b/arch/arm/include/asm/suspend.h
@@ -10,6 +10,7 @@ struct sleep_save_sp {
 };
 
 extern void cpu_resume(void);
+extern void cpu_resume_no_hyp(void);
 extern void cpu_resume_arm(void);
 extern int cpu_suspend(unsigned long, int (*)(unsigned long));
 
diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
index ae5a0df5316e..dff49845eb87 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -85,7 +85,8 @@ static inline void set_fs(mm_segment_t fs)
 #define __range_ok(addr, size) ({ \
         unsigned long flag, roksum; \
         __chk_user_ptr(addr);   \
-        __asm__("adds %1, %2, %3; sbcccs %1, %1, %0; movcc %0, #0" \
+        __asm__(".syntax unified\n" \
+                "adds %1, %2, %3; sbcscc %1, %1, %0; movcc %0, #0" \
                 : "=&r" (flag), "=&r" (roksum) \
                 : "r" (addr), "Ir" (size), "0" (current_thread_info()->addr_limit) \
                 : "cc"); \
diff --git a/arch/arm/include/asm/v7m.h b/arch/arm/include/asm/v7m.h
index 187ccf6496ad..2cb00d15831b 100644
--- a/arch/arm/include/asm/v7m.h
+++ b/arch/arm/include/asm/v7m.h
@@ -49,7 +49,7 @@
  * (0 -> msp; 1 -> psp). Bits [1:0] are fixed to 0b01.
  */
 #define EXC_RET_STACK_MASK                      0x00000004
-#define EXC_RET_THREADMODE_PROCESSSTACK         0xfffffffd
+#define EXC_RET_THREADMODE_PROCESSSTACK         (3 << 2)
 
 /* Cache related definitions */
 
diff --git a/arch/arm/include/asm/vfpmacros.h b/arch/arm/include/asm/vfpmacros.h
index ef5dfedacd8d..628c336e8e3b 100644
--- a/arch/arm/include/asm/vfpmacros.h
+++ b/arch/arm/include/asm/vfpmacros.h
@@ -29,13 +29,13 @@
         ldr     \tmp, =elf_hwcap                    @ may not have MVFR regs
         ldr     \tmp, [\tmp, #0]
         tst     \tmp, #HWCAP_VFPD32
-        ldcnel  p11, cr0, [\base],#32*4             @ FLDMIAD \base!, {d16-d31}
+        ldclne  p11, cr0, [\base],#32*4             @ FLDMIAD \base!, {d16-d31}
         addeq   \base, \base, #32*4                 @ step over unused register space
 #else
         VFPFMRX \tmp, MVFR0                         @ Media and VFP Feature Register 0
         and     \tmp, \tmp, #MVFR0_A_SIMD_MASK      @ A_SIMD field
         cmp     \tmp, #2                            @ 32 x 64bit registers?
-        ldceql  p11, cr0, [\base],#32*4             @ FLDMIAD \base!, {d16-d31}
+        ldcleq  p11, cr0, [\base],#32*4             @ FLDMIAD \base!, {d16-d31}
         addne   \base, \base, #32*4                 @ step over unused register space
 #endif
 #endif
@@ -53,13 +53,13 @@
         ldr     \tmp, =elf_hwcap                    @ may not have MVFR regs
         ldr     \tmp, [\tmp, #0]
         tst     \tmp, #HWCAP_VFPD32
-        stcnel  p11, cr0, [\base],#32*4             @ FSTMIAD \base!, {d16-d31}
+        stclne  p11, cr0, [\base],#32*4             @ FSTMIAD \base!, {d16-d31}
         addeq   \base, \base, #32*4                 @ step over unused register space
 #else
         VFPFMRX \tmp, MVFR0                         @ Media and VFP Feature Register 0
         and     \tmp, \tmp, #MVFR0_A_SIMD_MASK      @ A_SIMD field
         cmp     \tmp, #2                            @ 32 x 64bit registers?
-        stceql  p11, cr0, [\base],#32*4             @ FSTMIAD \base!, {d16-d31}
+        stcleq  p11, cr0, [\base],#32*4             @ FSTMIAD \base!, {d16-d31}
         addne   \base, \base, #32*4                 @ step over unused register space
 #endif
 #endif
diff --git a/arch/arm/include/debug/tegra.S b/arch/arm/include/debug/tegra.S
index 3bc80599c022..4a5a645c76e2 100644
--- a/arch/arm/include/debug/tegra.S
+++ b/arch/arm/include/debug/tegra.S
@@ -173,7 +173,7 @@
 
                 .macro  senduart, rd, rx
                 cmp     \rx, #0
-                strneb  \rd, [\rx, #UART_TX << UART_SHIFT]
+                strbne  \rd, [\rx, #UART_TX << UART_SHIFT]
 1001:
                 .endm
 
diff --git a/arch/arm/include/uapi/asm/Kbuild b/arch/arm/include/uapi/asm/Kbuild
index eee8f7d23899..23b4464c0995 100644
--- a/arch/arm/include/uapi/asm/Kbuild
+++ b/arch/arm/include/uapi/asm/Kbuild
@@ -1,5 +1,4 @@
 # SPDX-License-Identifier: GPL-2.0
-include include/uapi/asm-generic/Kbuild.asm
 
 generated-y += unistd-common.h
 generated-y += unistd-oabi.h
diff --git a/arch/arm/kernel/debug.S b/arch/arm/kernel/debug.S
index b795dc2408c0..b9f94e03d916 100644
--- a/arch/arm/kernel/debug.S
+++ b/arch/arm/kernel/debug.S
@@ -86,7 +86,7 @@ hexbuf_rel:	.long	hexbuf_addr - .
 ENTRY(printascii)
                 addruart_current r3, r1, r2
 1:              teq     r0, #0
-                ldrneb  r1, [r0], #1
+                ldrbne  r1, [r0], #1
                 teqne   r1, #0
                 reteq   lr
 2:              teq     r1, #'\n'
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index e85a3af9ddeb..ce4aea57130a 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -636,7 +636,7 @@ call_fpe:
         @ Test if we need to give access to iWMMXt coprocessors
         ldr     r5, [r10, #TI_FLAGS]
         rsbs    r7, r8, #(1 << 8)               @ CP 0 or 1 only
-        movcss  r7, r5, lsr #(TIF_USING_IWMMXT + 1)
+        movscs  r7, r5, lsr #(TIF_USING_IWMMXT + 1)
         bcs     iwmmxt_task_enable
 #endif
  ARM(   add     pc, pc, r8, lsr #6      )
@@ -872,7 +872,7 @@ __kuser_cmpxchg64:				@ 0xffff0f60
         smp_dmb arm
 1:      ldrexd  r0, r1, [r2]                    @ load current val
         eors    r3, r0, r4                      @ compare with oldval (1)
-        eoreqs  r3, r1, r5                      @ compare with oldval (2)
+        eorseq  r3, r1, r5                      @ compare with oldval (2)
         strexdeq r3, r6, r7, [r2]               @ store newval if eq
         teqeq   r3, #1                          @ success?
         beq     1b                              @ if no then retry
@@ -896,8 +896,8 @@ __kuser_cmpxchg64:				@ 0xffff0f60
         ldmia   r1, {r6, lr}                    @ load new val
 1:      ldmia   r2, {r0, r1}                    @ load current val
         eors    r3, r0, r4                      @ compare with oldval (1)
-        eoreqs  r3, r1, r5                      @ compare with oldval (2)
-2:      stmeqia r2, {r6, lr}                    @ store newval if eq
+        eorseq  r3, r1, r5                      @ compare with oldval (2)
+2:      stmiaeq r2, {r6, lr}                    @ store newval if eq
         rsbs    r0, r3, #0                      @ set return val and C flag
         ldmfd   sp!, {r4, r5, r6, pc}
 
@@ -911,7 +911,7 @@ kuser_cmpxchg64_fixup:
         mov     r7, #0xffff0fff
         sub     r7, r7, #(0xffff0fff - (0xffff0f60 + (1b - __kuser_cmpxchg64)))
         subs    r8, r4, r7
-        rsbcss  r8, r8, #(2b - 1b)
+        rsbscs  r8, r8, #(2b - 1b)
         strcs   r7, [sp, #S_PC]
 #if __LINUX_ARM_ARCH__ < 6
         bcc     kuser_cmpxchg32_fixup
@@ -969,7 +969,7 @@ kuser_cmpxchg32_fixup:
         mov     r7, #0xffff0fff
         sub     r7, r7, #(0xffff0fff - (0xffff0fc0 + (1b - __kuser_cmpxchg)))
         subs    r8, r4, r7
-        rsbcss  r8, r8, #(2b - 1b)
+        rsbscs  r8, r8, #(2b - 1b)
         strcs   r7, [sp, #S_PC]
         ret     lr
         .previous
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index 0465d65d23de..f7649adef505 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -373,7 +373,7 @@ sys_syscall:
                 movhs   scno, #0
                 csdb
 #endif
-                stmloia sp, {r5, r6}            @ shuffle args
+                stmialo sp, {r5, r6}            @ shuffle args
                 movlo   r0, r1
                 movlo   r1, r2
                 movlo   r2, r3
diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
index 773424843d6e..32051ec5b33f 100644
--- a/arch/arm/kernel/entry-header.S
+++ b/arch/arm/kernel/entry-header.S
@@ -127,7 +127,8 @@
          */
         .macro  v7m_exception_slow_exit ret_r0
         cpsid   i
-        ldr     lr, =EXC_RET_THREADMODE_PROCESSSTACK
+        ldr     lr, =exc_ret
+        ldr     lr, [lr]
 
         @ read original r12, sp, lr, pc and xPSR
         add     r12, sp, #S_IP
@@ -387,8 +388,8 @@
         badr    lr, \ret                        @ return address
         .if     \reload
         add     r1, sp, #S_R0 + S_OFF           @ pointer to regs
-        ldmccia r1, {r0 - r6}                   @ reload r0-r6
-        stmccia sp, {r4, r5}                    @ update stack arguments
+        ldmiacc r1, {r0 - r6}                   @ reload r0-r6
+        stmiacc sp, {r4, r5}                    @ update stack arguments
         .endif
         ldrcc   pc, [\table, \tmp, lsl #2]      @ call sys_* routine
 #else
@@ -396,8 +397,8 @@
         badr    lr, \ret                        @ return address
         .if     \reload
         add     r1, sp, #S_R0 + S_OFF           @ pointer to regs
-        ldmccia r1, {r0 - r6}                   @ reload r0-r6
-        stmccia sp, {r4, r5}                    @ update stack arguments
+        ldmiacc r1, {r0 - r6}                   @ reload r0-r6
+        stmiacc sp, {r4, r5}                    @ update stack arguments
         .endif
         ldrcc   pc, [\table, \nr, lsl #2]       @ call sys_* routine
 #endif
diff --git a/arch/arm/kernel/entry-v7m.S b/arch/arm/kernel/entry-v7m.S
index abcf47848525..19d2dcd6530d 100644
--- a/arch/arm/kernel/entry-v7m.S
+++ b/arch/arm/kernel/entry-v7m.S
@@ -146,3 +146,7 @@ ENTRY(vector_table)
         .rept   CONFIG_CPU_V7M_NUM_IRQ
         .long   __irq_entry             @ External Interrupts
         .endr
+        .align  2
+        .globl  exc_ret
+exc_ret:
+        .space  4
diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S
index ec29de250076..c08d2d890f7b 100644
--- a/arch/arm/kernel/head-nommu.S
+++ b/arch/arm/kernel/head-nommu.S
@@ -439,8 +439,8 @@ M_CLASS(str	r6, [r12, #PMSAv8_RLAR_A(3)])
         str     r5, [r12, #PMSAv8_RBAR_A(0)]
         str     r6, [r12, #PMSAv8_RLAR_A(0)]
 #else
-        mcr     p15, 0, r5, c6, c10, 1                  @ PRBAR4
-        mcr     p15, 0, r6, c6, c10, 2                  @ PRLAR4
+        mcr     p15, 0, r5, c6, c10, 0                  @ PRBAR4
+        mcr     p15, 0, r6, c6, c10, 1                  @ PRLAR4
 #endif
 #endif
         ret     lr
diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S
index 60146e32619a..82a942894fc0 100644
--- a/arch/arm/kernel/hyp-stub.S
+++ b/arch/arm/kernel/hyp-stub.S
@@ -180,8 +180,8 @@ ARM_BE8(orr	r7, r7, #(1 << 25))     @ HSCTLR.EE
         @ Check whether GICv3 system registers are available
         mrc     p15, 0, r7, c0, c1, 1   @ ID_PFR1
         ubfx    r7, r7, #28, #4
-        cmp     r7, #1
-        bne     2f
+        teq     r7, #0
+        beq     2f
 
         @ Enable system register accesses
         mrc     p15, 4, r7, c12, c9, 5  @ ICC_HSRE
diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c
index dd2eb5f76b9f..76300f3813e8 100644
--- a/arch/arm/kernel/machine_kexec.c
+++ b/arch/arm/kernel/machine_kexec.c
@@ -91,8 +91,11 @@ void machine_crash_nonpanic_core(void *unused)
 
         set_cpu_online(smp_processor_id(), false);
         atomic_dec(&waiting_for_crash_ipi);
-        while (1)
+
+        while (1) {
                 cpu_relax();
+                wfe();
+        }
 }
 
 void crash_smp_send_stop(void)
diff --git a/arch/arm/kernel/patch.c b/arch/arm/kernel/patch.c
index a50dc00d79a2..d0a05a3bdb96 100644
--- a/arch/arm/kernel/patch.c
+++ b/arch/arm/kernel/patch.c
@@ -16,7 +16,7 @@ struct patch {
         unsigned int insn;
 };
 
-static DEFINE_SPINLOCK(patch_lock);
+static DEFINE_RAW_SPINLOCK(patch_lock);
 
 static void __kprobes *patch_map(void *addr, int fixmap, unsigned long *flags)
         __acquires(&patch_lock)
@@ -33,7 +33,7 @@ static void __kprobes *patch_map(void *addr, int fixmap, unsigned long *flags)
                 return addr;
 
         if (flags)
-                spin_lock_irqsave(&patch_lock, *flags);
+                raw_spin_lock_irqsave(&patch_lock, *flags);
         else
                 __acquire(&patch_lock);
 
@@ -48,7 +48,7 @@ static void __kprobes patch_unmap(int fixmap, unsigned long *flags)
         clear_fixmap(fixmap);
 
         if (flags)
-                spin_unlock_irqrestore(&patch_lock, *flags);
+                raw_spin_unlock_irqrestore(&patch_lock, *flags);
         else
                 __release(&patch_lock);
 }
diff --git a/arch/arm/kernel/sleep.S b/arch/arm/kernel/sleep.S
index a8257fc9cf2a..5dc8b80bb693 100644
--- a/arch/arm/kernel/sleep.S
+++ b/arch/arm/kernel/sleep.S
@@ -120,6 +120,14 @@ ENDPROC(cpu_resume_after_mmu)
         .text
         .align
 
+#ifdef CONFIG_MCPM
+        .arm
+THUMB(  .thumb                  )
+ENTRY(cpu_resume_no_hyp)
+ARM_BE8(setend be)                      @ ensure we are in BE mode
+        b       no_hyp
+#endif
+
 #ifdef CONFIG_MMU
         .arm
 ENTRY(cpu_resume_arm)
@@ -135,6 +143,7 @@ ARM_BE8(setend be)			@ ensure we are in BE mode
         bl      __hyp_stub_install_secondary
 #endif
         safe_svcmode_maskall r1
+no_hyp:
         mov     r1, #0
         ALT_SMP(mrc p15, 0, r0, c0, c0, 5)
         ALT_UP_B(1f)
@@ -164,6 +173,9 @@ ENDPROC(cpu_resume)
 #ifdef CONFIG_MMU
 ENDPROC(cpu_resume_arm)
 #endif
+#ifdef CONFIG_MCPM
+ENDPROC(cpu_resume_no_hyp)
+#endif
 
         .align 2
 _sleep_save_sp:
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 1d6f5ea522f4..facd4240ca02 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -62,12 +62,6 @@
  */
 struct secondary_data secondary_data;
 
-/*
- * control for which core is the next to come out of the secondary
- * boot "holding pen"
- */
-volatile int pen_release = -1;
-
 enum ipi_msg_type {
         IPI_WAKEUP,
         IPI_TIMER,
@@ -604,8 +598,10 @@ static void ipi_cpu_stop(unsigned int cpu)
         local_fiq_disable();
         local_irq_disable();
 
-        while (1)
+        while (1) {
                 cpu_relax();
+                wfe();
+        }
 }
 
 static DEFINE_PER_CPU(struct completion *, cpu_completion);
diff --git a/arch/arm/kernel/smp_twd.c b/arch/arm/kernel/smp_twd.c
index b30eafeef096..3cdc399b9fc3 100644
--- a/arch/arm/kernel/smp_twd.c
+++ b/arch/arm/kernel/smp_twd.c
@@ -100,8 +100,6 @@ static void twd_timer_stop(void)
         disable_percpu_irq(clk->irq);
 }
 
-#ifdef CONFIG_COMMON_CLK
-
 /*
  * Updates clockevent frequency when the cpu frequency changes.
  * Called on the cpu that is changing frequency with interrupts disabled.
@@ -143,54 +141,6 @@ static int twd_clk_init(void)
 }
 core_initcall(twd_clk_init);
 
-#elif defined (CONFIG_CPU_FREQ)
-
-#include <linux/cpufreq.h>
-
-/*
- * Updates clockevent frequency when the cpu frequency changes.
- * Called on the cpu that is changing frequency with interrupts disabled.
- */
-static void twd_update_frequency(void *data)
-{
-        twd_timer_rate = clk_get_rate(twd_clk);
-
-        clockevents_update_freq(raw_cpu_ptr(twd_evt), twd_timer_rate);
-}
-
-static int twd_cpufreq_transition(struct notifier_block *nb,
-        unsigned long state, void *data)
-{
-        struct cpufreq_freqs *freqs = data;
-
-        /*
-         * The twd clock events must be reprogrammed to account for the new
-         * frequency.  The timer is local to a cpu, so cross-call to the
-         * changing cpu.
-         */
-        if (state == CPUFREQ_POSTCHANGE)
-                smp_call_function_single(freqs->cpu, twd_update_frequency,
-                        NULL, 1);
-
-        return NOTIFY_OK;
-}
-
-static struct notifier_block twd_cpufreq_nb = {
-        .notifier_call = twd_cpufreq_transition,
-};
-
-static int twd_cpufreq_init(void)
-{
-        if (twd_evt && raw_cpu_ptr(twd_evt) && !IS_ERR(twd_clk))
-                return cpufreq_register_notifier(&twd_cpufreq_nb,
-                        CPUFREQ_TRANSITION_NOTIFIER);
-
-        return 0;
-}
-core_initcall(twd_cpufreq_init);
-
-#endif
-
 static void twd_calibrate_rate(void)
 {
         unsigned long count;
@@ -366,21 +316,6 @@ out_free:
         return err;
 }
 
-int __init twd_local_timer_register(struct twd_local_timer *tlt)
-{
-        if (twd_base || twd_evt)
-                return -EBUSY;
-
-        twd_ppi = tlt->res[1].start;
-
-        twd_base = ioremap(tlt->res[0].start, resource_size(&tlt->res[0]));
-        if (!twd_base)
-                return -ENOMEM;
-
-        return twd_local_timer_common_register(NULL);
-}
-
-#ifdef CONFIG_OF
 static int __init twd_local_timer_of_register(struct device_node *np)
 {
         int err;
@@ -406,4 +341,3 @@ out:
 TIMER_OF_DECLARE(arm_twd_a9, "arm,cortex-a9-twd-timer", twd_local_timer_of_register);
 TIMER_OF_DECLARE(arm_twd_a5, "arm,cortex-a5-twd-timer", twd_local_timer_of_register);
 TIMER_OF_DECLARE(arm_twd_11mp, "arm,arm11mp-twd-timer", twd_local_timer_of_register);
-#endif
diff --git a/arch/arm/kernel/unwind.c b/arch/arm/kernel/unwind.c
index 0bee233fef9a..314cfb232a63 100644
--- a/arch/arm/kernel/unwind.c
+++ b/arch/arm/kernel/unwind.c
@@ -93,7 +93,7 @@ extern const struct unwind_idx __start_unwind_idx[];
 static const struct unwind_idx *__origin_unwind_idx;
 extern const struct unwind_idx __stop_unwind_idx[];
 
-static DEFINE_SPINLOCK(unwind_lock);
+static DEFINE_RAW_SPINLOCK(unwind_lock);
 static LIST_HEAD(unwind_tables);
 
 /* Convert a prel31 symbol to an absolute address */
@@ -201,7 +201,7 @@ static const struct unwind_idx *unwind_find_idx(unsigned long addr)
                 /* module unwind tables */
                 struct unwind_table *table;
 
-                spin_lock_irqsave(&unwind_lock, flags);
+                raw_spin_lock_irqsave(&unwind_lock, flags);
                 list_for_each_entry(table, &unwind_tables, list) {
                         if (addr >= table->begin_addr &&
                             addr < table->end_addr) {
@@ -213,7 +213,7 @@ static const struct unwind_idx *unwind_find_idx(unsigned long addr)
                                 break;
                         }
                 }
-                spin_unlock_irqrestore(&unwind_lock, flags);
+                raw_spin_unlock_irqrestore(&unwind_lock, flags);
         }
 
         pr_debug("%s: idx = %p\n", __func__, idx);
@@ -529,9 +529,9 @@ struct unwind_table *unwind_table_add(unsigned long start, unsigned long size,
         tab->begin_addr = text_addr;
         tab->end_addr = text_addr + text_size;
 
-        spin_lock_irqsave(&unwind_lock, flags);
+        raw_spin_lock_irqsave(&unwind_lock, flags);
         list_add_tail(&tab->list, &unwind_tables);
-        spin_unlock_irqrestore(&unwind_lock, flags);
+        raw_spin_unlock_irqrestore(&unwind_lock, flags);
 
         return tab;
 }
@@ -543,9 +543,9 @@ void unwind_table_del(struct unwind_table *tab)
         if (!tab)
                 return;
 
-        spin_lock_irqsave(&unwind_lock, flags);
+        raw_spin_lock_irqsave(&unwind_lock, flags);
         list_del(&tab->list);
-        spin_unlock_irqrestore(&unwind_lock, flags);
+        raw_spin_unlock_irqrestore(&unwind_lock, flags);
 
         kfree(tab);
 }
diff --git a/arch/arm/kvm/Makefile b/arch/arm/kvm/Makefile
index 48de846f2246..531e59f5be9c 100644
--- a/arch/arm/kvm/Makefile
+++ b/arch/arm/kvm/Makefile
@@ -8,9 +8,8 @@ ifeq ($(plus_virt),+virt)
         plus_virt_def := -DREQUIRES_VIRT=1
 endif
 
-ccflags-y += -Iarch/arm/kvm -Ivirt/kvm/arm/vgic
-CFLAGS_arm.o := -I. $(plus_virt_def)
-CFLAGS_mmu.o := -I.
+ccflags-y += -I $(srctree)/$(src) -I $(srctree)/virt/kvm/arm/vgic
+CFLAGS_arm.o := $(plus_virt_def)
 
 AFLAGS_init.o := -Wa,-march=armv7-a$(plus_virt)
 AFLAGS_interrupts.o := -Wa,-march=armv7-a$(plus_virt)
diff --git a/arch/arm/kvm/coproc.c b/arch/arm/kvm/coproc.c
index e8bd288fd5be..14915c78bd99 100644
--- a/arch/arm/kvm/coproc.c
+++ b/arch/arm/kvm/coproc.c
@@ -293,15 +293,16 @@ static bool access_cntp_tval(struct kvm_vcpu *vcpu,
                              const struct coproc_params *p,
                              const struct coproc_reg *r)
 {
-        u64 now = kvm_phys_timer_read();
-        u64 val;
+        u32 val;
 
         if (p->is_write) {
                 val = *vcpu_reg(vcpu, p->Rt1);
-                kvm_arm_timer_set_reg(vcpu, KVM_REG_ARM_PTIMER_CVAL, val + now);
+                kvm_arm_timer_write_sysreg(vcpu,
+                                           TIMER_PTIMER, TIMER_REG_TVAL, val);
         } else {
-                val = kvm_arm_timer_get_reg(vcpu, KVM_REG_ARM_PTIMER_CVAL);
-                *vcpu_reg(vcpu, p->Rt1) = val - now;
+                val = kvm_arm_timer_read_sysreg(vcpu,
+                                                TIMER_PTIMER, TIMER_REG_TVAL);
+                *vcpu_reg(vcpu, p->Rt1) = val;
         }
 
         return true;
@@ -315,9 +316,11 @@ static bool access_cntp_ctl(struct kvm_vcpu *vcpu,
 
         if (p->is_write) {
                 val = *vcpu_reg(vcpu, p->Rt1);
-                kvm_arm_timer_set_reg(vcpu, KVM_REG_ARM_PTIMER_CTL, val);
+                kvm_arm_timer_write_sysreg(vcpu,
+                                           TIMER_PTIMER, TIMER_REG_CTL, val);
         } else {
-                val = kvm_arm_timer_get_reg(vcpu, KVM_REG_ARM_PTIMER_CTL);
+                val = kvm_arm_timer_read_sysreg(vcpu,
+                                                TIMER_PTIMER, TIMER_REG_CTL);
                 *vcpu_reg(vcpu, p->Rt1) = val;
         }
 
@@ -333,9 +336,11 @@ static bool access_cntp_cval(struct kvm_vcpu *vcpu,
         if (p->is_write) {
                 val = (u64)*vcpu_reg(vcpu, p->Rt2) << 32;
                 val |= *vcpu_reg(vcpu, p->Rt1);
-                kvm_arm_timer_set_reg(vcpu, KVM_REG_ARM_PTIMER_CVAL, val);
+                kvm_arm_timer_write_sysreg(vcpu,
+                                           TIMER_PTIMER, TIMER_REG_CVAL, val);
         } else {
-                val = kvm_arm_timer_get_reg(vcpu, KVM_REG_ARM_PTIMER_CVAL);
+                val = kvm_arm_timer_read_sysreg(vcpu,
+                                                TIMER_PTIMER, TIMER_REG_CVAL);
                 *vcpu_reg(vcpu, p->Rt1) = val;
                 *vcpu_reg(vcpu, p->Rt2) = val >> 32;
         }
diff --git a/arch/arm/kvm/hyp/cp15-sr.c b/arch/arm/kvm/hyp/cp15-sr.c
index c4782812714c..8bf895ec6e04 100644
--- a/arch/arm/kvm/hyp/cp15-sr.c
+++ b/arch/arm/kvm/hyp/cp15-sr.c
@@ -27,7 +27,6 @@ static u64 *cp15_64(struct kvm_cpu_context *ctxt, int idx)
 
 void __hyp_text __sysreg_save_state(struct kvm_cpu_context *ctxt)
 {
-        ctxt->cp15[c0_MPIDR]            = read_sysreg(VMPIDR);
         ctxt->cp15[c0_CSSELR]           = read_sysreg(CSSELR);
         ctxt->cp15[c1_SCTLR]            = read_sysreg(SCTLR);
         ctxt->cp15[c1_CPACR]            = read_sysreg(CPACR);
diff --git a/arch/arm/kvm/hyp/hyp-entry.S b/arch/arm/kvm/hyp/hyp-entry.S
index aa3f9a9837ac..6ed3cf23fe89 100644
--- a/arch/arm/kvm/hyp/hyp-entry.S
+++ b/arch/arm/kvm/hyp/hyp-entry.S
@@ -176,7 +176,7 @@ THUMB(	orr	lr, lr, #PSR_T_BIT	)
         msr     spsr_cxsf, lr
         ldr     lr, =panic
         msr     ELR_hyp, lr
-        ldr     lr, =kvm_call_hyp
+        ldr     lr, =__kvm_call_hyp
         clrex
         eret
 ENDPROC(__hyp_do_panic)
diff --git a/arch/arm/kvm/hyp/switch.c b/arch/arm/kvm/hyp/switch.c
index acf1c37fa49c..3b058a5d7c5f 100644
--- a/arch/arm/kvm/hyp/switch.c
+++ b/arch/arm/kvm/hyp/switch.c
@@ -77,7 +77,7 @@ static void __hyp_text __deactivate_traps(struct kvm_vcpu *vcpu)
 static void __hyp_text __activate_vm(struct kvm_vcpu *vcpu)
 {
         struct kvm *kvm = kern_hyp_va(vcpu->kvm);
-        write_sysreg(kvm->arch.vttbr, VTTBR);
+        write_sysreg(kvm_get_vttbr(kvm), VTTBR);
         write_sysreg(vcpu->arch.midr, VPIDR);
 }
 
diff --git a/arch/arm/kvm/hyp/tlb.c b/arch/arm/kvm/hyp/tlb.c
index c0edd450e104..8e4afba73635 100644
--- a/arch/arm/kvm/hyp/tlb.c
+++ b/arch/arm/kvm/hyp/tlb.c
@@ -41,7 +41,7 @@ void __hyp_text __kvm_tlb_flush_vmid(struct kvm *kvm)
 
         /* Switch to requested VMID */
         kvm = kern_hyp_va(kvm);
-        write_sysreg(kvm->arch.vttbr, VTTBR);
+        write_sysreg(kvm_get_vttbr(kvm), VTTBR);
         isb();
 
         write_sysreg(0, TLBIALLIS);
@@ -61,7 +61,7 @@ void __hyp_text __kvm_tlb_flush_local_vmid(struct kvm_vcpu *vcpu)
         struct kvm *kvm = kern_hyp_va(kern_hyp_va(vcpu)->kvm);
 
         /* Switch to requested VMID */
-        write_sysreg(kvm->arch.vttbr, VTTBR);
+        write_sysreg(kvm_get_vttbr(kvm), VTTBR);
         isb();
 
         write_sysreg(0, TLBIALL);
diff --git a/arch/arm/kvm/interrupts.S b/arch/arm/kvm/interrupts.S
index 80a1d6cd261c..a08e6419ebe9 100644
--- a/arch/arm/kvm/interrupts.S
+++ b/arch/arm/kvm/interrupts.S
@@ -42,7 +42,7 @@
  *   r12:     caller save
  *   rest:    callee save
  */
-ENTRY(kvm_call_hyp)
+ENTRY(__kvm_call_hyp)
         hvc     #0
         bx      lr
-ENDPROC(kvm_call_hyp)
+ENDPROC(__kvm_call_hyp)
diff --git a/arch/arm/lib/Makefile b/arch/arm/lib/Makefile
index ad25fd1872c7..0bff0176db2c 100644
--- a/arch/arm/lib/Makefile
+++ b/arch/arm/lib/Makefile
@@ -39,7 +39,7 @@ $(obj)/csumpartialcopy.o:	$(obj)/csumpartialcopygeneric.S
 $(obj)/csumpartialcopyuser.o:   $(obj)/csumpartialcopygeneric.S
 
 ifeq ($(CONFIG_KERNEL_MODE_NEON),y)
-  NEON_FLAGS                    := -mfloat-abi=softfp -mfpu=neon
+  NEON_FLAGS                    := -march=armv7-a -mfloat-abi=softfp -mfpu=neon
   CFLAGS_xor-neon.o             += $(NEON_FLAGS)
   obj-$(CONFIG_XOR_BLOCKS)      += xor-neon.o
 endif
diff --git a/arch/arm/lib/bitops.h b/arch/arm/lib/bitops.h
index 93cddab73072..95bd35991288 100644
--- a/arch/arm/lib/bitops.h
+++ b/arch/arm/lib/bitops.h
@@ -7,7 +7,7 @@
 ENTRY(  \name           )
 UNWIND( .fnstart        )
         ands    ip, r1, #3
-        strneb  r1, [ip]                @ assert word-aligned
+        strbne  r1, [ip]                @ assert word-aligned
         mov     r2, #1
         and     r3, r0, #31             @ Get bit offset
         mov     r0, r0, lsr #5
@@ -32,7 +32,7 @@ ENDPROC(\name		)
 ENTRY(  \name           )
 UNWIND( .fnstart        )
         ands    ip, r1, #3
-        strneb  r1, [ip]                @ assert word-aligned
+        strbne  r1, [ip]                @ assert word-aligned
         mov     r2, #1
         and     r3, r0, #31             @ Get bit offset
         mov     r0, r0, lsr #5
@@ -62,7 +62,7 @@ ENDPROC(\name		)
 ENTRY(  \name           )
 UNWIND( .fnstart        )
         ands    ip, r1, #3
-        strneb  r1, [ip]                @ assert word-aligned
+        strbne  r1, [ip]                @ assert word-aligned
         and     r2, r0, #31
         mov     r0, r0, lsr #5
         mov     r3, #1
@@ -89,7 +89,7 @@ ENDPROC(\name		)
 ENTRY(  \name           )
 UNWIND( .fnstart        )
         ands    ip, r1, #3
-        strneb  r1, [ip]                @ assert word-aligned
+        strbne  r1, [ip]                @ assert word-aligned
         and     r3, r0, #31
         mov     r0, r0, lsr #5
         save_and_disable_irqs ip
diff --git a/arch/arm/lib/clear_user.S b/arch/arm/lib/clear_user.S
index e936352ccb00..55946e3fa2ba 100644
--- a/arch/arm/lib/clear_user.S
+++ b/arch/arm/lib/clear_user.S
@@ -44,7 +44,7 @@ UNWIND(.save {r1, lr})
                 strusr  r2, r0, 1, ne, rept=2
                 tst     r1, #1                  @ x1 x0 x1 x0 x1 x0 x1
                 it      ne                      @ explicit IT needed for the label
-USER(           strnebt r2, [r0])
+USER(           strbtne r2, [r0])
                 mov     r0, #0
                 ldmfd   sp!, {r1, pc}
 UNWIND(.fnend)
diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
index 0d4c189c7f4f..6a3419e2c6d8 100644
--- a/arch/arm/lib/copy_from_user.S
+++ b/arch/arm/lib/copy_from_user.S
@@ -91,7 +91,7 @@
         .endm
 
         .macro str1b ptr reg cond=al abort
-        str\cond\()b \reg, [\ptr], #1
+        strb\cond \reg, [\ptr], #1
         .endm
 
         .macro enter reg1 reg2
diff --git a/arch/arm/lib/copy_page.S b/arch/arm/lib/copy_page.S
index 6ee2f6706f86..b84ce1792043 100644
--- a/arch/arm/lib/copy_page.S
+++ b/arch/arm/lib/copy_page.S
@@ -39,9 +39,9 @@ ENTRY(copy_page)
         .endr
                 subs    r2, r2, #1                      @       1
                 stmia   r0!, {r3, r4, ip, lr}           @       4
-                ldmgtia r1!, {r3, r4, ip, lr}           @       4
+                ldmiagt r1!, {r3, r4, ip, lr}           @       4
                 bgt     1b                              @       1
-        PLD(    ldmeqia r1!, {r3, r4, ip, lr}   )
+        PLD(    ldmiaeq r1!, {r3, r4, ip, lr}   )
         PLD(    beq     2b                      )
                 ldmfd   sp!, {r4, pc}                   @       3
 ENDPROC(copy_page)
diff --git a/arch/arm/lib/copy_template.S b/arch/arm/lib/copy_template.S
index 652e4d98cd47..a11f2c25e03a 100644
--- a/arch/arm/lib/copy_template.S
+++ b/arch/arm/lib/copy_template.S
@@ -99,7 +99,7 @@
 
         CALGN(  ands    ip, r0, #31             )
         CALGN(  rsb     r3, ip, #32             )
-        CALGN(  sbcnes  r4, r3, r2              )  @ C is always set here
+        CALGN(  sbcsne  r4, r3, r2              )  @ C is always set here
         CALGN(  bcs     2f                      )
         CALGN(  adr     r4, 6f                  )
         CALGN(  subs    r2, r2, r3              )  @ C gets set
@@ -204,7 +204,7 @@
 
         CALGN(  ands    ip, r0, #31             )
         CALGN(  rsb     ip, ip, #32             )
-        CALGN(  sbcnes  r4, ip, r2              )  @ C is always set here
+        CALGN(  sbcsne  r4, ip, r2              )  @ C is always set here
         CALGN(  subcc   r2, r2, ip              )
         CALGN(  bcc     15f                     )
 
@@ -241,7 +241,7 @@
                 orr     r9, r9, ip, lspush #\push
                 mov     ip, ip, lspull #\pull
                 orr     ip, ip, lr, lspush #\push
-                str8w   r0, r3, r4, r5, r6, r7, r8, r9, ip, , abort=19f
+                str8w   r0, r3, r4, r5, r6, r7, r8, r9, ip, abort=19f
                 bge     12b
         PLD(    cmn     r2, #96                 )
         PLD(    bge     13b                     )
diff --git a/arch/arm/lib/copy_to_user.S b/arch/arm/lib/copy_to_user.S
index 97a6ff4b7e3c..c7d08096e354 100644
--- a/arch/arm/lib/copy_to_user.S
+++ b/arch/arm/lib/copy_to_user.S
@@ -49,7 +49,7 @@
         .endm
 
         .macro ldr1b ptr reg cond=al abort
-        ldr\cond\()b \reg, [\ptr], #1
+        ldrb\cond \reg, [\ptr], #1
         .endm
 
 #ifdef CONFIG_CPU_USE_DOMAINS
diff --git a/arch/arm/lib/csumpartial.S b/arch/arm/lib/csumpartial.S
index 984e0f29d548..bd84e2db353b 100644
--- a/arch/arm/lib/csumpartial.S
+++ b/arch/arm/lib/csumpartial.S
@@ -40,9 +40,9 @@ td3	.req	lr
                 /* we must have at least one byte. */
                 tst     buf, #1                 @ odd address?
                 movne   sum, sum, ror #8
-                ldrneb  td0, [buf], #1
+                ldrbne  td0, [buf], #1
                 subne   len, len, #1
-                adcnes  sum, sum, td0, put_byte_1
+                adcsne  sum, sum, td0, put_byte_1
 
 .Lless4:                tst     len, #6
                 beq     .Lless8_byte
@@ -68,8 +68,8 @@ td3	.req	lr
                 bne     .Lless8_wordlp
 
 .Lless8_byte:   tst     len, #1                 @ odd number of bytes
-                ldrneb  td0, [buf], #1          @ include last byte
-                adcnes  sum, sum, td0, put_byte_0       @ update checksum
+                ldrbne  td0, [buf], #1          @ include last byte
+                adcsne  sum, sum, td0, put_byte_0       @ update checksum
 
 .Ldone:         adc     r0, sum, #0             @ collect up the last carry
                 ldr     td0, [sp], #4
@@ -78,17 +78,17 @@ td3	.req	lr
                 ldr     pc, [sp], #4            @ return
 
 .Lnot_aligned:  tst     buf, #1                 @ odd address
-                ldrneb  td0, [buf], #1          @ make even
+                ldrbne  td0, [buf], #1          @ make even
                 subne   len, len, #1
-                adcnes  sum, sum, td0, put_byte_1       @ update checksum
+                adcsne  sum, sum, td0, put_byte_1       @ update checksum
 
                 tst     buf, #2                 @ 32-bit aligned?
 #if __LINUX_ARM_ARCH__ >= 4
-                ldrneh  td0, [buf], #2          @ make 32-bit aligned
+                ldrhne  td0, [buf], #2          @ make 32-bit aligned
                 subne   len, len, #2
 #else
-                ldrneb  td0, [buf], #1
-                ldrneb  ip, [buf], #1
+                ldrbne  td0, [buf], #1
+                ldrbne  ip, [buf], #1
                 subne   len, len, #2
 #ifndef __ARMEB__
                 orrne   td0, td0, ip, lsl #8
@@ -96,7 +96,7 @@ td3	.req	lr
                 orrne   td0, ip, td0, lsl #8
 #endif
 #endif
-                adcnes  sum, sum, td0           @ update checksum
+                adcsne  sum, sum, td0           @ update checksum
                 ret     lr
 
 ENTRY(csum_partial)
diff --git a/arch/arm/lib/csumpartialcopygeneric.S b/arch/arm/lib/csumpartialcopygeneric.S
index 10b45909610c..08e17758cbea 100644
--- a/arch/arm/lib/csumpartialcopygeneric.S
+++ b/arch/arm/lib/csumpartialcopygeneric.S
@@ -148,9 +148,9 @@ FN_ENTRY
                 strb    r5, [dst], #1
                 mov     r5, r4, get_byte_2
 .Lexit:         tst     len, #1
-                strneb  r5, [dst], #1
+                strbne  r5, [dst], #1
                 andne   r5, r5, #255
-                adcnes  sum, sum, r5, put_byte_0
+                adcsne  sum, sum, r5, put_byte_0
 
                 /*
                  * If the dst pointer was not 16-bit aligned, we
diff --git a/arch/arm/lib/csumpartialcopyuser.S b/arch/arm/lib/csumpartialcopyuser.S
index b83fdc06286a..f4716d98e0b4 100644
--- a/arch/arm/lib/csumpartialcopyuser.S
+++ b/arch/arm/lib/csumpartialcopyuser.S
@@ -95,7 +95,7 @@
                 add     r2, r2, r1
                 mov     r0, #0                  @ zero the buffer
 9002:           teq     r2, r1
-                strneb  r0, [r1], #1
+                strbne  r0, [r1], #1
                 bne     9002b
                 load_regs
                 .popsection
diff --git a/arch/arm/lib/div64.S b/arch/arm/lib/div64.S
index a9eafe4981eb..4d80f690c48b 100644
--- a/arch/arm/lib/div64.S
+++ b/arch/arm/lib/div64.S
@@ -88,8 +88,8 @@ UNWIND(.fnstart)
         @ Break out early if dividend reaches 0.
 2:      cmp     xh, yl
         orrcs   yh, yh, ip
-        subcss  xh, xh, yl
-        movnes  ip, ip, lsr #1
+        subscs  xh, xh, yl
+        movsne  ip, ip, lsr #1
         mov     yl, yl, lsr #1
         bne     2b
 
diff --git a/arch/arm/lib/floppydma.S b/arch/arm/lib/floppydma.S
index 617150b1baef..de68d3b343e3 100644
--- a/arch/arm/lib/floppydma.S
+++ b/arch/arm/lib/floppydma.S
@@ -14,8 +14,8 @@
                 .global floppy_fiqin_end
 ENTRY(floppy_fiqin_start)
                 subs    r9, r9, #1
-                ldrgtb  r12, [r11, #-4]
-                ldrleb  r12, [r11], #0
+                ldrbgt  r12, [r11, #-4]
+                ldrble  r12, [r11], #0
                 strb    r12, [r10], #1
                 subs    pc, lr, #4
 floppy_fiqin_end:
@@ -23,10 +23,10 @@ floppy_fiqin_end:
                 .global floppy_fiqout_end
 ENTRY(floppy_fiqout_start)
                 subs    r9, r9, #1
-                ldrgeb  r12, [r10], #1
+                ldrbge  r12, [r10], #1
                 movlt   r12, #0
-                strleb  r12, [r11], #0
-                subles  pc, lr, #4
+                strble  r12, [r11], #0
+                subsle  pc, lr, #4
                 strb    r12, [r11, #-4]
                 subs    pc, lr, #4
 floppy_fiqout_end:
diff --git a/arch/arm/lib/io-readsb.S b/arch/arm/lib/io-readsb.S
index c31b2f3153f1..91038a0a77b5 100644
--- a/arch/arm/lib/io-readsb.S
+++ b/arch/arm/lib/io-readsb.S
@@ -16,10 +16,10 @@
                 cmp     ip, #2
                 ldrb    r3, [r0]
                 strb    r3, [r1], #1
-                ldrgeb  r3, [r0]
-                strgeb  r3, [r1], #1
-                ldrgtb  r3, [r0]
-                strgtb  r3, [r1], #1
+                ldrbge  r3, [r0]
+                strbge  r3, [r1], #1
+                ldrbgt  r3, [r0]
+                strbgt  r3, [r1], #1
                 subs    r2, r2, ip
                 bne     .Linsb_aligned
 
@@ -72,7 +72,7 @@ ENTRY(__raw_readsb)
                 bpl     .Linsb_16_lp
 
                 tst     r2, #15
-                ldmeqfd sp!, {r4 - r6, pc}
+                ldmfdeq sp!, {r4 - r6, pc}
 
 .Linsb_no_16:   tst     r2, #8
                 beq     .Linsb_no_8
@@ -109,15 +109,15 @@ ENTRY(__raw_readsb)
                 str     r3, [r1], #4
 
 .Linsb_no_4:    ands    r2, r2, #3
-                ldmeqfd sp!, {r4 - r6, pc}
+                ldmfdeq sp!, {r4 - r6, pc}
 
                 cmp     r2, #2
                 ldrb    r3, [r0]
                 strb    r3, [r1], #1
-                ldrgeb  r3, [r0]
-                strgeb  r3, [r1], #1
-                ldrgtb  r3, [r0]
-                strgtb  r3, [r1]
+                ldrbge  r3, [r0]
+                strbge  r3, [r1], #1
+                ldrbgt  r3, [r0]
+                strbgt  r3, [r1]
 
                 ldmfd   sp!, {r4 - r6, pc}
 ENDPROC(__raw_readsb)
diff --git a/arch/arm/lib/io-readsl.S b/arch/arm/lib/io-readsl.S
index 2ed86fa5465f..f2e2064318d2 100644
--- a/arch/arm/lib/io-readsl.S
+++ b/arch/arm/lib/io-readsl.S
@@ -30,7 +30,7 @@ ENTRY(__raw_readsl)
 2:              movs    r2, r2, lsl #31
                 ldrcs   r3, [r0, #0]
                 ldrcs   ip, [r0, #0]
-                stmcsia r1!, {r3, ip}
+                stmiacs r1!, {r3, ip}
                 ldrne   r3, [r0, #0]
                 strne   r3, [r1, #0]
                 ret     lr
diff --git a/arch/arm/lib/io-readsw-armv3.S b/arch/arm/lib/io-readsw-armv3.S
index 413da9914529..8b25b69c516e 100644
--- a/arch/arm/lib/io-readsw-armv3.S
+++ b/arch/arm/lib/io-readsw-armv3.S
@@ -68,7 +68,7 @@ ENTRY(__raw_readsw)
                 bpl     .Linsw_8_lp
 
                 tst     r2, #7
-                ldmeqfd sp!, {r4, r5, r6, pc}
+                ldmfdeq sp!, {r4, r5, r6, pc}
 
 .Lno_insw_8:    tst     r2, #4
                 beq     .Lno_insw_4
@@ -97,9 +97,9 @@ ENTRY(__raw_readsw)
 
 .Lno_insw_2:    tst     r2, #1
                 ldrne   r3, [r0]
-                strneb  r3, [r1], #1
+                strbne  r3, [r1], #1
                 movne   r3, r3, lsr #8
-                strneb  r3, [r1]
+                strbne  r3, [r1]
 
                 ldmfd   sp!, {r4, r5, r6, pc}
 
diff --git a/arch/arm/lib/io-readsw-armv4.S b/arch/arm/lib/io-readsw-armv4.S
index d9a45e9692ae..5efdd66f5dcd 100644
--- a/arch/arm/lib/io-readsw-armv4.S
+++ b/arch/arm/lib/io-readsw-armv4.S
@@ -76,8 +76,8 @@ ENTRY(__raw_readsw)
                 pack    r3, r3, ip
                 str     r3, [r1], #4
 
-.Lno_insw_2:    ldrneh  r3, [r0]
-                strneh  r3, [r1]
+.Lno_insw_2:    ldrhne  r3, [r0]
+                strhne  r3, [r1]
 
                 ldmfd   sp!, {r4, r5, pc}
 
@@ -94,7 +94,7 @@ ENTRY(__raw_readsw)
 #endif
 
 .Linsw_noalign: stmfd   sp!, {r4, lr}
-                ldrccb  ip, [r1, #-1]!
+                ldrbcc  ip, [r1, #-1]!
                 bcc     1f
 
                 ldrh    ip, [r0]
@@ -121,11 +121,11 @@ ENTRY(__raw_readsw)
 
 3:              tst     r2, #1
                 strb    ip, [r1], #1
-                ldrneh  ip, [r0]
+                ldrhne  ip, [r0]
    _BE_ONLY_(   movne   ip, ip, ror #8          )
-                strneb  ip, [r1], #1
+                strbne  ip, [r1], #1
    _LE_ONLY_(   movne   ip, ip, lsr #8          )
    _BE_ONLY_(   movne   ip, ip, lsr #24         )
-                strneb  ip, [r1]
+                strbne  ip, [r1]
                 ldmfd   sp!, {r4, pc}
 ENDPROC(__raw_readsw)
diff --git a/arch/arm/lib/io-writesb.S b/arch/arm/lib/io-writesb.S
index a46bbc9b168b..7d2881a2381e 100644
--- a/arch/arm/lib/io-writesb.S
+++ b/arch/arm/lib/io-writesb.S
@@ -36,10 +36,10 @@
                 cmp     ip, #2
                 ldrb    r3, [r1], #1
                 strb    r3, [r0]
-                ldrgeb  r3, [r1], #1
-                strgeb  r3, [r0]
-                ldrgtb  r3, [r1], #1
-                strgtb  r3, [r0]
+                ldrbge  r3, [r1], #1
+                strbge  r3, [r0]
+                ldrbgt  r3, [r1], #1
+                strbgt  r3, [r0]
                 subs    r2, r2, ip
                 bne     .Loutsb_aligned
 
@@ -64,7 +64,7 @@ ENTRY(__raw_writesb)
                 bpl     .Loutsb_16_lp
 
                 tst     r2, #15
-                ldmeqfd sp!, {r4, r5, pc}
+                ldmfdeq sp!, {r4, r5, pc}
 
 .Loutsb_no_16:  tst     r2, #8
                 beq     .Loutsb_no_8
@@ -80,15 +80,15 @@ ENTRY(__raw_writesb)
                 outword r3
 
 .Loutsb_no_4:   ands    r2, r2, #3
-                ldmeqfd sp!, {r4, r5, pc}
+                ldmfdeq sp!, {r4, r5, pc}
 
                 cmp     r2, #2
                 ldrb    r3, [r1], #1
                 strb    r3, [r0]
-                ldrgeb  r3, [r1], #1
-                strgeb  r3, [r0]
-                ldrgtb  r3, [r1]
-                strgtb  r3, [r0]
+                ldrbge  r3, [r1], #1
+                strbge  r3, [r0]
+                ldrbgt  r3, [r1]
+                strbgt  r3, [r0]
 
                 ldmfd   sp!, {r4, r5, pc}
 ENDPROC(__raw_writesb)
diff --git a/arch/arm/lib/io-writesl.S b/arch/arm/lib/io-writesl.S
index 4ea2435988c1..7596ac0c90b0 100644
--- a/arch/arm/lib/io-writesl.S
+++ b/arch/arm/lib/io-writesl.S
@@ -28,7 +28,7 @@ ENTRY(__raw_writesl)
                 bpl     1b
                 ldmfd   sp!, {r4, lr}
 2:              movs    r2, r2, lsl #31
-                ldmcsia r1!, {r3, ip}
+                ldmiacs r1!, {r3, ip}
                 strcs   r3, [r0, #0]
                 ldrne   r3, [r1, #0]
                 strcs   ip, [r0, #0]
diff --git a/arch/arm/lib/io-writesw-armv3.S b/arch/arm/lib/io-writesw-armv3.S
index 121789eb6802..cb94b9b49405 100644
--- a/arch/arm/lib/io-writesw-armv3.S
+++ b/arch/arm/lib/io-writesw-armv3.S
@@ -79,7 +79,7 @@ ENTRY(__raw_writesw)
                 bpl     .Loutsw_8_lp
 
                 tst     r2, #7
-                ldmeqfd sp!, {r4, r5, r6, pc}
+                ldmfdeq sp!, {r4, r5, r6, pc}
 
 .Lno_outsw_8:   tst     r2, #4
                 beq     .Lno_outsw_4
diff --git a/arch/arm/lib/io-writesw-armv4.S b/arch/arm/lib/io-writesw-armv4.S
index 269f90c51ad2..e6645b2f249e 100644
--- a/arch/arm/lib/io-writesw-armv4.S
+++ b/arch/arm/lib/io-writesw-armv4.S
@@ -61,8 +61,8 @@ ENTRY(__raw_writesw)
                 ldr     r3, [r1], #4
                 outword r3
 
-.Lno_outsw_2:   ldrneh  r3, [r1]
-                strneh  r3, [r0]
+.Lno_outsw_2:   ldrhne  r3, [r1]
+                strhne  r3, [r0]
 
                 ldmfd   sp!, {r4, r5, pc}
 
@@ -95,6 +95,6 @@ ENTRY(__raw_writesw)
 
                 tst     r2, #1
 3:              movne   ip, r3, lsr #8
-                strneh  ip, [r0]
+                strhne  ip, [r0]
                 ret     lr
 ENDPROC(__raw_writesw)
diff --git a/arch/arm/lib/lib1funcs.S b/arch/arm/lib/lib1funcs.S
index 9397b2e532af..c23f9d9e2970 100644
--- a/arch/arm/lib/lib1funcs.S
+++ b/arch/arm/lib/lib1funcs.S
@@ -96,7 +96,7 @@ Boston, MA 02111-1307, USA.  */
         subhs   \dividend, \dividend, \divisor, lsr #3
         orrhs   \result,   \result,   \curbit,  lsr #3
         cmp     \dividend, #0                   @ Early termination?
-        movnes  \curbit,   \curbit,  lsr #4     @ No, any more bits to do?
+        movsne  \curbit,   \curbit,  lsr #4     @ No, any more bits to do?
         movne   \divisor,  \divisor, lsr #4
         bne     1b
 
@@ -182,7 +182,7 @@ Boston, MA 02111-1307, USA.  */
         subhs   \dividend, \dividend, \divisor, lsr #3
         cmp     \dividend, #1
         mov     \divisor, \divisor, lsr #4
-        subges  \order, \order, #4
+        subsge  \order, \order, #4
         bge     1b
 
         tst     \order, #3
diff --git a/arch/arm/lib/memcpy.S b/arch/arm/lib/memcpy.S
index 64111bd4440b..4a6997bb4404 100644
--- a/arch/arm/lib/memcpy.S
+++ b/arch/arm/lib/memcpy.S
@@ -30,7 +30,7 @@
         .endm
 
         .macro ldr1b ptr reg cond=al abort
-        ldr\cond\()b \reg, [\ptr], #1
+        ldrb\cond \reg, [\ptr], #1
         .endm
 
         .macro str1w ptr reg abort
@@ -42,7 +42,7 @@
         .endm
 
         .macro str1b ptr reg cond=al abort
-        str\cond\()b \reg, [\ptr], #1
+        strb\cond \reg, [\ptr], #1
         .endm
 
         .macro enter reg1 reg2
diff --git a/arch/arm/lib/memmove.S b/arch/arm/lib/memmove.S
index 69a9d47fc5ab..d70304cb2cd0 100644
--- a/arch/arm/lib/memmove.S
+++ b/arch/arm/lib/memmove.S
@@ -59,7 +59,7 @@ ENTRY(memmove)
                 blt     5f
 
         CALGN(  ands    ip, r0, #31             )
-        CALGN(  sbcnes  r4, ip, r2              )  @ C is always set here
+        CALGN(  sbcsne  r4, ip, r2              )  @ C is always set here
         CALGN(  bcs     2f                      )
         CALGN(  adr     r4, 6f                  )
         CALGN(  subs    r2, r2, ip              )  @ C is set here
@@ -114,20 +114,20 @@ ENTRY(memmove)
         UNWIND( .save   {r0, r4, lr}            ) @ still in first stmfd block
 
 8:              movs    r2, r2, lsl #31
-                ldrneb  r3, [r1, #-1]!
-                ldrcsb  r4, [r1, #-1]!
-                ldrcsb  ip, [r1, #-1]
-                strneb  r3, [r0, #-1]!
-                strcsb  r4, [r0, #-1]!
-                strcsb  ip, [r0, #-1]
+                ldrbne  r3, [r1, #-1]!
+                ldrbcs  r4, [r1, #-1]!
+                ldrbcs  ip, [r1, #-1]
+                strbne  r3, [r0, #-1]!
+                strbcs  r4, [r0, #-1]!
+                strbcs  ip, [r0, #-1]
                 ldmfd   sp!, {r0, r4, pc}
 
 9:              cmp     ip, #2
-                ldrgtb  r3, [r1, #-1]!
-                ldrgeb  r4, [r1, #-1]!
+                ldrbgt  r3, [r1, #-1]!
+                ldrbge  r4, [r1, #-1]!
                 ldrb    lr, [r1, #-1]!
-                strgtb  r3, [r0, #-1]!
-                strgeb  r4, [r0, #-1]!
+                strbgt  r3, [r0, #-1]!
+                strbge  r4, [r0, #-1]!
                 subs    r2, r2, ip
                 strb    lr, [r0, #-1]!
                 blt     8b
@@ -150,7 +150,7 @@ ENTRY(memmove)
                 blt     14f
 
         CALGN(  ands    ip, r0, #31             )
-        CALGN(  sbcnes  r4, ip, r2              )  @ C is always set here
+        CALGN(  sbcsne  r4, ip, r2              )  @ C is always set here
         CALGN(  subcc   r2, r2, ip              )
         CALGN(  bcc     15f                     )
 
diff --git a/arch/arm/lib/memset.S b/arch/arm/lib/memset.S
index ed6d35d9cdb5..5593a45e0a8c 100644
--- a/arch/arm/lib/memset.S
+++ b/arch/arm/lib/memset.S
@@ -44,20 +44,20 @@ UNWIND( .save {r8, lr}      )
         mov     lr, r3
 
 2:      subs    r2, r2, #64
-        stmgeia ip!, {r1, r3, r8, lr}   @ 64 bytes at a time.
-        stmgeia ip!, {r1, r3, r8, lr}
-        stmgeia ip!, {r1, r3, r8, lr}
-        stmgeia ip!, {r1, r3, r8, lr}
+        stmiage ip!, {r1, r3, r8, lr}   @ 64 bytes at a time.
+        stmiage ip!, {r1, r3, r8, lr}
+        stmiage ip!, {r1, r3, r8, lr}
+        stmiage ip!, {r1, r3, r8, lr}
         bgt     2b
-        ldmeqfd sp!, {r8, pc}           @ Now <64 bytes to go.
+        ldmfdeq sp!, {r8, pc}           @ Now <64 bytes to go.
 /*
  * No need to correct the count; we're only testing bits from now on
  */
         tst     r2, #32
-        stmneia ip!, {r1, r3, r8, lr}
-        stmneia ip!, {r1, r3, r8, lr}
+        stmiane ip!, {r1, r3, r8, lr}
+        stmiane ip!, {r1, r3, r8, lr}
         tst     r2, #16
-        stmneia ip!, {r1, r3, r8, lr}
+        stmiane ip!, {r1, r3, r8, lr}
         ldmfd   sp!, {r8, lr}
 UNWIND( .fnend              )
 
@@ -87,22 +87,22 @@ UNWIND( .save {r4-r8, lr}      )
         rsb     r8, r8, #32
         sub     r2, r2, r8
         movs    r8, r8, lsl #(32 - 4)
-        stmcsia ip!, {r4, r5, r6, r7}
-        stmmiia ip!, {r4, r5}
+        stmiacs ip!, {r4, r5, r6, r7}
+        stmiami ip!, {r4, r5}
         tst     r8, #(1 << 30)
         mov     r8, r1
         strne   r1, [ip], #4
 
 3:      subs    r2, r2, #64
-        stmgeia ip!, {r1, r3-r8, lr}
-        stmgeia ip!, {r1, r3-r8, lr}
+        stmiage ip!, {r1, r3-r8, lr}
+        stmiage ip!, {r1, r3-r8, lr}
         bgt     3b
-        ldmeqfd sp!, {r4-r8, pc}
+        ldmfdeq sp!, {r4-r8, pc}
 
         tst     r2, #32
-        stmneia ip!, {r1, r3-r8, lr}
+        stmiane ip!, {r1, r3-r8, lr}
         tst     r2, #16
-        stmneia ip!, {r4-r7}
+        stmiane ip!, {r4-r7}
         ldmfd   sp!, {r4-r8, lr}
 UNWIND( .fnend                 )
 
@@ -110,7 +110,7 @@ UNWIND( .fnend                 )
 
 UNWIND( .fnstart            )
 4:      tst     r2, #8
-        stmneia ip!, {r1, r3}
+        stmiane ip!, {r1, r3}
         tst     r2, #4
         strne   r1, [ip], #4
 /*
@@ -118,17 +118,17 @@ UNWIND( .fnstart            )
  * may have an unaligned pointer as well.
  */
 5:      tst     r2, #2
-        strneb  r1, [ip], #1
-        strneb  r1, [ip], #1
+        strbne  r1, [ip], #1
+        strbne  r1, [ip], #1
         tst     r2, #1
-        strneb  r1, [ip], #1
+        strbne  r1, [ip], #1
         ret     lr
 
 6:      subs    r2, r2, #4              @ 1 do we have enough
         blt     5b                      @ 1 bytes to align with?
         cmp     r3, #2                  @ 1
-        strltb  r1, [ip], #1            @ 1
-        strleb  r1, [ip], #1            @ 1
+        strblt  r1, [ip], #1            @ 1
+        strble  r1, [ip], #1            @ 1
         strb    r1, [ip], #1            @ 1
         add     r2, r2, r3              @ 1 (r2 = r2 - (4 - r3))
         b       1b
diff --git a/arch/arm/lib/xor-neon.c b/arch/arm/lib/xor-neon.c
index 2c40aeab3eaa..c691b901092f 100644
--- a/arch/arm/lib/xor-neon.c
+++ b/arch/arm/lib/xor-neon.c
@@ -14,7 +14,7 @@
 MODULE_LICENSE("GPL");
 
 #ifndef __ARM_NEON__
-#error You should compile this file with '-mfloat-abi=softfp -mfpu=neon'
+#error You should compile this file with '-march=armv7-a -mfloat-abi=softfp -mfpu=neon'
 #endif
 
 /*
diff --git a/arch/arm/mach-actions/platsmp.c b/arch/arm/mach-actions/platsmp.c
index 3efaa10efc43..4fd479c948e6 100644
--- a/arch/arm/mach-actions/platsmp.c
+++ b/arch/arm/mach-actions/platsmp.c
@@ -39,10 +39,6 @@ static void __iomem *sps_base_addr;
 static void __iomem *timer_base_addr;
 static int ncores;
 
-static DEFINE_SPINLOCK(boot_lock);
-
-void owl_secondary_startup(void);
-
 static int s500_wakeup_secondary(unsigned int cpu)
 {
         int ret;
@@ -84,7 +80,6 @@ static int s500_wakeup_secondary(unsigned int cpu)
 
 static int s500_smp_boot_secondary(unsigned int cpu, struct task_struct *idle)
 {
-        unsigned long timeout;
         int ret;
 
         ret = s500_wakeup_secondary(cpu);
@@ -93,21 +88,11 @@ static int s500_smp_boot_secondary(unsigned int cpu, struct task_struct *idle)
 
         udelay(10);
 
-        spin_lock(&boot_lock);
-
         smp_send_reschedule(cpu);
 
-        timeout = jiffies + (1 * HZ);
-        while (time_before(jiffies, timeout)) {
-                if (pen_release == -1)
-                        break;
-        }
-
         writel(0, timer_base_addr + OWL_CPU1_ADDR + (cpu - 1) * 4);
         writel(0, timer_base_addr + OWL_CPU1_FLAG + (cpu - 1) * 4);
 
-        spin_unlock(&boot_lock);
-
         return 0;
 }
 
diff --git a/arch/arm/mach-cns3xxx/core.c b/arch/arm/mach-cns3xxx/core.c
index 7d5a44a06648..f676592d8402 100644
--- a/arch/arm/mach-cns3xxx/core.c
+++ b/arch/arm/mach-cns3xxx/core.c
@@ -90,7 +90,7 @@ void __init cns3xxx_map_io(void)
 /* used by entry-macro.S */
 void __init cns3xxx_init_irq(void)
 {
-        gic_init(0, 29, IOMEM(CNS3XXX_TC11MP_GIC_DIST_BASE_VIRT),
+        gic_init(IOMEM(CNS3XXX_TC11MP_GIC_DIST_BASE_VIRT),
                  IOMEM(CNS3XXX_TC11MP_GIC_CPU_BASE_VIRT));
 }
 
diff --git a/arch/arm/mach-exynos/headsmp.S b/arch/arm/mach-exynos/headsmp.S
index 005695c9bf40..0ac2cb9a7355 100644
--- a/arch/arm/mach-exynos/headsmp.S
+++ b/arch/arm/mach-exynos/headsmp.S
@@ -36,4 +36,4 @@ ENDPROC(exynos4_secondary_startup)
 
         .align 2
 1:      .long   .
-        .long   pen_release
+        .long   exynos_pen_release
diff --git a/arch/arm/mach-exynos/platsmp.c b/arch/arm/mach-exynos/platsmp.c
index b6da7edbbd2f..abcac6164233 100644
--- a/arch/arm/mach-exynos/platsmp.c
+++ b/arch/arm/mach-exynos/platsmp.c
@@ -28,6 +28,9 @@
 
 extern void exynos4_secondary_startup(void);
 
+/* XXX exynos_pen_release is cargo culted code - DO NOT COPY XXX */
+volatile int exynos_pen_release = -1;
+
 #ifdef CONFIG_HOTPLUG_CPU
 static inline void cpu_leave_lowpower(u32 core_id)
 {
@@ -57,7 +60,7 @@ static inline void platform_do_lowpower(unsigned int cpu, int *spurious)
 
                 wfi();
 
-                if (pen_release == core_id) {
+                if (exynos_pen_release == core_id) {
                         /*
                          * OK, proper wakeup, we're done
                          */
@@ -228,15 +231,17 @@ void exynos_core_restart(u32 core_id)
 }
 
 /*
- * Write pen_release in a way that is guaranteed to be visible to all
- * observers, irrespective of whether they're taking part in coherency
+ * XXX CARGO CULTED CODE - DO NOT COPY XXX
+ *
+ * Write exynos_pen_release in a way that is guaranteed to be visible to
+ * all observers, irrespective of whether they're taking part in coherency
  * or not.  This is necessary for the hotplug code to work reliably.
  */
-static void write_pen_release(int val)
+static void exynos_write_pen_release(int val)
 {
-        pen_release = val;
+        exynos_pen_release = val;
         smp_wmb();
-        sync_cache_w(&pen_release);
+        sync_cache_w(&exynos_pen_release);
 }
 
 static DEFINE_SPINLOCK(boot_lock);
@@ -247,7 +252,7 @@ static void exynos_secondary_init(unsigned int cpu)
          * let the primary processor know we're out of the
          * pen, then head off into the C entry point
          */
-        write_pen_release(-1);
+        exynos_write_pen_release(-1);
 
         /*
          * Synchronise with the boot thread.
@@ -322,12 +327,12 @@ static int exynos_boot_secondary(unsigned int cpu, struct task_struct *idle)
         /*
          * The secondary processor is waiting to be released from
          * the holding pen - release it, then wait for it to flag
-         * that it has been released by resetting pen_release.
+         * that it has been released by resetting exynos_pen_release.
          *
-         * Note that "pen_release" is the hardware CPU core ID, whereas
+         * Note that "exynos_pen_release" is the hardware CPU core ID, whereas
          * "cpu" is Linux's internal ID.
          */
-        write_pen_release(core_id);
+        exynos_write_pen_release(core_id);
 
         if (!exynos_cpu_power_state(core_id)) {
                 exynos_cpu_power_up(core_id);
@@ -376,13 +381,13 @@ static int exynos_boot_secondary(unsigned int cpu, struct task_struct *idle)
                 else
                         arch_send_wakeup_ipi_mask(cpumask_of(cpu));
 
-                if (pen_release == -1)
+                if (exynos_pen_release == -1)
                         break;
 
                 udelay(10);
         }
 
-        if (pen_release != -1)
+        if (exynos_pen_release != -1)
                 ret = -ETIMEDOUT;
 
         /*
@@ -392,7 +397,7 @@ static int exynos_boot_secondary(unsigned int cpu, struct task_struct *idle)
 fail:
         spin_unlock(&boot_lock);
 
-        return pen_release != -1 ? ret : 0;
+        return exynos_pen_release != -1 ? ret : 0;
 }
 
 static void __init exynos_smp_prepare_cpus(unsigned int max_cpus)
diff --git a/arch/arm/mach-ks8695/include/mach/entry-macro.S b/arch/arm/mach-ks8695/include/mach/entry-macro.S
index 8315b34f32ff..7ff812cb010b 100644
--- a/arch/arm/mach-ks8695/include/mach/entry-macro.S
+++ b/arch/arm/mach-ks8695/include/mach/entry-macro.S
@@ -42,6 +42,6 @@
                 moveq   \irqstat, \irqstat, lsr #2
                 addeq   \irqnr, \irqnr, #2
                 tst     \irqstat, #0x01
-                addeqs  \irqnr, \irqnr, #1
+                addseq  \irqnr, \irqnr, #1
 1001:
         .endm
diff --git a/arch/arm/mach-omap2/prm_common.c b/arch/arm/mach-omap2/prm_common.c
index 058a37e6d11c..fd6e0671f957 100644
--- a/arch/arm/mach-omap2/prm_common.c
+++ b/arch/arm/mach-omap2/prm_common.c
@@ -523,8 +523,10 @@ void omap_prm_reset_system(void)
 
         prm_ll_data->reset_system();
 
-        while (1)
+        while (1) {
                 cpu_relax();
+                wfe();
+        }
 }
 
 /**
diff --git a/arch/arm/mach-oxnas/Makefile b/arch/arm/mach-oxnas/Makefile
index b625906a9970..61a34e1c0f22 100644
--- a/arch/arm/mach-oxnas/Makefile
+++ b/arch/arm/mach-oxnas/Makefile
@@ -1,2 +1 @@
 obj-$(CONFIG_SMP)               += platsmp.o headsmp.o
-obj-$(CONFIG_HOTPLUG_CPU)       += hotplug.o
diff --git a/arch/arm/mach-oxnas/hotplug.c b/arch/arm/mach-oxnas/hotplug.c
deleted file mode 100644
index 854f29b8cba6..000000000000
--- a/arch/arm/mach-oxnas/hotplug.c
+++ /dev/null
@@ -1,109 +0,0 @@
-/*
- *  Copyright (C) 2002 ARM Ltd.
- *  All Rights Reserved
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#include <linux/kernel.h>
-#include <linux/errno.h>
-#include <linux/smp.h>
-
-#include <asm/cp15.h>
-#include <asm/smp_plat.h>
-
-static inline void cpu_enter_lowpower(void)
-{
-        unsigned int v;
-
-        asm volatile(
-        "       mcr     p15, 0, %1, c7, c5, 0\n"
-        "       mcr     p15, 0, %1, c7, c10, 4\n"
-        /*
-         * Turn off coherency
-         */
-        "       mrc     p15, 0, %0, c1, c0, 1\n"
-        "       bic     %0, %0, #0x20\n"
-        "       mcr     p15, 0, %0, c1, c0, 1\n"
-        "       mrc     p15, 0, %0, c1, c0, 0\n"
-        "       bic     %0, %0, %2\n"
-        "       mcr     p15, 0, %0, c1, c0, 0\n"
-          : "=&r" (v)
-          : "r" (0), "Ir" (CR_C)
-          : "cc");
-}
-
-static inline void cpu_leave_lowpower(void)
-{
-        unsigned int v;
-
-        asm volatile(   "mrc    p15, 0, %0, c1, c0, 0\n"
-        "       orr     %0, %0, %1\n"
-        "       mcr     p15, 0, %0, c1, c0, 0\n"
-        "       mrc     p15, 0, %0, c1, c0, 1\n"
-        "       orr     %0, %0, #0x20\n"
-        "       mcr     p15, 0, %0, c1, c0, 1\n"
-          : "=&r" (v)
-          : "Ir" (CR_C)
-          : "cc");
-}
-
-static inline void platform_do_lowpower(unsigned int cpu, int *spurious)
-{
-        /*
-         * there is no power-control hardware on this platform, so all
-         * we can do is put the core into WFI; this is safe as the calling
-         * code will have already disabled interrupts
-         */
-        for (;;) {
-                /*
-                 * here's the WFI
-                 */
-                asm(".word      0xe320f003\n"
-                    :
-                    :
-                    : "memory", "cc");
-
-                if (pen_release == cpu_logical_map(cpu)) {
-                        /*
-                         * OK, proper wakeup, we're done
-                         */
-                        break;
-                }
-
-                /*
-                 * Getting here, means that we have come out of WFI without
-                 * having been woken up - this shouldn't happen
-                 *
-                 * Just note it happening - when we're woken, we can report
-                 * its occurrence.
-                 */
-                (*spurious)++;
-        }
-}
-
-/*
- * platform-specific code to shutdown a CPU
- *
- * Called with IRQs disabled
- */
-void ox820_cpu_die(unsigned int cpu)
-{
-        int spurious = 0;
-
-        /*
-         * we're ready for shutdown now, so do it
-         */
-        cpu_enter_lowpower();
-        platform_do_lowpower(cpu, &spurious);
-
-        /*
-         * bring this CPU back into the world of cache
-         * coherency, and then restore interrupts
-         */
-        cpu_leave_lowpower();
-
-        if (spurious)
-                pr_warn("CPU%u: %u spurious wakeup calls\n", cpu, spurious);
-}
diff --git a/arch/arm/mach-oxnas/platsmp.c b/arch/arm/mach-oxnas/platsmp.c
index 442cc8a2f7dc..735141c0e3a3 100644
--- a/arch/arm/mach-oxnas/platsmp.c
+++ b/arch/arm/mach-oxnas/platsmp.c
@@ -19,7 +19,6 @@
 #include <asm/smp_scu.h>
 
 extern void ox820_secondary_startup(void);
-extern void ox820_cpu_die(unsigned int cpu);
 
 static void __iomem *cpu_ctrl;
 static void __iomem *gic_cpu_ctrl;
@@ -94,9 +93,6 @@ unmap_scu:
 static const struct smp_operations ox820_smp_ops __initconst = {
         .smp_prepare_cpus       = ox820_smp_prepare_cpus,
         .smp_boot_secondary     = ox820_boot_secondary,
-#ifdef CONFIG_HOTPLUG_CPU
-        .cpu_die                = ox820_cpu_die,
-#endif
 };
 
 CPU_METHOD_OF_DECLARE(ox820_smp, "oxsemi,ox820-smp", &ox820_smp_ops);
diff --git a/arch/arm/mach-prima2/common.h b/arch/arm/mach-prima2/common.h
index 6d77b622d168..457eb7b18160 100644
--- a/arch/arm/mach-prima2/common.h
+++ b/arch/arm/mach-prima2/common.h
@@ -15,6 +15,8 @@
 #include <asm/mach/time.h>
 #include <asm/exception.h>
 
+extern volatile int prima2_pen_release;
+
 extern const struct smp_operations sirfsoc_smp_ops;
 extern void sirfsoc_secondary_startup(void);
 extern void sirfsoc_cpu_die(unsigned int cpu);
diff --git a/arch/arm/mach-prima2/headsmp.S b/arch/arm/mach-prima2/headsmp.S
index 209d9fc5c16c..6cf4fc60347b 100644
--- a/arch/arm/mach-prima2/headsmp.S
+++ b/arch/arm/mach-prima2/headsmp.S
@@ -34,4 +34,4 @@ ENDPROC(sirfsoc_secondary_startup)
 
         .align
 1:      .long   .
-        .long   pen_release
+        .long   prima2_pen_release
diff --git a/arch/arm/mach-prima2/hotplug.c b/arch/arm/mach-prima2/hotplug.c
index a728c78b996f..b6cf1527e330 100644
--- a/arch/arm/mach-prima2/hotplug.c
+++ b/arch/arm/mach-prima2/hotplug.c
@@ -11,6 +11,7 @@
 #include <linux/smp.h>
 
 #include <asm/smp_plat.h>
+#include "common.h"
 
 static inline void platform_do_lowpower(unsigned int cpu)
 {
@@ -18,7 +19,7 @@ static inline void platform_do_lowpower(unsigned int cpu)
         for (;;) {
                 __asm__ __volatile__("dsb\n\t" "wfi\n\t"
                         : : : "memory");
-                if (pen_release == cpu_logical_map(cpu)) {
+                if (prima2_pen_release == cpu_logical_map(cpu)) {
                         /*
                          * OK, proper wakeup, we're done
                          */
diff --git a/arch/arm/mach-prima2/platsmp.c b/arch/arm/mach-prima2/platsmp.c
index 75ef5d4be554..d1f8b5168083 100644
--- a/arch/arm/mach-prima2/platsmp.c
+++ b/arch/arm/mach-prima2/platsmp.c
@@ -24,13 +24,16 @@ static void __iomem *clk_base;
 
 static DEFINE_SPINLOCK(boot_lock);
 
+/* XXX prima2_pen_release is cargo culted code - DO NOT COPY XXX */
+volatile int prima2_pen_release = -1;
+
 static void sirfsoc_secondary_init(unsigned int cpu)
 {
         /*
          * let the primary processor know we're out of the
          * pen, then head off into the C entry point
          */
-        pen_release = -1;
+        prima2_pen_release = -1;
         smp_wmb();
 
         /*
@@ -80,13 +83,13 @@ static int sirfsoc_boot_secondary(unsigned int cpu, struct task_struct *idle)
         /*
          * The secondary processor is waiting to be released from
          * the holding pen - release it, then wait for it to flag
-         * that it has been released by resetting pen_release.
+         * that it has been released by resetting prima2_pen_release.
          *
-         * Note that "pen_release" is the hardware CPU ID, whereas
+         * Note that "prima2_pen_release" is the hardware CPU ID, whereas
          * "cpu" is Linux's internal ID.
          */
-        pen_release = cpu_logical_map(cpu);
-        sync_cache_w(&pen_release);
+        prima2_pen_release = cpu_logical_map(cpu);
+        sync_cache_w(&prima2_pen_release);
 
         /*
          * Send the secondary CPU SEV, thereby causing the boot monitor to read
@@ -97,7 +100,7 @@ static int sirfsoc_boot_secondary(unsigned int cpu, struct task_struct *idle)
         timeout = jiffies + (1 * HZ);
         while (time_before(jiffies, timeout)) {
                 smp_rmb();
-                if (pen_release == -1)
+                if (prima2_pen_release == -1)
                         break;
 
                 udelay(10);
@@ -109,7 +112,7 @@ static int sirfsoc_boot_secondary(unsigned int cpu, struct task_struct *idle)
          */
         spin_unlock(&boot_lock);
 
-        return pen_release != -1 ? -ENOSYS : 0;
+        return prima2_pen_release != -1 ? -ENOSYS : 0;
 }
 
 const struct smp_operations sirfsoc_smp_ops __initconst = {
diff --git a/arch/arm/mach-qcom/platsmp.c b/arch/arm/mach-qcom/platsmp.c
index 5494c9e0c909..99a6a5e809e0 100644
--- a/arch/arm/mach-qcom/platsmp.c
+++ b/arch/arm/mach-qcom/platsmp.c
@@ -46,8 +46,6 @@
 
 extern void secondary_startup_arm(void);
 
-static DEFINE_SPINLOCK(boot_lock);
-
 #ifdef CONFIG_HOTPLUG_CPU
 static void qcom_cpu_die(unsigned int cpu)
 {
@@ -55,15 +53,6 @@ static void qcom_cpu_die(unsigned int cpu)
 }
 #endif
 
-static void qcom_secondary_init(unsigned int cpu)
-{
-        /*
-         * Synchronise with the boot thread.
-         */
-        spin_lock(&boot_lock);
-        spin_unlock(&boot_lock);
-}
-
 static int scss_release_secondary(unsigned int cpu)
 {
         struct device_node *node;
@@ -281,24 +270,12 @@ static int qcom_boot_secondary(unsigned int cpu, int (*func)(unsigned int))
         }
 
         /*
-         * set synchronisation state between this boot processor
-         * and the secondary one
-         */
-        spin_lock(&boot_lock);
-
-        /*
          * Send the secondary CPU a soft interrupt, thereby causing
          * the boot monitor to read the system wide flags register,
          * and branch to the address found there.
          */
         arch_send_wakeup_ipi_mask(cpumask_of(cpu));
 
-        /*
-         * now the secondary core is starting up let it run its
-         * calibrations, then wait for it to finish
-         */
-        spin_unlock(&boot_lock);
-
         return ret;
 }
 
@@ -334,7 +311,6 @@ static void __init qcom_smp_prepare_cpus(unsigned int max_cpus)
 
 static const struct smp_operations smp_msm8660_ops __initconst = {
         .smp_prepare_cpus       = qcom_smp_prepare_cpus,
-        .smp_secondary_init     = qcom_secondary_init,
         .smp_boot_secondary     = msm8660_boot_secondary,
 #ifdef CONFIG_HOTPLUG_CPU
         .cpu_die                = qcom_cpu_die,
@@ -344,7 +320,6 @@ CPU_METHOD_OF_DECLARE(qcom_smp, "qcom,gcc-msm8660", &smp_msm8660_ops);
 
 static const struct smp_operations qcom_smp_kpssv1_ops __initconst = {
         .smp_prepare_cpus       = qcom_smp_prepare_cpus,
-        .smp_secondary_init     = qcom_secondary_init,
         .smp_boot_secondary     = kpssv1_boot_secondary,
 #ifdef CONFIG_HOTPLUG_CPU
         .cpu_die                = qcom_cpu_die,
@@ -354,7 +329,6 @@ CPU_METHOD_OF_DECLARE(qcom_smp_kpssv1, "qcom,kpss-acc-v1", &qcom_smp_kpssv1_ops)
 
 static const struct smp_operations qcom_smp_kpssv2_ops __initconst = {
         .smp_prepare_cpus       = qcom_smp_prepare_cpus,
-        .smp_secondary_init     = qcom_secondary_init,
         .smp_boot_secondary     = kpssv2_boot_secondary,
 #ifdef CONFIG_HOTPLUG_CPU
         .cpu_die                = qcom_cpu_die,
diff --git a/arch/arm/mach-spear/generic.h b/arch/arm/mach-spear/generic.h
index 909b97c0b237..25b4c5e66e39 100644
--- a/arch/arm/mach-spear/generic.h
+++ b/arch/arm/mach-spear/generic.h
@@ -20,6 +20,8 @@
 
 #include <asm/mach/time.h>
 
+extern volatile int spear_pen_release;
+
 extern void spear13xx_timer_init(void);
 extern void spear3xx_timer_init(void);
 extern struct pl022_ssp_controller pl022_plat_data;
diff --git a/arch/arm/mach-spear/headsmp.S b/arch/arm/mach-spear/headsmp.S
index c52192dc3d9f..6e250b6c0aa2 100644
--- a/arch/arm/mach-spear/headsmp.S
+++ b/arch/arm/mach-spear/headsmp.S
@@ -43,5 +43,5 @@ pen:	ldr	r7, [r6]
 
         .align
 1:      .long   .
-        .long   pen_release
+        .long   spear_pen_release
 ENDPROC(spear13xx_secondary_startup)
diff --git a/arch/arm/mach-spear/hotplug.c b/arch/arm/mach-spear/hotplug.c
index 12edd1cf8a12..0dd84f609627 100644
--- a/arch/arm/mach-spear/hotplug.c
+++ b/arch/arm/mach-spear/hotplug.c
@@ -16,6 +16,8 @@
 #include <asm/cp15.h>
 #include <asm/smp_plat.h>
 
+#include "generic.h"
+
 static inline void cpu_enter_lowpower(void)
 {
         unsigned int v;
@@ -57,7 +59,7 @@ static inline void spear13xx_do_lowpower(unsigned int cpu, int *spurious)
         for (;;) {
                 wfi();
 
-                if (pen_release == cpu) {
+                if (spear_pen_release == cpu) {
                         /*
                          * OK, proper wakeup, we're done
                          */
diff --git a/arch/arm/mach-spear/platsmp.c b/arch/arm/mach-spear/platsmp.c
index 39038a03836a..b1ff4bb86f6d 100644
--- a/arch/arm/mach-spear/platsmp.c
+++ b/arch/arm/mach-spear/platsmp.c
@@ -20,16 +20,21 @@
 #include <mach/spear.h>
 #include "generic.h"
 
+/* XXX spear_pen_release is cargo culted code - DO NOT COPY XXX */
+volatile int spear_pen_release = -1;
+
 /*
- * Write pen_release in a way that is guaranteed to be visible to all
- * observers, irrespective of whether they're taking part in coherency
+ * XXX CARGO CULTED CODE - DO NOT COPY XXX
+ *
+ * Write spear_pen_release in a way that is guaranteed to be visible to
+ * all observers, irrespective of whether they're taking part in coherency
  * or not.  This is necessary for the hotplug code to work reliably.
  */
-static void write_pen_release(int val)
+static void spear_write_pen_release(int val)
 {
-        pen_release = val;
+        spear_pen_release = val;
         smp_wmb();
-        sync_cache_w(&pen_release);
+        sync_cache_w(&spear_pen_release);
 }
 
 static DEFINE_SPINLOCK(boot_lock);
@@ -42,7 +47,7 @@ static void spear13xx_secondary_init(unsigned int cpu)
          * let the primary processor know we're out of the
          * pen, then head off into the C entry point
          */
-        write_pen_release(-1);
+        spear_write_pen_release(-1);
 
         /*
          * Synchronise with the boot thread.
@@ -64,17 +69,17 @@ static int spear13xx_boot_secondary(unsigned int cpu, struct task_struct *idle)
         /*
          * The secondary processor is waiting to be released from
          * the holding pen - release it, then wait for it to flag
-         * that it has been released by resetting pen_release.
+         * that it has been released by resetting spear_pen_release.
          *
-         * Note that "pen_release" is the hardware CPU ID, whereas
+         * Note that "spear_pen_release" is the hardware CPU ID, whereas
          * "cpu" is Linux's internal ID.
          */
-        write_pen_release(cpu);
+        spear_write_pen_release(cpu);
 
         timeout = jiffies + (1 * HZ);
         while (time_before(jiffies, timeout)) {
                 smp_rmb();
-                if (pen_release == -1)
+                if (spear_pen_release == -1)
                         break;
 
                 udelay(10);
@@ -86,7 +91,7 @@ static int spear13xx_boot_secondary(unsigned int cpu, struct task_struct *idle)
          */
         spin_unlock(&boot_lock);
 
-        return pen_release != -1 ? -ENOSYS : 0;
+        return spear_pen_release != -1 ? -ENOSYS : 0;
 }
 
 /*
diff --git a/arch/arm/mach-tegra/reset-handler.S b/arch/arm/mach-tegra/reset-handler.S
index 805f306fa6f7..e22ccf87eded 100644
--- a/arch/arm/mach-tegra/reset-handler.S
+++ b/arch/arm/mach-tegra/reset-handler.S
@@ -172,7 +172,7 @@ after_errata:
         mov32   r5, TEGRA_IRAM_BASE + TEGRA_IRAM_RESET_HANDLER_OFFSET
         mov     r0, #CPU_NOT_RESETTABLE
         cmp     r10, #0
-        strneb  r0, [r5, #__tegra20_cpu1_resettable_status_offset]
+        strbne  r0, [r5, #__tegra20_cpu1_resettable_status_offset]
 1:
 #endif
 
diff --git a/arch/arm/mm/cache-v6.S b/arch/arm/mm/cache-v6.S
index 24659952c278..be68d62566c7 100644
--- a/arch/arm/mm/cache-v6.S
+++ b/arch/arm/mm/cache-v6.S
@@ -215,8 +215,8 @@ v6_dma_inv_range:
 #endif
         tst     r1, #D_CACHE_LINE_SIZE - 1
 #ifdef CONFIG_DMA_CACHE_RWFO
-        ldrneb  r2, [r1, #-1]                   @ read for ownership
-        strneb  r2, [r1, #-1]                   @ write for ownership
+        ldrbne  r2, [r1, #-1]                   @ read for ownership
+        strbne  r2, [r1, #-1]                   @ write for ownership
 #endif
         bic     r1, r1, #D_CACHE_LINE_SIZE - 1
 #ifdef HARVARD_CACHE
@@ -284,8 +284,8 @@ ENTRY(v6_dma_flush_range)
         add     r0, r0, #D_CACHE_LINE_SIZE
         cmp     r0, r1
 #ifdef CONFIG_DMA_CACHE_RWFO
-        ldrlob  r2, [r0]                        @ read for ownership
-        strlob  r2, [r0]                        @ write for ownership
+        ldrblo  r2, [r0]                        @ read for ownership
+        strblo  r2, [r0]                        @ write for ownership
 #endif
         blo     1b
         mov     r0, #0
diff --git a/arch/arm/mm/copypage-v4mc.c b/arch/arm/mm/copypage-v4mc.c
index b03202cddddb..f74cdce6d4da 100644
--- a/arch/arm/mm/copypage-v4mc.c
+++ b/arch/arm/mm/copypage-v4mc.c
@@ -45,6 +45,7 @@ static void mc_copy_user_page(void *from, void *to)
         int tmp;
 
         asm volatile ("\
+        .syntax unified\n\
         ldmia   %0!, {r2, r3, ip, lr}           @ 4\n\
 1:      mcr     p15, 0, %1, c7, c6, 1           @ 1   invalidate D line\n\
         stmia   %1!, {r2, r3, ip, lr}           @ 4\n\
@@ -56,7 +57,7 @@ static void mc_copy_user_page(void *from, void *to)
         ldmia   %0!, {r2, r3, ip, lr}           @ 4\n\
         subs    %2, %2, #1                      @ 1\n\
         stmia   %1!, {r2, r3, ip, lr}           @ 4\n\
-        ldmneia %0!, {r2, r3, ip, lr}           @ 4\n\
+        ldmiane %0!, {r2, r3, ip, lr}           @ 4\n\
         bne     1b                              @ "
         : "+&r" (from), "+&r" (to), "=&r" (tmp)
         : "2" (PAGE_SIZE / 64)
diff --git a/arch/arm/mm/copypage-v4wb.c b/arch/arm/mm/copypage-v4wb.c
index cd3e165afeed..6d336740aae4 100644
--- a/arch/arm/mm/copypage-v4wb.c
+++ b/arch/arm/mm/copypage-v4wb.c
@@ -27,6 +27,7 @@ static void v4wb_copy_user_page(void *kto, const void *kfrom)
         int tmp;
 
         asm volatile ("\
+        .syntax unified\n\
         ldmia   %1!, {r3, r4, ip, lr}           @ 4\n\
 1:      mcr     p15, 0, %0, c7, c6, 1           @ 1   invalidate D line\n\
         stmia   %0!, {r3, r4, ip, lr}           @ 4\n\
@@ -38,7 +39,7 @@ static void v4wb_copy_user_page(void *kto, const void *kfrom)
         ldmia   %1!, {r3, r4, ip, lr}           @ 4\n\
         subs    %2, %2, #1                      @ 1\n\
         stmia   %0!, {r3, r4, ip, lr}           @ 4\n\
-        ldmneia %1!, {r3, r4, ip, lr}           @ 4\n\
+        ldmiane %1!, {r3, r4, ip, lr}           @ 4\n\
         bne     1b                              @ 1\n\
         mcr     p15, 0, %1, c7, c10, 4          @ 1   drain WB"
         : "+&r" (kto), "+&r" (kfrom), "=&r" (tmp)
diff --git a/arch/arm/mm/copypage-v4wt.c b/arch/arm/mm/copypage-v4wt.c
index 8614572e1296..3851bb396442 100644
--- a/arch/arm/mm/copypage-v4wt.c
+++ b/arch/arm/mm/copypage-v4wt.c
@@ -25,6 +25,7 @@ static void v4wt_copy_user_page(void *kto, const void *kfrom)
         int tmp;
 
         asm volatile ("\
+        .syntax unified\n\
         ldmia   %1!, {r3, r4, ip, lr}           @ 4\n\
 1:      stmia   %0!, {r3, r4, ip, lr}           @ 4\n\
         ldmia   %1!, {r3, r4, ip, lr}           @ 4+1\n\
@@ -34,7 +35,7 @@ static void v4wt_copy_user_page(void *kto, const void *kfrom)
         ldmia   %1!, {r3, r4, ip, lr}           @ 4\n\
         subs    %2, %2, #1                      @ 1\n\
         stmia   %0!, {r3, r4, ip, lr}           @ 4\n\
-        ldmneia %1!, {r3, r4, ip, lr}           @ 4\n\
+        ldmiane %1!, {r3, r4, ip, lr}           @ 4\n\
         bne     1b                              @ 1\n\
         mcr     p15, 0, %2, c7, c7, 0           @ flush ID cache"
         : "+&r" (kto), "+&r" (kfrom), "=&r" (tmp)
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index c6aab9c36ff1..43f46aa7ef33 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -2279,7 +2279,7 @@ EXPORT_SYMBOL_GPL(arm_iommu_attach_device);
  * @dev: valid struct device pointer
  *
  * Detaches the provided device from a previously attached map.
- * This voids the dma operations (dma_map_ops pointer)
+ * This overwrites the dma_ops pointer with appropriate non-IOMMU ops.
  */
 void arm_iommu_detach_device(struct device *dev)
 {
diff --git a/arch/arm/mm/idmap.c b/arch/arm/mm/idmap.c
index 1d1edd064199..a033f6134a64 100644
--- a/arch/arm/mm/idmap.c
+++ b/arch/arm/mm/idmap.c
@@ -6,6 +6,7 @@
 
 #include <asm/cputype.h>
 #include <asm/idmap.h>
+#include <asm/hwcap.h>
 #include <asm/pgalloc.h>
 #include <asm/pgtable.h>
 #include <asm/sections.h>
@@ -110,7 +111,8 @@ static int __init init_static_idmap(void)
                              __idmap_text_end, 0);
 
         /* Flush L1 for the hardware to see this page table content */
-        flush_cache_louis();
+        if (!(elf_hwcap & HWCAP_LPAE))
+                flush_cache_louis();
 
         return 0;
 }
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 15dddfe43319..c2daabbe0af0 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -282,15 +282,12 @@ void __init arm_memblock_init(const struct machine_desc *mdesc)
 
 void __init bootmem_init(void)
 {
-        unsigned long min, max_low, max_high;
-
         memblock_allow_resize();
-        max_low = max_high = 0;
 
-        find_limits(&min, &max_low, &max_high);
+        find_limits(&min_low_pfn, &max_low_pfn, &max_pfn);
 
-        early_memtest((phys_addr_t)min << PAGE_SHIFT,
-                      (phys_addr_t)max_low << PAGE_SHIFT);
+        early_memtest((phys_addr_t)min_low_pfn << PAGE_SHIFT,
+                      (phys_addr_t)max_low_pfn << PAGE_SHIFT);
 
         /*
          * Sparsemem tries to allocate bootmem in memory_present(),
@@ -308,16 +305,7 @@ void __init bootmem_init(void)
          * the sparse mem_map arrays initialized by sparse_init()
          * for memmap_init_zone(), otherwise all PFNs are invalid.
          */
-        zone_sizes_init(min, max_low, max_high);
-
-        /*
-         * This doesn't seem to be used by the Linux memory manager any
-         * more, but is used by ll_rw_block.  If we can get rid of it, we
-         * also get rid of some of the stuff above as well.
-         */
-        min_low_pfn = min;
-        max_low_pfn = max_low;
-        max_pfn = max_high;
+        zone_sizes_init(min_low_pfn, max_low_pfn, max_pfn);
 }
 
 /*
@@ -498,55 +486,6 @@ void __init mem_init(void)
 
         mem_init_print_info(NULL);
 
-#define MLK(b, t) b, t, ((t) - (b)) >> 10
-#define MLM(b, t) b, t, ((t) - (b)) >> 20
-#define MLK_ROUNDUP(b, t) b, t, DIV_ROUND_UP(((t) - (b)), SZ_1K)
-
-        pr_notice("Virtual kernel memory layout:\n"
-                        "    vector  : 0x%08lx - 0x%08lx   (%4ld kB)\n"
-#ifdef CONFIG_HAVE_TCM
-                        "    DTCM    : 0x%08lx - 0x%08lx   (%4ld kB)\n"
-                        "    ITCM    : 0x%08lx - 0x%08lx   (%4ld kB)\n"
-#endif
-                        "    fixmap  : 0x%08lx - 0x%08lx   (%4ld kB)\n"
-                        "    vmalloc : 0x%08lx - 0x%08lx   (%4ld MB)\n"
-                        "    lowmem  : 0x%08lx - 0x%08lx   (%4ld MB)\n"
-#ifdef CONFIG_HIGHMEM
-                        "    pkmap   : 0x%08lx - 0x%08lx   (%4ld MB)\n"
-#endif
-#ifdef CONFIG_MODULES
-                        "    modules : 0x%08lx - 0x%08lx   (%4ld MB)\n"
-#endif
-                        "      .text : 0x%p" " - 0x%p" "   (%4td kB)\n"
-                        "      .init : 0x%p" " - 0x%p" "   (%4td kB)\n"
-                        "      .data : 0x%p" " - 0x%p" "   (%4td kB)\n"
-                        "       .bss : 0x%p" " - 0x%p" "   (%4td kB)\n",
-
-                        MLK(VECTORS_BASE, VECTORS_BASE + PAGE_SIZE),
-#ifdef CONFIG_HAVE_TCM
-                        MLK(DTCM_OFFSET, (unsigned long) dtcm_end),
-                        MLK(ITCM_OFFSET, (unsigned long) itcm_end),
-#endif
-                        MLK(FIXADDR_START, FIXADDR_END),
-                        MLM(VMALLOC_START, VMALLOC_END),
-                        MLM(PAGE_OFFSET, (unsigned long)high_memory),
-#ifdef CONFIG_HIGHMEM
-                        MLM(PKMAP_BASE, (PKMAP_BASE) + (LAST_PKMAP) *
-                                (PAGE_SIZE)),
-#endif
-#ifdef CONFIG_MODULES
-                        MLM(MODULES_VADDR, MODULES_END),
-#endif
-
-                        MLK_ROUNDUP(_text, _etext),
-                        MLK_ROUNDUP(__init_begin, __init_end),
-                        MLK_ROUNDUP(_sdata, _edata),
-                        MLK_ROUNDUP(__bss_start, __bss_stop));
-
-#undef MLK
-#undef MLM
-#undef MLK_ROUNDUP
-
         /*
          * Check boundaries twice: Some fundamental inconsistencies can
          * be detected at build time already.
diff --git a/arch/arm/mm/pmsa-v8.c b/arch/arm/mm/pmsa-v8.c
index 617a83def88a..0d7d5fb59247 100644
--- a/arch/arm/mm/pmsa-v8.c
+++ b/arch/arm/mm/pmsa-v8.c
@@ -165,7 +165,7 @@ static int __init pmsav8_setup_ram(unsigned int number, phys_addr_t start,phys_a
                 return -EINVAL;
 
         bar = start;
-        lar = (end - 1) & ~(PMSAv8_MINALIGN - 1);;
+        lar = (end - 1) & ~(PMSAv8_MINALIGN - 1);
 
         bar |= PMSAv8_AP_PL1RW_PL0RW | PMSAv8_RGN_SHARED;
         lar |= PMSAv8_LAR_IDX(PMSAv8_RGN_NORMAL) | PMSAv8_LAR_EN;
@@ -181,7 +181,7 @@ static int __init pmsav8_setup_io(unsigned int number, phys_addr_t start,phys_ad
                 return -EINVAL;
 
         bar = start;
-        lar = (end - 1) & ~(PMSAv8_MINALIGN - 1);;
+        lar = (end - 1) & ~(PMSAv8_MINALIGN - 1);
 
         bar |= PMSAv8_AP_PL1RW_PL0RW | PMSAv8_RGN_SHARED | PMSAv8_BAR_XN;
         lar |= PMSAv8_LAR_IDX(PMSAv8_RGN_DEVICE_nGnRnE) | PMSAv8_LAR_EN;
diff --git a/arch/arm/mm/proc-v7m.S b/arch/arm/mm/proc-v7m.S
index 47a5acc64433..acd5a66dfc23 100644
--- a/arch/arm/mm/proc-v7m.S
+++ b/arch/arm/mm/proc-v7m.S
@@ -139,6 +139,9 @@ __v7m_setup_cont:
         cpsie   i
         svc     #0
 1:      cpsid   i
+        ldr     r0, =exc_ret
+        orr     lr, lr, #EXC_RET_THREADMODE_PROCESSSTACK
+        str     lr, [r0]
         ldmia   sp, {r0-r3, r12}
         str     r5, [r12, #11 * 4]      @ restore the original SVC vector entry
         mov     lr, r6                  @ restore LR
@@ -149,10 +152,10 @@ __v7m_setup_cont:
 
         @ Configure caches (if implemented)
         teq     r8, #0
-        stmneia sp, {r0-r6, lr}         @ v7m_invalidate_l1 touches r0-r6
+        stmiane sp, {r0-r6, lr}         @ v7m_invalidate_l1 touches r0-r6
         blne    v7m_invalidate_l1
         teq     r8, #0                  @ re-evalutae condition
-        ldmneia sp, {r0-r6, lr}
+        ldmiane sp, {r0-r6, lr}
 
         @ Configure the System Control Register to ensure 8-byte stack alignment
         @ Note the STKALIGN bit is either RW or RAO.
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 117b2541ef3d..7e34b9eba5de 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -159,7 +159,6 @@ config ARM64
         select IRQ_DOMAIN
         select IRQ_FORCED_THREADING
         select MODULES_USE_ELF_RELA
-        select MULTI_IRQ_HANDLER
         select NEED_DMA_MAP_STATE
         select NEED_SG_DMA_LENGTH
         select OF
diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
index 2afb1338b48a..5f1437099b99 100644
--- a/arch/arm64/include/asm/cputype.h
+++ b/arch/arm64/include/asm/cputype.h
@@ -77,6 +77,7 @@
 #define ARM_CPU_IMP_QCOM                0x51
 #define ARM_CPU_IMP_NVIDIA              0x4E
 #define ARM_CPU_IMP_FUJITSU             0x46
+#define ARM_CPU_IMP_HISI                0x48
 
 #define ARM_CPU_PART_AEM_V8             0xD0F
 #define ARM_CPU_PART_FOUNDATION         0xD00
@@ -107,6 +108,8 @@
 
 #define FUJITSU_CPU_PART_A64FX          0x001
 
+#define HISI_CPU_PART_TSV110            0xD01
+
 #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53)
 #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57)
 #define MIDR_CORTEX_A72 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72)
@@ -126,10 +129,11 @@
 #define MIDR_NVIDIA_DENVER MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_DENVER)
 #define MIDR_NVIDIA_CARMEL MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_CARMEL)
 #define MIDR_FUJITSU_A64FX MIDR_CPU_MODEL(ARM_CPU_IMP_FUJITSU, FUJITSU_CPU_PART_A64FX)
+#define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110)
 
 /* Fujitsu Erratum 010001 affects A64FX 1.0 and 1.1, (v0r0 and v1r0) */
 #define MIDR_FUJITSU_ERRATUM_010001             MIDR_FUJITSU_A64FX
-#define MIDR_FUJITSU_ERRATUM_010001_MASK        (~MIDR_VARIANT(1))
+#define MIDR_FUJITSU_ERRATUM_010001_MASK        (~MIDR_CPU_VAR_REV(1, 0))
 #define TCR_CLEAR_FUJITSU_ERRATUM_010001        (TCR_NFD1 | TCR_NFD0)
 
 #ifndef __ASSEMBLY__
diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
index 506386a3edde..d3842791e1c4 100644
--- a/arch/arm64/include/asm/kvm_emulate.h
+++ b/arch/arm64/include/asm/kvm_emulate.h
@@ -77,6 +77,10 @@ static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu)
          */
         if (!vcpu_el1_is_32bit(vcpu))
                 vcpu->arch.hcr_el2 |= HCR_TID3;
+
+        if (cpus_have_const_cap(ARM64_MISMATCHED_CACHE_TYPE) ||
+            vcpu_el1_is_32bit(vcpu))
+                vcpu->arch.hcr_el2 |= HCR_TID2;
 }
 
 static inline unsigned long *vcpu_hcr(struct kvm_vcpu *vcpu)
@@ -331,6 +335,14 @@ static inline int kvm_vcpu_sys_get_rt(struct kvm_vcpu *vcpu)
         return ESR_ELx_SYS64_ISS_RT(esr);
 }
 
+static inline bool kvm_is_write_fault(struct kvm_vcpu *vcpu)
+{
+        if (kvm_vcpu_trap_is_iabt(vcpu))
+                return false;
+
+        return kvm_vcpu_dabt_iswrite(vcpu);
+}
+
 static inline unsigned long kvm_vcpu_get_mpidr_aff(struct kvm_vcpu *vcpu)
 {
         return vcpu_read_sys_reg(vcpu, MPIDR_EL1) & MPIDR_HWID_BITMASK;
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index 222af1d2c3e4..a01fe087e022 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -31,6 +31,7 @@
 #include <asm/kvm.h>
 #include <asm/kvm_asm.h>
 #include <asm/kvm_mmio.h>
+#include <asm/smp_plat.h>
 #include <asm/thread_info.h>
 
 #define __KVM_HAVE_ARCH_INTC_INITIALIZED
@@ -58,16 +59,19 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu);
 int kvm_arch_vm_ioctl_check_extension(struct kvm *kvm, long ext);
 void __extended_idmap_trampoline(phys_addr_t boot_pgd, phys_addr_t idmap_start);
 
-struct kvm_arch {
+struct kvm_vmid {
         /* The VMID generation used for the virt. memory system */
         u64    vmid_gen;
         u32    vmid;
+};
+
+struct kvm_arch {
+        struct kvm_vmid vmid;
 
         /* stage2 entry level table */
         pgd_t *pgd;
+        phys_addr_t pgd_phys;
 
-        /* VTTBR value associated with above pgd and vmid */
-        u64    vttbr;
         /* VTCR_EL2 value for this VM */
         u64    vtcr;
 
@@ -382,7 +386,36 @@ void kvm_arm_halt_guest(struct kvm *kvm);
 void kvm_arm_resume_guest(struct kvm *kvm);
 
 u64 __kvm_call_hyp(void *hypfn, ...);
-#define kvm_call_hyp(f, ...) __kvm_call_hyp(kvm_ksym_ref(f), ##__VA_ARGS__)
+
+/*
+ * The couple of isb() below are there to guarantee the same behaviour
+ * on VHE as on !VHE, where the eret to EL1 acts as a context
+ * synchronization event.
+ */
+#define kvm_call_hyp(f, ...)                                            \
+        do {                                                            \
+                if (has_vhe()) {                                        \
+                        f(__VA_ARGS__);                                 \
+                        isb();                                          \
+                } else {                                                \
+                        __kvm_call_hyp(kvm_ksym_ref(f), ##__VA_ARGS__); \
+                }                                                       \
+        } while(0)
+
+#define kvm_call_hyp_ret(f, ...)                                        \
+        ({                                                              \
+                typeof(f(__VA_ARGS__)) ret;                             \
+                                                                        \
+                if (has_vhe()) {                                        \
+                        ret = f(__VA_ARGS__);                           \
+                        isb();                                          \
+                } else {                                                \
+                        ret = __kvm_call_hyp(kvm_ksym_ref(f),           \
+                                             ##__VA_ARGS__);            \
+                }                                                       \
+                                                                        \
+                ret;                                                    \
+        })
 
 void force_vm_exit(const cpumask_t *mask);
 void kvm_mmu_wp_memory_region(struct kvm *kvm, int slot);
@@ -401,6 +434,13 @@ struct kvm_vcpu *kvm_mpidr_to_vcpu(struct kvm *kvm, unsigned long mpidr);
 
 DECLARE_PER_CPU(kvm_cpu_context_t, kvm_host_cpu_state);
 
+static inline void kvm_init_host_cpu_context(kvm_cpu_context_t *cpu_ctxt,
+                                             int cpu)
+{
+        /* The host's MPIDR is immutable, so let's set it up at boot time */
+        cpu_ctxt->sys_regs[MPIDR_EL1] = cpu_logical_map(cpu);
+}
+
 void __kvm_enable_ssbs(void);
 
 static inline void __cpu_init_hyp_mode(phys_addr_t pgd_ptr,
diff --git a/arch/arm64/include/asm/kvm_hyp.h b/arch/arm64/include/asm/kvm_hyp.h
index a80a7ef57325..4da765f2cca5 100644
--- a/arch/arm64/include/asm/kvm_hyp.h
+++ b/arch/arm64/include/asm/kvm_hyp.h
@@ -21,6 +21,7 @@
 #include <linux/compiler.h>
 #include <linux/kvm_host.h>
 #include <asm/alternative.h>
+#include <asm/kvm_mmu.h>
 #include <asm/sysreg.h>
 
 #define __hyp_text __section(.hyp.text) notrace
@@ -163,7 +164,7 @@ void __noreturn __hyp_do_panic(unsigned long, ...);
 static __always_inline void __hyp_text __load_guest_stage2(struct kvm *kvm)
 {
         write_sysreg(kvm->arch.vtcr, vtcr_el2);
-        write_sysreg(kvm->arch.vttbr, vttbr_el2);
+        write_sysreg(kvm_get_vttbr(kvm), vttbr_el2);
 
         /*
          * ARM erratum 1165522 requires the actual execution of the above
diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
index 8af4b1befa42..b0742a16c6c9 100644
--- a/arch/arm64/include/asm/kvm_mmu.h
+++ b/arch/arm64/include/asm/kvm_mmu.h
@@ -138,7 +138,8 @@ static inline unsigned long __kern_hyp_va(unsigned long v)
         })
 
 /*
- * We currently only support a 40bit IPA.
+ * We currently support using a VM-specified IPA size. For backward
+ * compatibility, the default IPA size is fixed to 40bits.
  */
 #define KVM_PHYS_SHIFT  (40)
 
@@ -591,9 +592,15 @@ static inline u64 kvm_vttbr_baddr_mask(struct kvm *kvm)
         return vttbr_baddr_mask(kvm_phys_shift(kvm), kvm_stage2_levels(kvm));
 }
 
-static inline bool kvm_cpu_has_cnp(void)
+static __always_inline u64 kvm_get_vttbr(struct kvm *kvm)
 {
-        return system_supports_cnp();
+        struct kvm_vmid *vmid = &kvm->arch.vmid;
+        u64 vmid_field, baddr;
+        u64 cnp = system_supports_cnp() ? VTTBR_CNP_BIT : 0;
+
+        baddr = kvm->arch.pgd_phys;
+        vmid_field = (u64)vmid->vmid << VTTBR_VMID_SHIFT;
+        return kvm_phys_to_vttbr(baddr) | vmid_field | cnp;
 }
 
 #endif /* __ASSEMBLY__ */
diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
index 72dc4c011014..5b267dec6194 100644
--- a/arch/arm64/include/asm/sysreg.h
+++ b/arch/arm64/include/asm/sysreg.h
@@ -361,6 +361,7 @@
 
 #define SYS_CNTKCTL_EL1                 sys_reg(3, 0, 14, 1, 0)
 
+#define SYS_CCSIDR_EL1                  sys_reg(3, 1, 0, 0, 0)
 #define SYS_CLIDR_EL1                   sys_reg(3, 1, 0, 0, 1)
 #define SYS_AIDR_EL1                    sys_reg(3, 1, 0, 0, 7)
 
@@ -392,6 +393,10 @@
 #define SYS_CNTP_CTL_EL0                sys_reg(3, 3, 14, 2, 1)
 #define SYS_CNTP_CVAL_EL0               sys_reg(3, 3, 14, 2, 2)
 
+#define SYS_AARCH32_CNTP_TVAL           sys_reg(0, 0, 14, 2, 0)
+#define SYS_AARCH32_CNTP_CTL            sys_reg(0, 0, 14, 2, 1)
+#define SYS_AARCH32_CNTP_CVAL           sys_reg(0, 2, 0, 14, 0)
+
 #define __PMEV_op2(n)                   ((n) & 0x7)
 #define __CNTR_CRm(n)                   (0x8 | (((n) >> 3) & 0x3))
 #define SYS_PMEVCNTRn_EL0(n)            sys_reg(3, 3, 14, __CNTR_CRm(n), __PMEV_op2(n))
@@ -426,7 +431,7 @@
 #define SYS_ICH_VTR_EL2                 sys_reg(3, 4, 12, 11, 1)
 #define SYS_ICH_MISR_EL2                sys_reg(3, 4, 12, 11, 2)
 #define SYS_ICH_EISR_EL2                sys_reg(3, 4, 12, 11, 3)
-#define SYS_ICH_ELSR_EL2                sys_reg(3, 4, 12, 11, 5)
+#define SYS_ICH_ELRSR_EL2               sys_reg(3, 4, 12, 11, 5)
 #define SYS_ICH_VMCR_EL2                sys_reg(3, 4, 12, 11, 7)
 
 #define __SYS__LR0_EL2(x)               sys_reg(3, 4, 12, 12, x)
diff --git a/arch/arm64/include/uapi/asm/Kbuild b/arch/arm64/include/uapi/asm/Kbuild
index 87eea29b24ab..602d137932dc 100644
--- a/arch/arm64/include/uapi/asm/Kbuild
+++ b/arch/arm64/include/uapi/asm/Kbuild
@@ -1,4 +1,3 @@
 # SPDX-License-Identifier: GPL-2.0
-include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += kvm_para.h
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index e24e94d28767..4061de10cea6 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -963,6 +963,7 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
                 MIDR_ALL_VERSIONS(MIDR_CORTEX_A57),
                 MIDR_ALL_VERSIONS(MIDR_CORTEX_A72),
                 MIDR_ALL_VERSIONS(MIDR_CORTEX_A73),
+                MIDR_ALL_VERSIONS(MIDR_HISI_TSV110),
                 { /* sentinel */ }
         };
         char const *str = "command line option";
diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
index 7fb6f3aa5ceb..7a679caf4585 100644
--- a/arch/arm64/kernel/probes/kprobes.c
+++ b/arch/arm64/kernel/probes/kprobes.c
@@ -91,8 +91,6 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs)
 int __kprobes arch_prepare_kprobe(struct kprobe *p)
 {
         unsigned long probe_addr = (unsigned long)p->addr;
-        extern char __start_rodata[];
-        extern char __end_rodata[];
 
         if (probe_addr & 0x3)
                 return -EINVAL;
@@ -100,10 +98,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
         /* copy instruction */
         p->opcode = le32_to_cpu(*p->addr);
 
-        if (in_exception_text(probe_addr))
-                return -EINVAL;
-        if (probe_addr >= (unsigned long) __start_rodata &&
-            probe_addr <= (unsigned long) __end_rodata)
+        if (search_exception_tables(probe_addr))
                 return -EINVAL;
 
         /* decode instruction */
@@ -476,26 +471,37 @@ kprobe_breakpoint_handler(struct pt_regs *regs, unsigned int esr)
         return DBG_HOOK_HANDLED;
 }
 
-bool arch_within_kprobe_blacklist(unsigned long addr)
+/*
+ * Provide a blacklist of symbols identifying ranges which cannot be kprobed.
+ * This blacklist is exposed to userspace via debugfs (kprobes/blacklist).
+ */
+int __init arch_populate_kprobe_blacklist(void)
 {
-        if ((addr >= (unsigned long)__kprobes_text_start &&
-            addr < (unsigned long)__kprobes_text_end) ||
-            (addr >= (unsigned long)__entry_text_start &&
-            addr < (unsigned long)__entry_text_end) ||
-            (addr >= (unsigned long)__idmap_text_start &&
-            addr < (unsigned long)__idmap_text_end) ||
-            (addr >= (unsigned long)__hyp_text_start &&
-            addr < (unsigned long)__hyp_text_end) ||
-            !!search_exception_tables(addr))
-                return true;
-
-        if (!is_kernel_in_hyp_mode()) {
-                if ((addr >= (unsigned long)__hyp_idmap_text_start &&
-                    addr < (unsigned long)__hyp_idmap_text_end))
-                        return true;
-        }
-
-        return false;
+        int ret;
+
+        ret = kprobe_add_area_blacklist((unsigned long)__entry_text_start,
+                                        (unsigned long)__entry_text_end);
+        if (ret)
+                return ret;
+        ret = kprobe_add_area_blacklist((unsigned long)__irqentry_text_start,
+                                        (unsigned long)__irqentry_text_end);
+        if (ret)
+                return ret;
+        ret = kprobe_add_area_blacklist((unsigned long)__exception_text_start,
+                                        (unsigned long)__exception_text_end);
+        if (ret)
+                return ret;
+        ret = kprobe_add_area_blacklist((unsigned long)__idmap_text_start,
+                                        (unsigned long)__idmap_text_end);
+        if (ret)
+                return ret;
+        ret = kprobe_add_area_blacklist((unsigned long)__hyp_text_start,
+                                        (unsigned long)__hyp_text_end);
+        if (ret || is_kernel_in_hyp_mode())
+                return ret;
+        ret = kprobe_add_area_blacklist((unsigned long)__hyp_idmap_text_start,
+                                        (unsigned long)__hyp_idmap_text_end);
+        return ret;
 }
 
 void __kprobes __used *trampoline_probe_handler(struct pt_regs *regs)
diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
index 1a29f2695ff2..d908b5e9e949 100644
--- a/arch/arm64/kernel/stacktrace.c
+++ b/arch/arm64/kernel/stacktrace.c
@@ -143,6 +143,7 @@ void save_stack_trace_regs(struct pt_regs *regs, struct stack_trace *trace)
         if (trace->nr_entries < trace->max_entries)
                 trace->entries[trace->nr_entries++] = ULONG_MAX;
 }
+EXPORT_SYMBOL_GPL(save_stack_trace_regs);
 
 static noinline void __save_stack_trace(struct task_struct *tsk,
         struct stack_trace *trace, unsigned int nosched)
diff --git a/arch/arm64/kvm/Makefile b/arch/arm64/kvm/Makefile
index 0f2a135ba15b..690e033a91c0 100644
--- a/arch/arm64/kvm/Makefile
+++ b/arch/arm64/kvm/Makefile
@@ -3,9 +3,7 @@
 # Makefile for Kernel-based Virtual Machine module
 #
 
-ccflags-y += -Iarch/arm64/kvm -Ivirt/kvm/arm/vgic
-CFLAGS_arm.o := -I.
-CFLAGS_mmu.o := -I.
+ccflags-y += -I $(srctree)/$(src) -I $(srctree)/virt/kvm/arm/vgic
 
 KVM=../../../virt/kvm
 
diff --git a/arch/arm64/kvm/debug.c b/arch/arm64/kvm/debug.c
index f39801e4136c..fd917d6d12af 100644
--- a/arch/arm64/kvm/debug.c
+++ b/arch/arm64/kvm/debug.c
@@ -76,7 +76,7 @@ static void restore_guest_debug_regs(struct kvm_vcpu *vcpu)
 
 void kvm_arm_init_debug(void)
 {
-        __this_cpu_write(mdcr_el2, kvm_call_hyp(__kvm_get_mdcr_el2));
+        __this_cpu_write(mdcr_el2, kvm_call_hyp_ret(__kvm_get_mdcr_el2));
 }
 
 /**
diff --git a/arch/arm64/kvm/hyp.S b/arch/arm64/kvm/hyp.S
index 952f6cb9cf72..2845aa680841 100644
--- a/arch/arm64/kvm/hyp.S
+++ b/arch/arm64/kvm/hyp.S
@@ -40,9 +40,6 @@
  * arch/arm64/kernel/hyp_stub.S.
  */
 ENTRY(__kvm_call_hyp)
-alternative_if_not ARM64_HAS_VIRT_HOST_EXTN
         hvc     #0
         ret
-alternative_else_nop_endif
-        b       __vhe_hyp_call
 ENDPROC(__kvm_call_hyp)
diff --git a/arch/arm64/kvm/hyp/hyp-entry.S b/arch/arm64/kvm/hyp/hyp-entry.S
index 73c1b483ec39..2b1e686772bf 100644
--- a/arch/arm64/kvm/hyp/hyp-entry.S
+++ b/arch/arm64/kvm/hyp/hyp-entry.S
@@ -43,18 +43,6 @@
         ldr     lr, [sp], #16
 .endm
 
-ENTRY(__vhe_hyp_call)
-        do_el2_call
-        /*
-         * We used to rely on having an exception return to get
-         * an implicit isb. In the E2H case, we don't have it anymore.
-         * rather than changing all the leaf functions, just do it here
-         * before returning to the rest of the kernel.
-         */
-        isb
-        ret
-ENDPROC(__vhe_hyp_call)
-
 el1_sync:                               // Guest trapped into EL2
 
         mrs     x0, esr_el2
diff --git a/arch/arm64/kvm/hyp/sysreg-sr.c b/arch/arm64/kvm/hyp/sysreg-sr.c
index b426e2cf973c..c52a8451637c 100644
--- a/arch/arm64/kvm/hyp/sysreg-sr.c
+++ b/arch/arm64/kvm/hyp/sysreg-sr.c
@@ -53,7 +53,6 @@ static void __hyp_text __sysreg_save_user_state(struct kvm_cpu_context *ctxt)
 
 static void __hyp_text __sysreg_save_el1_state(struct kvm_cpu_context *ctxt)
 {
-        ctxt->sys_regs[MPIDR_EL1]       = read_sysreg(vmpidr_el2);
         ctxt->sys_regs[CSSELR_EL1]      = read_sysreg(csselr_el1);
         ctxt->sys_regs[SCTLR_EL1]       = read_sysreg_el1(sctlr);
         ctxt->sys_regs[ACTLR_EL1]       = read_sysreg(actlr_el1);
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index c936aa40c3f4..539feecda5b8 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -982,6 +982,10 @@ static bool access_pmuserenr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
         return true;
 }
 
+#define reg_to_encoding(x)                                              \
+        sys_reg((u32)(x)->Op0, (u32)(x)->Op1,                           \
+                (u32)(x)->CRn, (u32)(x)->CRm, (u32)(x)->Op2);
+
 /* Silly macro to expand the DBG{BCR,BVR,WVR,WCR}n_EL1 registers in one go */
 #define DBG_BCR_BVR_WCR_WVR_EL1(n)                                      \
         { SYS_DESC(SYS_DBGBVRn_EL1(n)),                                 \
@@ -1003,44 +1007,38 @@ static bool access_pmuserenr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
         { SYS_DESC(SYS_PMEVTYPERn_EL0(n)),                                      \
           access_pmu_evtyper, reset_unknown, (PMEVTYPER0_EL0 + n), }
 
-static bool access_cntp_tval(struct kvm_vcpu *vcpu,
-                struct sys_reg_params *p,
-                const struct sys_reg_desc *r)
+static bool access_arch_timer(struct kvm_vcpu *vcpu,
+                              struct sys_reg_params *p,
+                              const struct sys_reg_desc *r)
 {
-        u64 now = kvm_phys_timer_read();
-        u64 cval;
+        enum kvm_arch_timers tmr;
+        enum kvm_arch_timer_regs treg;
+        u64 reg = reg_to_encoding(r);
 
-        if (p->is_write) {
-                kvm_arm_timer_set_reg(vcpu, KVM_REG_ARM_PTIMER_CVAL,
-                                      p->regval + now);
-        } else {
-                cval = kvm_arm_timer_get_reg(vcpu, KVM_REG_ARM_PTIMER_CVAL);
-                p->regval = cval - now;
+        switch (reg) {
+        case SYS_CNTP_TVAL_EL0:
+        case SYS_AARCH32_CNTP_TVAL:
+                tmr = TIMER_PTIMER;
+                treg = TIMER_REG_TVAL;
+                break;
+        case SYS_CNTP_CTL_EL0:
+        case SYS_AARCH32_CNTP_CTL:
+                tmr = TIMER_PTIMER;
+                treg = TIMER_REG_CTL;
+                break;
+        case SYS_CNTP_CVAL_EL0:
+        case SYS_AARCH32_CNTP_CVAL:
+                tmr = TIMER_PTIMER;
+                treg = TIMER_REG_CVAL;
+                break;
+        default:
+                BUG();
         }
 
-        return true;
-}
-
-static bool access_cntp_ctl(struct kvm_vcpu *vcpu,
-                struct sys_reg_params *p,
-                const struct sys_reg_desc *r)
-{
-        if (p->is_write)
-                kvm_arm_timer_set_reg(vcpu, KVM_REG_ARM_PTIMER_CTL, p->regval);
-        else
-                p->regval = kvm_arm_timer_get_reg(vcpu, KVM_REG_ARM_PTIMER_CTL);
-
-        return true;
-}
-
-static bool access_cntp_cval(struct kvm_vcpu *vcpu,
-                struct sys_reg_params *p,
-                const struct sys_reg_desc *r)
-{
         if (p->is_write)
-                kvm_arm_timer_set_reg(vcpu, KVM_REG_ARM_PTIMER_CVAL, p->regval);
+                kvm_arm_timer_write_sysreg(vcpu, tmr, treg, p->regval);
         else
-                p->regval = kvm_arm_timer_get_reg(vcpu, KVM_REG_ARM_PTIMER_CVAL);
+                p->regval = kvm_arm_timer_read_sysreg(vcpu, tmr, treg);
 
         return true;
 }
@@ -1160,6 +1158,64 @@ static int set_raz_id_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
         return __set_id_reg(rd, uaddr, true);
 }
 
+static bool access_ctr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
+                       const struct sys_reg_desc *r)
+{
+        if (p->is_write)
+                return write_to_read_only(vcpu, p, r);
+
+        p->regval = read_sanitised_ftr_reg(SYS_CTR_EL0);
+        return true;
+}
+
+static bool access_clidr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
+                         const struct sys_reg_desc *r)
+{
+        if (p->is_write)
+                return write_to_read_only(vcpu, p, r);
+
+        p->regval = read_sysreg(clidr_el1);
+        return true;
+}
+
+static bool access_csselr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
+                          const struct sys_reg_desc *r)
+{
+        if (p->is_write)
+                vcpu_write_sys_reg(vcpu, p->regval, r->reg);
+        else
+                p->regval = vcpu_read_sys_reg(vcpu, r->reg);
+        return true;
+}
+
+static bool access_ccsidr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
+                          const struct sys_reg_desc *r)
+{
+        u32 csselr;
+
+        if (p->is_write)
+                return write_to_read_only(vcpu, p, r);
+
+        csselr = vcpu_read_sys_reg(vcpu, CSSELR_EL1);
+        p->regval = get_ccsidr(csselr);
+
+        /*
+         * Guests should not be doing cache operations by set/way at all, and
+         * for this reason, we trap them and attempt to infer the intent, so
+         * that we can flush the entire guest's address space at the appropriate
+         * time.
+         * To prevent this trapping from causing performance problems, let's
+         * expose the geometry of all data and unified caches (which are
+         * guaranteed to be PIPT and thus non-aliasing) as 1 set and 1 way.
+         * [If guests should attempt to infer aliasing properties from the
+         * geometry (which is not permitted by the architecture), they would
+         * only do so for virtually indexed caches.]
+         */
+        if (!(csselr & 1)) // data or unified cache
+                p->regval &= ~GENMASK(27, 3);
+        return true;
+}
+
 /* sys_reg_desc initialiser for known cpufeature ID registers */
 #define ID_SANITISED(name) {                    \
         SYS_DESC(SYS_##name),                   \
@@ -1377,7 +1433,10 @@ static const struct sys_reg_desc sys_reg_descs[] = {
 
         { SYS_DESC(SYS_CNTKCTL_EL1), NULL, reset_val, CNTKCTL_EL1, 0},
 
-        { SYS_DESC(SYS_CSSELR_EL1), NULL, reset_unknown, CSSELR_EL1 },
+        { SYS_DESC(SYS_CCSIDR_EL1), access_ccsidr },
+        { SYS_DESC(SYS_CLIDR_EL1), access_clidr },
+        { SYS_DESC(SYS_CSSELR_EL1), access_csselr, reset_unknown, CSSELR_EL1 },
+        { SYS_DESC(SYS_CTR_EL0), access_ctr },
 
         { SYS_DESC(SYS_PMCR_EL0), access_pmcr, reset_pmcr, },
         { SYS_DESC(SYS_PMCNTENSET_EL0), access_pmcnten, reset_unknown, PMCNTENSET_EL0 },
@@ -1400,9 +1459,9 @@ static const struct sys_reg_desc sys_reg_descs[] = {
         { SYS_DESC(SYS_TPIDR_EL0), NULL, reset_unknown, TPIDR_EL0 },
         { SYS_DESC(SYS_TPIDRRO_EL0), NULL, reset_unknown, TPIDRRO_EL0 },
 
-        { SYS_DESC(SYS_CNTP_TVAL_EL0), access_cntp_tval },
-        { SYS_DESC(SYS_CNTP_CTL_EL0), access_cntp_ctl },
-        { SYS_DESC(SYS_CNTP_CVAL_EL0), access_cntp_cval },
+        { SYS_DESC(SYS_CNTP_TVAL_EL0), access_arch_timer },
+        { SYS_DESC(SYS_CNTP_CTL_EL0), access_arch_timer },
+        { SYS_DESC(SYS_CNTP_CVAL_EL0), access_arch_timer },
 
         /* PMEVCNTRn_EL0 */
         PMU_PMEVCNTR_EL0(0),
@@ -1476,7 +1535,7 @@ static const struct sys_reg_desc sys_reg_descs[] = {
 
         { SYS_DESC(SYS_DACR32_EL2), NULL, reset_unknown, DACR32_EL2 },
         { SYS_DESC(SYS_IFSR32_EL2), NULL, reset_unknown, IFSR32_EL2 },
-        { SYS_DESC(SYS_FPEXC32_EL2), NULL, reset_val, FPEXC32_EL2, 0x70 },
+        { SYS_DESC(SYS_FPEXC32_EL2), NULL, reset_val, FPEXC32_EL2, 0x700 },
 };
 
 static bool trap_dbgidr(struct kvm_vcpu *vcpu,
@@ -1677,6 +1736,7 @@ static const struct sys_reg_desc cp14_64_regs[] = {
  * register).
  */
 static const struct sys_reg_desc cp15_regs[] = {
+        { Op1( 0), CRn( 0), CRm( 0), Op2( 1), access_ctr },
         { Op1( 0), CRn( 1), CRm( 0), Op2( 0), access_vm_reg, NULL, c1_SCTLR },
         { Op1( 0), CRn( 2), CRm( 0), Op2( 0), access_vm_reg, NULL, c2_TTBR0 },
         { Op1( 0), CRn( 2), CRm( 0), Op2( 1), access_vm_reg, NULL, c2_TTBR1 },
@@ -1723,10 +1783,9 @@ static const struct sys_reg_desc cp15_regs[] = {
 
         { Op1( 0), CRn(13), CRm( 0), Op2( 1), access_vm_reg, NULL, c13_CID },
 
-        /* CNTP_TVAL */
-        { Op1( 0), CRn(14), CRm( 2), Op2( 0), access_cntp_tval },
-        /* CNTP_CTL */
-        { Op1( 0), CRn(14), CRm( 2), Op2( 1), access_cntp_ctl },
+        /* Arch Tmers */
+        { SYS_DESC(SYS_AARCH32_CNTP_TVAL), access_arch_timer },
+        { SYS_DESC(SYS_AARCH32_CNTP_CTL), access_arch_timer },
 
         /* PMEVCNTRn */
         PMU_PMEVCNTR(0),
@@ -1794,6 +1853,10 @@ static const struct sys_reg_desc cp15_regs[] = {
         PMU_PMEVTYPER(30),
         /* PMCCFILTR */
         { Op1(0), CRn(14), CRm(15), Op2(7), access_pmu_evtyper },
+
+        { Op1(1), CRn( 0), CRm( 0), Op2(0), access_ccsidr },
+        { Op1(1), CRn( 0), CRm( 0), Op2(1), access_clidr },
+        { Op1(2), CRn( 0), CRm( 0), Op2(0), access_csselr, NULL, c0_CSSELR },
 };
 
 static const struct sys_reg_desc cp15_64_regs[] = {
@@ -1803,7 +1866,7 @@ static const struct sys_reg_desc cp15_64_regs[] = {
         { Op1( 1), CRn( 0), CRm( 2), Op2( 0), access_vm_reg, NULL, c2_TTBR1 },
         { Op1( 1), CRn( 0), CRm(12), Op2( 0), access_gic_sgi }, /* ICC_ASGI1R */
         { Op1( 2), CRn( 0), CRm(12), Op2( 0), access_gic_sgi }, /* ICC_SGI0R */
-        { Op1( 2), CRn( 0), CRm(14), Op2( 0), access_cntp_cval },
+        { SYS_DESC(SYS_AARCH32_CNTP_CVAL),    access_arch_timer },
 };
 
 /* Target specific emulation tables */
@@ -1832,30 +1895,19 @@ static const struct sys_reg_desc *get_target_table(unsigned target,
         }
 }
 
-#define reg_to_match_value(x)                                           \
-        ({                                                              \
-                unsigned long val;                                      \
-                val  = (x)->Op0 << 14;                                  \
-                val |= (x)->Op1 << 11;                                  \
-                val |= (x)->CRn << 7;                                   \
-                val |= (x)->CRm << 3;                                   \
-                val |= (x)->Op2;                                        \
-                val;                                                    \
-         })
-
 static int match_sys_reg(const void *key, const void *elt)
 {
         const unsigned long pval = (unsigned long)key;
         const struct sys_reg_desc *r = elt;
 
-        return pval - reg_to_match_value(r);
+        return pval - reg_to_encoding(r);
 }
 
 static const struct sys_reg_desc *find_reg(const struct sys_reg_params *params,
                                          const struct sys_reg_desc table[],
                                          unsigned int num)
 {
-        unsigned long pval = reg_to_match_value(params);
+        unsigned long pval = reg_to_encoding(params);
 
         return bsearch((void *)pval, table, num, sizeof(table[0]), match_sys_reg);
 }
@@ -2218,11 +2270,15 @@ static const struct sys_reg_desc *index_to_sys_reg_desc(struct kvm_vcpu *vcpu,
         }
 
 FUNCTION_INVARIANT(midr_el1)
-FUNCTION_INVARIANT(ctr_el0)
 FUNCTION_INVARIANT(revidr_el1)
 FUNCTION_INVARIANT(clidr_el1)
 FUNCTION_INVARIANT(aidr_el1)
 
+static void get_ctr_el0(struct kvm_vcpu *v, const struct sys_reg_desc *r)
+{
+        ((struct sys_reg_desc *)r)->val = read_sanitised_ftr_reg(SYS_CTR_EL0);
+}
+
 /* ->val is filled in by kvm_sys_reg_table_init() */
 static struct sys_reg_desc invariant_sys_regs[] = {
         { SYS_DESC(SYS_MIDR_EL1), NULL, get_midr_el1 },
diff --git a/arch/c6x/include/uapi/asm/Kbuild b/arch/c6x/include/uapi/asm/Kbuild
index 0febf1a07c30..755bb11323d8 100644
--- a/arch/c6x/include/uapi/asm/Kbuild
+++ b/arch/c6x/include/uapi/asm/Kbuild
@@ -1,4 +1,2 @@
-include include/uapi/asm-generic/Kbuild.asm
-
 generic-y += kvm_para.h
 generic-y += ucontext.h
diff --git a/arch/csky/include/uapi/asm/Kbuild b/arch/csky/include/uapi/asm/Kbuild
index c1b06dcf6cf8..1c72f04ff75d 100644
--- a/arch/csky/include/uapi/asm/Kbuild
+++ b/arch/csky/include/uapi/asm/Kbuild
@@ -1,3 +1 @@
-include include/uapi/asm-generic/Kbuild.asm
-
 generic-y += ucontext.h
diff --git a/arch/h8300/Makefile b/arch/h8300/Makefile
index f801f3708a89..ba0f26cfad61 100644
--- a/arch/h8300/Makefile
+++ b/arch/h8300/Makefile
@@ -27,7 +27,7 @@ KBUILD_LDFLAGS += $(ldflags-y)
 CHECKFLAGS += -msize-long
 
 ifeq ($(CROSS_COMPILE),)
-CROSS_COMPILE := h8300-unknown-linux-
+CROSS_COMPILE := $(call cc-cross-prefix, h8300-unknown-linux- h8300-linux-)
 endif
 
 core-y  += arch/$(ARCH)/kernel/ arch/$(ARCH)/mm/
diff --git a/arch/h8300/include/asm/Kbuild b/arch/h8300/include/asm/Kbuild
index 961c1dc064e1..3e7c8ecf151e 100644
--- a/arch/h8300/include/asm/Kbuild
+++ b/arch/h8300/include/asm/Kbuild
@@ -17,7 +17,6 @@ generic-y += fb.h
 generic-y += ftrace.h
 generic-y += futex.h
 generic-y += hardirq.h
-generic-y += hash.h
 generic-y += hw_irq.h
 generic-y += irq_regs.h
 generic-y += irq_work.h
diff --git a/arch/h8300/include/uapi/asm/Kbuild b/arch/h8300/include/uapi/asm/Kbuild
index 0febf1a07c30..755bb11323d8 100644
--- a/arch/h8300/include/uapi/asm/Kbuild
+++ b/arch/h8300/include/uapi/asm/Kbuild
@@ -1,4 +1,2 @@
-include include/uapi/asm-generic/Kbuild.asm
-
 generic-y += kvm_para.h
 generic-y += ucontext.h
diff --git a/arch/hexagon/include/uapi/asm/Kbuild b/arch/hexagon/include/uapi/asm/Kbuild
index c1b06dcf6cf8..1c72f04ff75d 100644
--- a/arch/hexagon/include/uapi/asm/Kbuild
+++ b/arch/hexagon/include/uapi/asm/Kbuild
@@ -1,3 +1 @@
-include include/uapi/asm-generic/Kbuild.asm
-
 generic-y += ucontext.h
diff --git a/arch/ia64/hp/sim/simscsi.c b/arch/ia64/hp/sim/simscsi.c
index f86844fc0725..0a8a74271173 100644
--- a/arch/ia64/hp/sim/simscsi.c
+++ b/arch/ia64/hp/sim/simscsi.c
@@ -105,7 +105,8 @@ simscsi_interrupt (unsigned long val)
                 atomic_dec(&num_reqs);
                 queue[rd].sc = NULL;
                 if (DBG)
-                        printk("simscsi_interrupt: done with %ld\n", sc->serial_number);
+                        printk("simscsi_interrupt: done with %u\n",
+                               sc->request->tag);
                 (*sc->scsi_done)(sc);
                 rd = (rd + 1) % SIMSCSI_REQ_QUEUE_LEN;
         }
@@ -214,8 +215,8 @@ simscsi_queuecommand_lck (struct scsi_cmnd *sc, void (*done)(struct scsi_cmnd *)
         register long sp asm ("sp");
 
         if (DBG)
-                printk("simscsi_queuecommand: target=%d,cmnd=%u,sc=%lu,sp=%lx,done=%p\n",
-                       target_id, sc->cmnd[0], sc->serial_number, sp, done);
+                printk("simscsi_queuecommand: target=%d,cmnd=%u,sc=%u,sp=%lx,done=%p\n",
+                       target_id, sc->cmnd[0], sc->request->tag, sp, done);
 #endif
 
         sc->result = DID_BAD_TARGET << 16;
diff --git a/arch/ia64/include/uapi/asm/Kbuild b/arch/ia64/include/uapi/asm/Kbuild
index b71c5f787783..20018cb883a9 100644
--- a/arch/ia64/include/uapi/asm/Kbuild
+++ b/arch/ia64/include/uapi/asm/Kbuild
@@ -1,5 +1,2 @@
-include include/uapi/asm-generic/Kbuild.asm
-
 generated-y += unistd_64.h
 generic-y += kvm_para.h
-generic-y += socket.h
diff --git a/arch/ia64/sn/kernel/Makefile b/arch/ia64/sn/kernel/Makefile
index d27df1d45da7..9c349dd23265 100644
--- a/arch/ia64/sn/kernel/Makefile
+++ b/arch/ia64/sn/kernel/Makefile
@@ -7,7 +7,7 @@
 # Copyright (C) 1999,2001-2006,2008 Silicon Graphics, Inc.  All Rights Reserved.
 #
 
-ccflags-y := -Iarch/ia64/sn/include
+ccflags-y := -I $(srctree)/arch/ia64/sn/include
 
 obj-y                           += setup.o bte.o bte_error.o irq.o mca.o idle.o \
                                    huberror.o io_acpi_init.o io_common.o \
diff --git a/arch/ia64/sn/kernel/sn2/Makefile b/arch/ia64/sn/kernel/sn2/Makefile
index 3d09108d4277..170bde4549da 100644
--- a/arch/ia64/sn/kernel/sn2/Makefile
+++ b/arch/ia64/sn/kernel/sn2/Makefile
@@ -9,7 +9,5 @@
 # sn2 specific kernel files
 #
 
-ccflags-y := -Iarch/ia64/sn/include
-
 obj-y += cache.o io.o ptc_deadlock.o sn2_smp.o sn_proc_fs.o \
          prominfo_proc.o timer.o timer_interrupt.o sn_hwperf.o
diff --git a/arch/ia64/sn/pci/Makefile b/arch/ia64/sn/pci/Makefile
index df2a90145426..321576b1b425 100644
--- a/arch/ia64/sn/pci/Makefile
+++ b/arch/ia64/sn/pci/Makefile
@@ -7,6 +7,4 @@
 #
 # Makefile for the sn pci general routines.
 
-ccflags-y := -Iarch/ia64/sn/include
-
 obj-y := pci_dma.o tioca_provider.o tioce_provider.o pcibr/
diff --git a/arch/ia64/sn/pci/pcibr/Makefile b/arch/ia64/sn/pci/pcibr/Makefile
index 396bcae36309..712f6af7c6e0 100644
--- a/arch/ia64/sn/pci/pcibr/Makefile
+++ b/arch/ia64/sn/pci/pcibr/Makefile
@@ -7,7 +7,7 @@
 #
 # Makefile for the sn2 io routines.
 
-ccflags-y := -Iarch/ia64/sn/include
+ccflags-y := -I $(srctree)/arch/ia64/sn/include
 
 obj-y                           +=  pcibr_dma.o pcibr_reg.o \
                                     pcibr_ate.o pcibr_provider.o
diff --git a/arch/m68k/include/uapi/asm/Kbuild b/arch/m68k/include/uapi/asm/Kbuild
index 960bf1e4be53..8a7ad40be463 100644
--- a/arch/m68k/include/uapi/asm/Kbuild
+++ b/arch/m68k/include/uapi/asm/Kbuild
@@ -1,4 +1,2 @@
-include include/uapi/asm-generic/Kbuild.asm
-
 generated-y += unistd_32.h
 generic-y += kvm_para.h
diff --git a/arch/microblaze/include/uapi/asm/Kbuild b/arch/microblaze/include/uapi/asm/Kbuild
index 97823ec46e97..3ce84fbb2678 100644
--- a/arch/microblaze/include/uapi/asm/Kbuild
+++ b/arch/microblaze/include/uapi/asm/Kbuild
@@ -1,5 +1,3 @@
-include include/uapi/asm-generic/Kbuild.asm
-
 generated-y += unistd_32.h
 generic-y += kvm_para.h
 generic-y += ucontext.h
diff --git a/arch/mips/bcm47xx/workarounds.c b/arch/mips/bcm47xx/workarounds.c
index 46eddbec8d9f..0ab95dd431b3 100644
--- a/arch/mips/bcm47xx/workarounds.c
+++ b/arch/mips/bcm47xx/workarounds.c
@@ -24,6 +24,7 @@ void __init bcm47xx_workarounds(void)
         case BCM47XX_BOARD_NETGEAR_WNR3500L:
                 bcm47xx_workarounds_enable_usb_power(12);
                 break;
+        case BCM47XX_BOARD_NETGEAR_WNDR3400V2:
         case BCM47XX_BOARD_NETGEAR_WNDR3400_V3:
                 bcm47xx_workarounds_enable_usb_power(21);
                 break;
diff --git a/arch/mips/include/asm/jump_label.h b/arch/mips/include/asm/jump_label.h
index e77672539e8e..e4456e450f94 100644
--- a/arch/mips/include/asm/jump_label.h
+++ b/arch/mips/include/asm/jump_label.h
@@ -21,15 +21,15 @@
 #endif
 
 #ifdef CONFIG_CPU_MICROMIPS
-#define NOP_INSN "nop32"
+#define B_INSN "b32"
 #else
-#define NOP_INSN "nop"
+#define B_INSN "b"
 #endif
 
 static __always_inline bool arch_static_branch(struct static_key *key, bool branch)
 {
-        asm_volatile_goto("1:\t" NOP_INSN "\n\t"
-                "nop\n\t"
+        asm_volatile_goto("1:\t" B_INSN " 2f\n\t"
+                "2:\tnop\n\t"
                 ".pushsection __jump_table,  \"aw\"\n\t"
                 WORD_INSN " 1b, %l[l_yes], %0\n\t"
                 ".popsection\n\t"
diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h
index d2abd98471e8..41204a49cf95 100644
--- a/arch/mips/include/asm/kvm_host.h
+++ b/arch/mips/include/asm/kvm_host.h
@@ -1134,7 +1134,7 @@ static inline void kvm_arch_hardware_unsetup(void) {}
 static inline void kvm_arch_sync_events(struct kvm *kvm) {}
 static inline void kvm_arch_free_memslot(struct kvm *kvm,
                 struct kvm_memory_slot *free, struct kvm_memory_slot *dont) {}
-static inline void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots) {}
+static inline void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen) {}
 static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {}
 static inline void kvm_arch_vcpu_blocking(struct kvm_vcpu *vcpu) {}
 static inline void kvm_arch_vcpu_unblocking(struct kvm_vcpu *vcpu) {}
diff --git a/arch/mips/include/uapi/asm/Kbuild b/arch/mips/include/uapi/asm/Kbuild
index 0851c103a8ce..c3798bfe0486 100644
--- a/arch/mips/include/uapi/asm/Kbuild
+++ b/arch/mips/include/uapi/asm/Kbuild
@@ -1,5 +1,3 @@
-include include/uapi/asm-generic/Kbuild.asm
-
 generated-y += unistd_n32.h
 generated-y += unistd_n64.h
 generated-y += unistd_o32.h
diff --git a/arch/mips/include/uapi/asm/posix_types.h b/arch/mips/include/uapi/asm/posix_types.h
index 6aa49c10f88f..f0ccb5b90ce9 100644
--- a/arch/mips/include/uapi/asm/posix_types.h
+++ b/arch/mips/include/uapi/asm/posix_types.h
@@ -21,13 +21,6 @@
 typedef long            __kernel_daddr_t;
 #define __kernel_daddr_t __kernel_daddr_t
 
-#if (_MIPS_SZLONG == 32)
-typedef struct {
-        long    val[2];
-} __kernel_fsid_t;
-#define __kernel_fsid_t __kernel_fsid_t
-#endif
-
 #include <asm-generic/posix_types.h>
 
 #endif /* _ASM_POSIX_TYPES_H */
diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
index cb7e9ed7a453..33ee0d18fb0a 100644
--- a/arch/mips/kernel/vmlinux.lds.S
+++ b/arch/mips/kernel/vmlinux.lds.S
@@ -140,6 +140,13 @@ SECTIONS
         PERCPU_SECTION(1 << CONFIG_MIPS_L1_CACHE_SHIFT)
 #endif
 
+#ifdef CONFIG_MIPS_ELF_APPENDED_DTB
+        .appended_dtb : AT(ADDR(.appended_dtb) - LOAD_OFFSET) {
+                *(.appended_dtb)
+                KEEP(*(.appended_dtb))
+        }
+#endif
+
 #ifdef CONFIG_RELOCATABLE
         . = ALIGN(4);
 
@@ -164,11 +171,6 @@ SECTIONS
         __appended_dtb = .;
         /* leave space for appended DTB */
         . += 0x100000;
-#elif defined(CONFIG_MIPS_ELF_APPENDED_DTB)
-        .appended_dtb : AT(ADDR(.appended_dtb) - LOAD_OFFSET) {
-                *(.appended_dtb)
-                KEEP(*(.appended_dtb))
-        }
 #endif
         /*
          * Align to 64K in attempt to eliminate holes before the
diff --git a/arch/mips/loongson64/lemote-2f/irq.c b/arch/mips/loongson64/lemote-2f/irq.c
index 9e33e45aa17c..b213cecb8e3a 100644
--- a/arch/mips/loongson64/lemote-2f/irq.c
+++ b/arch/mips/loongson64/lemote-2f/irq.c
@@ -103,7 +103,7 @@ static struct irqaction ip6_irqaction = {
 static struct irqaction cascade_irqaction = {
         .handler = no_action,
         .name = "cascade",
-        .flags = IRQF_NO_THREAD,
+        .flags = IRQF_NO_THREAD | IRQF_NO_SUSPEND,
 };
 
 void __init mach_init_irq(void)
diff --git a/arch/nds32/include/uapi/asm/Kbuild b/arch/nds32/include/uapi/asm/Kbuild
index c1b06dcf6cf8..1c72f04ff75d 100644
--- a/arch/nds32/include/uapi/asm/Kbuild
+++ b/arch/nds32/include/uapi/asm/Kbuild
@@ -1,3 +1 @@
-include include/uapi/asm-generic/Kbuild.asm
-
 generic-y += ucontext.h
diff --git a/arch/nios2/include/uapi/asm/Kbuild b/arch/nios2/include/uapi/asm/Kbuild
index 0febf1a07c30..755bb11323d8 100644
--- a/arch/nios2/include/uapi/asm/Kbuild
+++ b/arch/nios2/include/uapi/asm/Kbuild
@@ -1,4 +1,2 @@
-include include/uapi/asm-generic/Kbuild.asm
-
 generic-y += kvm_para.h
 generic-y += ucontext.h
diff --git a/arch/openrisc/include/asm/Kbuild b/arch/openrisc/include/asm/Kbuild
index 1f04844b6b82..5a73e2956ac4 100644
--- a/arch/openrisc/include/asm/Kbuild
+++ b/arch/openrisc/include/asm/Kbuild
@@ -15,7 +15,6 @@ generic-y += fb.h
 generic-y += ftrace.h
 generic-y += hardirq.h
 generic-y += hw_irq.h
-generic-y += irq.h
 generic-y += irq_regs.h
 generic-y += irq_work.h
 generic-y += kdebug.h
@@ -35,7 +34,6 @@ generic-y += qrwlock.h
 generic-y += sections.h
 generic-y += segment.h
 generic-y += shmparam.h
-generic-y += string.h
 generic-y += switch_to.h
 generic-y += topology.h
 generic-y += trace_clock.h
diff --git a/arch/openrisc/include/uapi/asm/Kbuild b/arch/openrisc/include/uapi/asm/Kbuild
index 0febf1a07c30..755bb11323d8 100644
--- a/arch/openrisc/include/uapi/asm/Kbuild
+++ b/arch/openrisc/include/uapi/asm/Kbuild
@@ -1,4 +1,2 @@
-include include/uapi/asm-generic/Kbuild.asm
-
 generic-y += kvm_para.h
 generic-y += ucontext.h
diff --git a/arch/parisc/include/asm/Kbuild b/arch/parisc/include/asm/Kbuild
index 0b1e354c8c24..6f49e77d82a2 100644
--- a/arch/parisc/include/asm/Kbuild
+++ b/arch/parisc/include/asm/Kbuild
@@ -1,7 +1,6 @@
 generated-y += syscall_table_32.h
 generated-y += syscall_table_64.h
 generated-y += syscall_table_c32.h
-generic-y += barrier.h
 generic-y += current.h
 generic-y += device.h
 generic-y += div64.h
@@ -20,7 +19,6 @@ generic-y += percpu.h
 generic-y += preempt.h
 generic-y += seccomp.h
 generic-y += segment.h
-generic-y += topology.h
 generic-y += trace_clock.h
 generic-y += user.h
 generic-y += vga.h
diff --git a/arch/parisc/include/uapi/asm/Kbuild b/arch/parisc/include/uapi/asm/Kbuild
index c54353d390ff..22fdbd08cdc8 100644
--- a/arch/parisc/include/uapi/asm/Kbuild
+++ b/arch/parisc/include/uapi/asm/Kbuild
@@ -1,5 +1,3 @@
-include include/uapi/asm-generic/Kbuild.asm
-
 generated-y += unistd_32.h
 generated-y += unistd_64.h
 generic-y += kvm_para.h
diff --git a/arch/powerpc/configs/skiroot_defconfig b/arch/powerpc/configs/skiroot_defconfig
index cfdd08897a06..5ba131c30f6b 100644
--- a/arch/powerpc/configs/skiroot_defconfig
+++ b/arch/powerpc/configs/skiroot_defconfig
@@ -37,7 +37,8 @@ CONFIG_MODULE_SIG=y
 CONFIG_MODULE_SIG_FORCE=y
 CONFIG_MODULE_SIG_SHA512=y
 CONFIG_PARTITION_ADVANCED=y
-# CONFIG_IOSCHED_DEADLINE is not set
+# CONFIG_MQ_IOSCHED_DEADLINE is not set
+# CONFIG_MQ_IOSCHED_KYBER is not set
 # CONFIG_PPC_VAS is not set
 # CONFIG_PPC_PSERIES is not set
 # CONFIG_PPC_OF_BOOT_TRAMPOLINE is not set
@@ -49,7 +50,6 @@ CONFIG_IRQ_ALL_CPUS=y
 CONFIG_NUMA=y
 # CONFIG_COMPACTION is not set
 # CONFIG_MIGRATION is not set
-# CONFIG_BOUNCE is not set
 CONFIG_PPC_64K_PAGES=y
 CONFIG_SCHED_SMT=y
 CONFIG_CMDLINE_BOOL=y
@@ -136,9 +136,11 @@ CONFIG_ACENIC_OMIT_TIGON_I=y
 # CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_VENDOR_ATHEROS is not set
+# CONFIG_NET_VENDOR_AURORA is not set
 CONFIG_TIGON3=m
 CONFIG_BNX2X=m
 # CONFIG_NET_VENDOR_BROCADE is not set
+# CONFIG_NET_VENDOR_CADENCE is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_CAVIUM is not set
 CONFIG_CHELSIO_T1=m
@@ -151,6 +153,7 @@ CONFIG_BE2NET=m
 # CONFIG_NET_VENDOR_HP is not set
 # CONFIG_NET_VENDOR_HUAWEI is not set
 CONFIG_E1000=m
+CONFIG_E1000E=m
 CONFIG_IGB=m
 CONFIG_IXGB=m
 CONFIG_IXGBE=m
@@ -161,15 +164,18 @@ CONFIG_MLX4_EN=m
 # CONFIG_MLX4_CORE_GEN2 is not set
 CONFIG_MLX5_CORE=m
 # CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_MICROSEMI is not set
 CONFIG_MYRI10GE=m
 # CONFIG_NET_VENDOR_NATSEMI is not set
 # CONFIG_NET_VENDOR_NETRONOME is not set
 # CONFIG_NET_VENDOR_NI is not set
 # CONFIG_NET_VENDOR_NVIDIA is not set
 # CONFIG_NET_VENDOR_OKI is not set
-# CONFIG_NET_PACKET_ENGINE is not set
+# CONFIG_NET_VENDOR_PACKET_ENGINES is not set
 CONFIG_QLGE=m
 CONFIG_NETXEN_NIC=m
+CONFIG_QED=m
+CONFIG_QEDE=m
 # CONFIG_NET_VENDOR_QUALCOMM is not set
 # CONFIG_NET_VENDOR_RDC is not set
 # CONFIG_NET_VENDOR_REALTEK is not set
diff --git a/arch/powerpc/include/asm/Kbuild b/arch/powerpc/include/asm/Kbuild
index 77ff7fb24823..a0c132bedfae 100644
--- a/arch/powerpc/include/asm/Kbuild
+++ b/arch/powerpc/include/asm/Kbuild
@@ -5,7 +5,6 @@ generated-y += syscall_table_spu.h
 generic-y += div64.h
 generic-y += export.h
 generic-y += irq_regs.h
-generic-y += irq_work.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
 generic-y += preempt.h
diff --git a/arch/powerpc/include/asm/book3s/64/hugetlb.h b/arch/powerpc/include/asm/book3s/64/hugetlb.h
index 66c1e4f88d65..ec2a55a553c7 100644
--- a/arch/powerpc/include/asm/book3s/64/hugetlb.h
+++ b/arch/powerpc/include/asm/book3s/64/hugetlb.h
@@ -39,6 +39,14 @@ static inline int hstate_get_psize(struct hstate *hstate)
 #ifdef CONFIG_ARCH_HAS_GIGANTIC_PAGE
 static inline bool gigantic_page_supported(void)
 {
+        /*
+         * We used gigantic page reservation with hypervisor assist in some case.
+         * We cannot use runtime allocation of gigantic pages in those platforms
+         * This is hash translation mode LPARs.
+         */
+        if (firmware_has_feature(FW_FEATURE_LPAR) && !radix_enabled())
+                return false;
+
         return true;
 }
 #endif
diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h
index 0f98f00da2ea..e6b5bb012ccb 100644
--- a/arch/powerpc/include/asm/kvm_host.h
+++ b/arch/powerpc/include/asm/kvm_host.h
@@ -99,6 +99,8 @@ struct kvm_nested_guest;
 
 struct kvm_vm_stat {
         ulong remote_tlb_flush;
+        ulong num_2M_pages;
+        ulong num_1G_pages;
 };
 
 struct kvm_vcpu_stat {
@@ -377,6 +379,7 @@ struct kvmppc_mmu {
         void (*slbmte)(struct kvm_vcpu *vcpu, u64 rb, u64 rs);
         u64  (*slbmfee)(struct kvm_vcpu *vcpu, u64 slb_nr);
         u64  (*slbmfev)(struct kvm_vcpu *vcpu, u64 slb_nr);
+        int  (*slbfee)(struct kvm_vcpu *vcpu, gva_t eaddr, ulong *ret_slb);
         void (*slbie)(struct kvm_vcpu *vcpu, u64 slb_nr);
         void (*slbia)(struct kvm_vcpu *vcpu);
         /* book3s */
@@ -837,7 +840,7 @@ struct kvm_vcpu_arch {
 static inline void kvm_arch_hardware_disable(void) {}
 static inline void kvm_arch_hardware_unsetup(void) {}
 static inline void kvm_arch_sync_events(struct kvm *kvm) {}
-static inline void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots) {}
+static inline void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen) {}
 static inline void kvm_arch_flush_shadow_all(struct kvm *kvm) {}
 static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {}
 static inline void kvm_arch_exit(void) {}
diff --git a/arch/powerpc/include/asm/kvm_ppc.h b/arch/powerpc/include/asm/kvm_ppc.h
index a6c8548ed9fa..ac22b28ae78d 100644
--- a/arch/powerpc/include/asm/kvm_ppc.h
+++ b/arch/powerpc/include/asm/kvm_ppc.h
@@ -36,6 +36,8 @@
 #endif
 #ifdef CONFIG_KVM_BOOK3S_64_HANDLER
 #include <asm/paca.h>
+#include <asm/xive.h>
+#include <asm/cpu_has_feature.h>
 #endif
 
 /*
@@ -617,6 +619,18 @@ static inline int kvmppc_xive_set_irq(struct kvm *kvm, int irq_source_id, u32 ir
 static inline void kvmppc_xive_push_vcpu(struct kvm_vcpu *vcpu) { }
 #endif /* CONFIG_KVM_XIVE */
 
+#if defined(CONFIG_PPC_POWERNV) && defined(CONFIG_KVM_BOOK3S_64_HANDLER)
+static inline bool xics_on_xive(void)
+{
+        return xive_enabled() && cpu_has_feature(CPU_FTR_HVMODE);
+}
+#else
+static inline bool xics_on_xive(void)
+{
+        return false;
+}
+#endif
+
 /*
  * Prototypes for functions called only from assembler code.
  * Having prototypes reduces sparse errors.
diff --git a/arch/powerpc/include/asm/mmu.h b/arch/powerpc/include/asm/mmu.h
index d34ad1657d7b..598cdcdd1355 100644
--- a/arch/powerpc/include/asm/mmu.h
+++ b/arch/powerpc/include/asm/mmu.h
@@ -352,7 +352,7 @@ static inline bool strict_kernel_rwx_enabled(void)
 #if defined(CONFIG_SPARSEMEM_VMEMMAP) && defined(CONFIG_SPARSEMEM_EXTREME) &&   \
         defined (CONFIG_PPC_64K_PAGES)
 #define MAX_PHYSMEM_BITS        51
-#else
+#elif defined(CONFIG_SPARSEMEM)
 #define MAX_PHYSMEM_BITS        46
 #endif
 
diff --git a/arch/powerpc/include/asm/vdso_datapage.h b/arch/powerpc/include/asm/vdso_datapage.h
index 1afe90ade595..bbc06bd72b1f 100644
--- a/arch/powerpc/include/asm/vdso_datapage.h
+++ b/arch/powerpc/include/asm/vdso_datapage.h
@@ -82,10 +82,10 @@ struct vdso_data {
         __u32 icache_block_size;                /* L1 i-cache block size     */
         __u32 dcache_log_block_size;            /* L1 d-cache log block size */
         __u32 icache_log_block_size;            /* L1 i-cache log block size */
-        __s32 wtom_clock_sec;                   /* Wall to monotonic clock */
-        __s32 wtom_clock_nsec;
-        struct timespec stamp_xtime;    /* xtime as at tb_orig_stamp */
-        __u32 stamp_sec_fraction;       /* fractional seconds of stamp_xtime */
+        __u32 stamp_sec_fraction;               /* fractional seconds of stamp_xtime */
+        __s32 wtom_clock_nsec;                  /* Wall to monotonic clock nsec */
+        __s64 wtom_clock_sec;                   /* Wall to monotonic clock sec */
+        struct timespec stamp_xtime;            /* xtime as at tb_orig_stamp */
         __u32 syscall_map_64[SYSCALL_MAP_SIZE]; /* map of syscalls  */
         __u32 syscall_map_32[SYSCALL_MAP_SIZE]; /* map of syscalls */
 };
diff --git a/arch/powerpc/include/uapi/asm/Kbuild b/arch/powerpc/include/uapi/asm/Kbuild
index 214a39acdf25..2bd5b392277c 100644
--- a/arch/powerpc/include/uapi/asm/Kbuild
+++ b/arch/powerpc/include/uapi/asm/Kbuild
@@ -1,4 +1,2 @@
-include include/uapi/asm-generic/Kbuild.asm
-
 generated-y += unistd_32.h
 generated-y += unistd_64.h
diff --git a/arch/powerpc/include/uapi/asm/kvm.h b/arch/powerpc/include/uapi/asm/kvm.h
index 8c876c166ef2..26ca425f4c2c 100644
--- a/arch/powerpc/include/uapi/asm/kvm.h
+++ b/arch/powerpc/include/uapi/asm/kvm.h
@@ -463,10 +463,12 @@ struct kvm_ppc_cpu_char {
 #define KVM_PPC_CPU_CHAR_BR_HINT_HONOURED       (1ULL << 58)
 #define KVM_PPC_CPU_CHAR_MTTRIG_THR_RECONF      (1ULL << 57)
 #define KVM_PPC_CPU_CHAR_COUNT_CACHE_DIS        (1ULL << 56)
+#define KVM_PPC_CPU_CHAR_BCCTR_FLUSH_ASSIST     (1ull << 54)
 
 #define KVM_PPC_CPU_BEHAV_FAVOUR_SECURITY       (1ULL << 63)
 #define KVM_PPC_CPU_BEHAV_L1D_FLUSH_PR          (1ULL << 62)
 #define KVM_PPC_CPU_BEHAV_BNDS_CHK_SPEC_BAR     (1ULL << 61)
+#define KVM_PPC_CPU_BEHAV_FLUSH_COUNT_CACHE     (1ull << 58)
 
 /* Per-vcpu XICS interrupt controller state */
 #define KVM_REG_PPC_ICP_STATE   (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0x8c)
diff --git a/arch/powerpc/kernel/cpu_setup_6xx.S b/arch/powerpc/kernel/cpu_setup_6xx.S
index 6f1c11e0691f..7534ecff5e92 100644
--- a/arch/powerpc/kernel/cpu_setup_6xx.S
+++ b/arch/powerpc/kernel/cpu_setup_6xx.S
@@ -24,9 +24,6 @@ BEGIN_MMU_FTR_SECTION
         li      r10,0
         mtspr   SPRN_SPRG_603_LRU,r10           /* init SW LRU tracking */
 END_MMU_FTR_SECTION_IFSET(MMU_FTR_NEED_DTLB_SW_LRU)
-        lis     r10, (swapper_pg_dir - PAGE_OFFSET)@h
-        ori     r10, r10, (swapper_pg_dir - PAGE_OFFSET)@l
-        mtspr   SPRN_SPRG_PGDIR, r10
 
 BEGIN_FTR_SECTION
         bl      __init_fpu_registers
diff --git a/arch/powerpc/kernel/head_32.S b/arch/powerpc/kernel/head_32.S
index ce6a972f2584..48051c8977c5 100644
--- a/arch/powerpc/kernel/head_32.S
+++ b/arch/powerpc/kernel/head_32.S
@@ -855,6 +855,9 @@ __secondary_start:
         li      r3,0
         stw     r3, RTAS_SP(r4)         /* 0 => not in RTAS */
 #endif
+        lis     r4, (swapper_pg_dir - PAGE_OFFSET)@h
+        ori     r4, r4, (swapper_pg_dir - PAGE_OFFSET)@l
+        mtspr   SPRN_SPRG_PGDIR, r4
 
         /* enable MMU and jump to start_secondary */
         li      r4,MSR_KERNEL
@@ -942,6 +945,9 @@ start_here:
         li      r3,0
         stw     r3, RTAS_SP(r4)         /* 0 => not in RTAS */
 #endif
+        lis     r4, (swapper_pg_dir - PAGE_OFFSET)@h
+        ori     r4, r4, (swapper_pg_dir - PAGE_OFFSET)@l
+        mtspr   SPRN_SPRG_PGDIR, r4
 
         /* stack */
         lis     r1,init_thread_union@ha
diff --git a/arch/powerpc/kernel/head_fsl_booke.S b/arch/powerpc/kernel/head_fsl_booke.S
index 1881127682e9..32332e24e421 100644
--- a/arch/powerpc/kernel/head_fsl_booke.S
+++ b/arch/powerpc/kernel/head_fsl_booke.S
@@ -194,13 +194,6 @@ set_ivor:
 #endif
         mtspr   SPRN_MAS4, r2
 
-#if 0
-        /* Enable DOZE */
-        mfspr   r2,SPRN_HID0
-        oris    r2,r2,HID0_DOZE@h
-        mtspr   SPRN_HID0, r2
-#endif
-
 #if !defined(CONFIG_BDI_SWITCH)
         /*
          * The Abatron BDI JTAG debugger does not tolerate others
diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c
index 9b8631533e02..b33bafb8fcea 100644
--- a/arch/powerpc/kernel/security.c
+++ b/arch/powerpc/kernel/security.c
@@ -190,29 +190,22 @@ ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, c
         bcs = security_ftr_enabled(SEC_FTR_BCCTRL_SERIALISED);
         ccd = security_ftr_enabled(SEC_FTR_COUNT_CACHE_DISABLED);
 
-        if (bcs || ccd || count_cache_flush_type != COUNT_CACHE_FLUSH_NONE) {
-                bool comma = false;
+        if (bcs || ccd) {
                 seq_buf_printf(&s, "Mitigation: ");
 
-                if (bcs) {
+                if (bcs)
                         seq_buf_printf(&s, "Indirect branch serialisation (kernel only)");
-                        comma = true;
-                }
 
-                if (ccd) {
-                        if (comma)
-                                seq_buf_printf(&s, ", ");
-                        seq_buf_printf(&s, "Indirect branch cache disabled");
-                        comma = true;
-                }
-
-                if (comma)
+                if (bcs && ccd)
                         seq_buf_printf(&s, ", ");
 
-                seq_buf_printf(&s, "Software count cache flush");
+                if (ccd)
+                        seq_buf_printf(&s, "Indirect branch cache disabled");
+        } else if (count_cache_flush_type != COUNT_CACHE_FLUSH_NONE) {
+                seq_buf_printf(&s, "Mitigation: Software count cache flush");
 
                 if (count_cache_flush_type == COUNT_CACHE_FLUSH_HW)
-                        seq_buf_printf(&s, "(hardware accelerated)");
+                        seq_buf_printf(&s, " (hardware accelerated)");
         } else if (btb_flush_enabled) {
                 seq_buf_printf(&s, "Mitigation: Branch predictor state flush");
         } else {
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index a21200c6aaea..1fd45a8650e1 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -71,6 +71,7 @@
 #include <sysdev/fsl_pci.h>
 #include <asm/kprobes.h>
 #include <asm/stacktrace.h>
+#include <asm/nmi.h>
 
 #if defined(CONFIG_DEBUGGER) || defined(CONFIG_KEXEC_CORE)
 int (*__debugger)(struct pt_regs *regs) __read_mostly;
diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S
index a4ed9edfd5f0..1f324c28705b 100644
--- a/arch/powerpc/kernel/vdso64/gettimeofday.S
+++ b/arch/powerpc/kernel/vdso64/gettimeofday.S
@@ -92,7 +92,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime)
          * At this point, r4,r5 contain our sec/nsec values.
          */
 
-        lwa     r6,WTOM_CLOCK_SEC(r3)
+        ld      r6,WTOM_CLOCK_SEC(r3)
         lwa     r9,WTOM_CLOCK_NSEC(r3)
 
         /* We now have our result in r6,r9. We create a fake dependency
@@ -125,7 +125,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime)
         bne     cr6,75f
 
         /* CLOCK_MONOTONIC_COARSE */
-        lwa     r6,WTOM_CLOCK_SEC(r3)
+        ld      r6,WTOM_CLOCK_SEC(r3)
         lwa     r9,WTOM_CLOCK_NSEC(r3)
 
         /* check if counter has updated */
diff --git a/arch/powerpc/kvm/book3s.c b/arch/powerpc/kvm/book3s.c
index 9a7dadbe1f17..10c5579d20ce 100644
--- a/arch/powerpc/kvm/book3s.c
+++ b/arch/powerpc/kvm/book3s.c
@@ -39,6 +39,7 @@
 #include "book3s.h"
 #include "trace.h"
 
+#define VM_STAT(x) offsetof(struct kvm, stat.x), KVM_STAT_VM
 #define VCPU_STAT(x) offsetof(struct kvm_vcpu, stat.x), KVM_STAT_VCPU
 
 /* #define EXIT_DEBUG */
@@ -71,6 +72,8 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
         { "pthru_all",       VCPU_STAT(pthru_all) },
         { "pthru_host",      VCPU_STAT(pthru_host) },
         { "pthru_bad_aff",   VCPU_STAT(pthru_bad_aff) },
+        { "largepages_2M",    VM_STAT(num_2M_pages) },
+        { "largepages_1G",    VM_STAT(num_1G_pages) },
         { NULL }
 };
 
@@ -642,7 +645,7 @@ int kvmppc_get_one_reg(struct kvm_vcpu *vcpu, u64 id,
                                 r = -ENXIO;
                                 break;
                         }
-                        if (xive_enabled())
+                        if (xics_on_xive())
                                 *val = get_reg_val(id, kvmppc_xive_get_icp(vcpu));
                         else
                                 *val = get_reg_val(id, kvmppc_xics_get_icp(vcpu));
@@ -715,7 +718,7 @@ int kvmppc_set_one_reg(struct kvm_vcpu *vcpu, u64 id,
                                 r = -ENXIO;
                                 break;
                         }
-                        if (xive_enabled())
+                        if (xics_on_xive())
                                 r = kvmppc_xive_set_icp(vcpu, set_reg_val(id, *val));
                         else
                                 r = kvmppc_xics_set_icp(vcpu, set_reg_val(id, *val));
@@ -991,7 +994,7 @@ int kvmppc_book3s_hcall_implemented(struct kvm *kvm, unsigned long hcall)
 int kvm_set_irq(struct kvm *kvm, int irq_source_id, u32 irq, int level,
                 bool line_status)
 {
-        if (xive_enabled())
+        if (xics_on_xive())
                 return kvmppc_xive_set_irq(kvm, irq_source_id, irq, level,
                                            line_status);
         else
@@ -1044,7 +1047,7 @@ static int kvmppc_book3s_init(void)
 
 #ifdef CONFIG_KVM_XICS
 #ifdef CONFIG_KVM_XIVE
-        if (xive_enabled()) {
+        if (xics_on_xive()) {
                 kvmppc_xive_init_module();
                 kvm_register_device_ops(&kvm_xive_ops, KVM_DEV_TYPE_XICS);
         } else
@@ -1057,7 +1060,7 @@ static int kvmppc_book3s_init(void)
 static void kvmppc_book3s_exit(void)
 {
 #ifdef CONFIG_KVM_XICS
-        if (xive_enabled())
+        if (xics_on_xive())
                 kvmppc_xive_exit_module();
 #endif
 #ifdef CONFIG_KVM_BOOK3S_32_HANDLER
diff --git a/arch/powerpc/kvm/book3s_32_mmu.c b/arch/powerpc/kvm/book3s_32_mmu.c
index 612169988a3d..6f789f674048 100644
--- a/arch/powerpc/kvm/book3s_32_mmu.c
+++ b/arch/powerpc/kvm/book3s_32_mmu.c
@@ -425,6 +425,7 @@ void kvmppc_mmu_book3s_32_init(struct kvm_vcpu *vcpu)
         mmu->slbmte = NULL;
         mmu->slbmfee = NULL;
         mmu->slbmfev = NULL;
+        mmu->slbfee = NULL;
         mmu->slbie = NULL;
         mmu->slbia = NULL;
 }
diff --git a/arch/powerpc/kvm/book3s_64_mmu.c b/arch/powerpc/kvm/book3s_64_mmu.c
index c92dd25bed23..d4b967f0e8d4 100644
--- a/arch/powerpc/kvm/book3s_64_mmu.c
+++ b/arch/powerpc/kvm/book3s_64_mmu.c
@@ -435,6 +435,19 @@ static void kvmppc_mmu_book3s_64_slbmte(struct kvm_vcpu *vcpu, u64 rs, u64 rb)
         kvmppc_mmu_map_segment(vcpu, esid << SID_SHIFT);
 }
 
+static int kvmppc_mmu_book3s_64_slbfee(struct kvm_vcpu *vcpu, gva_t eaddr,
+                                       ulong *ret_slb)
+{
+        struct kvmppc_slb *slbe = kvmppc_mmu_book3s_64_find_slbe(vcpu, eaddr);
+
+        if (slbe) {
+                *ret_slb = slbe->origv;
+                return 0;
+        }
+        *ret_slb = 0;
+        return -ENOENT;
+}
+
 static u64 kvmppc_mmu_book3s_64_slbmfee(struct kvm_vcpu *vcpu, u64 slb_nr)
 {
         struct kvmppc_slb *slbe;
@@ -670,6 +683,7 @@ void kvmppc_mmu_book3s_64_init(struct kvm_vcpu *vcpu)
         mmu->slbmte = kvmppc_mmu_book3s_64_slbmte;
         mmu->slbmfee = kvmppc_mmu_book3s_64_slbmfee;
         mmu->slbmfev = kvmppc_mmu_book3s_64_slbmfev;
+        mmu->slbfee = kvmppc_mmu_book3s_64_slbfee;
         mmu->slbie = kvmppc_mmu_book3s_64_slbie;
         mmu->slbia = kvmppc_mmu_book3s_64_slbia;
         mmu->xlate = kvmppc_mmu_book3s_64_xlate;
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index bd2dcfbf00cd..be7bc070eae5 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -442,6 +442,24 @@ int kvmppc_hv_emulate_mmio(struct kvm_run *run, struct kvm_vcpu *vcpu,
         u32 last_inst;
 
         /*
+         * Fast path - check if the guest physical address corresponds to a
+         * device on the FAST_MMIO_BUS, if so we can avoid loading the
+         * instruction all together, then we can just handle it and return.
+         */
+        if (is_store) {
+                int idx, ret;
+
+                idx = srcu_read_lock(&vcpu->kvm->srcu);
+                ret = kvm_io_bus_write(vcpu, KVM_FAST_MMIO_BUS, (gpa_t) gpa, 0,
+                                       NULL);
+                srcu_read_unlock(&vcpu->kvm->srcu, idx);
+                if (!ret) {
+                        kvmppc_set_pc(vcpu, kvmppc_get_pc(vcpu) + 4);
+                        return RESUME_GUEST;
+                }
+        }
+
+        /*
          * If we fail, we just return to the guest and try executing it again.
          */
         if (kvmppc_get_last_inst(vcpu, INST_GENERIC, &last_inst) !=
diff --git a/arch/powerpc/kvm/book3s_64_mmu_radix.c b/arch/powerpc/kvm/book3s_64_mmu_radix.c
index 1b821c6efdef..f55ef071883f 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_radix.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_radix.c
@@ -403,8 +403,13 @@ void kvmppc_unmap_pte(struct kvm *kvm, pte_t *pte, unsigned long gpa,
                 if (!memslot)
                         return;
         }
-        if (shift)
+        if (shift) { /* 1GB or 2MB page */
                 page_size = 1ul << shift;
+                if (shift == PMD_SHIFT)
+                        kvm->stat.num_2M_pages--;
+                else if (shift == PUD_SHIFT)
+                        kvm->stat.num_1G_pages--;
+        }
 
         gpa &= ~(page_size - 1);
         hpa = old & PTE_RPN_MASK;
@@ -878,6 +883,14 @@ int kvmppc_book3s_instantiate_page(struct kvm_vcpu *vcpu,
                 put_page(page);
         }
 
+        /* Increment number of large pages if we (successfully) inserted one */
+        if (!ret) {
+                if (level == 1)
+                        kvm->stat.num_2M_pages++;
+                else if (level == 2)
+                        kvm->stat.num_1G_pages++;
+        }
+
         return ret;
 }
 
diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
index 532ab79734c7..f02b04973710 100644
--- a/arch/powerpc/kvm/book3s_64_vio.c
+++ b/arch/powerpc/kvm/book3s_64_vio.c
@@ -133,7 +133,6 @@ extern void kvm_spapr_tce_release_iommu_group(struct kvm *kvm,
                                         continue;
 
                                 kref_put(&stit->kref, kvm_spapr_tce_liobn_put);
-                                return;
                         }
                 }
         }
@@ -338,14 +337,15 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm,
                 }
         }
 
+        kvm_get_kvm(kvm);
         if (!ret)
                 ret = anon_inode_getfd("kvm-spapr-tce", &kvm_spapr_tce_fops,
                                        stt, O_RDWR | O_CLOEXEC);
 
-        if (ret >= 0) {
+        if (ret >= 0)
                 list_add_rcu(&stt->list, &kvm->arch.spapr_tce_tables);
-                kvm_get_kvm(kvm);
-        }
+        else
+                kvm_put_kvm(kvm);
 
         mutex_unlock(&kvm->lock);
 
diff --git a/arch/powerpc/kvm/book3s_emulate.c b/arch/powerpc/kvm/book3s_emulate.c
index 8c7e933e942e..6ef7c5f00a49 100644
--- a/arch/powerpc/kvm/book3s_emulate.c
+++ b/arch/powerpc/kvm/book3s_emulate.c
@@ -47,6 +47,7 @@
 #define OP_31_XOP_SLBMFEV       851
 #define OP_31_XOP_EIOIO         854
 #define OP_31_XOP_SLBMFEE       915
+#define OP_31_XOP_SLBFEE        979
 
 #define OP_31_XOP_TBEGIN        654
 #define OP_31_XOP_TABORT        910
@@ -416,6 +417,23 @@ int kvmppc_core_emulate_op_pr(struct kvm_run *run, struct kvm_vcpu *vcpu,
 
                         vcpu->arch.mmu.slbia(vcpu);
                         break;
+                case OP_31_XOP_SLBFEE:
+                        if (!(inst & 1) || !vcpu->arch.mmu.slbfee) {
+                                return EMULATE_FAIL;
+                        } else {
+                                ulong b, t;
+                                ulong cr = kvmppc_get_cr(vcpu) & ~CR0_MASK;
+
+                                b = kvmppc_get_gpr(vcpu, rb);
+                                if (!vcpu->arch.mmu.slbfee(vcpu, b, &t))
+                                        cr |= 2 << CR0_SHIFT;
+                                kvmppc_set_gpr(vcpu, rt, t);
+                                /* copy XER[SO] bit to CR0[SO] */
+                                cr |= (vcpu->arch.regs.xer & 0x80000000) >>
+                                        (31 - CR0_SHIFT);
+                                kvmppc_set_cr(vcpu, cr);
+                        }
+                        break;
                 case OP_31_XOP_SLBMFEE:
                         if (!vcpu->arch.mmu.slbmfee) {
                                 emulated = EMULATE_FAIL;
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index a3d5318f5d1e..06964350b97a 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -922,7 +922,7 @@ int kvmppc_pseries_do_hcall(struct kvm_vcpu *vcpu)
         case H_IPOLL:
         case H_XIRR_X:
                 if (kvmppc_xics_enabled(vcpu)) {
-                        if (xive_enabled()) {
+                        if (xics_on_xive()) {
                                 ret = H_NOT_AVAILABLE;
                                 return RESUME_GUEST;
                         }
@@ -937,6 +937,7 @@ int kvmppc_pseries_do_hcall(struct kvm_vcpu *vcpu)
                 ret = kvmppc_h_set_xdabr(vcpu, kvmppc_get_gpr(vcpu, 4),
                                                 kvmppc_get_gpr(vcpu, 5));
                 break;
+#ifdef CONFIG_SPAPR_TCE_IOMMU
         case H_GET_TCE:
                 ret = kvmppc_h_get_tce(vcpu, kvmppc_get_gpr(vcpu, 4),
                                                 kvmppc_get_gpr(vcpu, 5));
@@ -966,6 +967,7 @@ int kvmppc_pseries_do_hcall(struct kvm_vcpu *vcpu)
                 if (ret == H_TOO_HARD)
                         return RESUME_HOST;
                 break;
+#endif
         case H_RANDOM:
                 if (!powernv_get_random_long(&vcpu->arch.regs.gpr[4]))
                         ret = H_HARDWARE;
@@ -1445,7 +1447,7 @@ static int kvmppc_handle_nested_exit(struct kvm_run *run, struct kvm_vcpu *vcpu)
         case BOOK3S_INTERRUPT_HV_RM_HARD:
                 vcpu->arch.trap = 0;
                 r = RESUME_GUEST;
-                if (!xive_enabled())
+                if (!xics_on_xive())
                         kvmppc_xics_rm_complete(vcpu, 0);
                 break;
         default:
@@ -3648,11 +3650,12 @@ static void kvmppc_wait_for_exec(struct kvmppc_vcore *vc,
 
 static void grow_halt_poll_ns(struct kvmppc_vcore *vc)
 {
-        /* 10us base */
-        if (vc->halt_poll_ns == 0 && halt_poll_ns_grow)
-                vc->halt_poll_ns = 10000;
-        else
-                vc->halt_poll_ns *= halt_poll_ns_grow;
+        if (!halt_poll_ns_grow)
+                return;
+
+        vc->halt_poll_ns *= halt_poll_ns_grow;
+        if (vc->halt_poll_ns < halt_poll_ns_grow_start)
+                vc->halt_poll_ns = halt_poll_ns_grow_start;
 }
 
 static void shrink_halt_poll_ns(struct kvmppc_vcore *vc)
@@ -3666,7 +3669,7 @@ static void shrink_halt_poll_ns(struct kvmppc_vcore *vc)
 #ifdef CONFIG_KVM_XICS
 static inline bool xive_interrupt_pending(struct kvm_vcpu *vcpu)
 {
-        if (!xive_enabled())
+        if (!xics_on_xive())
                 return false;
         return vcpu->arch.irq_pending || vcpu->arch.xive_saved_state.pipr <
                 vcpu->arch.xive_saved_state.cppr;
@@ -4226,7 +4229,7 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu)
                                 vcpu->arch.fault_dar, vcpu->arch.fault_dsisr);
                         srcu_read_unlock(&kvm->srcu, srcu_idx);
                 } else if (r == RESUME_PASSTHROUGH) {
-                        if (WARN_ON(xive_enabled()))
+                        if (WARN_ON(xics_on_xive()))
                                 r = H_SUCCESS;
                         else
                                 r = kvmppc_xics_rm_complete(vcpu, 0);
@@ -4750,7 +4753,7 @@ static int kvmppc_core_init_vm_hv(struct kvm *kvm)
                  * If xive is enabled, we route 0x500 interrupts directly
                  * to the guest.
                  */
-                if (xive_enabled())
+                if (xics_on_xive())
                         lpcr |= LPCR_LPES;
         }
 
@@ -4986,7 +4989,7 @@ static int kvmppc_set_passthru_irq(struct kvm *kvm, int host_irq, int guest_gsi)
         if (i == pimap->n_mapped)
                 pimap->n_mapped++;
 
-        if (xive_enabled())
+        if (xics_on_xive())
                 rc = kvmppc_xive_set_mapped(kvm, guest_gsi, desc);
         else
                 kvmppc_xics_set_mapped(kvm, guest_gsi, desc->irq_data.hwirq);
@@ -5027,7 +5030,7 @@ static int kvmppc_clr_passthru_irq(struct kvm *kvm, int host_irq, int guest_gsi)
                 return -ENODEV;
         }
 
-        if (xive_enabled())
+        if (xics_on_xive())
                 rc = kvmppc_xive_clr_mapped(kvm, guest_gsi, pimap->mapped[i].desc);
         else
                 kvmppc_xics_clr_mapped(kvm, guest_gsi, pimap->mapped[i].r_hwirq);
@@ -5359,13 +5362,11 @@ static int kvm_init_subcore_bitmap(void)
                         continue;
 
                 sibling_subcore_state =
-                        kmalloc_node(sizeof(struct sibling_subcore_state),
+                        kzalloc_node(sizeof(struct sibling_subcore_state),
                                                         GFP_KERNEL, node);
                 if (!sibling_subcore_state)
                         return -ENOMEM;
 
-                memset(sibling_subcore_state, 0,
-                                sizeof(struct sibling_subcore_state));
 
                 for (j = 0; j < threads_per_core; j++) {
                         int cpu = first_cpu + j;
@@ -5406,7 +5407,7 @@ static int kvmppc_book3s_init_hv(void)
          * indirectly, via OPAL.
          */
 #ifdef CONFIG_SMP
-        if (!xive_enabled() && !kvmhv_on_pseries() &&
+        if (!xics_on_xive() && !kvmhv_on_pseries() &&
             !local_paca->kvm_hstate.xics_phys) {
                 struct device_node *np;
 
diff --git a/arch/powerpc/kvm/book3s_hv_builtin.c b/arch/powerpc/kvm/book3s_hv_builtin.c
index a71e2fc00a4e..b0cf22477e87 100644
--- a/arch/powerpc/kvm/book3s_hv_builtin.c
+++ b/arch/powerpc/kvm/book3s_hv_builtin.c
@@ -257,7 +257,7 @@ void kvmhv_rm_send_ipi(int cpu)
         }
 
         /* We should never reach this */
-        if (WARN_ON_ONCE(xive_enabled()))
+        if (WARN_ON_ONCE(xics_on_xive()))
             return;
 
         /* Else poke the target with an IPI */
@@ -577,7 +577,7 @@ unsigned long kvmppc_rm_h_xirr(struct kvm_vcpu *vcpu)
 {
         if (!kvmppc_xics_enabled(vcpu))
                 return H_TOO_HARD;
-        if (xive_enabled()) {
+        if (xics_on_xive()) {
                 if (is_rm())
                         return xive_rm_h_xirr(vcpu);
                 if (unlikely(!__xive_vm_h_xirr))
@@ -592,7 +592,7 @@ unsigned long kvmppc_rm_h_xirr_x(struct kvm_vcpu *vcpu)
         if (!kvmppc_xics_enabled(vcpu))
                 return H_TOO_HARD;
         vcpu->arch.regs.gpr[5] = get_tb();
-        if (xive_enabled()) {
+        if (xics_on_xive()) {
                 if (is_rm())
                         return xive_rm_h_xirr(vcpu);
                 if (unlikely(!__xive_vm_h_xirr))
@@ -606,7 +606,7 @@ unsigned long kvmppc_rm_h_ipoll(struct kvm_vcpu *vcpu, unsigned long server)
 {
         if (!kvmppc_xics_enabled(vcpu))
                 return H_TOO_HARD;
-        if (xive_enabled()) {
+        if (xics_on_xive()) {
                 if (is_rm())
                         return xive_rm_h_ipoll(vcpu, server);
                 if (unlikely(!__xive_vm_h_ipoll))
@@ -621,7 +621,7 @@ int kvmppc_rm_h_ipi(struct kvm_vcpu *vcpu, unsigned long server,
 {
         if (!kvmppc_xics_enabled(vcpu))
                 return H_TOO_HARD;
-        if (xive_enabled()) {
+        if (xics_on_xive()) {
                 if (is_rm())
                         return xive_rm_h_ipi(vcpu, server, mfrr);
                 if (unlikely(!__xive_vm_h_ipi))
@@ -635,7 +635,7 @@ int kvmppc_rm_h_cppr(struct kvm_vcpu *vcpu, unsigned long cppr)
 {
         if (!kvmppc_xics_enabled(vcpu))
                 return H_TOO_HARD;
-        if (xive_enabled()) {
+        if (xics_on_xive()) {
                 if (is_rm())
                         return xive_rm_h_cppr(vcpu, cppr);
                 if (unlikely(!__xive_vm_h_cppr))
@@ -649,7 +649,7 @@ int kvmppc_rm_h_eoi(struct kvm_vcpu *vcpu, unsigned long xirr)
 {
         if (!kvmppc_xics_enabled(vcpu))
                 return H_TOO_HARD;
-        if (xive_enabled()) {
+        if (xics_on_xive()) {
                 if (is_rm())
                         return xive_rm_h_eoi(vcpu, xirr);
                 if (unlikely(!__xive_vm_h_eoi))
diff --git a/arch/powerpc/kvm/book3s_hv_rm_xics.c b/arch/powerpc/kvm/book3s_hv_rm_xics.c
index b3f5786b20dc..3b9662a4207e 100644
--- a/arch/powerpc/kvm/book3s_hv_rm_xics.c
+++ b/arch/powerpc/kvm/book3s_hv_rm_xics.c
@@ -144,6 +144,13 @@ static void icp_rm_set_vcpu_irq(struct kvm_vcpu *vcpu,
                 return;
         }
 
+        if (xive_enabled() && kvmhv_on_pseries()) {
+                /* No XICS access or hypercalls available, too hard */
+                this_icp->rm_action |= XICS_RM_KICK_VCPU;
+                this_icp->rm_kick_target = vcpu;
+                return;
+        }
+
         /*
          * Check if the core is loaded,
          * if not, find an available host core to post to wake the VCPU,
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index 25043b50cb30..3a5e719ef032 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -2272,8 +2272,13 @@ hcall_real_table:
         .long   DOTSYM(kvmppc_h_clear_mod) - hcall_real_table
         .long   DOTSYM(kvmppc_h_clear_ref) - hcall_real_table
         .long   DOTSYM(kvmppc_h_protect) - hcall_real_table
+#ifdef CONFIG_SPAPR_TCE_IOMMU
         .long   DOTSYM(kvmppc_h_get_tce) - hcall_real_table
         .long   DOTSYM(kvmppc_rm_h_put_tce) - hcall_real_table
+#else
+        .long   0               /* 0x1c */
+        .long   0               /* 0x20 */
+#endif
         .long   0               /* 0x24 - H_SET_SPRG0 */
         .long   DOTSYM(kvmppc_h_set_dabr) - hcall_real_table
         .long   0               /* 0x2c */
@@ -2351,8 +2356,13 @@ hcall_real_table:
         .long   0               /* 0x12c */
         .long   0               /* 0x130 */
         .long   DOTSYM(kvmppc_h_set_xdabr) - hcall_real_table
+#ifdef CONFIG_SPAPR_TCE_IOMMU
         .long   DOTSYM(kvmppc_rm_h_stuff_tce) - hcall_real_table
         .long   DOTSYM(kvmppc_rm_h_put_tce_indirect) - hcall_real_table
+#else
+        .long   0               /* 0x138 */
+        .long   0               /* 0x13c */
+#endif
         .long   0               /* 0x140 */
         .long   0               /* 0x144 */
         .long   0               /* 0x148 */
diff --git a/arch/powerpc/kvm/book3s_rtas.c b/arch/powerpc/kvm/book3s_rtas.c
index 2d3b2b1cc272..4e178c4c1ea5 100644
--- a/arch/powerpc/kvm/book3s_rtas.c
+++ b/arch/powerpc/kvm/book3s_rtas.c
@@ -33,7 +33,7 @@ static void kvm_rtas_set_xive(struct kvm_vcpu *vcpu, struct rtas_args *args)
         server = be32_to_cpu(args->args[1]);
         priority = be32_to_cpu(args->args[2]);
 
-        if (xive_enabled())
+        if (xics_on_xive())
                 rc = kvmppc_xive_set_xive(vcpu->kvm, irq, server, priority);
         else
                 rc = kvmppc_xics_set_xive(vcpu->kvm, irq, server, priority);
@@ -56,7 +56,7 @@ static void kvm_rtas_get_xive(struct kvm_vcpu *vcpu, struct rtas_args *args)
         irq = be32_to_cpu(args->args[0]);
 
         server = priority = 0;
-        if (xive_enabled())
+        if (xics_on_xive())
                 rc = kvmppc_xive_get_xive(vcpu->kvm, irq, &server, &priority);
         else
                 rc = kvmppc_xics_get_xive(vcpu->kvm, irq, &server, &priority);
@@ -83,7 +83,7 @@ static void kvm_rtas_int_off(struct kvm_vcpu *vcpu, struct rtas_args *args)
 
         irq = be32_to_cpu(args->args[0]);
 
-        if (xive_enabled())
+        if (xics_on_xive())
                 rc = kvmppc_xive_int_off(vcpu->kvm, irq);
         else
                 rc = kvmppc_xics_int_off(vcpu->kvm, irq);
@@ -105,7 +105,7 @@ static void kvm_rtas_int_on(struct kvm_vcpu *vcpu, struct rtas_args *args)
 
         irq = be32_to_cpu(args->args[0]);
 
-        if (xive_enabled())
+        if (xics_on_xive())
                 rc = kvmppc_xive_int_on(vcpu->kvm, irq);
         else
                 rc = kvmppc_xics_int_on(vcpu->kvm, irq);
diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
index b90a7d154180..8885377ec3e0 100644
--- a/arch/powerpc/kvm/powerpc.c
+++ b/arch/powerpc/kvm/powerpc.c
@@ -748,7 +748,7 @@ void kvm_arch_vcpu_free(struct kvm_vcpu *vcpu)
                 kvmppc_mpic_disconnect_vcpu(vcpu->arch.mpic, vcpu);
                 break;
         case KVMPPC_IRQ_XICS:
-                if (xive_enabled())
+                if (xics_on_xive())
                         kvmppc_xive_cleanup_vcpu(vcpu);
                 else
                         kvmppc_xics_free_icp(vcpu);
@@ -1931,7 +1931,7 @@ static int kvm_vcpu_ioctl_enable_cap(struct kvm_vcpu *vcpu,
                 r = -EPERM;
                 dev = kvm_device_from_filp(f.file);
                 if (dev) {
-                        if (xive_enabled())
+                        if (xics_on_xive())
                                 r = kvmppc_xive_connect_vcpu(dev, vcpu, cap->args[1]);
                         else
                                 r = kvmppc_xics_connect_vcpu(dev, vcpu, cap->args[1]);
@@ -2189,10 +2189,12 @@ static int pseries_get_cpu_char(struct kvm_ppc_cpu_char *cp)
                         KVM_PPC_CPU_CHAR_L1D_THREAD_PRIV |
                         KVM_PPC_CPU_CHAR_BR_HINT_HONOURED |
                         KVM_PPC_CPU_CHAR_MTTRIG_THR_RECONF |
-                        KVM_PPC_CPU_CHAR_COUNT_CACHE_DIS;
+                        KVM_PPC_CPU_CHAR_COUNT_CACHE_DIS |
+                        KVM_PPC_CPU_CHAR_BCCTR_FLUSH_ASSIST;
                 cp->behaviour_mask = KVM_PPC_CPU_BEHAV_FAVOUR_SECURITY |
                         KVM_PPC_CPU_BEHAV_L1D_FLUSH_PR |
-                        KVM_PPC_CPU_BEHAV_BNDS_CHK_SPEC_BAR;
+                        KVM_PPC_CPU_BEHAV_BNDS_CHK_SPEC_BAR |
+                        KVM_PPC_CPU_BEHAV_FLUSH_COUNT_CACHE;
         }
         return 0;
 }
@@ -2251,12 +2253,16 @@ static int kvmppc_get_cpu_char(struct kvm_ppc_cpu_char *cp)
                 if (have_fw_feat(fw_features, "enabled",
                                  "fw-count-cache-disabled"))
                         cp->character |= KVM_PPC_CPU_CHAR_COUNT_CACHE_DIS;
+                if (have_fw_feat(fw_features, "enabled",
+                                 "fw-count-cache-flush-bcctr2,0,0"))
+                        cp->character |= KVM_PPC_CPU_CHAR_BCCTR_FLUSH_ASSIST;
                 cp->character_mask = KVM_PPC_CPU_CHAR_SPEC_BAR_ORI31 |
                         KVM_PPC_CPU_CHAR_BCCTRL_SERIALISED |
                         KVM_PPC_CPU_CHAR_L1D_FLUSH_ORI30 |
                         KVM_PPC_CPU_CHAR_L1D_FLUSH_TRIG2 |
                         KVM_PPC_CPU_CHAR_L1D_THREAD_PRIV |
-                        KVM_PPC_CPU_CHAR_COUNT_CACHE_DIS;
+                        KVM_PPC_CPU_CHAR_COUNT_CACHE_DIS |
+                        KVM_PPC_CPU_CHAR_BCCTR_FLUSH_ASSIST;
 
                 if (have_fw_feat(fw_features, "enabled",
                                  "speculation-policy-favor-security"))
@@ -2267,9 +2273,13 @@ static int kvmppc_get_cpu_char(struct kvm_ppc_cpu_char *cp)
                 if (!have_fw_feat(fw_features, "disabled",
                                   "needs-spec-barrier-for-bound-checks"))
                         cp->behaviour |= KVM_PPC_CPU_BEHAV_BNDS_CHK_SPEC_BAR;
+                if (have_fw_feat(fw_features, "enabled",
+                                 "needs-count-cache-flush-on-context-switch"))
+                        cp->behaviour |= KVM_PPC_CPU_BEHAV_FLUSH_COUNT_CACHE;
                 cp->behaviour_mask = KVM_PPC_CPU_BEHAV_FAVOUR_SECURITY |
                         KVM_PPC_CPU_BEHAV_L1D_FLUSH_PR |
-                        KVM_PPC_CPU_BEHAV_BNDS_CHK_SPEC_BAR;
+                        KVM_PPC_CPU_BEHAV_BNDS_CHK_SPEC_BAR |
+                        KVM_PPC_CPU_BEHAV_FLUSH_COUNT_CACHE;
 
                 of_node_put(fw_features);
         }
diff --git a/arch/powerpc/mm/Makefile b/arch/powerpc/mm/Makefile
index d52ec118e09d..3c1bd9fa23cd 100644
--- a/arch/powerpc/mm/Makefile
+++ b/arch/powerpc/mm/Makefile
@@ -52,3 +52,6 @@ obj-$(CONFIG_PPC_MEM_KEYS)	+= pkeys.o
 # This is necessary for booting with kcov enabled on book3e machines
 KCOV_INSTRUMENT_tlb_nohash.o := n
 KCOV_INSTRUMENT_fsl_booke_mmu.o := n
+
+# Instrumenting the SLB fault path can lead to duplicate SLB entries
+KCOV_INSTRUMENT_slb.o := n
diff --git a/arch/powerpc/mm/hash_low_32.S b/arch/powerpc/mm/hash_low_32.S
index 1f13494efb2b..a6c491f18a04 100644
--- a/arch/powerpc/mm/hash_low_32.S
+++ b/arch/powerpc/mm/hash_low_32.S
@@ -70,12 +70,12 @@ _GLOBAL(hash_page)
         lis     r0,KERNELBASE@h         /* check if kernel address */
         cmplw   0,r4,r0
         ori     r3,r3,_PAGE_USER|_PAGE_PRESENT /* test low addresses as user */
-        mfspr   r5, SPRN_SPRG_PGDIR     /* virt page-table root */
+        mfspr   r5, SPRN_SPRG_PGDIR     /* phys page-table root */
         blt+    112f                    /* assume user more likely */
-        lis     r5,swapper_pg_dir@ha    /* if kernel address, use */
-        addi    r5,r5,swapper_pg_dir@l  /* kernel page table */
+        lis     r5, (swapper_pg_dir - PAGE_OFFSET)@ha   /* if kernel address, use */
+        addi    r5 ,r5 ,(swapper_pg_dir - PAGE_OFFSET)@l        /* kernel page table */
         rlwimi  r3,r9,32-12,29,29       /* MSR_PR -> _PAGE_USER */
-112:    tophys(r5, r5)
+112:
 #ifndef CONFIG_PTE_64BIT
         rlwimi  r5,r4,12,20,29          /* insert top 10 bits of address */
         lwz     r8,0(r5)                /* get pmd entry */
diff --git a/arch/powerpc/platforms/powernv/opal-call.c b/arch/powerpc/platforms/powernv/opal-call.c
index 578757d403ab..daad8c45c8e7 100644
--- a/arch/powerpc/platforms/powernv/opal-call.c
+++ b/arch/powerpc/platforms/powernv/opal-call.c
@@ -86,6 +86,7 @@ static s64 __opal_call_trace(s64 a0, s64 a1, s64 a2, s64 a3,
                              s64 a4, s64 a5, s64 a6, s64 a7,
                               unsigned long opcode, unsigned long msr)
 {
+        return 0;
 }
 
 #define DO_TRACE false
diff --git a/arch/powerpc/platforms/pseries/papr_scm.c b/arch/powerpc/platforms/pseries/papr_scm.c
index bba281b1fe1b..96c53b23e58f 100644
--- a/arch/powerpc/platforms/pseries/papr_scm.c
+++ b/arch/powerpc/platforms/pseries/papr_scm.c
@@ -239,6 +239,7 @@ static int papr_scm_nvdimm_init(struct papr_scm_priv *p)
         memset(&ndr_desc, 0, sizeof(ndr_desc));
         ndr_desc.attr_groups = region_attr_groups;
         ndr_desc.numa_node = dev_to_node(&p->pdev->dev);
+        ndr_desc.target_node = ndr_desc.numa_node;
         ndr_desc.res = &p->res;
         ndr_desc.of_node = p->dn;
         ndr_desc.provider_data = p;
diff --git a/arch/riscv/include/uapi/asm/Kbuild b/arch/riscv/include/uapi/asm/Kbuild
index d2ee86b4c091..e69de29bb2d1 100644
--- a/arch/riscv/include/uapi/asm/Kbuild
+++ b/arch/riscv/include/uapi/asm/Kbuild
@@ -1 +0,0 @@
-include include/uapi/asm-generic/Kbuild.asm
diff --git a/arch/s390/boot/Makefile b/arch/s390/boot/Makefile
index 11ca8795b74a..c844eaf24ed7 100644
--- a/arch/s390/boot/Makefile
+++ b/arch/s390/boot/Makefile
@@ -57,9 +57,6 @@ $(obj)/section_cmp%: vmlinux $(obj)/compressed/vmlinux FORCE
 $(obj)/compressed/vmlinux: $(obj)/startup.a FORCE
         $(Q)$(MAKE) $(build)=$(obj)/compressed $@
 
-quiet_cmd_ar = AR      $@
-      cmd_ar = rm -f $@; $(AR) rcsTP$(KBUILD_ARFLAGS) $@ $(real-prereqs)
-
 $(obj)/startup.a: $(OBJECTS) FORCE
         $(call if_changed,ar)
 
diff --git a/arch/s390/include/asm/Kbuild b/arch/s390/include/asm/Kbuild
index e3239772887a..12d77cb11fe5 100644
--- a/arch/s390/include/asm/Kbuild
+++ b/arch/s390/include/asm/Kbuild
@@ -20,7 +20,6 @@ generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
 generic-y += mm-arch-hooks.h
-generic-y += preempt.h
 generic-y += rwsem.h
 generic-y += trace_clock.h
 generic-y += unaligned.h
diff --git a/arch/s390/include/asm/cio.h b/arch/s390/include/asm/cio.h
index 225667652069..1727180e8ca1 100644
--- a/arch/s390/include/asm/cio.h
+++ b/arch/s390/include/asm/cio.h
@@ -331,5 +331,6 @@ extern void css_schedule_reprobe(void);
 /* Function from drivers/s390/cio/chsc.c */
 int chsc_sstpc(void *page, unsigned int op, u16 ctrl, u64 *clock_delta);
 int chsc_sstpi(void *page, void *result, size_t size);
+int chsc_sgib(u32 origin);
 
 #endif
diff --git a/arch/s390/include/asm/irq.h b/arch/s390/include/asm/irq.h
index 2f7f27e5493f..afaf5e3c57fd 100644
--- a/arch/s390/include/asm/irq.h
+++ b/arch/s390/include/asm/irq.h
@@ -62,6 +62,7 @@ enum interruption_class {
         IRQIO_MSI,
         IRQIO_VIR,
         IRQIO_VAI,
+        IRQIO_GAL,
         NMI_NMI,
         CPU_RST,
         NR_ARCH_IRQS
diff --git a/arch/s390/include/asm/isc.h b/arch/s390/include/asm/isc.h
index 6cb9e2ed05b6..b2cc1ec78d06 100644
--- a/arch/s390/include/asm/isc.h
+++ b/arch/s390/include/asm/isc.h
@@ -21,6 +21,7 @@
 /* Adapter interrupts. */
 #define QDIO_AIRQ_ISC IO_SCH_ISC        /* I/O subchannel in qdio mode */
 #define PCI_ISC 2                       /* PCI I/O subchannels */
+#define GAL_ISC 5                       /* GIB alert */
 #define AP_ISC 6                        /* adjunct processor (crypto) devices */
 
 /* Functions for registration of I/O interruption subclasses */
diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
index d5d24889c3bc..c47e22bba87f 100644
--- a/arch/s390/include/asm/kvm_host.h
+++ b/arch/s390/include/asm/kvm_host.h
@@ -591,7 +591,6 @@ struct kvm_s390_float_interrupt {
         struct kvm_s390_mchk_info mchk;
         struct kvm_s390_ext_info srv_signal;
         int next_rr_cpu;
-        unsigned long idle_mask[BITS_TO_LONGS(KVM_MAX_VCPUS)];
         struct mutex ais_lock;
         u8 simm;
         u8 nimm;
@@ -712,6 +711,7 @@ struct s390_io_adapter {
 struct kvm_s390_cpu_model {
         /* facility mask supported by kvm & hosting machine */
         __u64 fac_mask[S390_ARCH_FAC_LIST_SIZE_U64];
+        struct kvm_s390_vm_cpu_subfunc subfuncs;
         /* facility list requested by guest (in dma page) */
         __u64 *fac_list;
         u64 cpuid;
@@ -782,9 +782,21 @@ struct kvm_s390_gisa {
                         u8  reserved03[11];
                         u32 airq_count;
                 } g1;
+                struct {
+                        u64 word[4];
+                } u64;
         };
 };
 
+struct kvm_s390_gib {
+        u32 alert_list_origin;
+        u32 reserved01;
+        u8:5;
+        u8  nisc:3;
+        u8  reserved03[3];
+        u32 reserved04[5];
+};
+
 /*
  * sie_page2 has to be allocated as DMA because fac_list, crycb and
  * gisa need 31bit addresses in the sie control block.
@@ -793,7 +805,8 @@ struct sie_page2 {
         __u64 fac_list[S390_ARCH_FAC_LIST_SIZE_U64];    /* 0x0000 */
         struct kvm_s390_crypto_cb crycb;                /* 0x0800 */
         struct kvm_s390_gisa gisa;                      /* 0x0900 */
-        u8 reserved920[0x1000 - 0x920];                 /* 0x0920 */
+        struct kvm *kvm;                                /* 0x0920 */
+        u8 reserved928[0x1000 - 0x928];                 /* 0x0928 */
 };
 
 struct kvm_s390_vsie {
@@ -804,6 +817,20 @@ struct kvm_s390_vsie {
         struct page *pages[KVM_MAX_VCPUS];
 };
 
+struct kvm_s390_gisa_iam {
+        u8 mask;
+        spinlock_t ref_lock;
+        u32 ref_count[MAX_ISC + 1];
+};
+
+struct kvm_s390_gisa_interrupt {
+        struct kvm_s390_gisa *origin;
+        struct kvm_s390_gisa_iam alert;
+        struct hrtimer timer;
+        u64 expires;
+        DECLARE_BITMAP(kicked_mask, KVM_MAX_VCPUS);
+};
+
 struct kvm_arch{
         void *sca;
         int use_esca;
@@ -837,7 +864,8 @@ struct kvm_arch{
         atomic64_t cmma_dirty_pages;
         /* subset of available cpu features enabled by user space */
         DECLARE_BITMAP(cpu_feat, KVM_S390_VM_CPU_FEAT_NR_BITS);
-        struct kvm_s390_gisa *gisa;
+        DECLARE_BITMAP(idle_mask, KVM_MAX_VCPUS);
+        struct kvm_s390_gisa_interrupt gisa_int;
 };
 
 #define KVM_HVA_ERR_BAD         (-1UL)
@@ -871,6 +899,9 @@ void kvm_arch_crypto_set_masks(struct kvm *kvm, unsigned long *apm,
 extern int sie64a(struct kvm_s390_sie_block *, u64 *);
 extern char sie_exit;
 
+extern int kvm_s390_gisc_register(struct kvm *kvm, u32 gisc);
+extern int kvm_s390_gisc_unregister(struct kvm *kvm, u32 gisc);
+
 static inline void kvm_arch_hardware_disable(void) {}
 static inline void kvm_arch_check_processor_compat(void *rtn) {}
 static inline void kvm_arch_sync_events(struct kvm *kvm) {}
@@ -878,7 +909,7 @@ static inline void kvm_arch_vcpu_uninit(struct kvm_vcpu *vcpu) {}
 static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {}
 static inline void kvm_arch_free_memslot(struct kvm *kvm,
                 struct kvm_memory_slot *free, struct kvm_memory_slot *dont) {}
-static inline void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots) {}
+static inline void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen) {}
 static inline void kvm_arch_flush_shadow_all(struct kvm *kvm) {}
 static inline void kvm_arch_flush_shadow_memslot(struct kvm *kvm,
                 struct kvm_memory_slot *slot) {}
diff --git a/arch/s390/include/uapi/asm/Kbuild b/arch/s390/include/uapi/asm/Kbuild
index 6b0f30b14642..46c1ff0b842a 100644
--- a/arch/s390/include/uapi/asm/Kbuild
+++ b/arch/s390/include/uapi/asm/Kbuild
@@ -1,6 +1,4 @@
 # SPDX-License-Identifier: GPL-2.0
-include include/uapi/asm-generic/Kbuild.asm
 
 generated-y += unistd_32.h
 generated-y += unistd_64.h
-generic-y += socket.h
diff --git a/arch/s390/kernel/irq.c b/arch/s390/kernel/irq.c
index 0e8d68bac82c..0cd5a5f96729 100644
--- a/arch/s390/kernel/irq.c
+++ b/arch/s390/kernel/irq.c
@@ -88,6 +88,7 @@ static const struct irq_class irqclass_sub_desc[] = {
         {.irq = IRQIO_MSI,  .name = "MSI", .desc = "[I/O] MSI Interrupt" },
         {.irq = IRQIO_VIR,  .name = "VIR", .desc = "[I/O] Virtual I/O Devices"},
         {.irq = IRQIO_VAI,  .name = "VAI", .desc = "[I/O] Virtual I/O Devices AI"},
+        {.irq = IRQIO_GAL,  .name = "GAL", .desc = "[I/O] GIB Alert"},
         {.irq = NMI_NMI,    .name = "NMI", .desc = "[NMI] Machine Check"},
         {.irq = CPU_RST,    .name = "RST", .desc = "[CPU] CPU Restart"},
 };
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index fcb55b02990e..82162867f378 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -7,6 +7,9 @@
  *    Author(s): Carsten Otte <cotte@de.ibm.com>
  */
 
+#define KMSG_COMPONENT "kvm-s390"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/interrupt.h>
 #include <linux/kvm_host.h>
 #include <linux/hrtimer.h>
@@ -23,6 +26,7 @@
 #include <asm/gmap.h>
 #include <asm/switch_to.h>
 #include <asm/nmi.h>
+#include <asm/airq.h>
 #include "kvm-s390.h"
 #include "gaccess.h"
 #include "trace-s390.h"
@@ -31,6 +35,8 @@
 #define PFAULT_DONE 0x0680
 #define VIRTIO_PARAM 0x0d00
 
+static struct kvm_s390_gib *gib;
+
 /* handle external calls via sigp interpretation facility */
 static int sca_ext_call_pending(struct kvm_vcpu *vcpu, int *src_id)
 {
@@ -217,22 +223,100 @@ static inline u8 int_word_to_isc(u32 int_word)
  */
 #define IPM_BIT_OFFSET (offsetof(struct kvm_s390_gisa, ipm) * BITS_PER_BYTE)
 
-static inline void kvm_s390_gisa_set_ipm_gisc(struct kvm_s390_gisa *gisa, u32 gisc)
+/**
+ * gisa_set_iam - change the GISA interruption alert mask
+ *
+ * @gisa: gisa to operate on
+ * @iam: new IAM value to use
+ *
+ * Change the IAM atomically with the next alert address and the IPM
+ * of the GISA if the GISA is not part of the GIB alert list. All three
+ * fields are located in the first long word of the GISA.
+ *
+ * Returns: 0 on success
+ *          -EBUSY in case the gisa is part of the alert list
+ */
+static inline int gisa_set_iam(struct kvm_s390_gisa *gisa, u8 iam)
+{
+        u64 word, _word;
+
+        do {
+                word = READ_ONCE(gisa->u64.word[0]);
+                if ((u64)gisa != word >> 32)
+                        return -EBUSY;
+                _word = (word & ~0xffUL) | iam;
+        } while (cmpxchg(&gisa->u64.word[0], word, _word) != word);
+
+        return 0;
+}
+
+/**
+ * gisa_clear_ipm - clear the GISA interruption pending mask
+ *
+ * @gisa: gisa to operate on
+ *
+ * Clear the IPM atomically with the next alert address and the IAM
+ * of the GISA unconditionally. All three fields are located in the
+ * first long word of the GISA.
+ */
+static inline void gisa_clear_ipm(struct kvm_s390_gisa *gisa)
+{
+        u64 word, _word;
+
+        do {
+                word = READ_ONCE(gisa->u64.word[0]);
+                _word = word & ~(0xffUL << 24);
+        } while (cmpxchg(&gisa->u64.word[0], word, _word) != word);
+}
+
+/**
+ * gisa_get_ipm_or_restore_iam - return IPM or restore GISA IAM
+ *
+ * @gi: gisa interrupt struct to work on
+ *
+ * Atomically restores the interruption alert mask if none of the
+ * relevant ISCs are pending and return the IPM.
+ *
+ * Returns: the relevant pending ISCs
+ */
+static inline u8 gisa_get_ipm_or_restore_iam(struct kvm_s390_gisa_interrupt *gi)
+{
+        u8 pending_mask, alert_mask;
+        u64 word, _word;
+
+        do {
+                word = READ_ONCE(gi->origin->u64.word[0]);
+                alert_mask = READ_ONCE(gi->alert.mask);
+                pending_mask = (u8)(word >> 24) & alert_mask;
+                if (pending_mask)
+                        return pending_mask;
+                _word = (word & ~0xffUL) | alert_mask;
+        } while (cmpxchg(&gi->origin->u64.word[0], word, _word) != word);
+
+        return 0;
+}
+
+static inline int gisa_in_alert_list(struct kvm_s390_gisa *gisa)
+{
+        return READ_ONCE(gisa->next_alert) != (u32)(u64)gisa;
+}
+
+static inline void gisa_set_ipm_gisc(struct kvm_s390_gisa *gisa, u32 gisc)
 {
         set_bit_inv(IPM_BIT_OFFSET + gisc, (unsigned long *) gisa);
 }
 
-static inline u8 kvm_s390_gisa_get_ipm(struct kvm_s390_gisa *gisa)
+static inline u8 gisa_get_ipm(struct kvm_s390_gisa *gisa)
 {
         return READ_ONCE(gisa->ipm);
 }
 
-static inline void kvm_s390_gisa_clear_ipm_gisc(struct kvm_s390_gisa *gisa, u32 gisc)
+static inline void gisa_clear_ipm_gisc(struct kvm_s390_gisa *gisa, u32 gisc)
 {
         clear_bit_inv(IPM_BIT_OFFSET + gisc, (unsigned long *) gisa);
 }
 
-static inline int kvm_s390_gisa_tac_ipm_gisc(struct kvm_s390_gisa *gisa, u32 gisc)
+static inline int gisa_tac_ipm_gisc(struct kvm_s390_gisa *gisa, u32 gisc)
 {
         return test_and_clear_bit_inv(IPM_BIT_OFFSET + gisc, (unsigned long *) gisa);
 }
@@ -245,8 +329,13 @@ static inline unsigned long pending_irqs_no_gisa(struct kvm_vcpu *vcpu)
 
 static inline unsigned long pending_irqs(struct kvm_vcpu *vcpu)
 {
-        return pending_irqs_no_gisa(vcpu) |
-                kvm_s390_gisa_get_ipm(vcpu->kvm->arch.gisa) << IRQ_PEND_IO_ISC_7;
+        struct kvm_s390_gisa_interrupt *gi = &vcpu->kvm->arch.gisa_int;
+        unsigned long pending_mask;
+
+        pending_mask = pending_irqs_no_gisa(vcpu);
+        if (gi->origin)
+                pending_mask |= gisa_get_ipm(gi->origin) << IRQ_PEND_IO_ISC_7;
+        return pending_mask;
 }
 
 static inline int isc_to_irq_type(unsigned long isc)
@@ -318,13 +407,13 @@ static unsigned long deliverable_irqs(struct kvm_vcpu *vcpu)
 static void __set_cpu_idle(struct kvm_vcpu *vcpu)
 {
         kvm_s390_set_cpuflags(vcpu, CPUSTAT_WAIT);
-        set_bit(vcpu->vcpu_id, vcpu->kvm->arch.float_int.idle_mask);
+        set_bit(vcpu->vcpu_id, vcpu->kvm->arch.idle_mask);
 }
 
 static void __unset_cpu_idle(struct kvm_vcpu *vcpu)
 {
         kvm_s390_clear_cpuflags(vcpu, CPUSTAT_WAIT);
-        clear_bit(vcpu->vcpu_id, vcpu->kvm->arch.float_int.idle_mask);
+        clear_bit(vcpu->vcpu_id, vcpu->kvm->arch.idle_mask);
 }
 
 static void __reset_intercept_indicators(struct kvm_vcpu *vcpu)
@@ -345,7 +434,7 @@ static void set_intercept_indicators_io(struct kvm_vcpu *vcpu)
 {
         if (!(pending_irqs_no_gisa(vcpu) & IRQ_PEND_IO_MASK))
                 return;
-        else if (psw_ioint_disabled(vcpu))
+        if (psw_ioint_disabled(vcpu))
                 kvm_s390_set_cpuflags(vcpu, CPUSTAT_IO_INT);
         else
                 vcpu->arch.sie_block->lctl |= LCTL_CR6;
@@ -353,7 +442,7 @@ static void set_intercept_indicators_io(struct kvm_vcpu *vcpu)
 
 static void set_intercept_indicators_ext(struct kvm_vcpu *vcpu)
 {
-        if (!(pending_irqs(vcpu) & IRQ_PEND_EXT_MASK))
+        if (!(pending_irqs_no_gisa(vcpu) & IRQ_PEND_EXT_MASK))
                 return;
         if (psw_extint_disabled(vcpu))
                 kvm_s390_set_cpuflags(vcpu, CPUSTAT_EXT_INT);
@@ -363,7 +452,7 @@ static void set_intercept_indicators_ext(struct kvm_vcpu *vcpu)
 
 static void set_intercept_indicators_mchk(struct kvm_vcpu *vcpu)
 {
-        if (!(pending_irqs(vcpu) & IRQ_PEND_MCHK_MASK))
+        if (!(pending_irqs_no_gisa(vcpu) & IRQ_PEND_MCHK_MASK))
                 return;
         if (psw_mchk_disabled(vcpu))
                 vcpu->arch.sie_block->ictl |= ICTL_LPSW;
@@ -956,6 +1045,7 @@ static int __must_check __deliver_io(struct kvm_vcpu *vcpu,
 {
         struct list_head *isc_list;
         struct kvm_s390_float_interrupt *fi;
+        struct kvm_s390_gisa_interrupt *gi = &vcpu->kvm->arch.gisa_int;
         struct kvm_s390_interrupt_info *inti = NULL;
         struct kvm_s390_io_info io;
         u32 isc;
@@ -998,8 +1088,7 @@ static int __must_check __deliver_io(struct kvm_vcpu *vcpu,
                 goto out;
         }
 
-        if (vcpu->kvm->arch.gisa &&
-            kvm_s390_gisa_tac_ipm_gisc(vcpu->kvm->arch.gisa, isc)) {
+        if (gi->origin && gisa_tac_ipm_gisc(gi->origin, isc)) {
                 /*
                  * in case an adapter interrupt was not delivered
                  * in SIE context KVM will handle the delivery
@@ -1089,6 +1178,7 @@ static u64 __calculate_sltime(struct kvm_vcpu *vcpu)
 
 int kvm_s390_handle_wait(struct kvm_vcpu *vcpu)
 {
+        struct kvm_s390_gisa_interrupt *gi = &vcpu->kvm->arch.gisa_int;
         u64 sltime;
 
         vcpu->stat.exit_wait_state++;
@@ -1102,6 +1192,11 @@ int kvm_s390_handle_wait(struct kvm_vcpu *vcpu)
                 return -EOPNOTSUPP; /* disabled wait */
         }
 
+        if (gi->origin &&
+            (gisa_get_ipm_or_restore_iam(gi) &
+             vcpu->arch.sie_block->gcr[6] >> 24))
+                return 0;
+
         if (!ckc_interrupts_enabled(vcpu) &&
             !cpu_timer_interrupts_enabled(vcpu)) {
                 VCPU_EVENT(vcpu, 3, "%s", "enabled wait w/o timer");
@@ -1533,18 +1628,19 @@ static struct kvm_s390_interrupt_info *get_top_io_int(struct kvm *kvm,
 
 static int get_top_gisa_isc(struct kvm *kvm, u64 isc_mask, u32 schid)
 {
+        struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
         unsigned long active_mask;
         int isc;
 
         if (schid)
                 goto out;
-        if (!kvm->arch.gisa)
+        if (!gi->origin)
                 goto out;
 
-        active_mask = (isc_mask & kvm_s390_gisa_get_ipm(kvm->arch.gisa) << 24) << 32;
+        active_mask = (isc_mask & gisa_get_ipm(gi->origin) << 24) << 32;
         while (active_mask) {
                 isc = __fls(active_mask) ^ (BITS_PER_LONG - 1);
-                if (kvm_s390_gisa_tac_ipm_gisc(kvm->arch.gisa, isc))
+                if (gisa_tac_ipm_gisc(gi->origin, isc))
                         return isc;
                 clear_bit_inv(isc, &active_mask);
         }
@@ -1567,6 +1663,7 @@ out:
 struct kvm_s390_interrupt_info *kvm_s390_get_io_int(struct kvm *kvm,
                                                     u64 isc_mask, u32 schid)
 {
+        struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
         struct kvm_s390_interrupt_info *inti, *tmp_inti;
         int isc;
 
@@ -1584,7 +1681,7 @@ struct kvm_s390_interrupt_info *kvm_s390_get_io_int(struct kvm *kvm,
         /* both types of interrupts present */
         if (int_word_to_isc(inti->io.io_int_word) <= isc) {
                 /* classical IO int with higher priority */
-                kvm_s390_gisa_set_ipm_gisc(kvm->arch.gisa, isc);
+                gisa_set_ipm_gisc(gi->origin, isc);
                 goto out;
         }
 gisa_out:
@@ -1596,7 +1693,7 @@ gisa_out:
                         kvm_s390_reinject_io_int(kvm, inti);
                 inti = tmp_inti;
         } else
-                kvm_s390_gisa_set_ipm_gisc(kvm->arch.gisa, isc);
+                gisa_set_ipm_gisc(gi->origin, isc);
 out:
         return inti;
 }
@@ -1685,6 +1782,7 @@ static int __inject_float_mchk(struct kvm *kvm,
 
 static int __inject_io(struct kvm *kvm, struct kvm_s390_interrupt_info *inti)
 {
+        struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
         struct kvm_s390_float_interrupt *fi;
         struct list_head *list;
         int isc;
@@ -1692,9 +1790,9 @@ static int __inject_io(struct kvm *kvm, struct kvm_s390_interrupt_info *inti)
         kvm->stat.inject_io++;
         isc = int_word_to_isc(inti->io.io_int_word);
 
-        if (kvm->arch.gisa && inti->type & KVM_S390_INT_IO_AI_MASK) {
+        if (gi->origin && inti->type & KVM_S390_INT_IO_AI_MASK) {
                 VM_EVENT(kvm, 4, "%s isc %1u", "inject: I/O (AI/gisa)", isc);
-                kvm_s390_gisa_set_ipm_gisc(kvm->arch.gisa, isc);
+                gisa_set_ipm_gisc(gi->origin, isc);
                 kfree(inti);
                 return 0;
         }
@@ -1726,7 +1824,6 @@ static int __inject_io(struct kvm *kvm, struct kvm_s390_interrupt_info *inti)
  */
 static void __floating_irq_kick(struct kvm *kvm, u64 type)
 {
-        struct kvm_s390_float_interrupt *fi = &kvm->arch.float_int;
         struct kvm_vcpu *dst_vcpu;
         int sigcpu, online_vcpus, nr_tries = 0;
 
@@ -1735,11 +1832,11 @@ static void __floating_irq_kick(struct kvm *kvm, u64 type)
                 return;
 
         /* find idle VCPUs first, then round robin */
-        sigcpu = find_first_bit(fi->idle_mask, online_vcpus);
+        sigcpu = find_first_bit(kvm->arch.idle_mask, online_vcpus);
         if (sigcpu == online_vcpus) {
                 do {
-                        sigcpu = fi->next_rr_cpu;
-                        fi->next_rr_cpu = (fi->next_rr_cpu + 1) % online_vcpus;
+                        sigcpu = kvm->arch.float_int.next_rr_cpu++;
+                        kvm->arch.float_int.next_rr_cpu %= online_vcpus;
                         /* avoid endless loops if all vcpus are stopped */
                         if (nr_tries++ >= online_vcpus)
                                 return;
@@ -1753,7 +1850,8 @@ static void __floating_irq_kick(struct kvm *kvm, u64 type)
                 kvm_s390_set_cpuflags(dst_vcpu, CPUSTAT_STOP_INT);
                 break;
         case KVM_S390_INT_IO_MIN...KVM_S390_INT_IO_MAX:
-                if (!(type & KVM_S390_INT_IO_AI_MASK && kvm->arch.gisa))
+                if (!(type & KVM_S390_INT_IO_AI_MASK &&
+                      kvm->arch.gisa_int.origin))
                         kvm_s390_set_cpuflags(dst_vcpu, CPUSTAT_IO_INT);
                 break;
         default:
@@ -2003,6 +2101,7 @@ void kvm_s390_clear_float_irqs(struct kvm *kvm)
 
 static int get_all_floating_irqs(struct kvm *kvm, u8 __user *usrbuf, u64 len)
 {
+        struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
         struct kvm_s390_interrupt_info *inti;
         struct kvm_s390_float_interrupt *fi;
         struct kvm_s390_irq *buf;
@@ -2026,15 +2125,14 @@ static int get_all_floating_irqs(struct kvm *kvm, u8 __user *usrbuf, u64 len)
 
         max_irqs = len / sizeof(struct kvm_s390_irq);
 
-        if (kvm->arch.gisa &&
-            kvm_s390_gisa_get_ipm(kvm->arch.gisa)) {
+        if (gi->origin && gisa_get_ipm(gi->origin)) {
                 for (i = 0; i <= MAX_ISC; i++) {
                         if (n == max_irqs) {
                                 /* signal userspace to try again */
                                 ret = -ENOMEM;
                                 goto out_nolock;
                         }
-                        if (kvm_s390_gisa_tac_ipm_gisc(kvm->arch.gisa, i)) {
+                        if (gisa_tac_ipm_gisc(gi->origin, i)) {
                                 irq = (struct kvm_s390_irq *) &buf[n];
                                 irq->type = KVM_S390_INT_IO(1, 0, 0, 0);
                                 irq->u.io.io_int_word = isc_to_int_word(i);
@@ -2831,7 +2929,7 @@ static void store_local_irq(struct kvm_s390_local_interrupt *li,
 int kvm_s390_get_irq_state(struct kvm_vcpu *vcpu, __u8 __user *buf, int len)
 {
         int scn;
-        unsigned long sigp_emerg_pending[BITS_TO_LONGS(KVM_MAX_VCPUS)];
+        DECLARE_BITMAP(sigp_emerg_pending, KVM_MAX_VCPUS);
         struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
         unsigned long pending_irqs;
         struct kvm_s390_irq irq;
@@ -2884,27 +2982,278 @@ int kvm_s390_get_irq_state(struct kvm_vcpu *vcpu, __u8 __user *buf, int len)
         return n;
 }
 
-void kvm_s390_gisa_clear(struct kvm *kvm)
+static void __airqs_kick_single_vcpu(struct kvm *kvm, u8 deliverable_mask)
 {
-        if (kvm->arch.gisa) {
-                memset(kvm->arch.gisa, 0, sizeof(struct kvm_s390_gisa));
-                kvm->arch.gisa->next_alert = (u32)(u64)kvm->arch.gisa;
-                VM_EVENT(kvm, 3, "gisa 0x%pK cleared", kvm->arch.gisa);
+        int vcpu_id, online_vcpus = atomic_read(&kvm->online_vcpus);
+        struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
+        struct kvm_vcpu *vcpu;
+
+        for_each_set_bit(vcpu_id, kvm->arch.idle_mask, online_vcpus) {
+                vcpu = kvm_get_vcpu(kvm, vcpu_id);
+                if (psw_ioint_disabled(vcpu))
+                        continue;
+                deliverable_mask &= (u8)(vcpu->arch.sie_block->gcr[6] >> 24);
+                if (deliverable_mask) {
+                        /* lately kicked but not yet running */
+                        if (test_and_set_bit(vcpu_id, gi->kicked_mask))
+                                return;
+                        kvm_s390_vcpu_wakeup(vcpu);
+                        return;
+                }
         }
 }
 
+static enum hrtimer_restart gisa_vcpu_kicker(struct hrtimer *timer)
+{
+        struct kvm_s390_gisa_interrupt *gi =
+                container_of(timer, struct kvm_s390_gisa_interrupt, timer);
+        struct kvm *kvm =
+                container_of(gi->origin, struct sie_page2, gisa)->kvm;
+        u8 pending_mask;
+
+        pending_mask = gisa_get_ipm_or_restore_iam(gi);
+        if (pending_mask) {
+                __airqs_kick_single_vcpu(kvm, pending_mask);
+                hrtimer_forward_now(timer, ns_to_ktime(gi->expires));
+                return HRTIMER_RESTART;
+        };
+
+        return HRTIMER_NORESTART;
+}
+
+#define NULL_GISA_ADDR 0x00000000UL
+#define NONE_GISA_ADDR 0x00000001UL
+#define GISA_ADDR_MASK 0xfffff000UL
+
+static void process_gib_alert_list(void)
+{
+        struct kvm_s390_gisa_interrupt *gi;
+        struct kvm_s390_gisa *gisa;
+        struct kvm *kvm;
+        u32 final, origin = 0UL;
+
+        do {
+                /*
+                 * If the NONE_GISA_ADDR is still stored in the alert list
+                 * origin, we will leave the outer loop. No further GISA has
+                 * been added to the alert list by millicode while processing
+                 * the current alert list.
+                 */
+                final = (origin & NONE_GISA_ADDR);
+                /*
+                 * Cut off the alert list and store the NONE_GISA_ADDR in the
+                 * alert list origin to avoid further GAL interruptions.
+                 * A new alert list can be build up by millicode in parallel
+                 * for guests not in the yet cut-off alert list. When in the
+                 * final loop, store the NULL_GISA_ADDR instead. This will re-
+                 * enable GAL interruptions on the host again.
+                 */
+                origin = xchg(&gib->alert_list_origin,
+                              (!final) ? NONE_GISA_ADDR : NULL_GISA_ADDR);
+                /*
+                 * Loop through the just cut-off alert list and start the
+                 * gisa timers to kick idle vcpus to consume the pending
+                 * interruptions asap.
+                 */
+                while (origin & GISA_ADDR_MASK) {
+                        gisa = (struct kvm_s390_gisa *)(u64)origin;
+                        origin = gisa->next_alert;
+                        gisa->next_alert = (u32)(u64)gisa;
+                        kvm = container_of(gisa, struct sie_page2, gisa)->kvm;
+                        gi = &kvm->arch.gisa_int;
+                        if (hrtimer_active(&gi->timer))
+                                hrtimer_cancel(&gi->timer);
+                        hrtimer_start(&gi->timer, 0, HRTIMER_MODE_REL);
+                }
+        } while (!final);
+
+}
+
+void kvm_s390_gisa_clear(struct kvm *kvm)
+{
+        struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
+
+        if (!gi->origin)
+                return;
+        gisa_clear_ipm(gi->origin);
+        VM_EVENT(kvm, 3, "gisa 0x%pK cleared", gi->origin);
+}
+
 void kvm_s390_gisa_init(struct kvm *kvm)
 {
-        if (css_general_characteristics.aiv) {
-                kvm->arch.gisa = &kvm->arch.sie_page2->gisa;
-                VM_EVENT(kvm, 3, "gisa 0x%pK initialized", kvm->arch.gisa);
-                kvm_s390_gisa_clear(kvm);
-        }
+        struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
+
+        if (!css_general_characteristics.aiv)
+                return;
+        gi->origin = &kvm->arch.sie_page2->gisa;
+        gi->alert.mask = 0;
+        spin_lock_init(&gi->alert.ref_lock);
+        gi->expires = 50 * 1000; /* 50 usec */
+        hrtimer_init(&gi->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+        gi->timer.function = gisa_vcpu_kicker;
+        memset(gi->origin, 0, sizeof(struct kvm_s390_gisa));
+        gi->origin->next_alert = (u32)(u64)gi->origin;
+        VM_EVENT(kvm, 3, "gisa 0x%pK initialized", gi->origin);
 }
 
 void kvm_s390_gisa_destroy(struct kvm *kvm)
 {
-        if (!kvm->arch.gisa)
+        struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
+
+        if (!gi->origin)
+                return;
+        if (gi->alert.mask)
+                KVM_EVENT(3, "vm 0x%pK has unexpected iam 0x%02x",
+                          kvm, gi->alert.mask);
+        while (gisa_in_alert_list(gi->origin))
+                cpu_relax();
+        hrtimer_cancel(&gi->timer);
+        gi->origin = NULL;
+}
+
+/**
+ * kvm_s390_gisc_register - register a guest ISC
+ *
+ * @kvm:  the kernel vm to work with
+ * @gisc: the guest interruption sub class to register
+ *
+ * The function extends the vm specific alert mask to use.
+ * The effective IAM mask in the GISA is updated as well
+ * in case the GISA is not part of the GIB alert list.
+ * It will be updated latest when the IAM gets restored
+ * by gisa_get_ipm_or_restore_iam().
+ *
+ * Returns: the nonspecific ISC (NISC) the gib alert mechanism
+ *          has registered with the channel subsystem.
+ *          -ENODEV in case the vm uses no GISA
+ *          -ERANGE in case the guest ISC is invalid
+ */
+int kvm_s390_gisc_register(struct kvm *kvm, u32 gisc)
+{
+        struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
+
+        if (!gi->origin)
+                return -ENODEV;
+        if (gisc > MAX_ISC)
+                return -ERANGE;
+
+        spin_lock(&gi->alert.ref_lock);
+        gi->alert.ref_count[gisc]++;
+        if (gi->alert.ref_count[gisc] == 1) {
+                gi->alert.mask |= 0x80 >> gisc;
+                gisa_set_iam(gi->origin, gi->alert.mask);
+        }
+        spin_unlock(&gi->alert.ref_lock);
+
+        return gib->nisc;
+}
+EXPORT_SYMBOL_GPL(kvm_s390_gisc_register);
+
+/**
+ * kvm_s390_gisc_unregister - unregister a guest ISC
+ *
+ * @kvm:  the kernel vm to work with
+ * @gisc: the guest interruption sub class to register
+ *
+ * The function reduces the vm specific alert mask to use.
+ * The effective IAM mask in the GISA is updated as well
+ * in case the GISA is not part of the GIB alert list.
+ * It will be updated latest when the IAM gets restored
+ * by gisa_get_ipm_or_restore_iam().
+ *
+ * Returns: the nonspecific ISC (NISC) the gib alert mechanism
+ *          has registered with the channel subsystem.
+ *          -ENODEV in case the vm uses no GISA
+ *          -ERANGE in case the guest ISC is invalid
+ *          -EINVAL in case the guest ISC is not registered
+ */
+int kvm_s390_gisc_unregister(struct kvm *kvm, u32 gisc)
+{
+        struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
+        int rc = 0;
+
+        if (!gi->origin)
+                return -ENODEV;
+        if (gisc > MAX_ISC)
+                return -ERANGE;
+
+        spin_lock(&gi->alert.ref_lock);
+        if (gi->alert.ref_count[gisc] == 0) {
+                rc = -EINVAL;
+                goto out;
+        }
+        gi->alert.ref_count[gisc]--;
+        if (gi->alert.ref_count[gisc] == 0) {
+                gi->alert.mask &= ~(0x80 >> gisc);
+                gisa_set_iam(gi->origin, gi->alert.mask);
+        }
+out:
+        spin_unlock(&gi->alert.ref_lock);
+
+        return rc;
+}
+EXPORT_SYMBOL_GPL(kvm_s390_gisc_unregister);
+
+static void gib_alert_irq_handler(struct airq_struct *airq)
+{
+        inc_irq_stat(IRQIO_GAL);
+        process_gib_alert_list();
+}
+
+static struct airq_struct gib_alert_irq = {
+        .handler = gib_alert_irq_handler,
+        .lsi_ptr = &gib_alert_irq.lsi_mask,
+};
+
+void kvm_s390_gib_destroy(void)
+{
+        if (!gib)
                 return;
-        kvm->arch.gisa = NULL;
+        chsc_sgib(0);
+        unregister_adapter_interrupt(&gib_alert_irq);
+        free_page((unsigned long)gib);
+        gib = NULL;
+}
+
+int kvm_s390_gib_init(u8 nisc)
+{
+        int rc = 0;
+
+        if (!css_general_characteristics.aiv) {
+                KVM_EVENT(3, "%s", "gib not initialized, no AIV facility");
+                goto out;
+        }
+
+        gib = (struct kvm_s390_gib *)get_zeroed_page(GFP_KERNEL | GFP_DMA);
+        if (!gib) {
+                rc = -ENOMEM;
+                goto out;
+        }
+
+        gib_alert_irq.isc = nisc;
+        if (register_adapter_interrupt(&gib_alert_irq)) {
+                pr_err("Registering the GIB alert interruption handler failed\n");
+                rc = -EIO;
+                goto out_free_gib;
+        }
+
+        gib->nisc = nisc;
+        if (chsc_sgib((u32)(u64)gib)) {
+                pr_err("Associating the GIB with the AIV facility failed\n");
+                free_page((unsigned long)gib);
+                gib = NULL;
+                rc = -EIO;
+                goto out_unreg_gal;
+        }
+
+        KVM_EVENT(3, "gib 0x%pK (nisc=%d) initialized", gib, gib->nisc);
+        goto out;
+
+out_unreg_gal:
+        unregister_adapter_interrupt(&gib_alert_irq);
+out_free_gib:
+        free_page((unsigned long)gib);
+        gib = NULL;
+out:
+        return rc;
 }
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 7f4bc58a53b9..4638303ba6a8 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -432,11 +432,18 @@ int kvm_arch_init(void *opaque)
         /* Register floating interrupt controller interface. */
         rc = kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC);
         if (rc) {
-                pr_err("Failed to register FLIC rc=%d\n", rc);
+                pr_err("A FLIC registration call failed with rc=%d\n", rc);
                 goto out_debug_unreg;
         }
+
+        rc = kvm_s390_gib_init(GAL_ISC);
+        if (rc)
+                goto out_gib_destroy;
+
         return 0;
 
+out_gib_destroy:
+        kvm_s390_gib_destroy();
 out_debug_unreg:
         debug_unregister(kvm_s390_dbf);
         return rc;
@@ -444,6 +451,7 @@ out_debug_unreg:
 
 void kvm_arch_exit(void)
 {
+        kvm_s390_gib_destroy();
         debug_unregister(kvm_s390_dbf);
 }
 
@@ -1258,11 +1266,65 @@ static int kvm_s390_set_processor_feat(struct kvm *kvm,
 static int kvm_s390_set_processor_subfunc(struct kvm *kvm,
                                           struct kvm_device_attr *attr)
 {
-        /*
-         * Once supported by kernel + hw, we have to store the subfunctions
-         * in kvm->arch and remember that user space configured them.
-         */
-        return -ENXIO;
+        mutex_lock(&kvm->lock);
+        if (kvm->created_vcpus) {
+                mutex_unlock(&kvm->lock);
+                return -EBUSY;
+        }
+
+        if (copy_from_user(&kvm->arch.model.subfuncs, (void __user *)attr->addr,
+                           sizeof(struct kvm_s390_vm_cpu_subfunc))) {
+                mutex_unlock(&kvm->lock);
+                return -EFAULT;
+        }
+        mutex_unlock(&kvm->lock);
+
+        VM_EVENT(kvm, 3, "SET: guest PLO    subfunc 0x%16.16lx.%16.16lx.%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.plo)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.plo)[1],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.plo)[2],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.plo)[3]);
+        VM_EVENT(kvm, 3, "SET: guest PTFF   subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.ptff)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.ptff)[1]);
+        VM_EVENT(kvm, 3, "SET: guest KMAC   subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kmac)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kmac)[1]);
+        VM_EVENT(kvm, 3, "SET: guest KMC    subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kmc)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kmc)[1]);
+        VM_EVENT(kvm, 3, "SET: guest KM     subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.km)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.km)[1]);
+        VM_EVENT(kvm, 3, "SET: guest KIMD   subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kimd)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kimd)[1]);
+        VM_EVENT(kvm, 3, "SET: guest KLMD   subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.klmd)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.klmd)[1]);
+        VM_EVENT(kvm, 3, "SET: guest PCKMO  subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.pckmo)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.pckmo)[1]);
+        VM_EVENT(kvm, 3, "SET: guest KMCTR  subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kmctr)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kmctr)[1]);
+        VM_EVENT(kvm, 3, "SET: guest KMF    subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kmf)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kmf)[1]);
+        VM_EVENT(kvm, 3, "SET: guest KMO    subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kmo)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kmo)[1]);
+        VM_EVENT(kvm, 3, "SET: guest PCC    subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.pcc)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.pcc)[1]);
+        VM_EVENT(kvm, 3, "SET: guest PPNO   subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.ppno)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.ppno)[1]);
+        VM_EVENT(kvm, 3, "SET: guest KMA    subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kma)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kma)[1]);
+
+        return 0;
 }
 
 static int kvm_s390_set_cpu_model(struct kvm *kvm, struct kvm_device_attr *attr)
@@ -1381,12 +1443,56 @@ static int kvm_s390_get_machine_feat(struct kvm *kvm,
 static int kvm_s390_get_processor_subfunc(struct kvm *kvm,
                                           struct kvm_device_attr *attr)
 {
-        /*
-         * Once we can actually configure subfunctions (kernel + hw support),
-         * we have to check if they were already set by user space, if so copy
-         * them from kvm->arch.
-         */
-        return -ENXIO;
+        if (copy_to_user((void __user *)attr->addr, &kvm->arch.model.subfuncs,
+            sizeof(struct kvm_s390_vm_cpu_subfunc)))
+                return -EFAULT;
+
+        VM_EVENT(kvm, 3, "GET: guest PLO    subfunc 0x%16.16lx.%16.16lx.%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.plo)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.plo)[1],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.plo)[2],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.plo)[3]);
+        VM_EVENT(kvm, 3, "GET: guest PTFF   subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.ptff)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.ptff)[1]);
+        VM_EVENT(kvm, 3, "GET: guest KMAC   subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kmac)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kmac)[1]);
+        VM_EVENT(kvm, 3, "GET: guest KMC    subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kmc)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kmc)[1]);
+        VM_EVENT(kvm, 3, "GET: guest KM     subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.km)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.km)[1]);
+        VM_EVENT(kvm, 3, "GET: guest KIMD   subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kimd)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kimd)[1]);
+        VM_EVENT(kvm, 3, "GET: guest KLMD   subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.klmd)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.klmd)[1]);
+        VM_EVENT(kvm, 3, "GET: guest PCKMO  subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.pckmo)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.pckmo)[1]);
+        VM_EVENT(kvm, 3, "GET: guest KMCTR  subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kmctr)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kmctr)[1]);
+        VM_EVENT(kvm, 3, "GET: guest KMF    subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kmf)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kmf)[1]);
+        VM_EVENT(kvm, 3, "GET: guest KMO    subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kmo)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kmo)[1]);
+        VM_EVENT(kvm, 3, "GET: guest PCC    subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.pcc)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.pcc)[1]);
+        VM_EVENT(kvm, 3, "GET: guest PPNO   subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.ppno)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.ppno)[1]);
+        VM_EVENT(kvm, 3, "GET: guest KMA    subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kma)[0],
+                 ((unsigned long *) &kvm->arch.model.subfuncs.kma)[1]);
+
+        return 0;
 }
 
 static int kvm_s390_get_machine_subfunc(struct kvm *kvm,
@@ -1395,8 +1501,55 @@ static int kvm_s390_get_machine_subfunc(struct kvm *kvm,
         if (copy_to_user((void __user *)attr->addr, &kvm_s390_available_subfunc,
             sizeof(struct kvm_s390_vm_cpu_subfunc)))
                 return -EFAULT;
+
+        VM_EVENT(kvm, 3, "GET: host  PLO    subfunc 0x%16.16lx.%16.16lx.%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm_s390_available_subfunc.plo)[0],
+                 ((unsigned long *) &kvm_s390_available_subfunc.plo)[1],
+                 ((unsigned long *) &kvm_s390_available_subfunc.plo)[2],
+                 ((unsigned long *) &kvm_s390_available_subfunc.plo)[3]);
+        VM_EVENT(kvm, 3, "GET: host  PTFF   subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm_s390_available_subfunc.ptff)[0],
+                 ((unsigned long *) &kvm_s390_available_subfunc.ptff)[1]);
+        VM_EVENT(kvm, 3, "GET: host  KMAC   subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm_s390_available_subfunc.kmac)[0],
+                 ((unsigned long *) &kvm_s390_available_subfunc.kmac)[1]);
+        VM_EVENT(kvm, 3, "GET: host  KMC    subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm_s390_available_subfunc.kmc)[0],
+                 ((unsigned long *) &kvm_s390_available_subfunc.kmc)[1]);
+        VM_EVENT(kvm, 3, "GET: host  KM     subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm_s390_available_subfunc.km)[0],
+                 ((unsigned long *) &kvm_s390_available_subfunc.km)[1]);
+        VM_EVENT(kvm, 3, "GET: host  KIMD   subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm_s390_available_subfunc.kimd)[0],
+                 ((unsigned long *) &kvm_s390_available_subfunc.kimd)[1]);
+        VM_EVENT(kvm, 3, "GET: host  KLMD   subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm_s390_available_subfunc.klmd)[0],
+                 ((unsigned long *) &kvm_s390_available_subfunc.klmd)[1]);
+        VM_EVENT(kvm, 3, "GET: host  PCKMO  subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm_s390_available_subfunc.pckmo)[0],
+                 ((unsigned long *) &kvm_s390_available_subfunc.pckmo)[1]);
+        VM_EVENT(kvm, 3, "GET: host  KMCTR  subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm_s390_available_subfunc.kmctr)[0],
+                 ((unsigned long *) &kvm_s390_available_subfunc.kmctr)[1]);
+        VM_EVENT(kvm, 3, "GET: host  KMF    subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm_s390_available_subfunc.kmf)[0],
+                 ((unsigned long *) &kvm_s390_available_subfunc.kmf)[1]);
+        VM_EVENT(kvm, 3, "GET: host  KMO    subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm_s390_available_subfunc.kmo)[0],
+                 ((unsigned long *) &kvm_s390_available_subfunc.kmo)[1]);
+        VM_EVENT(kvm, 3, "GET: host  PCC    subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm_s390_available_subfunc.pcc)[0],
+                 ((unsigned long *) &kvm_s390_available_subfunc.pcc)[1]);
+        VM_EVENT(kvm, 3, "GET: host  PPNO   subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm_s390_available_subfunc.ppno)[0],
+                 ((unsigned long *) &kvm_s390_available_subfunc.ppno)[1]);
+        VM_EVENT(kvm, 3, "GET: host  KMA    subfunc 0x%16.16lx.%16.16lx",
+                 ((unsigned long *) &kvm_s390_available_subfunc.kma)[0],
+                 ((unsigned long *) &kvm_s390_available_subfunc.kma)[1]);
+
         return 0;
 }
+
 static int kvm_s390_get_cpu_model(struct kvm *kvm, struct kvm_device_attr *attr)
 {
         int ret = -ENXIO;
@@ -1514,10 +1667,9 @@ static int kvm_s390_vm_has_attr(struct kvm *kvm, struct kvm_device_attr *attr)
                 case KVM_S390_VM_CPU_PROCESSOR_FEAT:
                 case KVM_S390_VM_CPU_MACHINE_FEAT:
                 case KVM_S390_VM_CPU_MACHINE_SUBFUNC:
+                case KVM_S390_VM_CPU_PROCESSOR_SUBFUNC:
                         ret = 0;
                         break;
-                /* configuring subfunctions is not supported yet */
-                case KVM_S390_VM_CPU_PROCESSOR_SUBFUNC:
                 default:
                         ret = -ENXIO;
                         break;
@@ -2209,6 +2361,7 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
         if (!kvm->arch.sie_page2)
                 goto out_err;
 
+        kvm->arch.sie_page2->kvm = kvm;
         kvm->arch.model.fac_list = kvm->arch.sie_page2->fac_list;
 
         for (i = 0; i < kvm_s390_fac_size(); i++) {
@@ -2218,6 +2371,7 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
                 kvm->arch.model.fac_list[i] = S390_lowcore.stfle_fac_list[i] &
                                               kvm_s390_fac_base[i];
         }
+        kvm->arch.model.subfuncs = kvm_s390_available_subfunc;
 
         /* we are always in czam mode - even on pre z14 machines */
         set_kvm_facility(kvm->arch.model.fac_mask, 138);
@@ -2812,7 +2966,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm,
 
         vcpu->arch.sie_block->icpua = id;
         spin_lock_init(&vcpu->arch.local_int.lock);
-        vcpu->arch.sie_block->gd = (u32)(u64)kvm->arch.gisa;
+        vcpu->arch.sie_block->gd = (u32)(u64)kvm->arch.gisa_int.origin;
         if (vcpu->arch.sie_block->gd && sclp.has_gisaf)
                 vcpu->arch.sie_block->gd |= GISA_FORMAT1;
         seqcount_init(&vcpu->arch.cputm_seqcount);
@@ -3458,6 +3612,8 @@ static int vcpu_pre_run(struct kvm_vcpu *vcpu)
                 kvm_s390_patch_guest_per_regs(vcpu);
         }
 
+        clear_bit(vcpu->vcpu_id, vcpu->kvm->arch.gisa_int.kicked_mask);
+
         vcpu->arch.sie_block->icptcode = 0;
         cpuflags = atomic_read(&vcpu->arch.sie_block->cpuflags);
         VCPU_EVENT(vcpu, 6, "entering sie flags %x", cpuflags);
@@ -4293,12 +4449,12 @@ static int __init kvm_s390_init(void)
         int i;
 
         if (!sclp.has_sief2) {
-                pr_info("SIE not available\n");
+                pr_info("SIE is not available\n");
                 return -ENODEV;
         }
 
         if (nested && hpage) {
-                pr_info("nested (vSIE) and hpage (huge page backing) can currently not be activated concurrently");
+                pr_info("A KVM host that supports nesting cannot back its KVM guests with huge pages\n");
                 return -EINVAL;
         }
 
diff --git a/arch/s390/kvm/kvm-s390.h b/arch/s390/kvm/kvm-s390.h
index 1f6e36cdce0d..6d9448dbd052 100644
--- a/arch/s390/kvm/kvm-s390.h
+++ b/arch/s390/kvm/kvm-s390.h
@@ -67,7 +67,7 @@ static inline int is_vcpu_stopped(struct kvm_vcpu *vcpu)
 
 static inline int is_vcpu_idle(struct kvm_vcpu *vcpu)
 {
-        return test_bit(vcpu->vcpu_id, vcpu->kvm->arch.float_int.idle_mask);
+        return test_bit(vcpu->vcpu_id, vcpu->kvm->arch.idle_mask);
 }
 
 static inline int kvm_is_ucontrol(struct kvm *kvm)
@@ -381,6 +381,8 @@ int kvm_s390_get_irq_state(struct kvm_vcpu *vcpu,
 void kvm_s390_gisa_init(struct kvm *kvm);
 void kvm_s390_gisa_clear(struct kvm *kvm);
 void kvm_s390_gisa_destroy(struct kvm *kvm);
+int kvm_s390_gib_init(u8 nisc);
+void kvm_s390_gib_destroy(void);
 
 /* implemented in guestdbg.c */
 void kvm_s390_backup_guest_per_regs(struct kvm_vcpu *vcpu);
diff --git a/arch/sh/include/uapi/asm/Kbuild b/arch/sh/include/uapi/asm/Kbuild
index eaa30bcd93bf..ecfbd40924dd 100644
--- a/arch/sh/include/uapi/asm/Kbuild
+++ b/arch/sh/include/uapi/asm/Kbuild
@@ -1,5 +1,4 @@
 # SPDX-License-Identifier: GPL-2.0
-include include/uapi/asm-generic/Kbuild.asm
 
 generated-y += unistd_32.h
 generic-y += kvm_para.h
diff --git a/arch/sparc/include/uapi/asm/Kbuild b/arch/sparc/include/uapi/asm/Kbuild
index 214a39acdf25..2bd5b392277c 100644
--- a/arch/sparc/include/uapi/asm/Kbuild
+++ b/arch/sparc/include/uapi/asm/Kbuild
@@ -1,4 +1,2 @@
-include include/uapi/asm-generic/Kbuild.asm
-
 generated-y += unistd_32.h
 generated-y += unistd_64.h
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index a4a41421c5e2..aca09be2373e 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -938,7 +938,7 @@ static int ubd_add(int n, char **error_out)
         ubd_dev->queue = blk_mq_init_queue(&ubd_dev->tag_set);
         if (IS_ERR(ubd_dev->queue)) {
                 err = PTR_ERR(ubd_dev->queue);
-                goto out_cleanup;
+                goto out_cleanup_tags;
         }
 
         ubd_dev->queue->queuedata = ubd_dev;
@@ -968,8 +968,8 @@ out:
 
 out_cleanup_tags:
         blk_mq_free_tag_set(&ubd_dev->tag_set);
-out_cleanup:
-        blk_cleanup_queue(ubd_dev->queue);
+        if (!(IS_ERR(ubd_dev->queue)))
+                blk_cleanup_queue(ubd_dev->queue);
         goto out;
 }
 
diff --git a/arch/um/drivers/vector_user.c b/arch/um/drivers/vector_user.c
index d2c17dd74620..b3f7b3ca896d 100644
--- a/arch/um/drivers/vector_user.c
+++ b/arch/um/drivers/vector_user.c
@@ -16,14 +16,12 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
-#include <sys/types.h>
 #include <sys/socket.h>
 #include <net/ethernet.h>
 #include <netinet/ip.h>
 #include <netinet/ether.h>
 #include <linux/if_ether.h>
 #include <linux/if_packet.h>
-#include <sys/socket.h>
 #include <sys/wait.h>
 #include <sys/uio.h>
 #include <linux/virtio_net.h>
@@ -31,7 +29,6 @@
 #include <stdlib.h>
 #include <os.h>
 #include <um_malloc.h>
-#include <sys/uio.h>
 #include "vector_user.h"
 
 #define ID_GRE 0
diff --git a/arch/unicore32/boot/compressed/Makefile b/arch/unicore32/boot/compressed/Makefile
index 9aecdd3ddc48..150fafc32fb0 100644
--- a/arch/unicore32/boot/compressed/Makefile
+++ b/arch/unicore32/boot/compressed/Makefile
@@ -61,7 +61,4 @@ $(obj)/vmlinux: $(obj)/vmlinux.lds $(obj)/head.o $(obj)/piggy.o \
 ZTEXTADDR       := 0x03000000
 ZBSSADDR        := ALIGN(4)
 
-SEDFLAGS_lds    = s/TEXT_START/$(ZTEXTADDR)/;s/BSS_START/$(ZBSSADDR)/
-$(obj)/vmlinux.lds: $(obj)/vmlinux.lds.in arch/unicore32/boot/Makefile $(KCONFIG_CONFIG)
-        @sed "$(SEDFLAGS_lds)" < $< > $@
-
+CPPFLAGS_vmlinux.lds = -DTEXT_START="$(ZTEXTADDR)" -DBSS_START="$(ZBSSADDR)"
diff --git a/arch/unicore32/boot/compressed/vmlinux.lds.in b/arch/unicore32/boot/compressed/vmlinux.lds.S
index d5a3ce296239..d5a3ce296239 100644
--- a/arch/unicore32/boot/compressed/vmlinux.lds.in
+++ b/arch/unicore32/boot/compressed/vmlinux.lds.S
diff --git a/arch/unicore32/include/uapi/asm/Kbuild b/arch/unicore32/include/uapi/asm/Kbuild
index 0febf1a07c30..755bb11323d8 100644
--- a/arch/unicore32/include/uapi/asm/Kbuild
+++ b/arch/unicore32/include/uapi/asm/Kbuild
@@ -1,4 +1,2 @@
-include include/uapi/asm-generic/Kbuild.asm
-
 generic-y += kvm_para.h
 generic-y += ucontext.h
diff --git a/arch/x86/boot/string.c b/arch/x86/boot/string.c
index 315a67b8896b..90154df8f125 100644
--- a/arch/x86/boot/string.c
+++ b/arch/x86/boot/string.c
@@ -13,8 +13,9 @@
  */
 
 #include <linux/types.h>
-#include <linux/kernel.h>
+#include <linux/compiler.h>
 #include <linux/errno.h>
+#include <linux/limits.h>
 #include <asm/asm.h>
 #include "ctype.h"
 #include "string.h"
diff --git a/arch/x86/entry/syscalls/syscall_32.tbl b/arch/x86/entry/syscalls/syscall_32.tbl
index 8da78595d69d..1f9607ed087c 100644
--- a/arch/x86/entry/syscalls/syscall_32.tbl
+++ b/arch/x86/entry/syscalls/syscall_32.tbl
@@ -429,6 +429,7 @@
 421     i386    rt_sigtimedwait_time64  sys_rt_sigtimedwait             __ia32_compat_sys_rt_sigtimedwait_time64
 422     i386    futex_time64            sys_futex                       __ia32_sys_futex
 423     i386    sched_rr_get_interval_time64    sys_sched_rr_get_interval       __ia32_sys_sched_rr_get_interval
+424     i386    pidfd_send_signal       sys_pidfd_send_signal           __ia32_sys_pidfd_send_signal
 425     i386    io_uring_setup          sys_io_uring_setup              __ia32_sys_io_uring_setup
 426     i386    io_uring_enter          sys_io_uring_enter              __ia32_sys_io_uring_enter
 427     i386    io_uring_register       sys_io_uring_register           __ia32_sys_io_uring_register
diff --git a/arch/x86/entry/syscalls/syscall_64.tbl b/arch/x86/entry/syscalls/syscall_64.tbl
index c768447f97ec..92ee0b4378d4 100644
--- a/arch/x86/entry/syscalls/syscall_64.tbl
+++ b/arch/x86/entry/syscalls/syscall_64.tbl
@@ -345,6 +345,7 @@
 334     common  rseq                    __x64_sys_rseq
 # don't use numbers 387 through 423, add new calls after the last
 # 'common' entry
+424     common  pidfd_send_signal       __x64_sys_pidfd_send_signal
 425     common  io_uring_setup          __x64_sys_io_uring_setup
 426     common  io_uring_enter          __x64_sys_io_uring_enter
 427     common  io_uring_register       __x64_sys_io_uring_register
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 35102ecdfc8d..8baa441d8000 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3410,7 +3410,7 @@ tfa_get_event_constraints(struct cpu_hw_events *cpuc, int idx,
         /*
          * Without TFA we must not use PMC3.
          */
-        if (!allow_tsx_force_abort && test_bit(3, c->idxmsk)) {
+        if (!allow_tsx_force_abort && test_bit(3, c->idxmsk) && idx >= 0) {
                 c = dyn_constraint(cpuc, c, idx);
                 c->idxmsk64 &= ~(1ULL << 3);
                 c->weight--;
@@ -4179,7 +4179,7 @@ static struct attribute *intel_pmu_caps_attrs[] = {
        NULL
 };
 
-DEVICE_BOOL_ATTR(allow_tsx_force_abort, 0644, allow_tsx_force_abort);
+static DEVICE_BOOL_ATTR(allow_tsx_force_abort, 0644, allow_tsx_force_abort);
 
 static struct attribute *intel_pmu_attrs[] = {
         &dev_attr_freeze_on_smi.attr,
diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
index b04ae6c8775e..a75955741c50 100644
--- a/arch/x86/events/perf_event.h
+++ b/arch/x86/events/perf_event.h
@@ -1033,12 +1033,12 @@ static inline int intel_pmu_init(void)
         return 0;
 }
 
-static inline int intel_cpuc_prepare(struct cpu_hw_event *cpuc, int cpu)
+static inline int intel_cpuc_prepare(struct cpu_hw_events *cpuc, int cpu)
 {
         return 0;
 }
 
-static inline void intel_cpuc_finish(struct cpu_hw_event *cpuc)
+static inline void intel_cpuc_finish(struct cpu_hw_events *cpuc)
 {
 }
 
diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
index 6461a16b4559..e4ba467a9fc6 100644
--- a/arch/x86/hyperv/hv_init.c
+++ b/arch/x86/hyperv/hv_init.c
@@ -103,9 +103,13 @@ static int hv_cpu_init(unsigned int cpu)
         u64 msr_vp_index;
         struct hv_vp_assist_page **hvp = &hv_vp_assist_page[smp_processor_id()];
         void **input_arg;
+        struct page *pg;
 
         input_arg = (void **)this_cpu_ptr(hyperv_pcpu_input_arg);
-        *input_arg = page_address(alloc_page(GFP_KERNEL));
+        pg = alloc_page(GFP_KERNEL);
+        if (unlikely(!pg))
+                return -ENOMEM;
+        *input_arg = page_address(pg);
 
         hv_get_vp_index(msr_vp_index);
 
diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
index ad7b210aa3f6..d153d570bb04 100644
--- a/arch/x86/include/asm/bitops.h
+++ b/arch/x86/include/asm/bitops.h
@@ -36,13 +36,7 @@
  * bit 0 is the LSB of addr; bit 32 is the LSB of (addr+1).
  */
 
-#if __GNUC__ < 4 || (__GNUC__ == 4 && __GNUC_MINOR__ < 1)
-/* Technically wrong, but this avoids compilation errors on some gcc
-   versions. */
-#define BITOP_ADDR(x) "=m" (*(volatile long *) (x))
-#else
 #define BITOP_ADDR(x) "+m" (*(volatile long *) (x))
-#endif
 
 #define ADDR                            BITOP_ADDR(addr)
 
diff --git a/arch/x86/include/asm/cpu_device_id.h b/arch/x86/include/asm/cpu_device_id.h
index 3417110574c1..31c379c1da41 100644
--- a/arch/x86/include/asm/cpu_device_id.h
+++ b/arch/x86/include/asm/cpu_device_id.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-#ifndef _CPU_DEVICE_ID
-#define _CPU_DEVICE_ID 1
+#ifndef _ASM_X86_CPU_DEVICE_ID
+#define _ASM_X86_CPU_DEVICE_ID
 
 /*
  * Declare drivers belonging to specific x86 CPUs
@@ -9,8 +9,6 @@
 
 #include <linux/mod_devicetable.h>
 
-extern const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match);
-
 /*
  * Match specific microcode revisions.
  *
@@ -22,21 +20,22 @@ extern const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match);
  */
 
 struct x86_cpu_desc {
-        __u8    x86_family;
-        __u8    x86_vendor;
-        __u8    x86_model;
-        __u8    x86_stepping;
-        __u32   x86_microcode_rev;
+        u8      x86_family;
+        u8      x86_vendor;
+        u8      x86_model;
+        u8      x86_stepping;
+        u32     x86_microcode_rev;
 };
 
-#define INTEL_CPU_DESC(mod, step, rev) {                        \
-        .x86_family = 6,                                        \
-        .x86_vendor = X86_VENDOR_INTEL,                         \
-        .x86_model = mod,                                       \
-        .x86_stepping = step,                                   \
-        .x86_microcode_rev = rev,                               \
+#define INTEL_CPU_DESC(model, stepping, revision) {             \
+        .x86_family             = 6,                            \
+        .x86_vendor             = X86_VENDOR_INTEL,             \
+        .x86_model              = (model),                      \
+        .x86_stepping           = (stepping),                   \
+        .x86_microcode_rev      = (revision),                   \
 }
 
+extern const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match);
 extern bool x86_cpu_has_min_microcode_rev(const struct x86_cpu_desc *table);
 
-#endif
+#endif /* _ASM_X86_CPU_DEVICE_ID */
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 180373360e34..a5db4475e72d 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -35,6 +35,7 @@
 #include <asm/msr-index.h>
 #include <asm/asm.h>
 #include <asm/kvm_page_track.h>
+#include <asm/kvm_vcpu_regs.h>
 #include <asm/hyperv-tlfs.h>
 
 #define KVM_MAX_VCPUS 288
@@ -137,23 +138,23 @@ static inline gfn_t gfn_to_index(gfn_t gfn, gfn_t base_gfn, int level)
 #define ASYNC_PF_PER_VCPU 64
 
 enum kvm_reg {
-        VCPU_REGS_RAX = 0,
-        VCPU_REGS_RCX = 1,
-        VCPU_REGS_RDX = 2,
-        VCPU_REGS_RBX = 3,
-        VCPU_REGS_RSP = 4,
-        VCPU_REGS_RBP = 5,
-        VCPU_REGS_RSI = 6,
-        VCPU_REGS_RDI = 7,
+        VCPU_REGS_RAX = __VCPU_REGS_RAX,
+        VCPU_REGS_RCX = __VCPU_REGS_RCX,
+        VCPU_REGS_RDX = __VCPU_REGS_RDX,
+        VCPU_REGS_RBX = __VCPU_REGS_RBX,
+        VCPU_REGS_RSP = __VCPU_REGS_RSP,
+        VCPU_REGS_RBP = __VCPU_REGS_RBP,
+        VCPU_REGS_RSI = __VCPU_REGS_RSI,
+        VCPU_REGS_RDI = __VCPU_REGS_RDI,
 #ifdef CONFIG_X86_64
-        VCPU_REGS_R8 = 8,
-        VCPU_REGS_R9 = 9,
-        VCPU_REGS_R10 = 10,
-        VCPU_REGS_R11 = 11,
-        VCPU_REGS_R12 = 12,
-        VCPU_REGS_R13 = 13,
-        VCPU_REGS_R14 = 14,
-        VCPU_REGS_R15 = 15,
+        VCPU_REGS_R8  = __VCPU_REGS_R8,
+        VCPU_REGS_R9  = __VCPU_REGS_R9,
+        VCPU_REGS_R10 = __VCPU_REGS_R10,
+        VCPU_REGS_R11 = __VCPU_REGS_R11,
+        VCPU_REGS_R12 = __VCPU_REGS_R12,
+        VCPU_REGS_R13 = __VCPU_REGS_R13,
+        VCPU_REGS_R14 = __VCPU_REGS_R14,
+        VCPU_REGS_R15 = __VCPU_REGS_R15,
 #endif
         VCPU_REGS_RIP,
         NR_VCPU_REGS
@@ -319,6 +320,7 @@ struct kvm_mmu_page {
         struct list_head link;
         struct hlist_node hash_link;
         bool unsync;
+        bool mmio_cached;
 
         /*
          * The following two entries are used to key the shadow page in the
@@ -333,10 +335,6 @@ struct kvm_mmu_page {
         int root_count;          /* Currently serving as active root */
         unsigned int unsync_children;
         struct kvm_rmap_head parent_ptes; /* rmap pointers to parent sptes */
-
-        /* The page is obsolete if mmu_valid_gen != kvm->arch.mmu_valid_gen.  */
-        unsigned long mmu_valid_gen;
-
         DECLARE_BITMAP(unsync_child_bitmap, 512);
 
 #ifdef CONFIG_X86_32
@@ -848,13 +846,11 @@ struct kvm_arch {
         unsigned int n_requested_mmu_pages;
         unsigned int n_max_mmu_pages;
         unsigned int indirect_shadow_pages;
-        unsigned long mmu_valid_gen;
         struct hlist_head mmu_page_hash[KVM_NUM_MMU_PAGES];
         /*
          * Hash table of struct kvm_mmu_page.
          */
         struct list_head active_mmu_pages;
-        struct list_head zapped_obsolete_pages;
         struct kvm_page_track_notifier_node mmu_sp_tracker;
         struct kvm_page_track_notifier_head track_notifier_head;
 
@@ -1255,7 +1251,7 @@ void kvm_mmu_clear_dirty_pt_masked(struct kvm *kvm,
                                    struct kvm_memory_slot *slot,
                                    gfn_t gfn_offset, unsigned long mask);
 void kvm_mmu_zap_all(struct kvm *kvm);
-void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, struct kvm_memslots *slots);
+void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, u64 gen);
 unsigned int kvm_mmu_calculate_mmu_pages(struct kvm *kvm);
 void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int kvm_nr_mmu_pages);
 
diff --git a/arch/x86/include/asm/kvm_vcpu_regs.h b/arch/x86/include/asm/kvm_vcpu_regs.h
new file mode 100644
index 000000000000..1af2cb59233b
--- /dev/null
+++ b/arch/x86/include/asm/kvm_vcpu_regs.h
@@ -0,0 +1,25 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _ASM_X86_KVM_VCPU_REGS_H
+#define _ASM_X86_KVM_VCPU_REGS_H
+
+#define __VCPU_REGS_RAX  0
+#define __VCPU_REGS_RCX  1
+#define __VCPU_REGS_RDX  2
+#define __VCPU_REGS_RBX  3
+#define __VCPU_REGS_RSP  4
+#define __VCPU_REGS_RBP  5
+#define __VCPU_REGS_RSI  6
+#define __VCPU_REGS_RDI  7
+
+#ifdef CONFIG_X86_64
+#define __VCPU_REGS_R8   8
+#define __VCPU_REGS_R9   9
+#define __VCPU_REGS_R10 10
+#define __VCPU_REGS_R11 11
+#define __VCPU_REGS_R12 12
+#define __VCPU_REGS_R13 13
+#define __VCPU_REGS_R14 14
+#define __VCPU_REGS_R15 15
+#endif
+
+#endif /* _ASM_X86_KVM_VCPU_REGS_H */
diff --git a/arch/x86/include/asm/processor-cyrix.h b/arch/x86/include/asm/processor-cyrix.h
index aaedd73ea2c6..df700a6cc869 100644
--- a/arch/x86/include/asm/processor-cyrix.h
+++ b/arch/x86/include/asm/processor-cyrix.h
@@ -3,19 +3,6 @@
  * NSC/Cyrix CPU indexed register access. Must be inlined instead of
  * macros to ensure correct access ordering
  * Access order is always 0x22 (=offset), 0x23 (=value)
- *
- * When using the old macros a line like
- *   setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x88);
- * gets expanded to:
- *  do {
- *    outb((CX86_CCR2), 0x22);
- *    outb((({
- *        outb((CX86_CCR2), 0x22);
- *        inb(0x23);
- *    }) | 0x88), 0x23);
- *  } while (0);
- *
- * which in fact violates the access order (= 0x22, 0x22, 0x23, 0x23).
  */
 
 static inline u8 getCx86(u8 reg)
@@ -29,11 +16,3 @@ static inline void setCx86(u8 reg, u8 data)
         outb(reg, 0x22);
         outb(data, 0x23);
 }
-
-#define getCx86_old(reg) ({ outb((reg), 0x22); inb(0x23); })
-
-#define setCx86_old(reg, data) do { \
-        outb((reg), 0x22); \
-        outb((data), 0x23); \
-} while (0)
-
diff --git a/arch/x86/include/asm/string_32.h b/arch/x86/include/asm/string_32.h
index 55d392c6bd29..f74362b05619 100644
--- a/arch/x86/include/asm/string_32.h
+++ b/arch/x86/include/asm/string_32.h
@@ -179,14 +179,7 @@ static inline void *__memcpy3d(void *to, const void *from, size_t len)
  *      No 3D Now!
  */
 
-#if (__GNUC__ >= 4)
 #define memcpy(t, f, n) __builtin_memcpy(t, f, n)
-#else
-#define memcpy(t, f, n)                         \
-        (__builtin_constant_p((n))              \
-         ? __constant_memcpy((t), (f), (n))     \
-         : __memcpy((t), (f), (n)))
-#endif
 
 #endif
 #endif /* !CONFIG_FORTIFY_SOURCE */
@@ -216,29 +209,6 @@ static inline void *__memset_generic(void *s, char c, size_t count)
 /* we might want to write optimized versions of these later */
 #define __constant_count_memset(s, c, count) __memset_generic((s), (c), (count))
 
-/*
- * memset(x, 0, y) is a reasonably common thing to do, so we want to fill
- * things 32 bits at a time even when we don't know the size of the
- * area at compile-time..
- */
-static __always_inline
-void *__constant_c_memset(void *s, unsigned long c, size_t count)
-{
-        int d0, d1;
-        asm volatile("rep ; stosl\n\t"
-                     "testb $2,%b3\n\t"
-                     "je 1f\n\t"
-                     "stosw\n"
-                     "1:\ttestb $1,%b3\n\t"
-                     "je 2f\n\t"
-                     "stosb\n"
-                     "2:"
-                     : "=&c" (d0), "=&D" (d1)
-                     : "a" (c), "q" (count), "0" (count/4), "1" ((long)s)
-                     : "memory");
-        return s;
-}
-
 /* Added by Gertjan van Wingerde to make minix and sysv module work */
 #define __HAVE_ARCH_STRNLEN
 extern size_t strnlen(const char *s, size_t count);
@@ -247,72 +217,6 @@ extern size_t strnlen(const char *s, size_t count);
 #define __HAVE_ARCH_STRSTR
 extern char *strstr(const char *cs, const char *ct);
 
-/*
- * This looks horribly ugly, but the compiler can optimize it totally,
- * as we by now know that both pattern and count is constant..
- */
-static __always_inline
-void *__constant_c_and_count_memset(void *s, unsigned long pattern,
-                                    size_t count)
-{
-        switch (count) {
-        case 0:
-                return s;
-        case 1:
-                *(unsigned char *)s = pattern & 0xff;
-                return s;
-        case 2:
-                *(unsigned short *)s = pattern & 0xffff;
-                return s;
-        case 3:
-                *(unsigned short *)s = pattern & 0xffff;
-                *((unsigned char *)s + 2) = pattern & 0xff;
-                return s;
-        case 4:
-                *(unsigned long *)s = pattern;
-                return s;
-        }
-
-#define COMMON(x)                                                       \
-        asm volatile("rep ; stosl"                                      \
-                     x                                                  \
-                     : "=&c" (d0), "=&D" (d1)                           \
-                     : "a" (eax), "0" (count/4), "1" ((long)s)  \
-                     : "memory")
-
-        {
-                int d0, d1;
-#if __GNUC__ == 4 && __GNUC_MINOR__ == 0
-                /* Workaround for broken gcc 4.0 */
-                register unsigned long eax asm("%eax") = pattern;
-#else
-                unsigned long eax = pattern;
-#endif
-
-                switch (count % 4) {
-                case 0:
-                        COMMON("");
-                        return s;
-                case 1:
-                        COMMON("\n\tstosb");
-                        return s;
-                case 2:
-                        COMMON("\n\tstosw");
-                        return s;
-                default:
-                        COMMON("\n\tstosw\n\tstosb");
-                        return s;
-                }
-        }
-
-#undef COMMON
-}
-
-#define __constant_c_x_memset(s, c, count)                      \
-        (__builtin_constant_p(count)                            \
-         ? __constant_c_and_count_memset((s), (c), (count))     \
-         : __constant_c_memset((s), (c), (count)))
-
 #define __memset(s, c, count)                           \
         (__builtin_constant_p(count)                    \
          ? __constant_count_memset((s), (c), (count))   \
@@ -321,15 +225,7 @@ void *__constant_c_and_count_memset(void *s, unsigned long pattern,
 #define __HAVE_ARCH_MEMSET
 extern void *memset(void *, int, size_t);
 #ifndef CONFIG_FORTIFY_SOURCE
-#if (__GNUC__ >= 4)
 #define memset(s, c, count) __builtin_memset(s, c, count)
-#else
-#define memset(s, c, count)                                             \
-        (__builtin_constant_p(c)                                        \
-         ? __constant_c_x_memset((s), (0x01010101UL * (unsigned char)(c)), \
-                                 (count))                               \
-         : __memset((s), (c), (count)))
-#endif
 #endif /* !CONFIG_FORTIFY_SOURCE */
 
 #define __HAVE_ARCH_MEMSET16
diff --git a/arch/x86/include/asm/string_64.h b/arch/x86/include/asm/string_64.h
index 4e4194e21a09..75314c3dbe47 100644
--- a/arch/x86/include/asm/string_64.h
+++ b/arch/x86/include/asm/string_64.h
@@ -14,21 +14,6 @@
 extern void *memcpy(void *to, const void *from, size_t len);
 extern void *__memcpy(void *to, const void *from, size_t len);
 
-#ifndef CONFIG_FORTIFY_SOURCE
-#if (__GNUC__ == 4 && __GNUC_MINOR__ < 3) || __GNUC__ < 4
-#define memcpy(dst, src, len)                                   \
-({                                                              \
-        size_t __len = (len);                                   \
-        void *__ret;                                            \
-        if (__builtin_constant_p(len) && __len >= 64)           \
-                __ret = __memcpy((dst), (src), __len);          \
-        else                                                    \
-                __ret = __builtin_memcpy((dst), (src), __len);  \
-        __ret;                                                  \
-})
-#endif
-#endif /* !CONFIG_FORTIFY_SOURCE */
-
 #define __HAVE_ARCH_MEMSET
 void *memset(void *s, int c, size_t n);
 void *__memset(void *s, int c, size_t n);
diff --git a/arch/x86/include/uapi/asm/Kbuild b/arch/x86/include/uapi/asm/Kbuild
index efe701b7c6ce..59b5ad310f78 100644
--- a/arch/x86/include/uapi/asm/Kbuild
+++ b/arch/x86/include/uapi/asm/Kbuild
@@ -1,6 +1,3 @@
-include include/uapi/asm-generic/Kbuild.asm
-
 generated-y += unistd_32.h
 generated-y += unistd_64.h
 generated-y += unistd_x32.h
-generic-y += socket.h
diff --git a/arch/x86/kernel/aperture_64.c b/arch/x86/kernel/aperture_64.c
index 58176b56354e..294ed4392a0e 100644
--- a/arch/x86/kernel/aperture_64.c
+++ b/arch/x86/kernel/aperture_64.c
@@ -14,6 +14,7 @@
 #define pr_fmt(fmt) "AGP: " fmt
 
 #include <linux/kernel.h>
+#include <linux/kcore.h>
 #include <linux/types.h>
 #include <linux/init.h>
 #include <linux/memblock.h>
@@ -57,7 +58,7 @@ int fallback_aper_force __initdata;
 
 int fix_aperture __initdata = 1;
 
-#ifdef CONFIG_PROC_VMCORE
+#if defined(CONFIG_PROC_VMCORE) || defined(CONFIG_PROC_KCORE)
 /*
  * If the first kernel maps the aperture over e820 RAM, the kdump kernel will
  * use the same range because it will remain configured in the northbridge.
@@ -66,20 +67,25 @@ int fix_aperture __initdata = 1;
  */
 static unsigned long aperture_pfn_start, aperture_page_count;
 
-static int gart_oldmem_pfn_is_ram(unsigned long pfn)
+static int gart_mem_pfn_is_ram(unsigned long pfn)
 {
         return likely((pfn < aperture_pfn_start) ||
                       (pfn >= aperture_pfn_start + aperture_page_count));
 }
 
-static void exclude_from_vmcore(u64 aper_base, u32 aper_order)
+static void __init exclude_from_core(u64 aper_base, u32 aper_order)
 {
         aperture_pfn_start = aper_base >> PAGE_SHIFT;
         aperture_page_count = (32 * 1024 * 1024) << aper_order >> PAGE_SHIFT;
-        WARN_ON(register_oldmem_pfn_is_ram(&gart_oldmem_pfn_is_ram));
+#ifdef CONFIG_PROC_VMCORE
+        WARN_ON(register_oldmem_pfn_is_ram(&gart_mem_pfn_is_ram));
+#endif
+#ifdef CONFIG_PROC_KCORE
+        WARN_ON(register_mem_pfn_is_ram(&gart_mem_pfn_is_ram));
+#endif
 }
 #else
-static void exclude_from_vmcore(u64 aper_base, u32 aper_order)
+static void exclude_from_core(u64 aper_base, u32 aper_order)
 {
 }
 #endif
@@ -474,7 +480,7 @@ out:
                          * may have allocated the range over its e820 RAM
                          * and fixed up the northbridge
                          */
-                        exclude_from_vmcore(last_aper_base, last_aper_order);
+                        exclude_from_core(last_aper_base, last_aper_order);
 
                         return 1;
                 }
@@ -520,7 +526,7 @@ out:
          * overlap with the first kernel's memory. We can't access the
          * range through vmcore even though it should be part of the dump.
          */
-        exclude_from_vmcore(aper_alloc, aper_order);
+        exclude_from_core(aper_alloc, aper_order);
 
         /* Fix up the north bridges */
         for (i = 0; i < amd_nb_bus_dev_ranges[i].dev_limit; i++) {
diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
index d12226f60168..1d9b8aaea06c 100644
--- a/arch/x86/kernel/cpu/cyrix.c
+++ b/arch/x86/kernel/cpu/cyrix.c
@@ -124,7 +124,7 @@ static void set_cx86_reorder(void)
         setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10); /* enable MAPEN */
 
         /* Load/Store Serialize to mem access disable (=reorder it) */
-        setCx86_old(CX86_PCR0, getCx86_old(CX86_PCR0) & ~0x80);
+        setCx86(CX86_PCR0, getCx86(CX86_PCR0) & ~0x80);
         /* set load/store serialize from 1GB to 4GB */
         ccr3 |= 0xe0;
         setCx86(CX86_CCR3, ccr3);
@@ -135,11 +135,11 @@ static void set_cx86_memwb(void)
         pr_info("Enable Memory-Write-back mode on Cyrix/NSC processor.\n");
 
         /* CCR2 bit 2: unlock NW bit */
-        setCx86_old(CX86_CCR2, getCx86_old(CX86_CCR2) & ~0x04);
+        setCx86(CX86_CCR2, getCx86(CX86_CCR2) & ~0x04);
         /* set 'Not Write-through' */
         write_cr0(read_cr0() | X86_CR0_NW);
         /* CCR2 bit 2: lock NW bit and set WT1 */
-        setCx86_old(CX86_CCR2, getCx86_old(CX86_CCR2) | 0x14);
+        setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x14);
 }
 
 /*
@@ -153,14 +153,14 @@ static void geode_configure(void)
         local_irq_save(flags);
 
         /* Suspend on halt power saving and enable #SUSP pin */
-        setCx86_old(CX86_CCR2, getCx86_old(CX86_CCR2) | 0x88);
+        setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x88);
 
         ccr3 = getCx86(CX86_CCR3);
         setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10);       /* enable MAPEN */
 
 
         /* FPU fast, DTE cache, Mem bypass */
-        setCx86_old(CX86_CCR4, getCx86_old(CX86_CCR4) | 0x38);
+        setCx86(CX86_CCR4, getCx86(CX86_CCR4) | 0x38);
         setCx86(CX86_CCR3, ccr3);                       /* disable MAPEN */
 
         set_cx86_memwb();
@@ -296,7 +296,7 @@ static void init_cyrix(struct cpuinfo_x86 *c)
                 /* GXm supports extended cpuid levels 'ala' AMD */
                 if (c->cpuid_level == 2) {
                         /* Enable cxMMX extensions (GX1 Datasheet 54) */
-                        setCx86_old(CX86_CCR7, getCx86_old(CX86_CCR7) | 1);
+                        setCx86(CX86_CCR7, getCx86(CX86_CCR7) | 1);
 
                         /*
                          * GXm : 0x30 ... 0x5f GXm  datasheet 51
@@ -319,7 +319,7 @@ static void init_cyrix(struct cpuinfo_x86 *c)
                 if (dir1 > 7) {
                         dir0_msn++;  /* M II */
                         /* Enable MMX extensions (App note 108) */
-                        setCx86_old(CX86_CCR7, getCx86_old(CX86_CCR7)|1);
+                        setCx86(CX86_CCR7, getCx86(CX86_CCR7)|1);
                 } else {
                         /* A 6x86MX - it has the bug. */
                         set_cpu_bug(c, X86_BUG_COMA);
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index 97f9ada9ceda..5260185cbf7b 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -608,6 +608,8 @@ static int microcode_reload_late(void)
         if (ret > 0)
                 microcode_check();
 
+        pr_info("Reload completed, microcode revision: 0x%x\n", boot_cpu_data.microcode);
+
         return ret;
 }
 
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index dfd3aca82c61..fb32925a2e62 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -905,6 +905,8 @@ int __init hpet_enable(void)
                 return 0;
 
         hpet_set_mapping();
+        if (!hpet_virt_address)
+                return 0;
 
         /*
          * Read the period and check for a sane value:
diff --git a/arch/x86/kernel/hw_breakpoint.c b/arch/x86/kernel/hw_breakpoint.c
index ff9bfd40429e..d73083021002 100644
--- a/arch/x86/kernel/hw_breakpoint.c
+++ b/arch/x86/kernel/hw_breakpoint.c
@@ -354,6 +354,7 @@ int hw_breakpoint_arch_parse(struct perf_event *bp,
 #endif
         default:
                 WARN_ON_ONCE(1);
+                return -EINVAL;
         }
 
         /*
diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
index e811d4d1c824..904494b924c1 100644
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c
@@ -104,12 +104,8 @@ static u64 kvm_sched_clock_read(void)
 
 static inline void kvm_sched_clock_init(bool stable)
 {
-        if (!stable) {
-                pv_ops.time.sched_clock = kvm_clock_read;
+        if (!stable)
                 clear_sched_clock_stable();
-                return;
-        }
-
         kvm_sched_clock_offset = kvm_clock_read();
         pv_ops.time.sched_clock = kvm_sched_clock_read;
 
@@ -355,6 +351,20 @@ void __init kvmclock_init(void)
         machine_ops.crash_shutdown  = kvm_crash_shutdown;
 #endif
         kvm_get_preset_lpj();
+
+        /*
+         * X86_FEATURE_NONSTOP_TSC is TSC runs at constant rate
+         * with P/T states and does not stop in deep C-states.
+         *
+         * Invariant TSC exposed by host means kvmclock is not necessary:
+         * can use TSC as clocksource.
+         *
+         */
+        if (boot_cpu_has(X86_FEATURE_CONSTANT_TSC) &&
+            boot_cpu_has(X86_FEATURE_NONSTOP_TSC) &&
+            !check_tsc_unstable())
+                kvm_clock.rating = 299;
+
         clocksource_register_hz(&kvm_clock, NSEC_PER_SEC);
         pv_info.name = "KVM";
 }
diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
index 3482460d984d..1bfe5c6e6cfe 100644
--- a/arch/x86/kernel/mpparse.c
+++ b/arch/x86/kernel/mpparse.c
@@ -598,8 +598,8 @@ static int __init smp_scan_config(unsigned long base, unsigned long length)
                         mpf_base = base;
                         mpf_found = true;
 
-                        pr_info("found SMP MP-table at [mem %#010lx-%#010lx] mapped at [%p]\n",
-                                base, base + sizeof(*mpf) - 1, mpf);
+                        pr_info("found SMP MP-table at [mem %#010lx-%#010lx]\n",
+                                base, base + sizeof(*mpf) - 1);
 
                         memblock_reserve(base, sizeof(*mpf));
                         if (mpf->physptr)
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index c07958b59f50..fd3951638ae4 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -405,7 +405,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
                 F(AVX512VBMI) | F(LA57) | F(PKU) | 0 /*OSPKE*/ |
                 F(AVX512_VPOPCNTDQ) | F(UMIP) | F(AVX512_VBMI2) | F(GFNI) |
                 F(VAES) | F(VPCLMULQDQ) | F(AVX512_VNNI) | F(AVX512_BITALG) |
-                F(CLDEMOTE);
+                F(CLDEMOTE) | F(MOVDIRI) | F(MOVDIR64B);
 
         /* cpuid 7.0.edx*/
         const u32 kvm_cpuid_7_0_edx_x86_features =
diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
index 89d20ed1d2e8..27c43525a05f 100644
--- a/arch/x86/kvm/hyperv.c
+++ b/arch/x86/kvm/hyperv.c
@@ -1729,7 +1729,7 @@ static int kvm_hv_eventfd_assign(struct kvm *kvm, u32 conn_id, int fd)
 
         mutex_lock(&hv->hv_lock);
         ret = idr_alloc(&hv->conn_to_evt, eventfd, conn_id, conn_id + 1,
-                        GFP_KERNEL);
+                        GFP_KERNEL_ACCOUNT);
         mutex_unlock(&hv->hv_lock);
 
         if (ret >= 0)
diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
index af192895b1fc..4a6dc54cc12b 100644
--- a/arch/x86/kvm/i8254.c
+++ b/arch/x86/kvm/i8254.c
@@ -653,7 +653,7 @@ struct kvm_pit *kvm_create_pit(struct kvm *kvm, u32 flags)
         pid_t pid_nr;
         int ret;
 
-        pit = kzalloc(sizeof(struct kvm_pit), GFP_KERNEL);
+        pit = kzalloc(sizeof(struct kvm_pit), GFP_KERNEL_ACCOUNT);
         if (!pit)
                 return NULL;
 
diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
index bdcd4139eca9..8b38bb4868a6 100644
--- a/arch/x86/kvm/i8259.c
+++ b/arch/x86/kvm/i8259.c
@@ -583,7 +583,7 @@ int kvm_pic_init(struct kvm *kvm)
         struct kvm_pic *s;
         int ret;
 
-        s = kzalloc(sizeof(struct kvm_pic), GFP_KERNEL);
+        s = kzalloc(sizeof(struct kvm_pic), GFP_KERNEL_ACCOUNT);
         if (!s)
                 return -ENOMEM;
         spin_lock_init(&s->lock);
diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
index 4e822ad363f3..1add1bc881e2 100644
--- a/arch/x86/kvm/ioapic.c
+++ b/arch/x86/kvm/ioapic.c
@@ -622,7 +622,7 @@ int kvm_ioapic_init(struct kvm *kvm)
         struct kvm_ioapic *ioapic;
         int ret;
 
-        ioapic = kzalloc(sizeof(struct kvm_ioapic), GFP_KERNEL);
+        ioapic = kzalloc(sizeof(struct kvm_ioapic), GFP_KERNEL_ACCOUNT);
         if (!ioapic)
                 return -ENOMEM;
         spin_lock_init(&ioapic->lock);
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 4b6c2da7265c..991fdf7fc17f 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -181,7 +181,8 @@ static void recalculate_apic_map(struct kvm *kvm)
                         max_id = max(max_id, kvm_x2apic_id(vcpu->arch.apic));
 
         new = kvzalloc(sizeof(struct kvm_apic_map) +
-                           sizeof(struct kvm_lapic *) * ((u64)max_id + 1), GFP_KERNEL);
+                           sizeof(struct kvm_lapic *) * ((u64)max_id + 1),
+                           GFP_KERNEL_ACCOUNT);
 
         if (!new)
                 goto out;
@@ -2259,13 +2260,13 @@ int kvm_create_lapic(struct kvm_vcpu *vcpu)
         ASSERT(vcpu != NULL);
         apic_debug("apic_init %d\n", vcpu->vcpu_id);
 
-        apic = kzalloc(sizeof(*apic), GFP_KERNEL);
+        apic = kzalloc(sizeof(*apic), GFP_KERNEL_ACCOUNT);
         if (!apic)
                 goto nomem;
 
         vcpu->arch.apic = apic;
 
-        apic->regs = (void *)get_zeroed_page(GFP_KERNEL);
+        apic->regs = (void *)get_zeroed_page(GFP_KERNEL_ACCOUNT);
         if (!apic->regs) {
                 printk(KERN_ERR "malloc apic regs error for vcpu %x\n",
                        vcpu->vcpu_id);
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index f2d1d230d5b8..7837ab001d80 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -109,9 +109,11 @@ module_param(dbg, bool, 0644);
         (((address) >> PT32_LEVEL_SHIFT(level)) & ((1 << PT32_LEVEL_BITS) - 1))
 
 
-#define PT64_BASE_ADDR_MASK __sme_clr((((1ULL << 52) - 1) & ~(u64)(PAGE_SIZE-1)))
-#define PT64_DIR_BASE_ADDR_MASK \
-        (PT64_BASE_ADDR_MASK & ~((1ULL << (PAGE_SHIFT + PT64_LEVEL_BITS)) - 1))
+#ifdef CONFIG_DYNAMIC_PHYSICAL_MASK
+#define PT64_BASE_ADDR_MASK (physical_mask & ~(u64)(PAGE_SIZE-1))
+#else
+#define PT64_BASE_ADDR_MASK (((1ULL << 52) - 1) & ~(u64)(PAGE_SIZE-1))
+#endif
 #define PT64_LVL_ADDR_MASK(level) \
         (PT64_BASE_ADDR_MASK & ~((1ULL << (PAGE_SHIFT + (((level) - 1) \
                                                 * PT64_LEVEL_BITS))) - 1))
@@ -330,53 +332,56 @@ static inline bool is_access_track_spte(u64 spte)
 }
 
 /*
- * the low bit of the generation number is always presumed to be zero.
- * This disables mmio caching during memslot updates.  The concept is
- * similar to a seqcount but instead of retrying the access we just punt
- * and ignore the cache.
+ * Due to limited space in PTEs, the MMIO generation is a 19 bit subset of
+ * the memslots generation and is derived as follows:
  *
- * spte bits 3-11 are used as bits 1-9 of the generation number,
- * the bits 52-61 are used as bits 10-19 of the generation number.
+ * Bits 0-8 of the MMIO generation are propagated to spte bits 3-11
+ * Bits 9-18 of the MMIO generation are propagated to spte bits 52-61
+ *
+ * The KVM_MEMSLOT_GEN_UPDATE_IN_PROGRESS flag is intentionally not included in
+ * the MMIO generation number, as doing so would require stealing a bit from
+ * the "real" generation number and thus effectively halve the maximum number
+ * of MMIO generations that can be handled before encountering a wrap (which
+ * requires a full MMU zap).  The flag is instead explicitly queried when
+ * checking for MMIO spte cache hits.
  */
-#define MMIO_SPTE_GEN_LOW_SHIFT         2
-#define MMIO_SPTE_GEN_HIGH_SHIFT        52
+#define MMIO_SPTE_GEN_MASK              GENMASK_ULL(18, 0)
 
-#define MMIO_GEN_SHIFT                  20
-#define MMIO_GEN_LOW_SHIFT              10
-#define MMIO_GEN_LOW_MASK               ((1 << MMIO_GEN_LOW_SHIFT) - 2)
-#define MMIO_GEN_MASK                   ((1 << MMIO_GEN_SHIFT) - 1)
+#define MMIO_SPTE_GEN_LOW_START         3
+#define MMIO_SPTE_GEN_LOW_END           11
+#define MMIO_SPTE_GEN_LOW_MASK          GENMASK_ULL(MMIO_SPTE_GEN_LOW_END, \
+                                                    MMIO_SPTE_GEN_LOW_START)
 
-static u64 generation_mmio_spte_mask(unsigned int gen)
+#define MMIO_SPTE_GEN_HIGH_START        52
+#define MMIO_SPTE_GEN_HIGH_END          61
+#define MMIO_SPTE_GEN_HIGH_MASK         GENMASK_ULL(MMIO_SPTE_GEN_HIGH_END, \
+                                                    MMIO_SPTE_GEN_HIGH_START)
+static u64 generation_mmio_spte_mask(u64 gen)
 {
         u64 mask;
 
-        WARN_ON(gen & ~MMIO_GEN_MASK);
+        WARN_ON(gen & ~MMIO_SPTE_GEN_MASK);
 
-        mask = (gen & MMIO_GEN_LOW_MASK) << MMIO_SPTE_GEN_LOW_SHIFT;
-        mask |= ((u64)gen >> MMIO_GEN_LOW_SHIFT) << MMIO_SPTE_GEN_HIGH_SHIFT;
+        mask = (gen << MMIO_SPTE_GEN_LOW_START) & MMIO_SPTE_GEN_LOW_MASK;
+        mask |= (gen << MMIO_SPTE_GEN_HIGH_START) & MMIO_SPTE_GEN_HIGH_MASK;
         return mask;
 }
 
-static unsigned int get_mmio_spte_generation(u64 spte)
+static u64 get_mmio_spte_generation(u64 spte)
 {
-        unsigned int gen;
+        u64 gen;
 
         spte &= ~shadow_mmio_mask;
 
-        gen = (spte >> MMIO_SPTE_GEN_LOW_SHIFT) & MMIO_GEN_LOW_MASK;
-        gen |= (spte >> MMIO_SPTE_GEN_HIGH_SHIFT) << MMIO_GEN_LOW_SHIFT;
+        gen = (spte & MMIO_SPTE_GEN_LOW_MASK) >> MMIO_SPTE_GEN_LOW_START;
+        gen |= (spte & MMIO_SPTE_GEN_HIGH_MASK) >> MMIO_SPTE_GEN_HIGH_START;
         return gen;
 }
 
-static unsigned int kvm_current_mmio_generation(struct kvm_vcpu *vcpu)
-{
-        return kvm_vcpu_memslots(vcpu)->generation & MMIO_GEN_MASK;
-}
-
 static void mark_mmio_spte(struct kvm_vcpu *vcpu, u64 *sptep, u64 gfn,
                            unsigned access)
 {
-        unsigned int gen = kvm_current_mmio_generation(vcpu);
+        u64 gen = kvm_vcpu_memslots(vcpu)->generation & MMIO_SPTE_GEN_MASK;
         u64 mask = generation_mmio_spte_mask(gen);
         u64 gpa = gfn << PAGE_SHIFT;
 
@@ -386,6 +391,8 @@ static void mark_mmio_spte(struct kvm_vcpu *vcpu, u64 *sptep, u64 gfn,
         mask |= (gpa & shadow_nonpresent_or_rsvd_mask)
                 << shadow_nonpresent_or_rsvd_mask_len;
 
+        page_header(__pa(sptep))->mmio_cached = true;
+
         trace_mark_mmio_spte(sptep, gfn, access, gen);
         mmu_spte_set(sptep, mask);
 }
@@ -407,7 +414,7 @@ static gfn_t get_mmio_spte_gfn(u64 spte)
 
 static unsigned get_mmio_spte_access(u64 spte)
 {
-        u64 mask = generation_mmio_spte_mask(MMIO_GEN_MASK) | shadow_mmio_mask;
+        u64 mask = generation_mmio_spte_mask(MMIO_SPTE_GEN_MASK) | shadow_mmio_mask;
         return (spte & ~mask) & ~PAGE_MASK;
 }
 
@@ -424,9 +431,13 @@ static bool set_mmio_spte(struct kvm_vcpu *vcpu, u64 *sptep, gfn_t gfn,
 
 static bool check_mmio_spte(struct kvm_vcpu *vcpu, u64 spte)
 {
-        unsigned int kvm_gen, spte_gen;
+        u64 kvm_gen, spte_gen, gen;
 
-        kvm_gen = kvm_current_mmio_generation(vcpu);
+        gen = kvm_vcpu_memslots(vcpu)->generation;
+        if (unlikely(gen & KVM_MEMSLOT_GEN_UPDATE_IN_PROGRESS))
+                return false;
+
+        kvm_gen = gen & MMIO_SPTE_GEN_MASK;
         spte_gen = get_mmio_spte_generation(spte);
 
         trace_check_mmio_spte(spte, kvm_gen, spte_gen);
@@ -959,7 +970,7 @@ static int mmu_topup_memory_cache(struct kvm_mmu_memory_cache *cache,
         if (cache->nobjs >= min)
                 return 0;
         while (cache->nobjs < ARRAY_SIZE(cache->objects)) {
-                obj = kmem_cache_zalloc(base_cache, GFP_KERNEL);
+                obj = kmem_cache_zalloc(base_cache, GFP_KERNEL_ACCOUNT);
                 if (!obj)
                         return cache->nobjs >= min ? 0 : -ENOMEM;
                 cache->objects[cache->nobjs++] = obj;
@@ -2049,12 +2060,6 @@ static struct kvm_mmu_page *kvm_mmu_alloc_page(struct kvm_vcpu *vcpu, int direct
         if (!direct)
                 sp->gfns = mmu_memory_cache_alloc(&vcpu->arch.mmu_page_cache);
         set_page_private(virt_to_page(sp->spt), (unsigned long)sp);
-
-        /*
-         * The active_mmu_pages list is the FIFO list, do not move the
-         * page until it is zapped. kvm_zap_obsolete_pages depends on
-         * this feature. See the comments in kvm_zap_obsolete_pages().
-         */
         list_add(&sp->link, &vcpu->kvm->arch.active_mmu_pages);
         kvm_mod_used_mmu_pages(vcpu->kvm, +1);
         return sp;
@@ -2195,23 +2200,15 @@ static void kvm_unlink_unsync_page(struct kvm *kvm, struct kvm_mmu_page *sp)
         --kvm->stat.mmu_unsync;
 }
 
-static int kvm_mmu_prepare_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp,
-                                    struct list_head *invalid_list);
+static bool kvm_mmu_prepare_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp,
+                                     struct list_head *invalid_list);
 static void kvm_mmu_commit_zap_page(struct kvm *kvm,
                                     struct list_head *invalid_list);
 
-/*
- * NOTE: we should pay more attention on the zapped-obsolete page
- * (is_obsolete_sp(sp) && sp->role.invalid) when you do hash list walk
- * since it has been deleted from active_mmu_pages but still can be found
- * at hast list.
- *
- * for_each_valid_sp() has skipped that kind of pages.
- */
 #define for_each_valid_sp(_kvm, _sp, _gfn)                              \
         hlist_for_each_entry(_sp,                                       \
           &(_kvm)->arch.mmu_page_hash[kvm_page_table_hashfn(_gfn)], hash_link) \
-                if (is_obsolete_sp((_kvm), (_sp)) || (_sp)->role.invalid) {    \
+                if ((_sp)->role.invalid) {    \
                 } else
 
 #define for_each_gfn_indirect_valid_sp(_kvm, _sp, _gfn)                 \
@@ -2231,18 +2228,28 @@ static bool __kvm_sync_page(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp,
         return true;
 }
 
+static bool kvm_mmu_remote_flush_or_zap(struct kvm *kvm,
+                                        struct list_head *invalid_list,
+                                        bool remote_flush)
+{
+        if (!remote_flush && !list_empty(invalid_list))
+                return false;
+
+        if (!list_empty(invalid_list))
+                kvm_mmu_commit_zap_page(kvm, invalid_list);
+        else
+                kvm_flush_remote_tlbs(kvm);
+        return true;
+}
+
 static void kvm_mmu_flush_or_zap(struct kvm_vcpu *vcpu,
                                  struct list_head *invalid_list,
                                  bool remote_flush, bool local_flush)
 {
-        if (!list_empty(invalid_list)) {
-                kvm_mmu_commit_zap_page(vcpu->kvm, invalid_list);
+        if (kvm_mmu_remote_flush_or_zap(vcpu->kvm, invalid_list, remote_flush))
                 return;
-        }
 
-        if (remote_flush)
-                kvm_flush_remote_tlbs(vcpu->kvm);
-        else if (local_flush)
+        if (local_flush)
                 kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
 }
 
@@ -2253,11 +2260,6 @@ static void kvm_mmu_audit(struct kvm_vcpu *vcpu, int point) { }
 static void mmu_audit_disable(void) { }
 #endif
 
-static bool is_obsolete_sp(struct kvm *kvm, struct kvm_mmu_page *sp)
-{
-        return unlikely(sp->mmu_valid_gen != kvm->arch.mmu_valid_gen);
-}
-
 static bool kvm_sync_page(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp,
                          struct list_head *invalid_list)
 {
@@ -2482,7 +2484,6 @@ static struct kvm_mmu_page *kvm_mmu_get_page(struct kvm_vcpu *vcpu,
                 if (level > PT_PAGE_TABLE_LEVEL && need_sync)
                         flush |= kvm_sync_pages(vcpu, gfn, &invalid_list);
         }
-        sp->mmu_valid_gen = vcpu->kvm->arch.mmu_valid_gen;
         clear_page(sp->spt);
         trace_kvm_mmu_get_page(sp, true);
 
@@ -2668,17 +2669,22 @@ static int mmu_zap_unsync_children(struct kvm *kvm,
         return zapped;
 }
 
-static int kvm_mmu_prepare_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp,
-                                    struct list_head *invalid_list)
+static bool __kvm_mmu_prepare_zap_page(struct kvm *kvm,
+                                       struct kvm_mmu_page *sp,
+                                       struct list_head *invalid_list,
+                                       int *nr_zapped)
 {
-        int ret;
+        bool list_unstable;
 
         trace_kvm_mmu_prepare_zap_page(sp);
         ++kvm->stat.mmu_shadow_zapped;
-        ret = mmu_zap_unsync_children(kvm, sp, invalid_list);
+        *nr_zapped = mmu_zap_unsync_children(kvm, sp, invalid_list);
         kvm_mmu_page_unlink_children(kvm, sp);
         kvm_mmu_unlink_parents(kvm, sp);
 
+        /* Zapping children means active_mmu_pages has become unstable. */
+        list_unstable = *nr_zapped;
+
         if (!sp->role.invalid && !sp->role.direct)
                 unaccount_shadowed(kvm, sp);
 
@@ -2686,22 +2692,27 @@ static int kvm_mmu_prepare_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp,
                 kvm_unlink_unsync_page(kvm, sp);
         if (!sp->root_count) {
                 /* Count self */
-                ret++;
+                (*nr_zapped)++;
                 list_move(&sp->link, invalid_list);
                 kvm_mod_used_mmu_pages(kvm, -1);
         } else {
                 list_move(&sp->link, &kvm->arch.active_mmu_pages);
 
-                /*
-                 * The obsolete pages can not be used on any vcpus.
-                 * See the comments in kvm_mmu_invalidate_zap_all_pages().
-                 */
-                if (!sp->role.invalid && !is_obsolete_sp(kvm, sp))
+                if (!sp->role.invalid)
                         kvm_reload_remote_mmus(kvm);
         }
 
         sp->role.invalid = 1;
-        return ret;
+        return list_unstable;
+}
+
+static bool kvm_mmu_prepare_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp,
+                                     struct list_head *invalid_list)
+{
+        int nr_zapped;
+
+        __kvm_mmu_prepare_zap_page(kvm, sp, invalid_list, &nr_zapped);
+        return nr_zapped;
 }
 
 static void kvm_mmu_commit_zap_page(struct kvm *kvm,
@@ -3703,7 +3714,7 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu)
 
                         u64 *lm_root;
 
-                        lm_root = (void*)get_zeroed_page(GFP_KERNEL);
+                        lm_root = (void*)get_zeroed_page(GFP_KERNEL_ACCOUNT);
                         if (lm_root == NULL)
                                 return 1;
 
@@ -4204,14 +4215,6 @@ static bool fast_cr3_switch(struct kvm_vcpu *vcpu, gpa_t new_cr3,
                         return false;
 
                 if (cached_root_available(vcpu, new_cr3, new_role)) {
-                        /*
-                         * It is possible that the cached previous root page is
-                         * obsolete because of a change in the MMU
-                         * generation number. However, that is accompanied by
-                         * KVM_REQ_MMU_RELOAD, which will free the root that we
-                         * have set here and allocate a new one.
-                         */
-
                         kvm_make_request(KVM_REQ_LOAD_CR3, vcpu);
                         if (!skip_tlb_flush) {
                                 kvm_make_request(KVM_REQ_MMU_SYNC, vcpu);
@@ -5486,6 +5489,76 @@ void kvm_disable_tdp(void)
 }
 EXPORT_SYMBOL_GPL(kvm_disable_tdp);
 
+
+/* The return value indicates if tlb flush on all vcpus is needed. */
+typedef bool (*slot_level_handler) (struct kvm *kvm, struct kvm_rmap_head *rmap_head);
+
+/* The caller should hold mmu-lock before calling this function. */
+static __always_inline bool
+slot_handle_level_range(struct kvm *kvm, struct kvm_memory_slot *memslot,
+                        slot_level_handler fn, int start_level, int end_level,
+                        gfn_t start_gfn, gfn_t end_gfn, bool lock_flush_tlb)
+{
+        struct slot_rmap_walk_iterator iterator;
+        bool flush = false;
+
+        for_each_slot_rmap_range(memslot, start_level, end_level, start_gfn,
+                        end_gfn, &iterator) {
+                if (iterator.rmap)
+                        flush |= fn(kvm, iterator.rmap);
+
+                if (need_resched() || spin_needbreak(&kvm->mmu_lock)) {
+                        if (flush && lock_flush_tlb) {
+                                kvm_flush_remote_tlbs(kvm);
+                                flush = false;
+                        }
+                        cond_resched_lock(&kvm->mmu_lock);
+                }
+        }
+
+        if (flush && lock_flush_tlb) {
+                kvm_flush_remote_tlbs(kvm);
+                flush = false;
+        }
+
+        return flush;
+}
+
+static __always_inline bool
+slot_handle_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
+                  slot_level_handler fn, int start_level, int end_level,
+                  bool lock_flush_tlb)
+{
+        return slot_handle_level_range(kvm, memslot, fn, start_level,
+                        end_level, memslot->base_gfn,
+                        memslot->base_gfn + memslot->npages - 1,
+                        lock_flush_tlb);
+}
+
+static __always_inline bool
+slot_handle_all_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
+                      slot_level_handler fn, bool lock_flush_tlb)
+{
+        return slot_handle_level(kvm, memslot, fn, PT_PAGE_TABLE_LEVEL,
+                                 PT_MAX_HUGEPAGE_LEVEL, lock_flush_tlb);
+}
+
+static __always_inline bool
+slot_handle_large_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
+                        slot_level_handler fn, bool lock_flush_tlb)
+{
+        return slot_handle_level(kvm, memslot, fn, PT_PAGE_TABLE_LEVEL + 1,
+                                 PT_MAX_HUGEPAGE_LEVEL, lock_flush_tlb);
+}
+
+static __always_inline bool
+slot_handle_leaf(struct kvm *kvm, struct kvm_memory_slot *memslot,
+                 slot_level_handler fn, bool lock_flush_tlb)
+{
+        return slot_handle_level(kvm, memslot, fn, PT_PAGE_TABLE_LEVEL,
+                                 PT_PAGE_TABLE_LEVEL, lock_flush_tlb);
+}
+
 static void free_mmu_pages(struct kvm_vcpu *vcpu)
 {
         free_page((unsigned long)vcpu->arch.mmu->pae_root);
@@ -5505,7 +5578,7 @@ static int alloc_mmu_pages(struct kvm_vcpu *vcpu)
          * Therefore we need to allocate shadow page tables in the first
          * 4GB of memory, which happens to fit the DMA32 zone.
          */
-        page = alloc_page(GFP_KERNEL | __GFP_DMA32);
+        page = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_DMA32);
         if (!page)
                 return -ENOMEM;
 
@@ -5543,105 +5616,62 @@ static void kvm_mmu_invalidate_zap_pages_in_memslot(struct kvm *kvm,
                         struct kvm_memory_slot *slot,
                         struct kvm_page_track_notifier_node *node)
 {
-        kvm_mmu_invalidate_zap_all_pages(kvm);
-}
-
-void kvm_mmu_init_vm(struct kvm *kvm)
-{
-        struct kvm_page_track_notifier_node *node = &kvm->arch.mmu_sp_tracker;
-
-        node->track_write = kvm_mmu_pte_write;
-        node->track_flush_slot = kvm_mmu_invalidate_zap_pages_in_memslot;
-        kvm_page_track_register_notifier(kvm, node);
-}
+        struct kvm_mmu_page *sp;
+        LIST_HEAD(invalid_list);
+        unsigned long i;
+        bool flush;
+        gfn_t gfn;
 
-void kvm_mmu_uninit_vm(struct kvm *kvm)
-{
-        struct kvm_page_track_notifier_node *node = &kvm->arch.mmu_sp_tracker;
+        spin_lock(&kvm->mmu_lock);
 
-        kvm_page_track_unregister_notifier(kvm, node);
-}
+        if (list_empty(&kvm->arch.active_mmu_pages))
+                goto out_unlock;
 
-/* The return value indicates if tlb flush on all vcpus is needed. */
-typedef bool (*slot_level_handler) (struct kvm *kvm, struct kvm_rmap_head *rmap_head);
+        flush = slot_handle_all_level(kvm, slot, kvm_zap_rmapp, false);
 
-/* The caller should hold mmu-lock before calling this function. */
-static __always_inline bool
-slot_handle_level_range(struct kvm *kvm, struct kvm_memory_slot *memslot,
-                        slot_level_handler fn, int start_level, int end_level,
-                        gfn_t start_gfn, gfn_t end_gfn, bool lock_flush_tlb)
-{
-        struct slot_rmap_walk_iterator iterator;
-        bool flush = false;
+        for (i = 0; i < slot->npages; i++) {
+                gfn = slot->base_gfn + i;
 
-        for_each_slot_rmap_range(memslot, start_level, end_level, start_gfn,
-                        end_gfn, &iterator) {
-                if (iterator.rmap)
-                        flush |= fn(kvm, iterator.rmap);
+                for_each_valid_sp(kvm, sp, gfn) {
+                        if (sp->gfn != gfn)
+                                continue;
 
+                        kvm_mmu_prepare_zap_page(kvm, sp, &invalid_list);
+                }
                 if (need_resched() || spin_needbreak(&kvm->mmu_lock)) {
-                        if (flush && lock_flush_tlb) {
-                                kvm_flush_remote_tlbs(kvm);
-                                flush = false;
-                        }
+                        kvm_mmu_remote_flush_or_zap(kvm, &invalid_list, flush);
+                        flush = false;
                         cond_resched_lock(&kvm->mmu_lock);
                 }
         }
+        kvm_mmu_remote_flush_or_zap(kvm, &invalid_list, flush);
 
-        if (flush && lock_flush_tlb) {
-                kvm_flush_remote_tlbs(kvm);
-                flush = false;
-        }
-
-        return flush;
+out_unlock:
+        spin_unlock(&kvm->mmu_lock);
 }
 
-static __always_inline bool
-slot_handle_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
-                  slot_level_handler fn, int start_level, int end_level,
-                  bool lock_flush_tlb)
+void kvm_mmu_init_vm(struct kvm *kvm)
 {
-        return slot_handle_level_range(kvm, memslot, fn, start_level,
-                        end_level, memslot->base_gfn,
-                        memslot->base_gfn + memslot->npages - 1,
-                        lock_flush_tlb);
-}
+        struct kvm_page_track_notifier_node *node = &kvm->arch.mmu_sp_tracker;
 
-static __always_inline bool
-slot_handle_all_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
-                      slot_level_handler fn, bool lock_flush_tlb)
-{
-        return slot_handle_level(kvm, memslot, fn, PT_PAGE_TABLE_LEVEL,
-                                 PT_MAX_HUGEPAGE_LEVEL, lock_flush_tlb);
+        node->track_write = kvm_mmu_pte_write;
+        node->track_flush_slot = kvm_mmu_invalidate_zap_pages_in_memslot;
+        kvm_page_track_register_notifier(kvm, node);
 }
 
-static __always_inline bool
-slot_handle_large_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
-                        slot_level_handler fn, bool lock_flush_tlb)
+void kvm_mmu_uninit_vm(struct kvm *kvm)
 {
-        return slot_handle_level(kvm, memslot, fn, PT_PAGE_TABLE_LEVEL + 1,
-                                 PT_MAX_HUGEPAGE_LEVEL, lock_flush_tlb);
-}
+        struct kvm_page_track_notifier_node *node = &kvm->arch.mmu_sp_tracker;
 
-static __always_inline bool
-slot_handle_leaf(struct kvm *kvm, struct kvm_memory_slot *memslot,
-                 slot_level_handler fn, bool lock_flush_tlb)
-{
-        return slot_handle_level(kvm, memslot, fn, PT_PAGE_TABLE_LEVEL,
-                                 PT_PAGE_TABLE_LEVEL, lock_flush_tlb);
+        kvm_page_track_unregister_notifier(kvm, node);
 }
 
 void kvm_zap_gfn_range(struct kvm *kvm, gfn_t gfn_start, gfn_t gfn_end)
 {
         struct kvm_memslots *slots;
         struct kvm_memory_slot *memslot;
-        bool flush_tlb = true;
-        bool flush = false;
         int i;
 
-        if (kvm_available_flush_tlb_with_range())
-                flush_tlb = false;
-
         spin_lock(&kvm->mmu_lock);
         for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) {
                 slots = __kvm_memslots(kvm, i);
@@ -5653,17 +5683,12 @@ void kvm_zap_gfn_range(struct kvm *kvm, gfn_t gfn_start, gfn_t gfn_end)
                         if (start >= end)
                                 continue;
 
-                        flush |= slot_handle_level_range(kvm, memslot,
-                                        kvm_zap_rmapp, PT_PAGE_TABLE_LEVEL,
-                                        PT_MAX_HUGEPAGE_LEVEL, start,
-                                        end - 1, flush_tlb);
+                        slot_handle_level_range(kvm, memslot, kvm_zap_rmapp,
+                                                PT_PAGE_TABLE_LEVEL, PT_MAX_HUGEPAGE_LEVEL,
+                                                start, end - 1, true);
                 }
         }
 
-        if (flush)
-                kvm_flush_remote_tlbs_with_address(kvm, gfn_start,
-                                gfn_end - gfn_start + 1);
-
         spin_unlock(&kvm->mmu_lock);
 }
 
@@ -5815,101 +5840,58 @@ void kvm_mmu_slot_set_dirty(struct kvm *kvm,
 }
 EXPORT_SYMBOL_GPL(kvm_mmu_slot_set_dirty);
 
-#define BATCH_ZAP_PAGES 10
-static void kvm_zap_obsolete_pages(struct kvm *kvm)
+static void __kvm_mmu_zap_all(struct kvm *kvm, bool mmio_only)
 {
         struct kvm_mmu_page *sp, *node;
-        int batch = 0;
+        LIST_HEAD(invalid_list);
+        int ign;
 
+        spin_lock(&kvm->mmu_lock);
 restart:
-        list_for_each_entry_safe_reverse(sp, node,
-              &kvm->arch.active_mmu_pages, link) {
-                int ret;
-
-                /*
-                 * No obsolete page exists before new created page since
-                 * active_mmu_pages is the FIFO list.
-                 */
-                if (!is_obsolete_sp(kvm, sp))
-                        break;
-
-                /*
-                 * Since we are reversely walking the list and the invalid
-                 * list will be moved to the head, skip the invalid page
-                 * can help us to avoid the infinity list walking.
-                 */
-                if (sp->role.invalid)
+        list_for_each_entry_safe(sp, node, &kvm->arch.active_mmu_pages, link) {
+                if (mmio_only && !sp->mmio_cached)
                         continue;
-
-                /*
-                 * Need not flush tlb since we only zap the sp with invalid
-                 * generation number.
-                 */
-                if (batch >= BATCH_ZAP_PAGES &&
-                      cond_resched_lock(&kvm->mmu_lock)) {
-                        batch = 0;
+                if (sp->role.invalid && sp->root_count)
+                        continue;
+                if (__kvm_mmu_prepare_zap_page(kvm, sp, &invalid_list, &ign)) {
+                        WARN_ON_ONCE(mmio_only);
                         goto restart;
                 }
-
-                ret = kvm_mmu_prepare_zap_page(kvm, sp,
-                                &kvm->arch.zapped_obsolete_pages);
-                batch += ret;
-
-                if (ret)
+                if (cond_resched_lock(&kvm->mmu_lock))
                         goto restart;
         }
 
-        /*
-         * Should flush tlb before free page tables since lockless-walking
-         * may use the pages.
-         */
-        kvm_mmu_commit_zap_page(kvm, &kvm->arch.zapped_obsolete_pages);
-}
-
-/*
- * Fast invalidate all shadow pages and use lock-break technique
- * to zap obsolete pages.
- *
- * It's required when memslot is being deleted or VM is being
- * destroyed, in these cases, we should ensure that KVM MMU does
- * not use any resource of the being-deleted slot or all slots
- * after calling the function.
- */
-void kvm_mmu_invalidate_zap_all_pages(struct kvm *kvm)
-{
-        spin_lock(&kvm->mmu_lock);
-        trace_kvm_mmu_invalidate_zap_all_pages(kvm);
-        kvm->arch.mmu_valid_gen++;
-
-        /*
-         * Notify all vcpus to reload its shadow page table
-         * and flush TLB. Then all vcpus will switch to new
-         * shadow page table with the new mmu_valid_gen.
-         *
-         * Note: we should do this under the protection of
-         * mmu-lock, otherwise, vcpu would purge shadow page
-         * but miss tlb flush.
-         */
-        kvm_reload_remote_mmus(kvm);
-
-        kvm_zap_obsolete_pages(kvm);
+        kvm_mmu_commit_zap_page(kvm, &invalid_list);
         spin_unlock(&kvm->mmu_lock);
 }
 
-static bool kvm_has_zapped_obsolete_pages(struct kvm *kvm)
+void kvm_mmu_zap_all(struct kvm *kvm)
 {
-        return unlikely(!list_empty_careful(&kvm->arch.zapped_obsolete_pages));
+        return __kvm_mmu_zap_all(kvm, false);
 }
 
-void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, struct kvm_memslots *slots)
+void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, u64 gen)
 {
+        WARN_ON(gen & KVM_MEMSLOT_GEN_UPDATE_IN_PROGRESS);
+
+        gen &= MMIO_SPTE_GEN_MASK;
+
         /*
-         * The very rare case: if the generation-number is round,
+         * Generation numbers are incremented in multiples of the number of
+         * address spaces in order to provide unique generations across all
+         * address spaces.  Strip what is effectively the address space
+         * modifier prior to checking for a wrap of the MMIO generation so
+         * that a wrap in any address space is detected.
+         */
+        gen &= ~((u64)KVM_ADDRESS_SPACE_NUM - 1);
+
+        /*
+         * The very rare case: if the MMIO generation number has wrapped,
          * zap all shadow pages.
          */
-        if (unlikely((slots->generation & MMIO_GEN_MASK) == 0)) {
+        if (unlikely(gen == 0)) {
                 kvm_debug_ratelimited("kvm: zapping shadow pages for mmio generation wraparound\n");
-                kvm_mmu_invalidate_zap_all_pages(kvm);
+                __kvm_mmu_zap_all(kvm, true);
         }
 }
 
@@ -5940,24 +5922,16 @@ mmu_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
                  * want to shrink a VM that only started to populate its MMU
                  * anyway.
                  */
-                if (!kvm->arch.n_used_mmu_pages &&
-                      !kvm_has_zapped_obsolete_pages(kvm))
+                if (!kvm->arch.n_used_mmu_pages)
                         continue;
 
                 idx = srcu_read_lock(&kvm->srcu);
                 spin_lock(&kvm->mmu_lock);
 
-                if (kvm_has_zapped_obsolete_pages(kvm)) {
-                        kvm_mmu_commit_zap_page(kvm,
-                              &kvm->arch.zapped_obsolete_pages);
-                        goto unlock;
-                }
-
                 if (prepare_zap_oldest_mmu_page(kvm, &invalid_list))
                         freed++;
                 kvm_mmu_commit_zap_page(kvm, &invalid_list);
 
-unlock:
                 spin_unlock(&kvm->mmu_lock);
                 srcu_read_unlock(&kvm->srcu, idx);
 
diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
index c7b333147c4a..bbdc60f2fae8 100644
--- a/arch/x86/kvm/mmu.h
+++ b/arch/x86/kvm/mmu.h
@@ -203,7 +203,6 @@ static inline u8 permission_fault(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu,
         return -(u32)fault & errcode;
 }
 
-void kvm_mmu_invalidate_zap_all_pages(struct kvm *kvm);
 void kvm_zap_gfn_range(struct kvm *kvm, gfn_t gfn_start, gfn_t gfn_end);
 
 void kvm_mmu_gfn_disallow_lpage(struct kvm_memory_slot *slot, gfn_t gfn);
diff --git a/arch/x86/kvm/mmutrace.h b/arch/x86/kvm/mmutrace.h
index c73bf4e4988c..9f6c855a0043 100644
--- a/arch/x86/kvm/mmutrace.h
+++ b/arch/x86/kvm/mmutrace.h
@@ -8,18 +8,16 @@
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM kvmmmu
 
-#define KVM_MMU_PAGE_FIELDS                     \
-        __field(unsigned long, mmu_valid_gen)   \
-        __field(__u64, gfn)                     \
-        __field(__u32, role)                    \
-        __field(__u32, root_count)              \
+#define KVM_MMU_PAGE_FIELDS \
+        __field(__u64, gfn) \
+        __field(__u32, role) \
+        __field(__u32, root_count) \
         __field(bool, unsync)
 
-#define KVM_MMU_PAGE_ASSIGN(sp)                         \
-        __entry->mmu_valid_gen = sp->mmu_valid_gen;     \
-        __entry->gfn = sp->gfn;                         \
-        __entry->role = sp->role.word;                  \
-        __entry->root_count = sp->root_count;           \
+#define KVM_MMU_PAGE_ASSIGN(sp)                      \
+        __entry->gfn = sp->gfn;                      \
+        __entry->role = sp->role.word;               \
+        __entry->root_count = sp->root_count;        \
         __entry->unsync = sp->unsync;
 
 #define KVM_MMU_PAGE_PRINTK() ({                                        \
@@ -31,9 +29,8 @@
                                                                         \
         role.word = __entry->role;                                      \
                                                                         \
-        trace_seq_printf(p, "sp gen %lx gfn %llx l%u%s q%u%s %s%s"      \
+        trace_seq_printf(p, "sp gfn %llx l%u%s q%u%s %s%s"              \
                          " %snxe %sad root %u %s%c",                    \
-                         __entry->mmu_valid_gen,                        \
                          __entry->gfn, role.level,                      \
                          role.cr4_pae ? " pae" : "",                    \
                          role.quadrant,                                 \
@@ -283,27 +280,6 @@ TRACE_EVENT(
 );
 
 TRACE_EVENT(
-        kvm_mmu_invalidate_zap_all_pages,
-        TP_PROTO(struct kvm *kvm),
-        TP_ARGS(kvm),
-
-        TP_STRUCT__entry(
-                __field(unsigned long, mmu_valid_gen)
-                __field(unsigned int, mmu_used_pages)
-        ),
-
-        TP_fast_assign(
-                __entry->mmu_valid_gen = kvm->arch.mmu_valid_gen;
-                __entry->mmu_used_pages = kvm->arch.n_used_mmu_pages;
-        ),
-
-        TP_printk("kvm-mmu-valid-gen %lx used_pages %x",
-                  __entry->mmu_valid_gen, __entry->mmu_used_pages
-        )
-);
-
-
-TRACE_EVENT(
         check_mmio_spte,
         TP_PROTO(u64 spte, unsigned int kvm_gen, unsigned int spte_gen),
         TP_ARGS(spte, kvm_gen, spte_gen),
diff --git a/arch/x86/kvm/page_track.c b/arch/x86/kvm/page_track.c
index 3052a59a3065..fd04d462fdae 100644
--- a/arch/x86/kvm/page_track.c
+++ b/arch/x86/kvm/page_track.c
@@ -42,7 +42,7 @@ int kvm_page_track_create_memslot(struct kvm_memory_slot *slot,
         for (i = 0; i < KVM_PAGE_TRACK_MAX; i++) {
                 slot->arch.gfn_track[i] =
                         kvcalloc(npages, sizeof(*slot->arch.gfn_track[i]),
-                                 GFP_KERNEL);
+                                 GFP_KERNEL_ACCOUNT);
                 if (!slot->arch.gfn_track[i])
                         goto track_free;
         }
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index f13a3a24d360..b5b128a0a051 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -145,7 +145,6 @@ struct kvm_svm {
 
         /* Struct members for AVIC */
         u32 avic_vm_id;
-        u32 ldr_mode;
         struct page *avic_logical_id_table_page;
         struct page *avic_physical_id_table_page;
         struct hlist_node hnode;
@@ -236,6 +235,7 @@ struct vcpu_svm {
         bool nrips_enabled      : 1;
 
         u32 ldr_reg;
+        u32 dfr_reg;
         struct page *avic_backing_page;
         u64 *avic_physical_id_cache;
         bool avic_is_running;
@@ -1795,9 +1795,10 @@ static struct page **sev_pin_memory(struct kvm *kvm, unsigned long uaddr,
         /* Avoid using vmalloc for smaller buffers. */
         size = npages * sizeof(struct page *);
         if (size > PAGE_SIZE)
-                pages = vmalloc(size);
+                pages = __vmalloc(size, GFP_KERNEL_ACCOUNT | __GFP_ZERO,
+                                  PAGE_KERNEL);
         else
-                pages = kmalloc(size, GFP_KERNEL);
+                pages = kmalloc(size, GFP_KERNEL_ACCOUNT);
 
         if (!pages)
                 return NULL;
@@ -1865,7 +1866,9 @@ static void __unregister_enc_region_locked(struct kvm *kvm,
 
 static struct kvm *svm_vm_alloc(void)
 {
-        struct kvm_svm *kvm_svm = vzalloc(sizeof(struct kvm_svm));
+        struct kvm_svm *kvm_svm = __vmalloc(sizeof(struct kvm_svm),
+                                            GFP_KERNEL_ACCOUNT | __GFP_ZERO,
+                                            PAGE_KERNEL);
         return &kvm_svm->kvm;
 }
 
@@ -1940,7 +1943,7 @@ static int avic_vm_init(struct kvm *kvm)
                 return 0;
 
         /* Allocating physical APIC ID table (4KB) */
-        p_page = alloc_page(GFP_KERNEL);
+        p_page = alloc_page(GFP_KERNEL_ACCOUNT);
         if (!p_page)
                 goto free_avic;
 
@@ -1948,7 +1951,7 @@ static int avic_vm_init(struct kvm *kvm)
         clear_page(page_address(p_page));
 
         /* Allocating logical APIC ID table (4KB) */
-        l_page = alloc_page(GFP_KERNEL);
+        l_page = alloc_page(GFP_KERNEL_ACCOUNT);
         if (!l_page)
                 goto free_avic;
 
@@ -2106,6 +2109,7 @@ static int avic_init_vcpu(struct vcpu_svm *svm)
 
         INIT_LIST_HEAD(&svm->ir_list);
         spin_lock_init(&svm->ir_list_lock);
+        svm->dfr_reg = APIC_DFR_FLAT;
 
         return ret;
 }
@@ -2119,13 +2123,14 @@ static struct kvm_vcpu *svm_create_vcpu(struct kvm *kvm, unsigned int id)
         struct page *nested_msrpm_pages;
         int err;
 
-        svm = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL);
+        svm = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL_ACCOUNT);
         if (!svm) {
                 err = -ENOMEM;
                 goto out;
         }
 
-        svm->vcpu.arch.guest_fpu = kmem_cache_zalloc(x86_fpu_cache, GFP_KERNEL);
+        svm->vcpu.arch.guest_fpu = kmem_cache_zalloc(x86_fpu_cache,
+                                                     GFP_KERNEL_ACCOUNT);
         if (!svm->vcpu.arch.guest_fpu) {
                 printk(KERN_ERR "kvm: failed to allocate vcpu's fpu\n");
                 err = -ENOMEM;
@@ -2137,19 +2142,19 @@ static struct kvm_vcpu *svm_create_vcpu(struct kvm *kvm, unsigned int id)
                 goto free_svm;
 
         err = -ENOMEM;
-        page = alloc_page(GFP_KERNEL);
+        page = alloc_page(GFP_KERNEL_ACCOUNT);
         if (!page)
                 goto uninit;
 
-        msrpm_pages = alloc_pages(GFP_KERNEL, MSRPM_ALLOC_ORDER);
+        msrpm_pages = alloc_pages(GFP_KERNEL_ACCOUNT, MSRPM_ALLOC_ORDER);
         if (!msrpm_pages)
                 goto free_page1;
 
-        nested_msrpm_pages = alloc_pages(GFP_KERNEL, MSRPM_ALLOC_ORDER);
+        nested_msrpm_pages = alloc_pages(GFP_KERNEL_ACCOUNT, MSRPM_ALLOC_ORDER);
         if (!nested_msrpm_pages)
                 goto free_page2;
 
-        hsave_page = alloc_page(GFP_KERNEL);
+        hsave_page = alloc_page(GFP_KERNEL_ACCOUNT);
         if (!hsave_page)
                 goto free_page3;
 
@@ -4565,8 +4570,7 @@ static u32 *avic_get_logical_id_entry(struct kvm_vcpu *vcpu, u32 ldr, bool flat)
         return &logical_apic_id_table[index];
 }
 
-static int avic_ldr_write(struct kvm_vcpu *vcpu, u8 g_physical_id, u32 ldr,
-                          bool valid)
+static int avic_ldr_write(struct kvm_vcpu *vcpu, u8 g_physical_id, u32 ldr)
 {
         bool flat;
         u32 *entry, new_entry;
@@ -4579,31 +4583,39 @@ static int avic_ldr_write(struct kvm_vcpu *vcpu, u8 g_physical_id, u32 ldr,
         new_entry = READ_ONCE(*entry);
         new_entry &= ~AVIC_LOGICAL_ID_ENTRY_GUEST_PHYSICAL_ID_MASK;
         new_entry |= (g_physical_id & AVIC_LOGICAL_ID_ENTRY_GUEST_PHYSICAL_ID_MASK);
-        if (valid)
-                new_entry |= AVIC_LOGICAL_ID_ENTRY_VALID_MASK;
-        else
-                new_entry &= ~AVIC_LOGICAL_ID_ENTRY_VALID_MASK;
+        new_entry |= AVIC_LOGICAL_ID_ENTRY_VALID_MASK;
         WRITE_ONCE(*entry, new_entry);
 
         return 0;
 }
 
+static void avic_invalidate_logical_id_entry(struct kvm_vcpu *vcpu)
+{
+        struct vcpu_svm *svm = to_svm(vcpu);
+        bool flat = svm->dfr_reg == APIC_DFR_FLAT;
+        u32 *entry = avic_get_logical_id_entry(vcpu, svm->ldr_reg, flat);
+
+        if (entry)
+                WRITE_ONCE(*entry, (u32) ~AVIC_LOGICAL_ID_ENTRY_VALID_MASK);
+}
+
 static int avic_handle_ldr_update(struct kvm_vcpu *vcpu)
 {
-        int ret;
+        int ret = 0;
         struct vcpu_svm *svm = to_svm(vcpu);
         u32 ldr = kvm_lapic_get_reg(vcpu->arch.apic, APIC_LDR);
 
-        if (!ldr)
-                return 1;
+        if (ldr == svm->ldr_reg)
+                return 0;
 
-        ret = avic_ldr_write(vcpu, vcpu->vcpu_id, ldr, true);
-        if (ret && svm->ldr_reg) {
-                avic_ldr_write(vcpu, 0, svm->ldr_reg, false);
-                svm->ldr_reg = 0;
-        } else {
+        avic_invalidate_logical_id_entry(vcpu);
+
+        if (ldr)
+                ret = avic_ldr_write(vcpu, vcpu->vcpu_id, ldr);
+
+        if (!ret)
                 svm->ldr_reg = ldr;
-        }
+
         return ret;
 }
 
@@ -4637,27 +4649,16 @@ static int avic_handle_apic_id_update(struct kvm_vcpu *vcpu)
         return 0;
 }
 
-static int avic_handle_dfr_update(struct kvm_vcpu *vcpu)
+static void avic_handle_dfr_update(struct kvm_vcpu *vcpu)
 {
         struct vcpu_svm *svm = to_svm(vcpu);
-        struct kvm_svm *kvm_svm = to_kvm_svm(vcpu->kvm);
         u32 dfr = kvm_lapic_get_reg(vcpu->arch.apic, APIC_DFR);
-        u32 mod = (dfr >> 28) & 0xf;
 
-        /*
-         * We assume that all local APICs are using the same type.
-         * If this changes, we need to flush the AVIC logical
-         * APID id table.
-         */
-        if (kvm_svm->ldr_mode == mod)
-                return 0;
-
-        clear_page(page_address(kvm_svm->avic_logical_id_table_page));
-        kvm_svm->ldr_mode = mod;
+        if (svm->dfr_reg == dfr)
+                return;
 
-        if (svm->ldr_reg)
-                avic_handle_ldr_update(vcpu);
-        return 0;
+        avic_invalidate_logical_id_entry(vcpu);
+        svm->dfr_reg = dfr;
 }
 
 static int avic_unaccel_trap_write(struct vcpu_svm *svm)
@@ -5125,11 +5126,11 @@ static void svm_refresh_apicv_exec_ctrl(struct kvm_vcpu *vcpu)
         struct vcpu_svm *svm = to_svm(vcpu);
         struct vmcb *vmcb = svm->vmcb;
 
-        if (!kvm_vcpu_apicv_active(&svm->vcpu))
-                return;
-
-        vmcb->control.int_ctl &= ~AVIC_ENABLE_MASK;
-        mark_dirty(vmcb, VMCB_INTR);
+        if (kvm_vcpu_apicv_active(vcpu))
+                vmcb->control.int_ctl |= AVIC_ENABLE_MASK;
+        else
+                vmcb->control.int_ctl &= ~AVIC_ENABLE_MASK;
+        mark_dirty(vmcb, VMCB_AVIC);
 }
 
 static void svm_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
@@ -5195,7 +5196,7 @@ static int svm_ir_list_add(struct vcpu_svm *svm, struct amd_iommu_pi_data *pi)
          * Allocating new amd_iommu_pi_data, which will get
          * add to the per-vcpu ir_list.
          */
-        ir = kzalloc(sizeof(struct amd_svm_iommu_ir), GFP_KERNEL);
+        ir = kzalloc(sizeof(struct amd_svm_iommu_ir), GFP_KERNEL_ACCOUNT);
         if (!ir) {
                 ret = -ENOMEM;
                 goto out;
@@ -6163,8 +6164,7 @@ static inline void avic_post_state_restore(struct kvm_vcpu *vcpu)
 {
         if (avic_handle_apic_id_update(vcpu) != 0)
                 return;
-        if (avic_handle_dfr_update(vcpu) != 0)
-                return;
+        avic_handle_dfr_update(vcpu);
         avic_handle_ldr_update(vcpu);
 }
 
@@ -6311,7 +6311,7 @@ static int sev_bind_asid(struct kvm *kvm, unsigned int handle, int *error)
         if (ret)
                 return ret;
 
-        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        data = kzalloc(sizeof(*data), GFP_KERNEL_ACCOUNT);
         if (!data)
                 return -ENOMEM;
 
@@ -6361,7 +6361,7 @@ static int sev_launch_start(struct kvm *kvm, struct kvm_sev_cmd *argp)
         if (copy_from_user(&params, (void __user *)(uintptr_t)argp->data, sizeof(params)))
                 return -EFAULT;
 
-        start = kzalloc(sizeof(*start), GFP_KERNEL);
+        start = kzalloc(sizeof(*start), GFP_KERNEL_ACCOUNT);
         if (!start)
                 return -ENOMEM;
 
@@ -6458,7 +6458,7 @@ static int sev_launch_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp)
         if (copy_from_user(&params, (void __user *)(uintptr_t)argp->data, sizeof(params)))
                 return -EFAULT;
 
-        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        data = kzalloc(sizeof(*data), GFP_KERNEL_ACCOUNT);
         if (!data)
                 return -ENOMEM;
 
@@ -6535,7 +6535,7 @@ static int sev_launch_measure(struct kvm *kvm, struct kvm_sev_cmd *argp)
         if (copy_from_user(&params, measure, sizeof(params)))
                 return -EFAULT;
 
-        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        data = kzalloc(sizeof(*data), GFP_KERNEL_ACCOUNT);
         if (!data)
                 return -ENOMEM;
 
@@ -6597,7 +6597,7 @@ static int sev_launch_finish(struct kvm *kvm, struct kvm_sev_cmd *argp)
         if (!sev_guest(kvm))
                 return -ENOTTY;
 
-        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        data = kzalloc(sizeof(*data), GFP_KERNEL_ACCOUNT);
         if (!data)
                 return -ENOMEM;
 
@@ -6618,7 +6618,7 @@ static int sev_guest_status(struct kvm *kvm, struct kvm_sev_cmd *argp)
         if (!sev_guest(kvm))
                 return -ENOTTY;
 
-        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        data = kzalloc(sizeof(*data), GFP_KERNEL_ACCOUNT);
         if (!data)
                 return -ENOMEM;
 
@@ -6646,7 +6646,7 @@ static int __sev_issue_dbg_cmd(struct kvm *kvm, unsigned long src,
         struct sev_data_dbg *data;
         int ret;
 
-        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        data = kzalloc(sizeof(*data), GFP_KERNEL_ACCOUNT);
         if (!data)
                 return -ENOMEM;
 
@@ -6901,7 +6901,7 @@ static int sev_launch_secret(struct kvm *kvm, struct kvm_sev_cmd *argp)
         }
 
         ret = -ENOMEM;
-        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        data = kzalloc(sizeof(*data), GFP_KERNEL_ACCOUNT);
         if (!data)
                 goto e_unpin_memory;
 
@@ -7007,7 +7007,7 @@ static int svm_register_enc_region(struct kvm *kvm,
         if (range->addr > ULONG_MAX || range->size > ULONG_MAX)
                 return -EINVAL;
 
-        region = kzalloc(sizeof(*region), GFP_KERNEL);
+        region = kzalloc(sizeof(*region), GFP_KERNEL_ACCOUNT);
         if (!region)
                 return -ENOMEM;
 
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index d737a51a53ca..f24a2c225070 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -211,7 +211,6 @@ static void free_nested(struct kvm_vcpu *vcpu)
         if (!vmx->nested.vmxon && !vmx->nested.smm.vmxon)
                 return;
 
-        hrtimer_cancel(&vmx->nested.preemption_timer);
         vmx->nested.vmxon = false;
         vmx->nested.smm.vmxon = false;
         free_vpid(vmx->nested.vpid02);
@@ -274,6 +273,7 @@ static void vmx_switch_vmcs(struct kvm_vcpu *vcpu, struct loaded_vmcs *vmcs)
 void nested_vmx_free_vcpu(struct kvm_vcpu *vcpu)
 {
         vcpu_load(vcpu);
+        vmx_leave_nested(vcpu);
         vmx_switch_vmcs(vcpu, &to_vmx(vcpu)->vmcs01);
         free_nested(vcpu);
         vcpu_put(vcpu);
@@ -1980,17 +1980,6 @@ static void prepare_vmcs02_early(struct vcpu_vmx *vmx, struct vmcs12 *vmcs12)
                 prepare_vmcs02_early_full(vmx, vmcs12);
 
         /*
-         * HOST_RSP is normally set correctly in vmx_vcpu_run() just before
-         * entry, but only if the current (host) sp changed from the value
-         * we wrote last (vmx->host_rsp).  This cache is no longer relevant
-         * if we switch vmcs, and rather than hold a separate cache per vmcs,
-         * here we just force the write to happen on entry.  host_rsp will
-         * also be written unconditionally by nested_vmx_check_vmentry_hw()
-         * if we are doing early consistency checks via hardware.
-         */
-        vmx->host_rsp = 0;
-
-        /*
          * PIN CONTROLS
          */
         exec_control = vmcs12->pin_based_vm_exec_control;
@@ -2289,10 +2278,6 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
         }
         vmx_set_rflags(vcpu, vmcs12->guest_rflags);
 
-        vmx->nested.preemption_timer_expired = false;
-        if (nested_cpu_has_preemption_timer(vmcs12))
-                vmx_start_preemption_timer(vcpu);
-
         /* EXCEPTION_BITMAP and CR0_GUEST_HOST_MASK should basically be the
          * bitwise-or of what L1 wants to trap for L2, and what we want to
          * trap. Note that CR0.TS also needs updating - we do this later.
@@ -2722,6 +2707,7 @@ static int nested_vmx_check_vmentry_hw(struct kvm_vcpu *vcpu)
 {
         struct vcpu_vmx *vmx = to_vmx(vcpu);
         unsigned long cr3, cr4;
+        bool vm_fail;
 
         if (!nested_early_check)
                 return 0;
@@ -2755,29 +2741,34 @@ static int nested_vmx_check_vmentry_hw(struct kvm_vcpu *vcpu)
                 vmx->loaded_vmcs->host_state.cr4 = cr4;
         }
 
-        vmx->__launched = vmx->loaded_vmcs->launched;
-
         asm(
-                /* Set HOST_RSP */
                 "sub $%c[wordsize], %%" _ASM_SP "\n\t" /* temporarily adjust RSP for CALL */
-                __ex("vmwrite %%" _ASM_SP ", %%" _ASM_DX) "\n\t"
-                "mov %%" _ASM_SP ", %c[host_rsp](%1)\n\t"
+                "cmp %%" _ASM_SP ", %c[host_state_rsp](%[loaded_vmcs]) \n\t"
+                "je 1f \n\t"
+                __ex("vmwrite %%" _ASM_SP ", %[HOST_RSP]") "\n\t"
+                "mov %%" _ASM_SP ", %c[host_state_rsp](%[loaded_vmcs]) \n\t"
+                "1: \n\t"
                 "add $%c[wordsize], %%" _ASM_SP "\n\t" /* un-adjust RSP */
 
                 /* Check if vmlaunch or vmresume is needed */
-                "cmpl $0, %c[launched](%% " _ASM_CX")\n\t"
+                "cmpb $0, %c[launched](%[loaded_vmcs])\n\t"
 
+                /*
+                 * VMLAUNCH and VMRESUME clear RFLAGS.{CF,ZF} on VM-Exit, set
+                 * RFLAGS.CF on VM-Fail Invalid and set RFLAGS.ZF on VM-Fail
+                 * Valid.  vmx_vmenter() directly "returns" RFLAGS, and so the
+                 * results of VM-Enter is captured via CC_{SET,OUT} to vm_fail.
+                 */
                 "call vmx_vmenter\n\t"
 
-                /* Set vmx->fail accordingly */
-                "setbe %c[fail](%% " _ASM_CX")\n\t"
-              : ASM_CALL_CONSTRAINT
-              : "c"(vmx), "d"((unsigned long)HOST_RSP),
-                [launched]"i"(offsetof(struct vcpu_vmx, __launched)),
-                [fail]"i"(offsetof(struct vcpu_vmx, fail)),
-                [host_rsp]"i"(offsetof(struct vcpu_vmx, host_rsp)),
+                CC_SET(be)
+              : ASM_CALL_CONSTRAINT, CC_OUT(be) (vm_fail)
+              : [HOST_RSP]"r"((unsigned long)HOST_RSP),
+                [loaded_vmcs]"r"(vmx->loaded_vmcs),
+                [launched]"i"(offsetof(struct loaded_vmcs, launched)),
+                [host_state_rsp]"i"(offsetof(struct loaded_vmcs, host_state.rsp)),
                 [wordsize]"i"(sizeof(ulong))
-              : "rax", "cc", "memory"
+              : "cc", "memory"
         );
 
         preempt_enable();
@@ -2787,10 +2778,9 @@ static int nested_vmx_check_vmentry_hw(struct kvm_vcpu *vcpu)
         if (vmx->msr_autoload.guest.nr)
                 vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, vmx->msr_autoload.guest.nr);
 
-        if (vmx->fail) {
+        if (vm_fail) {
                 WARN_ON_ONCE(vmcs_read32(VM_INSTRUCTION_ERROR) !=
                              VMXERR_ENTRY_INVALID_CONTROL_FIELD);
-                vmx->fail = 0;
                 return 1;
         }
 
@@ -2813,8 +2803,6 @@ static int nested_vmx_check_vmentry_hw(struct kvm_vcpu *vcpu)
 
         return 0;
 }
-STACK_FRAME_NON_STANDARD(nested_vmx_check_vmentry_hw);
-
 
 static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu,
                                                  struct vmcs12 *vmcs12);
@@ -3031,6 +3019,15 @@ int nested_vmx_enter_non_root_mode(struct kvm_vcpu *vcpu, bool from_vmentry)
                 kvm_make_request(KVM_REQ_EVENT, vcpu);
 
         /*
+         * Do not start the preemption timer hrtimer until after we know
+         * we are successful, so that only nested_vmx_vmexit needs to cancel
+         * the timer.
+         */
+        vmx->nested.preemption_timer_expired = false;
+        if (nested_cpu_has_preemption_timer(vmcs12))
+                vmx_start_preemption_timer(vcpu);
+
+        /*
          * Note no nested_vmx_succeed or nested_vmx_fail here. At this point
          * we are no longer running L1, and VMLAUNCH/VMRESUME has not yet
          * returned as far as L1 is concerned. It will only return (and set
@@ -3450,13 +3447,10 @@ static void sync_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
         else
                 vmcs12->guest_activity_state = GUEST_ACTIVITY_ACTIVE;
 
-        if (nested_cpu_has_preemption_timer(vmcs12)) {
-                if (vmcs12->vm_exit_controls &
-                    VM_EXIT_SAVE_VMX_PREEMPTION_TIMER)
+        if (nested_cpu_has_preemption_timer(vmcs12) &&
+            vmcs12->vm_exit_controls & VM_EXIT_SAVE_VMX_PREEMPTION_TIMER)
                         vmcs12->vmx_preemption_timer_value =
                                 vmx_get_preemption_timer_value(vcpu);
-                hrtimer_cancel(&to_vmx(vcpu)->nested.preemption_timer);
-        }
 
         /*
          * In some cases (usually, nested EPT), L2 is allowed to change its
@@ -3864,6 +3858,9 @@ void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
 
         leave_guest_mode(vcpu);
 
+        if (nested_cpu_has_preemption_timer(vmcs12))
+                hrtimer_cancel(&to_vmx(vcpu)->nested.preemption_timer);
+
         if (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING)
                 vcpu->arch.tsc_offset -= vmcs12->tsc_offset;
 
@@ -3915,9 +3912,6 @@ void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
                 vmx_flush_tlb(vcpu, true);
         }
 
-        /* This is needed for same reason as it was needed in prepare_vmcs02 */
-        vmx->host_rsp = 0;
-
         /* Unpin physical memory we referred to in vmcs02 */
         if (vmx->nested.apic_access_page) {
                 kvm_release_page_dirty(vmx->nested.apic_access_page);
@@ -4035,25 +4029,50 @@ int get_vmx_mem_address(struct kvm_vcpu *vcpu, unsigned long exit_qualification,
         /* Addr = segment_base + offset */
         /* offset = base + [index * scale] + displacement */
         off = exit_qualification; /* holds the displacement */
+        if (addr_size == 1)
+                off = (gva_t)sign_extend64(off, 31);
+        else if (addr_size == 0)
+                off = (gva_t)sign_extend64(off, 15);
         if (base_is_valid)
                 off += kvm_register_read(vcpu, base_reg);
         if (index_is_valid)
                 off += kvm_register_read(vcpu, index_reg)<<scaling;
         vmx_get_segment(vcpu, &s, seg_reg);
-        *ret = s.base + off;
 
+        /*
+         * The effective address, i.e. @off, of a memory operand is truncated
+         * based on the address size of the instruction.  Note that this is
+         * the *effective address*, i.e. the address prior to accounting for
+         * the segment's base.
+         */
         if (addr_size == 1) /* 32 bit */
-                *ret &= 0xffffffff;
+                off &= 0xffffffff;
+        else if (addr_size == 0) /* 16 bit */
+                off &= 0xffff;
 
         /* Checks for #GP/#SS exceptions. */
         exn = false;
         if (is_long_mode(vcpu)) {
+                /*
+                 * The virtual/linear address is never truncated in 64-bit
+                 * mode, e.g. a 32-bit address size can yield a 64-bit virtual
+                 * address when using FS/GS with a non-zero base.
+                 */
+                *ret = s.base + off;
+
                 /* Long mode: #GP(0)/#SS(0) if the memory address is in a
                  * non-canonical form. This is the only check on the memory
                  * destination for long mode!
                  */
                 exn = is_noncanonical_address(*ret, vcpu);
-        } else if (is_protmode(vcpu)) {
+        } else {
+                /*
+                 * When not in long mode, the virtual/linear address is
+                 * unconditionally truncated to 32 bits regardless of the
+                 * address size.
+                 */
+                *ret = (s.base + off) & 0xffffffff;
+
                 /* Protected mode: apply checks for segment validity in the
                  * following order:
                  * - segment type check (#GP(0) may be thrown)
@@ -4077,10 +4096,16 @@ int get_vmx_mem_address(struct kvm_vcpu *vcpu, unsigned long exit_qualification,
                 /* Protected mode: #GP(0)/#SS(0) if the segment is unusable.
                  */
                 exn = (s.unusable != 0);
-                /* Protected mode: #GP(0)/#SS(0) if the memory
-                 * operand is outside the segment limit.
+
+                /*
+                 * Protected mode: #GP(0)/#SS(0) if the memory operand is
+                 * outside the segment limit.  All CPUs that support VMX ignore
+                 * limit checks for flat segments, i.e. segments with base==0,
+                 * limit==0xffffffff and of type expand-up data or code.
                  */
-                exn = exn || (off + sizeof(u64) > s.limit);
+                if (!(s.base == 0 && s.limit == 0xffffffff &&
+                     ((s.type & 8) || !(s.type & 4))))
+                        exn = exn || (off + sizeof(u64) > s.limit);
         }
         if (exn) {
                 kvm_queue_exception_e(vcpu,
@@ -4145,11 +4170,11 @@ static int enter_vmx_operation(struct kvm_vcpu *vcpu)
         if (r < 0)
                 goto out_vmcs02;
 
-        vmx->nested.cached_vmcs12 = kzalloc(VMCS12_SIZE, GFP_KERNEL);
+        vmx->nested.cached_vmcs12 = kzalloc(VMCS12_SIZE, GFP_KERNEL_ACCOUNT);
         if (!vmx->nested.cached_vmcs12)
                 goto out_cached_vmcs12;
 
-        vmx->nested.cached_shadow_vmcs12 = kzalloc(VMCS12_SIZE, GFP_KERNEL);
+        vmx->nested.cached_shadow_vmcs12 = kzalloc(VMCS12_SIZE, GFP_KERNEL_ACCOUNT);
         if (!vmx->nested.cached_shadow_vmcs12)
                 goto out_cached_shadow_vmcs12;
 
@@ -5696,6 +5721,10 @@ __init int nested_vmx_hardware_setup(int (*exit_handlers[])(struct kvm_vcpu *))
                 enable_shadow_vmcs = 0;
         if (enable_shadow_vmcs) {
                 for (i = 0; i < VMX_BITMAP_NR; i++) {
+                        /*
+                         * The vmx_bitmap is not tied to a VM and so should
+                         * not be charged to a memcg.
+                         */
                         vmx_bitmap[i] = (unsigned long *)
                                 __get_free_page(GFP_KERNEL);
                         if (!vmx_bitmap[i]) {
diff --git a/arch/x86/kvm/vmx/vmcs.h b/arch/x86/kvm/vmx/vmcs.h
index 6def3ba88e3b..cb6079f8a227 100644
--- a/arch/x86/kvm/vmx/vmcs.h
+++ b/arch/x86/kvm/vmx/vmcs.h
@@ -34,6 +34,7 @@ struct vmcs_host_state {
         unsigned long cr4;      /* May not match real cr4 */
         unsigned long gs_base;
         unsigned long fs_base;
+        unsigned long rsp;
 
         u16           fs_sel, gs_sel, ldt_sel;
 #ifdef CONFIG_X86_64
diff --git a/arch/x86/kvm/vmx/vmenter.S b/arch/x86/kvm/vmx/vmenter.S
index bcef2c7e9bc4..7b272738c576 100644
--- a/arch/x86/kvm/vmx/vmenter.S
+++ b/arch/x86/kvm/vmx/vmenter.S
@@ -1,6 +1,30 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 #include <linux/linkage.h>
 #include <asm/asm.h>
+#include <asm/bitsperlong.h>
+#include <asm/kvm_vcpu_regs.h>
+
+#define WORD_SIZE (BITS_PER_LONG / 8)
+
+#define VCPU_RAX        __VCPU_REGS_RAX * WORD_SIZE
+#define VCPU_RCX        __VCPU_REGS_RCX * WORD_SIZE
+#define VCPU_RDX        __VCPU_REGS_RDX * WORD_SIZE
+#define VCPU_RBX        __VCPU_REGS_RBX * WORD_SIZE
+/* Intentionally omit RSP as it's context switched by hardware */
+#define VCPU_RBP        __VCPU_REGS_RBP * WORD_SIZE
+#define VCPU_RSI        __VCPU_REGS_RSI * WORD_SIZE
+#define VCPU_RDI        __VCPU_REGS_RDI * WORD_SIZE
+
+#ifdef CONFIG_X86_64
+#define VCPU_R8         __VCPU_REGS_R8  * WORD_SIZE
+#define VCPU_R9         __VCPU_REGS_R9  * WORD_SIZE
+#define VCPU_R10        __VCPU_REGS_R10 * WORD_SIZE
+#define VCPU_R11        __VCPU_REGS_R11 * WORD_SIZE
+#define VCPU_R12        __VCPU_REGS_R12 * WORD_SIZE
+#define VCPU_R13        __VCPU_REGS_R13 * WORD_SIZE
+#define VCPU_R14        __VCPU_REGS_R14 * WORD_SIZE
+#define VCPU_R15        __VCPU_REGS_R15 * WORD_SIZE
+#endif
 
         .text
 
@@ -55,3 +79,146 @@ ENDPROC(vmx_vmenter)
 ENTRY(vmx_vmexit)
         ret
 ENDPROC(vmx_vmexit)
+
+/**
+ * __vmx_vcpu_run - Run a vCPU via a transition to VMX guest mode
+ * @vmx:        struct vcpu_vmx *
+ * @regs:       unsigned long * (to guest registers)
+ * @launched:   %true if the VMCS has been launched
+ *
+ * Returns:
+ *      0 on VM-Exit, 1 on VM-Fail
+ */
+ENTRY(__vmx_vcpu_run)
+        push %_ASM_BP
+        mov  %_ASM_SP, %_ASM_BP
+#ifdef CONFIG_X86_64
+        push %r15
+        push %r14
+        push %r13
+        push %r12
+#else
+        push %edi
+        push %esi
+#endif
+        push %_ASM_BX
+
+        /*
+         * Save @regs, _ASM_ARG2 may be modified by vmx_update_host_rsp() and
+         * @regs is needed after VM-Exit to save the guest's register values.
+         */
+        push %_ASM_ARG2
+
+        /* Copy @launched to BL, _ASM_ARG3 is volatile. */
+        mov %_ASM_ARG3B, %bl
+
+        /* Adjust RSP to account for the CALL to vmx_vmenter(). */
+        lea -WORD_SIZE(%_ASM_SP), %_ASM_ARG2
+        call vmx_update_host_rsp
+
+        /* Load @regs to RAX. */
+        mov (%_ASM_SP), %_ASM_AX
+
+        /* Check if vmlaunch or vmresume is needed */
+        cmpb $0, %bl
+
+        /* Load guest registers.  Don't clobber flags. */
+        mov VCPU_RBX(%_ASM_AX), %_ASM_BX
+        mov VCPU_RCX(%_ASM_AX), %_ASM_CX
+        mov VCPU_RDX(%_ASM_AX), %_ASM_DX
+        mov VCPU_RSI(%_ASM_AX), %_ASM_SI
+        mov VCPU_RDI(%_ASM_AX), %_ASM_DI
+        mov VCPU_RBP(%_ASM_AX), %_ASM_BP
+#ifdef CONFIG_X86_64
+        mov VCPU_R8 (%_ASM_AX),  %r8
+        mov VCPU_R9 (%_ASM_AX),  %r9
+        mov VCPU_R10(%_ASM_AX), %r10
+        mov VCPU_R11(%_ASM_AX), %r11
+        mov VCPU_R12(%_ASM_AX), %r12
+        mov VCPU_R13(%_ASM_AX), %r13
+        mov VCPU_R14(%_ASM_AX), %r14
+        mov VCPU_R15(%_ASM_AX), %r15
+#endif
+        /* Load guest RAX.  This kills the vmx_vcpu pointer! */
+        mov VCPU_RAX(%_ASM_AX), %_ASM_AX
+
+        /* Enter guest mode */
+        call vmx_vmenter
+
+        /* Jump on VM-Fail. */
+        jbe 2f
+
+        /* Temporarily save guest's RAX. */
+        push %_ASM_AX
+
+        /* Reload @regs to RAX. */
+        mov WORD_SIZE(%_ASM_SP), %_ASM_AX
+
+        /* Save all guest registers, including RAX from the stack */
+        __ASM_SIZE(pop) VCPU_RAX(%_ASM_AX)
+        mov %_ASM_BX,   VCPU_RBX(%_ASM_AX)
+        mov %_ASM_CX,   VCPU_RCX(%_ASM_AX)
+        mov %_ASM_DX,   VCPU_RDX(%_ASM_AX)
+        mov %_ASM_SI,   VCPU_RSI(%_ASM_AX)
+        mov %_ASM_DI,   VCPU_RDI(%_ASM_AX)
+        mov %_ASM_BP,   VCPU_RBP(%_ASM_AX)
+#ifdef CONFIG_X86_64
+        mov %r8,  VCPU_R8 (%_ASM_AX)
+        mov %r9,  VCPU_R9 (%_ASM_AX)
+        mov %r10, VCPU_R10(%_ASM_AX)
+        mov %r11, VCPU_R11(%_ASM_AX)
+        mov %r12, VCPU_R12(%_ASM_AX)
+        mov %r13, VCPU_R13(%_ASM_AX)
+        mov %r14, VCPU_R14(%_ASM_AX)
+        mov %r15, VCPU_R15(%_ASM_AX)
+#endif
+
+        /* Clear RAX to indicate VM-Exit (as opposed to VM-Fail). */
+        xor %eax, %eax
+
+        /*
+         * Clear all general purpose registers except RSP and RAX to prevent
+         * speculative use of the guest's values, even those that are reloaded
+         * via the stack.  In theory, an L1 cache miss when restoring registers
+         * could lead to speculative execution with the guest's values.
+         * Zeroing XORs are dirt cheap, i.e. the extra paranoia is essentially
+         * free.  RSP and RAX are exempt as RSP is restored by hardware during
+         * VM-Exit and RAX is explicitly loaded with 0 or 1 to return VM-Fail.
+         */
+1:      xor %ebx, %ebx
+        xor %ecx, %ecx
+        xor %edx, %edx
+        xor %esi, %esi
+        xor %edi, %edi
+        xor %ebp, %ebp
+#ifdef CONFIG_X86_64
+        xor %r8d,  %r8d
+        xor %r9d,  %r9d
+        xor %r10d, %r10d
+        xor %r11d, %r11d
+        xor %r12d, %r12d
+        xor %r13d, %r13d
+        xor %r14d, %r14d
+        xor %r15d, %r15d
+#endif
+
+        /* "POP" @regs. */
+        add $WORD_SIZE, %_ASM_SP
+        pop %_ASM_BX
+
+#ifdef CONFIG_X86_64
+        pop %r12
+        pop %r13
+        pop %r14
+        pop %r15
+#else
+        pop %esi
+        pop %edi
+#endif
+        pop %_ASM_BP
+        ret
+
+        /* VM-Fail.  Out-of-line to avoid a taken Jcc after VM-Exit. */
+2:      mov $1, %eax
+        jmp 1b
+ENDPROC(__vmx_vcpu_run)
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 30a6bcd735ec..c73375e01ab8 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -246,6 +246,10 @@ static int vmx_setup_l1d_flush(enum vmx_l1d_flush_state l1tf)
 
         if (l1tf != VMENTER_L1D_FLUSH_NEVER && !vmx_l1d_flush_pages &&
             !boot_cpu_has(X86_FEATURE_FLUSH_L1D)) {
+                /*
+                 * This allocation for vmx_l1d_flush_pages is not tied to a VM
+                 * lifetime and so should not be charged to a memcg.
+                 */
                 page = alloc_pages(GFP_KERNEL, L1D_CACHE_ORDER);
                 if (!page)
                         return -ENOMEM;
@@ -2387,13 +2391,13 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf,
         return 0;
 }
 
-struct vmcs *alloc_vmcs_cpu(bool shadow, int cpu)
+struct vmcs *alloc_vmcs_cpu(bool shadow, int cpu, gfp_t flags)
 {
         int node = cpu_to_node(cpu);
         struct page *pages;
         struct vmcs *vmcs;
 
-        pages = __alloc_pages_node(node, GFP_KERNEL, vmcs_config.order);
+        pages = __alloc_pages_node(node, flags, vmcs_config.order);
         if (!pages)
                 return NULL;
         vmcs = page_address(pages);
@@ -2440,7 +2444,8 @@ int alloc_loaded_vmcs(struct loaded_vmcs *loaded_vmcs)
         loaded_vmcs_init(loaded_vmcs);
 
         if (cpu_has_vmx_msr_bitmap()) {
-                loaded_vmcs->msr_bitmap = (unsigned long *)__get_free_page(GFP_KERNEL);
+                loaded_vmcs->msr_bitmap = (unsigned long *)
+                                __get_free_page(GFP_KERNEL_ACCOUNT);
                 if (!loaded_vmcs->msr_bitmap)
                         goto out_vmcs;
                 memset(loaded_vmcs->msr_bitmap, 0xff, PAGE_SIZE);
@@ -2481,7 +2486,7 @@ static __init int alloc_kvm_area(void)
         for_each_possible_cpu(cpu) {
                 struct vmcs *vmcs;
 
-                vmcs = alloc_vmcs_cpu(false, cpu);
+                vmcs = alloc_vmcs_cpu(false, cpu, GFP_KERNEL);
                 if (!vmcs) {
                         free_kvm_area();
                         return -ENOMEM;
@@ -6360,150 +6365,15 @@ static void vmx_update_hv_timer(struct kvm_vcpu *vcpu)
         vmx->loaded_vmcs->hv_timer_armed = false;
 }
 
-static void __vmx_vcpu_run(struct kvm_vcpu *vcpu, struct vcpu_vmx *vmx)
+void vmx_update_host_rsp(struct vcpu_vmx *vmx, unsigned long host_rsp)
 {
-        unsigned long evmcs_rsp;
-
-        vmx->__launched = vmx->loaded_vmcs->launched;
-
-        evmcs_rsp = static_branch_unlikely(&enable_evmcs) ?
-                (unsigned long)&current_evmcs->host_rsp : 0;
-
-        if (static_branch_unlikely(&vmx_l1d_should_flush))
-                vmx_l1d_flush(vcpu);
-
-        asm(
-                /* Store host registers */
-                "push %%" _ASM_DX "; push %%" _ASM_BP ";"
-                "push %%" _ASM_CX " \n\t" /* placeholder for guest rcx */
-                "push %%" _ASM_CX " \n\t"
-                "sub $%c[wordsize], %%" _ASM_SP "\n\t" /* temporarily adjust RSP for CALL */
-                "cmp %%" _ASM_SP ", %c[host_rsp](%%" _ASM_CX ") \n\t"
-                "je 1f \n\t"
-                "mov %%" _ASM_SP ", %c[host_rsp](%%" _ASM_CX ") \n\t"
-                /* Avoid VMWRITE when Enlightened VMCS is in use */
-                "test %%" _ASM_SI ", %%" _ASM_SI " \n\t"
-                "jz 2f \n\t"
-                "mov %%" _ASM_SP ", (%%" _ASM_SI ") \n\t"
-                "jmp 1f \n\t"
-                "2: \n\t"
-                __ex("vmwrite %%" _ASM_SP ", %%" _ASM_DX) "\n\t"
-                "1: \n\t"
-                "add $%c[wordsize], %%" _ASM_SP "\n\t" /* un-adjust RSP */
-
-                /* Reload cr2 if changed */
-                "mov %c[cr2](%%" _ASM_CX "), %%" _ASM_AX " \n\t"
-                "mov %%cr2, %%" _ASM_DX " \n\t"
-                "cmp %%" _ASM_AX ", %%" _ASM_DX " \n\t"
-                "je 3f \n\t"
-                "mov %%" _ASM_AX", %%cr2 \n\t"
-                "3: \n\t"
-                /* Check if vmlaunch or vmresume is needed */
-                "cmpl $0, %c[launched](%%" _ASM_CX ") \n\t"
-                /* Load guest registers.  Don't clobber flags. */
-                "mov %c[rax](%%" _ASM_CX "), %%" _ASM_AX " \n\t"
-                "mov %c[rbx](%%" _ASM_CX "), %%" _ASM_BX " \n\t"
-                "mov %c[rdx](%%" _ASM_CX "), %%" _ASM_DX " \n\t"
-                "mov %c[rsi](%%" _ASM_CX "), %%" _ASM_SI " \n\t"
-                "mov %c[rdi](%%" _ASM_CX "), %%" _ASM_DI " \n\t"
-                "mov %c[rbp](%%" _ASM_CX "), %%" _ASM_BP " \n\t"
-#ifdef CONFIG_X86_64
-                "mov %c[r8](%%" _ASM_CX "),  %%r8  \n\t"
-                "mov %c[r9](%%" _ASM_CX "),  %%r9  \n\t"
-                "mov %c[r10](%%" _ASM_CX "), %%r10 \n\t"
-                "mov %c[r11](%%" _ASM_CX "), %%r11 \n\t"
-                "mov %c[r12](%%" _ASM_CX "), %%r12 \n\t"
-                "mov %c[r13](%%" _ASM_CX "), %%r13 \n\t"
-                "mov %c[r14](%%" _ASM_CX "), %%r14 \n\t"
-                "mov %c[r15](%%" _ASM_CX "), %%r15 \n\t"
-#endif
-                /* Load guest RCX.  This kills the vmx_vcpu pointer! */
-                "mov %c[rcx](%%" _ASM_CX "), %%" _ASM_CX " \n\t"
-
-                /* Enter guest mode */
-                "call vmx_vmenter\n\t"
-
-                /* Save guest's RCX to the stack placeholder (see above) */
-                "mov %%" _ASM_CX ", %c[wordsize](%%" _ASM_SP ") \n\t"
-
-                /* Load host's RCX, i.e. the vmx_vcpu pointer */
-                "pop %%" _ASM_CX " \n\t"
-
-                /* Set vmx->fail based on EFLAGS.{CF,ZF} */
-                "setbe %c[fail](%%" _ASM_CX ")\n\t"
-
-                /* Save all guest registers, including RCX from the stack */
-                "mov %%" _ASM_AX ", %c[rax](%%" _ASM_CX ") \n\t"
-                "mov %%" _ASM_BX ", %c[rbx](%%" _ASM_CX ") \n\t"
-                __ASM_SIZE(pop) " %c[rcx](%%" _ASM_CX ") \n\t"
-                "mov %%" _ASM_DX ", %c[rdx](%%" _ASM_CX ") \n\t"
-                "mov %%" _ASM_SI ", %c[rsi](%%" _ASM_CX ") \n\t"
-                "mov %%" _ASM_DI ", %c[rdi](%%" _ASM_CX ") \n\t"
-                "mov %%" _ASM_BP ", %c[rbp](%%" _ASM_CX ") \n\t"
-#ifdef CONFIG_X86_64
-                "mov %%r8,  %c[r8](%%" _ASM_CX ") \n\t"
-                "mov %%r9,  %c[r9](%%" _ASM_CX ") \n\t"
-                "mov %%r10, %c[r10](%%" _ASM_CX ") \n\t"
-                "mov %%r11, %c[r11](%%" _ASM_CX ") \n\t"
-                "mov %%r12, %c[r12](%%" _ASM_CX ") \n\t"
-                "mov %%r13, %c[r13](%%" _ASM_CX ") \n\t"
-                "mov %%r14, %c[r14](%%" _ASM_CX ") \n\t"
-                "mov %%r15, %c[r15](%%" _ASM_CX ") \n\t"
-                /*
-                * Clear host registers marked as clobbered to prevent
-                * speculative use.
-                */
-                "xor %%r8d,  %%r8d \n\t"
-                "xor %%r9d,  %%r9d \n\t"
-                "xor %%r10d, %%r10d \n\t"
-                "xor %%r11d, %%r11d \n\t"
-                "xor %%r12d, %%r12d \n\t"
-                "xor %%r13d, %%r13d \n\t"
-                "xor %%r14d, %%r14d \n\t"
-                "xor %%r15d, %%r15d \n\t"
-#endif
-                "mov %%cr2, %%" _ASM_AX "   \n\t"
-                "mov %%" _ASM_AX ", %c[cr2](%%" _ASM_CX ") \n\t"
-
-                "xor %%eax, %%eax \n\t"
-                "xor %%ebx, %%ebx \n\t"
-                "xor %%esi, %%esi \n\t"
-                "xor %%edi, %%edi \n\t"
-                "pop  %%" _ASM_BP "; pop  %%" _ASM_DX " \n\t"
-              : ASM_CALL_CONSTRAINT
-              : "c"(vmx), "d"((unsigned long)HOST_RSP), "S"(evmcs_rsp),
-                [launched]"i"(offsetof(struct vcpu_vmx, __launched)),
-                [fail]"i"(offsetof(struct vcpu_vmx, fail)),
-                [host_rsp]"i"(offsetof(struct vcpu_vmx, host_rsp)),
-                [rax]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RAX])),
-                [rbx]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RBX])),
-                [rcx]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RCX])),
-                [rdx]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RDX])),
-                [rsi]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RSI])),
-                [rdi]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RDI])),
-                [rbp]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RBP])),
-#ifdef CONFIG_X86_64
-                [r8]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R8])),
-                [r9]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R9])),
-                [r10]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R10])),
-                [r11]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R11])),
-                [r12]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R12])),
-                [r13]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R13])),
-                [r14]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R14])),
-                [r15]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R15])),
-#endif
-                [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
-                [wordsize]"i"(sizeof(ulong))
-              : "cc", "memory"
-#ifdef CONFIG_X86_64
-                , "rax", "rbx", "rdi"
-                , "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"
-#else
-                , "eax", "ebx", "edi"
-#endif
-              );
+        if (unlikely(host_rsp != vmx->loaded_vmcs->host_state.rsp)) {
+                vmx->loaded_vmcs->host_state.rsp = host_rsp;
+                vmcs_writel(HOST_RSP, host_rsp);
+        }
 }
-STACK_FRAME_NON_STANDARD(__vmx_vcpu_run);
+
+bool __vmx_vcpu_run(struct vcpu_vmx *vmx, unsigned long *regs, bool launched);
 
 static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
 {
@@ -6572,7 +6442,16 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
          */
         x86_spec_ctrl_set_guest(vmx->spec_ctrl, 0);
 
-        __vmx_vcpu_run(vcpu, vmx);
+        if (static_branch_unlikely(&vmx_l1d_should_flush))
+                vmx_l1d_flush(vcpu);
+
+        if (vcpu->arch.cr2 != read_cr2())
+                write_cr2(vcpu->arch.cr2);
+
+        vmx->fail = __vmx_vcpu_run(vmx, (unsigned long *)&vcpu->arch.regs,
+                                   vmx->loaded_vmcs->launched);
+
+        vcpu->arch.cr2 = read_cr2();
 
         /*
          * We do not use IBRS in the kernel. If this vCPU has used the
@@ -6657,7 +6536,9 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
 
 static struct kvm *vmx_vm_alloc(void)
 {
-        struct kvm_vmx *kvm_vmx = vzalloc(sizeof(struct kvm_vmx));
+        struct kvm_vmx *kvm_vmx = __vmalloc(sizeof(struct kvm_vmx),
+                                            GFP_KERNEL_ACCOUNT | __GFP_ZERO,
+                                            PAGE_KERNEL);
         return &kvm_vmx->kvm;
 }
 
@@ -6673,7 +6554,6 @@ static void vmx_free_vcpu(struct kvm_vcpu *vcpu)
         if (enable_pml)
                 vmx_destroy_pml_buffer(vmx);
         free_vpid(vmx->vpid);
-        leave_guest_mode(vcpu);
         nested_vmx_free_vcpu(vcpu);
         free_loaded_vmcs(vmx->loaded_vmcs);
         kfree(vmx->guest_msrs);
@@ -6685,14 +6565,16 @@ static void vmx_free_vcpu(struct kvm_vcpu *vcpu)
 static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id)
 {
         int err;
-        struct vcpu_vmx *vmx = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL);
+        struct vcpu_vmx *vmx;
         unsigned long *msr_bitmap;
         int cpu;
 
+        vmx = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL_ACCOUNT);
         if (!vmx)
                 return ERR_PTR(-ENOMEM);
 
-        vmx->vcpu.arch.guest_fpu = kmem_cache_zalloc(x86_fpu_cache, GFP_KERNEL);
+        vmx->vcpu.arch.guest_fpu = kmem_cache_zalloc(x86_fpu_cache,
+                        GFP_KERNEL_ACCOUNT);
         if (!vmx->vcpu.arch.guest_fpu) {
                 printk(KERN_ERR "kvm: failed to allocate vcpu's fpu\n");
                 err = -ENOMEM;
@@ -6714,12 +6596,12 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id)
          * for the guest, etc.
          */
         if (enable_pml) {
-                vmx->pml_pg = alloc_page(GFP_KERNEL | __GFP_ZERO);
+                vmx->pml_pg = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO);
                 if (!vmx->pml_pg)
                         goto uninit_vcpu;
         }
 
-        vmx->guest_msrs = kmalloc(PAGE_SIZE, GFP_KERNEL);
+        vmx->guest_msrs = kmalloc(PAGE_SIZE, GFP_KERNEL_ACCOUNT);
         BUILD_BUG_ON(ARRAY_SIZE(vmx_msr_index) * sizeof(vmx->guest_msrs[0])
                      > PAGE_SIZE);
 
diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
index 0ac0a64c7790..1554cb45b393 100644
--- a/arch/x86/kvm/vmx/vmx.h
+++ b/arch/x86/kvm/vmx/vmx.h
@@ -175,7 +175,6 @@ struct nested_vmx {
 
 struct vcpu_vmx {
         struct kvm_vcpu       vcpu;
-        unsigned long         host_rsp;
         u8                    fail;
         u8                    msr_bitmap_mode;
         u32                   exit_intr_info;
@@ -209,7 +208,7 @@ struct vcpu_vmx {
         struct loaded_vmcs    vmcs01;
         struct loaded_vmcs   *loaded_vmcs;
         struct loaded_vmcs   *loaded_cpu_state;
-        bool                  __launched; /* temporary, used in vmx_vcpu_run */
+
         struct msr_autoload {
                 struct vmx_msrs guest;
                 struct vmx_msrs host;
@@ -339,8 +338,8 @@ static inline int pi_test_and_set_pir(int vector, struct pi_desc *pi_desc)
 
 static inline void pi_set_sn(struct pi_desc *pi_desc)
 {
-        return set_bit(POSTED_INTR_SN,
-                        (unsigned long *)&pi_desc->control);
+        set_bit(POSTED_INTR_SN,
+                (unsigned long *)&pi_desc->control);
 }
 
 static inline void pi_set_on(struct pi_desc *pi_desc)
@@ -445,7 +444,8 @@ static inline u32 vmx_vmentry_ctrl(void)
 {
         u32 vmentry_ctrl = vmcs_config.vmentry_ctrl;
         if (pt_mode == PT_MODE_SYSTEM)
-                vmentry_ctrl &= ~(VM_EXIT_PT_CONCEAL_PIP | VM_EXIT_CLEAR_IA32_RTIT_CTL);
+                vmentry_ctrl &= ~(VM_ENTRY_PT_CONCEAL_PIP |
+                                  VM_ENTRY_LOAD_IA32_RTIT_CTL);
         /* Loading of EFER and PERF_GLOBAL_CTRL are toggled dynamically */
         return vmentry_ctrl &
                 ~(VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL | VM_ENTRY_LOAD_IA32_EFER);
@@ -455,9 +455,10 @@ static inline u32 vmx_vmexit_ctrl(void)
 {
         u32 vmexit_ctrl = vmcs_config.vmexit_ctrl;
         if (pt_mode == PT_MODE_SYSTEM)
-                vmexit_ctrl &= ~(VM_ENTRY_PT_CONCEAL_PIP | VM_ENTRY_LOAD_IA32_RTIT_CTL);
+                vmexit_ctrl &= ~(VM_EXIT_PT_CONCEAL_PIP |
+                                 VM_EXIT_CLEAR_IA32_RTIT_CTL);
         /* Loading of EFER and PERF_GLOBAL_CTRL are toggled dynamically */
-        return vmcs_config.vmexit_ctrl &
+        return vmexit_ctrl &
                 ~(VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL | VM_EXIT_LOAD_IA32_EFER);
 }
 
@@ -478,7 +479,7 @@ static inline struct pi_desc *vcpu_to_pi_desc(struct kvm_vcpu *vcpu)
         return &(to_vmx(vcpu)->pi_desc);
 }
 
-struct vmcs *alloc_vmcs_cpu(bool shadow, int cpu);
+struct vmcs *alloc_vmcs_cpu(bool shadow, int cpu, gfp_t flags);
 void free_vmcs(struct vmcs *vmcs);
 int alloc_loaded_vmcs(struct loaded_vmcs *loaded_vmcs);
 void free_loaded_vmcs(struct loaded_vmcs *loaded_vmcs);
@@ -487,7 +488,8 @@ void loaded_vmcs_clear(struct loaded_vmcs *loaded_vmcs);
 
 static inline struct vmcs *alloc_vmcs(bool shadow)
 {
-        return alloc_vmcs_cpu(shadow, raw_smp_processor_id());
+        return alloc_vmcs_cpu(shadow, raw_smp_processor_id(),
+                              GFP_KERNEL_ACCOUNT);
 }
 
 u64 construct_eptp(struct kvm_vcpu *vcpu, unsigned long root_hpa);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 941f932373d0..65e4559eef2f 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3879,7 +3879,8 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
                 r = -EINVAL;
                 if (!lapic_in_kernel(vcpu))
                         goto out;
-                u.lapic = kzalloc(sizeof(struct kvm_lapic_state), GFP_KERNEL);
+                u.lapic = kzalloc(sizeof(struct kvm_lapic_state),
+                                GFP_KERNEL_ACCOUNT);
 
                 r = -ENOMEM;
                 if (!u.lapic)
@@ -4066,7 +4067,7 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
                 break;
         }
         case KVM_GET_XSAVE: {
-                u.xsave = kzalloc(sizeof(struct kvm_xsave), GFP_KERNEL);
+                u.xsave = kzalloc(sizeof(struct kvm_xsave), GFP_KERNEL_ACCOUNT);
                 r = -ENOMEM;
                 if (!u.xsave)
                         break;
@@ -4090,7 +4091,7 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
                 break;
         }
         case KVM_GET_XCRS: {
-                u.xcrs = kzalloc(sizeof(struct kvm_xcrs), GFP_KERNEL);
+                u.xcrs = kzalloc(sizeof(struct kvm_xcrs), GFP_KERNEL_ACCOUNT);
                 r = -ENOMEM;
                 if (!u.xcrs)
                         break;
@@ -7055,6 +7056,13 @@ static void kvm_pv_kick_cpu_op(struct kvm *kvm, unsigned long flags, int apicid)
 
 void kvm_vcpu_deactivate_apicv(struct kvm_vcpu *vcpu)
 {
+        if (!lapic_in_kernel(vcpu)) {
+                WARN_ON_ONCE(vcpu->arch.apicv_active);
+                return;
+        }
+        if (!vcpu->arch.apicv_active)
+                return;
+
         vcpu->arch.apicv_active = false;
         kvm_x86_ops->refresh_apicv_exec_ctrl(vcpu);
 }
@@ -9005,7 +9013,6 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
         struct page *page;
         int r;
 
-        vcpu->arch.apicv_active = kvm_x86_ops->get_enable_apicv(vcpu);
         vcpu->arch.emulate_ctxt.ops = &emulate_ops;
         if (!irqchip_in_kernel(vcpu->kvm) || kvm_vcpu_is_reset_bsp(vcpu))
                 vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE;
@@ -9026,6 +9033,7 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
                 goto fail_free_pio_data;
 
         if (irqchip_in_kernel(vcpu->kvm)) {
+                vcpu->arch.apicv_active = kvm_x86_ops->get_enable_apicv(vcpu);
                 r = kvm_create_lapic(vcpu);
                 if (r < 0)
                         goto fail_mmu_destroy;
@@ -9033,14 +9041,15 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
                 static_key_slow_inc(&kvm_no_apic_vcpu);
 
         vcpu->arch.mce_banks = kzalloc(KVM_MAX_MCE_BANKS * sizeof(u64) * 4,
-                                       GFP_KERNEL);
+                                       GFP_KERNEL_ACCOUNT);
         if (!vcpu->arch.mce_banks) {
                 r = -ENOMEM;
                 goto fail_free_lapic;
         }
         vcpu->arch.mcg_cap = KVM_MAX_MCE_BANKS;
 
-        if (!zalloc_cpumask_var(&vcpu->arch.wbinvd_dirty_mask, GFP_KERNEL)) {
+        if (!zalloc_cpumask_var(&vcpu->arch.wbinvd_dirty_mask,
+                                GFP_KERNEL_ACCOUNT)) {
                 r = -ENOMEM;
                 goto fail_free_mce_banks;
         }
@@ -9104,7 +9113,6 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
 
         INIT_HLIST_HEAD(&kvm->arch.mask_notifier_list);
         INIT_LIST_HEAD(&kvm->arch.active_mmu_pages);
-        INIT_LIST_HEAD(&kvm->arch.zapped_obsolete_pages);
         INIT_LIST_HEAD(&kvm->arch.assigned_dev_head);
         atomic_set(&kvm->arch.noncoherent_dma_count, 0);
 
@@ -9299,13 +9307,13 @@ int kvm_arch_create_memslot(struct kvm *kvm, struct kvm_memory_slot *slot,
 
                 slot->arch.rmap[i] =
                         kvcalloc(lpages, sizeof(*slot->arch.rmap[i]),
-                                 GFP_KERNEL);
+                                 GFP_KERNEL_ACCOUNT);
                 if (!slot->arch.rmap[i])
                         goto out_free;
                 if (i == 0)
                         continue;
 
-                linfo = kvcalloc(lpages, sizeof(*linfo), GFP_KERNEL);
+                linfo = kvcalloc(lpages, sizeof(*linfo), GFP_KERNEL_ACCOUNT);
                 if (!linfo)
                         goto out_free;
 
@@ -9348,13 +9356,13 @@ out_free:
         return -ENOMEM;
 }
 
-void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots)
+void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen)
 {
         /*
          * memslots->generation has been incremented.
          * mmio generation may have reached its maximum value.
          */
-        kvm_mmu_invalidate_mmio_sptes(kvm, slots);
+        kvm_mmu_invalidate_mmio_sptes(kvm, gen);
 }
 
 int kvm_arch_prepare_memory_region(struct kvm *kvm,
@@ -9462,7 +9470,7 @@ void kvm_arch_commit_memory_region(struct kvm *kvm,
 
 void kvm_arch_flush_shadow_all(struct kvm *kvm)
 {
-        kvm_mmu_invalidate_zap_all_pages(kvm);
+        kvm_mmu_zap_all(kvm);
 }
 
 void kvm_arch_flush_shadow_memslot(struct kvm *kvm,
diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index 224cd0a47568..28406aa1136d 100644
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -181,6 +181,11 @@ static inline bool emul_is_noncanonical_address(u64 la,
 static inline void vcpu_cache_mmio_info(struct kvm_vcpu *vcpu,
                                         gva_t gva, gfn_t gfn, unsigned access)
 {
+        u64 gen = kvm_memslots(vcpu->kvm)->generation;
+
+        if (unlikely(gen & KVM_MEMSLOT_GEN_UPDATE_IN_PROGRESS))
+                return;
+
         /*
          * If this is a shadow nested page table, the "GVA" is
          * actually a nGPA.
@@ -188,7 +193,7 @@ static inline void vcpu_cache_mmio_info(struct kvm_vcpu *vcpu,
         vcpu->arch.mmio_gva = mmu_is_nested(vcpu) ? 0 : gva & PAGE_MASK;
         vcpu->arch.access = access;
         vcpu->arch.mmio_gfn = gfn;
-        vcpu->arch.mmio_gen = kvm_memslots(vcpu->kvm)->generation;
+        vcpu->arch.mmio_gen = gen;
 }
 
 static inline bool vcpu_match_mmio_gen(struct kvm_vcpu *vcpu)
diff --git a/arch/x86/lib/csum-partial_64.c b/arch/x86/lib/csum-partial_64.c
index 9baca3e054be..e7925d668b68 100644
--- a/arch/x86/lib/csum-partial_64.c
+++ b/arch/x86/lib/csum-partial_64.c
@@ -94,7 +94,7 @@ static unsigned do_csum(const unsigned char *buff, unsigned len)
                                     : "m" (*(unsigned long *)buff), 
                                     "r" (zero),  "0" (result));
                                 --count; 
-                                        buff += 8;
+                                buff += 8;
                         }
                         result = add32_with_carry(result>>32,
                                                   result&0xffffffff); 
diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
index 4fee5c3003ed..139b28a01ce4 100644
--- a/arch/x86/mm/pti.c
+++ b/arch/x86/mm/pti.c
@@ -77,7 +77,7 @@ static void __init pti_print_if_secure(const char *reason)
                 pr_info("%s\n", reason);
 }
 
-enum pti_mode {
+static enum pti_mode {
         PTI_AUTO = 0,
         PTI_FORCE_OFF,
         PTI_FORCE_ON
@@ -602,7 +602,7 @@ static void pti_clone_kernel_text(void)
         set_memory_global(start, (end_global - start) >> PAGE_SHIFT);
 }
 
-void pti_set_kernel_image_nonglobal(void)
+static void pti_set_kernel_image_nonglobal(void)
 {
         /*
          * The identity map is created with PMDs, regardless of the
diff --git a/arch/xtensa/include/asm/Kbuild b/arch/xtensa/include/asm/Kbuild
index d939e13e8d84..42b6cb3d16f7 100644
--- a/arch/xtensa/include/asm/Kbuild
+++ b/arch/xtensa/include/asm/Kbuild
@@ -15,7 +15,6 @@ generic-y += irq_work.h
 generic-y += kdebug.h
 generic-y += kmap_types.h
 generic-y += kprobes.h
-generic-y += linkage.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
diff --git a/arch/xtensa/include/uapi/asm/Kbuild b/arch/xtensa/include/uapi/asm/Kbuild
index 6b43e5049ff7..8a7ad40be463 100644
--- a/arch/xtensa/include/uapi/asm/Kbuild
+++ b/arch/xtensa/include/uapi/asm/Kbuild
@@ -1,5 +1,2 @@
-include include/uapi/asm-generic/Kbuild.asm
-
 generated-y += unistd_32.h
 generic-y += kvm_para.h
-generic-y += socket.h
diff --git a/block/bio.c b/block/bio.c
index 71a78d9fb8b7..b64cedc7f87c 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -849,20 +849,14 @@ static int __bio_iov_bvec_add_pages(struct bio *bio, struct iov_iter *iter)
         size = bio_add_page(bio, bv->bv_page, len,
                                 bv->bv_offset + iter->iov_offset);
         if (size == len) {
-                struct page *page;
-                int i;
+                if (!bio_flagged(bio, BIO_NO_PAGE_REF)) {
+                        struct page *page;
+                        int i;
+
+                        mp_bvec_for_each_page(page, bv, i)
+                                get_page(page);
+                }
 
-                /*
-                 * For the normal O_DIRECT case, we could skip grabbing this
-                 * reference and then not have to put them again when IO
-                 * completes. But this breaks some in-kernel users, like
-                 * splicing to/from a loop device, where we release the pipe
-                 * pages unconditionally. If we can fix that case, we can
-                 * get rid of the get here and the need to call
-                 * bio_release_pages() at IO completion time.
-                 */
-                mp_bvec_for_each_page(page, bv, i)
-                        get_page(page);
                 iov_iter_advance(iter, size);
                 return 0;
         }
@@ -925,10 +919,12 @@ static int __bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter)
  * This takes either an iterator pointing to user memory, or one pointing to
  * kernel pages (BVEC iterator). If we're adding user pages, we pin them and
  * map them into the kernel. On IO completion, the caller should put those
- * pages. For now, when adding kernel pages, we still grab a reference to the
- * page. This isn't strictly needed for the common case, but some call paths
- * end up releasing pages from eg a pipe and we can't easily control these.
- * See comment in __bio_iov_bvec_add_pages().
+ * pages. If we're adding kernel pages, and the caller told us it's safe to
+ * do so, we just have to add the pages to the bio directly. We don't grab an
+ * extra reference to those pages (the user should already have that), and we
+ * don't put the page on IO completion. The caller needs to check if the bio is
+ * flagged BIO_NO_PAGE_REF on IO completion. If it isn't, then pages should be
+ * released.
  *
  * The function tries, but does not guarantee, to pin as many pages as
  * fit into the bio, or are requested in *iter, whatever is smaller. If
@@ -940,6 +936,13 @@ int bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter)
         const bool is_bvec = iov_iter_is_bvec(iter);
         unsigned short orig_vcnt = bio->bi_vcnt;
 
+        /*
+         * If this is a BVEC iter, then the pages are kernel pages. Don't
+         * release them on IO completion, if the caller asked us to.
+         */
+        if (is_bvec && iov_iter_bvec_no_ref(iter))
+                bio_set_flag(bio, BIO_NO_PAGE_REF);
+
         do {
                 int ret;
 
@@ -1696,7 +1699,8 @@ static void bio_dirty_fn(struct work_struct *work)
                 next = bio->bi_private;
 
                 bio_set_pages_dirty(bio);
-                bio_release_pages(bio);
+                if (!bio_flagged(bio, BIO_NO_PAGE_REF))
+                        bio_release_pages(bio);
                 bio_put(bio);
         }
 }
@@ -1713,7 +1717,8 @@ void bio_check_pages_dirty(struct bio *bio)
                         goto defer;
         }
 
-        bio_release_pages(bio);
+        if (!bio_flagged(bio, BIO_NO_PAGE_REF))
+                bio_release_pages(bio);
         bio_put(bio);
         return;
 defer:
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 77f37ef8ef06..617a2b3f7582 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -1736,8 +1736,8 @@ out:
 
 /**
  * blkcg_schedule_throttle - this task needs to check for throttling
- * @q - the request queue IO was submitted on
- * @use_memdelay - do we charge this to memory delay for PSI
+ * @q: the request queue IO was submitted on
+ * @use_memdelay: do we charge this to memory delay for PSI
  *
  * This is called by the IO controller when we know there's delay accumulated
  * for the blkg for this task.  We do not pass the blkg because there are places
@@ -1769,8 +1769,9 @@ void blkcg_schedule_throttle(struct request_queue *q, bool use_memdelay)
 
 /**
  * blkcg_add_delay - add delay to this blkg
- * @now - the current time in nanoseconds
- * @delta - how many nanoseconds of delay to add
+ * @blkg: blkg of interest
+ * @now: the current time in nanoseconds
+ * @delta: how many nanoseconds of delay to add
  *
  * Charge @delta to the blkg's current delay accumulation.  This is used to
  * throttle tasks if an IO controller thinks we need more throttling.
diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c
index 2620baa1f699..507212d75ee2 100644
--- a/block/blk-iolatency.c
+++ b/block/blk-iolatency.c
@@ -75,6 +75,7 @@
 #include <linux/blk-mq.h>
 #include "blk-rq-qos.h"
 #include "blk-stat.h"
+#include "blk.h"
 
 #define DEFAULT_SCALE_COOKIE 1000000U
 
diff --git a/block/blk-merge.c b/block/blk-merge.c
index 22467f475ab4..1c9d4f0f96ea 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -180,7 +180,7 @@ static unsigned get_max_segment_size(struct request_queue *q,
  */
 static bool bvec_split_segs(struct request_queue *q, struct bio_vec *bv,
                 unsigned *nsegs, unsigned *last_seg_size,
-                unsigned *front_seg_size, unsigned *sectors)
+                unsigned *front_seg_size, unsigned *sectors, unsigned max_segs)
 {
         unsigned len = bv->bv_len;
         unsigned total_len = 0;
@@ -190,7 +190,7 @@ static bool bvec_split_segs(struct request_queue *q, struct bio_vec *bv,
          * Multi-page bvec may be too big to hold in one segment, so the
          * current bvec has to be splitted as multiple segments.
          */
-        while (len && new_nsegs + *nsegs < queue_max_segments(q)) {
+        while (len && new_nsegs + *nsegs < max_segs) {
                 seg_size = get_max_segment_size(q, bv->bv_offset + total_len);
                 seg_size = min(seg_size, len);
 
@@ -240,6 +240,7 @@ static struct bio *blk_bio_segment_split(struct request_queue *q,
         bool do_split = true;
         struct bio *new = NULL;
         const unsigned max_sectors = get_max_io_size(q, bio);
+        const unsigned max_segs = queue_max_segments(q);
 
         bio_for_each_bvec(bv, bio, iter) {
                 /*
@@ -254,14 +255,14 @@ static struct bio *blk_bio_segment_split(struct request_queue *q,
                          * Consider this a new segment if we're splitting in
                          * the middle of this vector.
                          */
-                        if (nsegs < queue_max_segments(q) &&
+                        if (nsegs < max_segs &&
                             sectors < max_sectors) {
                                 /* split in the middle of bvec */
                                 bv.bv_len = (max_sectors - sectors) << 9;
                                 bvec_split_segs(q, &bv, &nsegs,
                                                 &seg_size,
                                                 &front_seg_size,
-                                                &sectors);
+                                                &sectors, max_segs);
                         }
                         goto split;
                 }
@@ -283,7 +284,7 @@ static struct bio *blk_bio_segment_split(struct request_queue *q,
                         continue;
                 }
 new_segment:
-                if (nsegs == queue_max_segments(q))
+                if (nsegs == max_segs)
                         goto split;
 
                 bvprv = bv;
@@ -296,7 +297,7 @@ new_segment:
                         if (nsegs == 1 && seg_size > front_seg_size)
                                 front_seg_size = seg_size;
                 } else if (bvec_split_segs(q, &bv, &nsegs, &seg_size,
-                                    &front_seg_size, &sectors)) {
+                                    &front_seg_size, &sectors, max_segs)) {
                         goto split;
                 }
         }
@@ -415,7 +416,7 @@ new_segment:
                         bvprv = bv;
                         prev = 1;
                         bvec_split_segs(q, &bv, &nr_phys_segs, &seg_size,
-                                        &front_seg_size, NULL);
+                                        &front_seg_size, NULL, UINT_MAX);
                 }
                 bbio = bio;
         }
diff --git a/block/blk-mq.c b/block/blk-mq.c
index a9c181603cbd..70b210a308c4 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -782,7 +782,6 @@ void blk_mq_add_to_requeue_list(struct request *rq, bool at_head,
         if (kick_requeue_list)
                 blk_mq_kick_requeue_list(q);
 }
-EXPORT_SYMBOL(blk_mq_add_to_requeue_list);
 
 void blk_mq_kick_requeue_list(struct request_queue *q)
 {
@@ -1093,8 +1092,7 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx,
         bool ret;
 
         if (!(hctx->flags & BLK_MQ_F_TAG_SHARED)) {
-                if (!test_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state))
-                        set_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
+                blk_mq_sched_mark_restart_hctx(hctx);
 
                 /*
                  * It's possible that a tag was freed in the window between the
@@ -2857,7 +2855,7 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
         /*
          * Default to classic polling
          */
-        q->poll_nsec = -1;
+        q->poll_nsec = BLK_MQ_POLL_CLASSIC;
 
         blk_mq_init_cpu_queues(q, set->nr_hw_queues);
         blk_mq_add_queue_tag_set(set, q);
@@ -3392,7 +3390,7 @@ static bool blk_mq_poll_hybrid(struct request_queue *q,
 {
         struct request *rq;
 
-        if (q->poll_nsec == -1)
+        if (q->poll_nsec == BLK_MQ_POLL_CLASSIC)
                 return false;
 
         if (!blk_qc_t_is_internal(cookie))
diff --git a/block/blk-mq.h b/block/blk-mq.h
index c11353a3749d..0ed8e5a8729f 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -41,6 +41,8 @@ void blk_mq_free_queue(struct request_queue *q);
 int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr);
 void blk_mq_wake_waiters(struct request_queue *q);
 bool blk_mq_dispatch_rq_list(struct request_queue *, struct list_head *, bool);
+void blk_mq_add_to_requeue_list(struct request *rq, bool at_head,
+                                bool kick_requeue_list);
 void blk_mq_flush_busy_ctxs(struct blk_mq_hw_ctx *hctx, struct list_head *list);
 bool blk_mq_get_driver_tag(struct request *rq);
 struct request *blk_mq_dequeue_from_ctx(struct blk_mq_hw_ctx *hctx,
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 59685918167e..422327089e0f 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -360,8 +360,8 @@ static ssize_t queue_poll_delay_show(struct request_queue *q, char *page)
 {
         int val;
 
-        if (q->poll_nsec == -1)
-                val = -1;
+        if (q->poll_nsec == BLK_MQ_POLL_CLASSIC)
+                val = BLK_MQ_POLL_CLASSIC;
         else
                 val = q->poll_nsec / 1000;
 
@@ -380,10 +380,12 @@ static ssize_t queue_poll_delay_store(struct request_queue *q, const char *page,
         if (err < 0)
                 return err;
 
-        if (val == -1)
-                q->poll_nsec = -1;
-        else
+        if (val == BLK_MQ_POLL_CLASSIC)
+                q->poll_nsec = BLK_MQ_POLL_CLASSIC;
+        else if (val >= 0)
                 q->poll_nsec = val * 1000;
+        else
+                return -EINVAL;
 
         return count;
 }
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index df8979008dd4..5a389a4f4f65 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -2956,11 +2956,15 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc,
         ndr_desc->res = &res;
         ndr_desc->provider_data = nfit_spa;
         ndr_desc->attr_groups = acpi_nfit_region_attribute_groups;
-        if (spa->flags & ACPI_NFIT_PROXIMITY_VALID)
+        if (spa->flags & ACPI_NFIT_PROXIMITY_VALID) {
                 ndr_desc->numa_node = acpi_map_pxm_to_online_node(
                                                 spa->proximity_domain);
-        else
+                ndr_desc->target_node = acpi_map_pxm_to_node(
+                                spa->proximity_domain);
+        } else {
                 ndr_desc->numa_node = NUMA_NO_NODE;
+                ndr_desc->target_node = NUMA_NO_NODE;
+        }
 
         /*
          * Persistence domain bits are hierarchical, if
diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c
index 7bbbf8256a41..867f6e3f2b4f 100644
--- a/drivers/acpi/numa.c
+++ b/drivers/acpi/numa.c
@@ -84,6 +84,7 @@ int acpi_map_pxm_to_node(int pxm)
 
         return node;
 }
+EXPORT_SYMBOL(acpi_map_pxm_to_node);
 
 /**
  * acpi_map_pxm_to_online_node - Map proximity ID to online node
diff --git a/drivers/acpi/utils.c b/drivers/acpi/utils.c
index 78db97687f26..c4b06cc075f9 100644
--- a/drivers/acpi/utils.c
+++ b/drivers/acpi/utils.c
@@ -800,6 +800,7 @@ bool acpi_dev_present(const char *hid, const char *uid, s64 hrv)
         match.hrv = hrv;
 
         dev = bus_find_device(&acpi_bus_type, NULL, &match, acpi_dev_match_cb);
+        put_device(dev);
         return !!dev;
 }
 EXPORT_SYMBOL(acpi_dev_present);
diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
index 41b706403ef7..b4dae624b9af 100644
--- a/drivers/amba/bus.c
+++ b/drivers/amba/bus.c
@@ -26,19 +26,36 @@
 
 #define to_amba_driver(d)       container_of(d, struct amba_driver, drv)
 
-static const struct amba_id *
-amba_lookup(const struct amba_id *table, struct amba_device *dev)
+/* called on periphid match and class 0x9 coresight device. */
+static int
+amba_cs_uci_id_match(const struct amba_id *table, struct amba_device *dev)
 {
         int ret = 0;
+        struct amba_cs_uci_id *uci;
+
+        uci = table->data;
 
+        /* no table data or zero mask - return match on periphid */
+        if (!uci || (uci->devarch_mask == 0))
+                return 1;
+
+        /* test against read devtype and masked devarch value */
+        ret = (dev->uci.devtype == uci->devtype) &&
+                ((dev->uci.devarch & uci->devarch_mask) == uci->devarch);
+        return ret;
+}
+
+static const struct amba_id *
+amba_lookup(const struct amba_id *table, struct amba_device *dev)
+{
         while (table->mask) {
-                ret = (dev->periphid & table->mask) == table->id;
-                if (ret)
-                        break;
+                if (((dev->periphid & table->mask) == table->id) &&
+                        ((dev->cid != CORESIGHT_CID) ||
+                         (amba_cs_uci_id_match(table, dev))))
+                        return table;
                 table++;
         }
-
-        return ret ? table : NULL;
+        return NULL;
 }
 
 static int amba_match(struct device *dev, struct device_driver *drv)
@@ -399,10 +416,22 @@ static int amba_device_try_add(struct amba_device *dev, struct resource *parent)
                         cid |= (readl(tmp + size - 0x10 + 4 * i) & 255) <<
                                 (i * 8);
 
+                if (cid == CORESIGHT_CID) {
+                        /* set the base to the start of the last 4k block */
+                        void __iomem *csbase = tmp + size - 4096;
+
+                        dev->uci.devarch =
+                                readl(csbase + UCI_REG_DEVARCH_OFFSET);
+                        dev->uci.devtype =
+                                readl(csbase + UCI_REG_DEVTYPE_OFFSET) & 0xff;
+                }
+
                 amba_put_disable_pclk(dev);
 
-                if (cid == AMBA_CID || cid == CORESIGHT_CID)
+                if (cid == AMBA_CID || cid == CORESIGHT_CID) {
                         dev->periphid = pid;
+                        dev->cid = cid;
+                }
 
                 if (!dev->periphid)
                         ret = -ENODEV;
diff --git a/drivers/auxdisplay/Kconfig b/drivers/auxdisplay/Kconfig
index 57410f9c5d44..c52c738e554a 100644
--- a/drivers/auxdisplay/Kconfig
+++ b/drivers/auxdisplay/Kconfig
@@ -164,9 +164,7 @@ config ARM_CHARLCD
           line and the Linux version on the second line, but that's
           still useful.
 
-endif # AUXDISPLAY
-
-menuconfig PANEL
+menuconfig PARPORT_PANEL
         tristate "Parallel port LCD/Keypad Panel support"
         depends on PARPORT
         select CHARLCD
@@ -178,7 +176,7 @@ menuconfig PANEL
           compiled as a module, or linked into the kernel and started at boot.
           If you don't understand what all this is about, say N.
 
-if PANEL
+if PARPORT_PANEL
 
 config PANEL_PARPORT
         int "Default parallel port number (0=LPT1)"
@@ -419,8 +417,11 @@ config PANEL_LCD_PIN_BL
 
           Default for the 'BL' pin in custom profile is '0' (uncontrolled).
 
+endif # PARPORT_PANEL
+
 config PANEL_CHANGE_MESSAGE
         bool "Change LCD initialization message ?"
+        depends on CHARLCD
         default "n"
         ---help---
           This allows you to replace the boot message indicating the kernel version
@@ -444,7 +445,34 @@ config PANEL_BOOT_MESSAGE
           An empty message will only clear the display at driver init time. Any other
           printf()-formatted message is valid with newline and escape codes.
 
-endif # PANEL
+choice
+        prompt "Backlight initial state"
+        default CHARLCD_BL_FLASH
+
+        config CHARLCD_BL_OFF
+                bool "Off"
+                help
+                  Backlight is initially turned off
+
+        config CHARLCD_BL_ON
+                bool "On"
+                help
+                  Backlight is initially turned on
+
+        config CHARLCD_BL_FLASH
+                bool "Flash"
+                help
+                  Backlight is flashed briefly on init
+
+endchoice
+
+endif # AUXDISPLAY
+
+config PANEL
+        tristate "Parallel port LCD/Keypad Panel support (OLD OPTION)"
+        depends on PARPORT
+        select AUXDISPLAY
+        select PARPORT_PANEL
 
 config CHARLCD
         tristate "Character LCD core support" if COMPILE_TEST
diff --git a/drivers/auxdisplay/Makefile b/drivers/auxdisplay/Makefile
index 7ac6776ca3f6..cf54b5efb07e 100644
--- a/drivers/auxdisplay/Makefile
+++ b/drivers/auxdisplay/Makefile
@@ -10,4 +10,4 @@ obj-$(CONFIG_CFAG12864B)	+= cfag12864b.o cfag12864bfb.o
 obj-$(CONFIG_IMG_ASCII_LCD)     += img-ascii-lcd.o
 obj-$(CONFIG_HD44780)           += hd44780.o
 obj-$(CONFIG_HT16K33)           += ht16k33.o
-obj-$(CONFIG_PANEL)             += panel.o
+obj-$(CONFIG_PARPORT_PANEL)     += panel.o
diff --git a/drivers/auxdisplay/charlcd.c b/drivers/auxdisplay/charlcd.c
index 60e0b772673f..92745efefb54 100644
--- a/drivers/auxdisplay/charlcd.c
+++ b/drivers/auxdisplay/charlcd.c
@@ -91,7 +91,7 @@ struct charlcd_priv {
         unsigned long long drvdata[0];
 };
 
-#define to_priv(p)      container_of(p, struct charlcd_priv, lcd)
+#define charlcd_to_priv(p)      container_of(p, struct charlcd_priv, lcd)
 
 /* Device single-open policy control */
 static atomic_t charlcd_available = ATOMIC_INIT(1);
@@ -105,7 +105,7 @@ static void long_sleep(int ms)
 /* turn the backlight on or off */
 static void charlcd_backlight(struct charlcd *lcd, int on)
 {
-        struct charlcd_priv *priv = to_priv(lcd);
+        struct charlcd_priv *priv = charlcd_to_priv(lcd);
 
         if (!lcd->ops->backlight)
                 return;
@@ -134,7 +134,7 @@ static void charlcd_bl_off(struct work_struct *work)
 /* turn the backlight on for a little while */
 void charlcd_poke(struct charlcd *lcd)
 {
-        struct charlcd_priv *priv = to_priv(lcd);
+        struct charlcd_priv *priv = charlcd_to_priv(lcd);
 
         if (!lcd->ops->backlight)
                 return;
@@ -152,7 +152,7 @@ EXPORT_SYMBOL_GPL(charlcd_poke);
 
 static void charlcd_gotoxy(struct charlcd *lcd)
 {
-        struct charlcd_priv *priv = to_priv(lcd);
+        struct charlcd_priv *priv = charlcd_to_priv(lcd);
         unsigned int addr;
 
         /*
@@ -170,7 +170,7 @@ static void charlcd_gotoxy(struct charlcd *lcd)
 
 static void charlcd_home(struct charlcd *lcd)
 {
-        struct charlcd_priv *priv = to_priv(lcd);
+        struct charlcd_priv *priv = charlcd_to_priv(lcd);
 
         priv->addr.x = 0;
         priv->addr.y = 0;
@@ -179,7 +179,7 @@ static void charlcd_home(struct charlcd *lcd)
 
 static void charlcd_print(struct charlcd *lcd, char c)
 {
-        struct charlcd_priv *priv = to_priv(lcd);
+        struct charlcd_priv *priv = charlcd_to_priv(lcd);
 
         if (priv->addr.x < lcd->bwidth) {
                 if (lcd->char_conv)
@@ -211,7 +211,7 @@ static void charlcd_clear_fast(struct charlcd *lcd)
 /* clears the display and resets X/Y */
 static void charlcd_clear_display(struct charlcd *lcd)
 {
-        struct charlcd_priv *priv = to_priv(lcd);
+        struct charlcd_priv *priv = charlcd_to_priv(lcd);
 
         lcd->ops->write_cmd(lcd, LCD_CMD_DISPLAY_CLEAR);
         priv->addr.x = 0;
@@ -223,7 +223,7 @@ static void charlcd_clear_display(struct charlcd *lcd)
 static int charlcd_init_display(struct charlcd *lcd)
 {
         void (*write_cmd_raw)(struct charlcd *lcd, int cmd);
-        struct charlcd_priv *priv = to_priv(lcd);
+        struct charlcd_priv *priv = charlcd_to_priv(lcd);
         u8 init;
 
         if (lcd->ifwidth != 4 && lcd->ifwidth != 8)
@@ -369,7 +369,7 @@ static bool parse_xy(const char *s, unsigned long *x, unsigned long *y)
 
 static inline int handle_lcd_special_code(struct charlcd *lcd)
 {
-        struct charlcd_priv *priv = to_priv(lcd);
+        struct charlcd_priv *priv = charlcd_to_priv(lcd);
 
         /* LCD special codes */
 
@@ -580,7 +580,7 @@ static inline int handle_lcd_special_code(struct charlcd *lcd)
 
 static void charlcd_write_char(struct charlcd *lcd, char c)
 {
-        struct charlcd_priv *priv = to_priv(lcd);
+        struct charlcd_priv *priv = charlcd_to_priv(lcd);
 
         /* first, we'll test if we're in escape mode */
         if ((c != '\n') && priv->esc_seq.len >= 0) {
@@ -705,7 +705,7 @@ static ssize_t charlcd_write(struct file *file, const char __user *buf,
 
 static int charlcd_open(struct inode *inode, struct file *file)
 {
-        struct charlcd_priv *priv = to_priv(the_charlcd);
+        struct charlcd_priv *priv = charlcd_to_priv(the_charlcd);
         int ret;
 
         ret = -EBUSY;
@@ -763,10 +763,24 @@ static void charlcd_puts(struct charlcd *lcd, const char *s)
         }
 }
 
+#ifdef CONFIG_PANEL_BOOT_MESSAGE
+#define LCD_INIT_TEXT CONFIG_PANEL_BOOT_MESSAGE
+#else
+#define LCD_INIT_TEXT "Linux-" UTS_RELEASE "\n"
+#endif
+
+#ifdef CONFIG_CHARLCD_BL_ON
+#define LCD_INIT_BL "\x1b[L+"
+#elif defined(CONFIG_CHARLCD_BL_FLASH)
+#define LCD_INIT_BL "\x1b[L*"
+#else
+#define LCD_INIT_BL "\x1b[L-"
+#endif
+
 /* initialize the LCD driver */
 static int charlcd_init(struct charlcd *lcd)
 {
-        struct charlcd_priv *priv = to_priv(lcd);
+        struct charlcd_priv *priv = charlcd_to_priv(lcd);
         int ret;
 
         if (lcd->ops->backlight) {
@@ -784,13 +798,8 @@ static int charlcd_init(struct charlcd *lcd)
                 return ret;
 
         /* display a short message */
-#ifdef CONFIG_PANEL_CHANGE_MESSAGE
-#ifdef CONFIG_PANEL_BOOT_MESSAGE
-        charlcd_puts(lcd, "\x1b[Lc\x1b[Lb\x1b[L*" CONFIG_PANEL_BOOT_MESSAGE);
-#endif
-#else
-        charlcd_puts(lcd, "\x1b[Lc\x1b[Lb\x1b[L*Linux-" UTS_RELEASE "\n");
-#endif
+        charlcd_puts(lcd, "\x1b[Lc\x1b[Lb" LCD_INIT_BL LCD_INIT_TEXT);
+
         /* clear the display on the next device opening */
         priv->must_clear = true;
         charlcd_home(lcd);
@@ -818,6 +827,12 @@ struct charlcd *charlcd_alloc(unsigned int drvdata_size)
 }
 EXPORT_SYMBOL_GPL(charlcd_alloc);
 
+void charlcd_free(struct charlcd *lcd)
+{
+        kfree(charlcd_to_priv(lcd));
+}
+EXPORT_SYMBOL_GPL(charlcd_free);
+
 static int panel_notify_sys(struct notifier_block *this, unsigned long code,
                             void *unused)
 {
@@ -866,7 +881,7 @@ EXPORT_SYMBOL_GPL(charlcd_register);
 
 int charlcd_unregister(struct charlcd *lcd)
 {
-        struct charlcd_priv *priv = to_priv(lcd);
+        struct charlcd_priv *priv = charlcd_to_priv(lcd);
 
         unregister_reboot_notifier(&panel_notifier);
         charlcd_puts(lcd, "\x0cLCD driver unloaded.\x1b[Lc\x1b[Lb\x1b[L-");
diff --git a/drivers/auxdisplay/hd44780.c b/drivers/auxdisplay/hd44780.c
index 9ad93ea42fdc..ab15b64707ad 100644
--- a/drivers/auxdisplay/hd44780.c
+++ b/drivers/auxdisplay/hd44780.c
@@ -271,7 +271,7 @@ static int hd44780_probe(struct platform_device *pdev)
         return 0;
 
 fail:
-        kfree(lcd);
+        charlcd_free(lcd);
         return ret;
 }
 
@@ -280,6 +280,8 @@ static int hd44780_remove(struct platform_device *pdev)
         struct charlcd *lcd = platform_get_drvdata(pdev);
 
         charlcd_unregister(lcd);
+
+        charlcd_free(lcd);
         return 0;
 }
 
diff --git a/drivers/auxdisplay/panel.c b/drivers/auxdisplay/panel.c
index 21b9b2f2470a..e06de63497cf 100644
--- a/drivers/auxdisplay/panel.c
+++ b/drivers/auxdisplay/panel.c
@@ -1620,7 +1620,7 @@ err_lcd_unreg:
         if (lcd.enabled)
                 charlcd_unregister(lcd.charlcd);
 err_unreg_device:
-        kfree(lcd.charlcd);
+        charlcd_free(lcd.charlcd);
         lcd.charlcd = NULL;
         parport_unregister_device(pprt);
         pprt = NULL;
@@ -1647,7 +1647,7 @@ static void panel_detach(struct parport *port)
         if (lcd.enabled) {
                 charlcd_unregister(lcd.charlcd);
                 lcd.initialized = false;
-                kfree(lcd.charlcd);
+                charlcd_free(lcd.charlcd);
                 lcd.charlcd = NULL;
         }
 
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index 048cbf7d5233..cb8347500ce2 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -88,6 +88,7 @@ unsigned long __weak memory_block_size_bytes(void)
 {
         return MIN_MEMORY_BLOCK_SIZE;
 }
+EXPORT_SYMBOL_GPL(memory_block_size_bytes);
 
 static unsigned long get_memory_block_size(void)
 {
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index 76c9969b7124..96a6dc9d305c 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -1469,12 +1469,12 @@ static int genpd_add_device(struct generic_pm_domain *genpd, struct device *dev,
         if (IS_ERR(gpd_data))
                 return PTR_ERR(gpd_data);
 
-        genpd_lock(genpd);
-
         ret = genpd->attach_dev ? genpd->attach_dev(genpd, dev) : 0;
         if (ret)
                 goto out;
 
+        genpd_lock(genpd);
+
         dev_pm_domain_set(dev, &genpd->domain);
 
         genpd->device_count++;
@@ -1482,9 +1482,8 @@ static int genpd_add_device(struct generic_pm_domain *genpd, struct device *dev,
 
         list_add_tail(&gpd_data->base.list_node, &genpd->dev_list);
 
- out:
         genpd_unlock(genpd);
-
+ out:
         if (ret)
                 genpd_free_dev_data(dev, gpd_data);
         else
@@ -1533,15 +1532,15 @@ static int genpd_remove_device(struct generic_pm_domain *genpd,
         genpd->device_count--;
         genpd->max_off_time_changed = true;
 
-        if (genpd->detach_dev)
-                genpd->detach_dev(genpd, dev);
-
         dev_pm_domain_set(dev, NULL);
 
         list_del_init(&pdd->list_node);
 
         genpd_unlock(genpd);
 
+        if (genpd->detach_dev)
+                genpd->detach_dev(genpd, dev);
+
         genpd_free_dev_data(dev, gpd_data);
 
         return 0;
diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
index 1fad9291f6aa..7fc5a18e02ad 100644
--- a/drivers/base/swnode.c
+++ b/drivers/base/swnode.c
@@ -472,7 +472,7 @@ static int software_node_read_string_array(const struct fwnode_handle *fwnode,
                                                 val, nval);
 }
 
-struct fwnode_handle *
+static struct fwnode_handle *
 software_node_get_parent(const struct fwnode_handle *fwnode)
 {
         struct software_node *swnode = to_software_node(fwnode);
@@ -481,7 +481,7 @@ software_node_get_parent(const struct fwnode_handle *fwnode)
                         NULL;
 }
 
-struct fwnode_handle *
+static struct fwnode_handle *
 software_node_get_next_child(const struct fwnode_handle *fwnode,
                              struct fwnode_handle *child)
 {
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 1e6edd568214..bf1c61cab8eb 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -656,7 +656,7 @@ static int loop_validate_file(struct file *file, struct block_device *bdev)
                         return -EBADF;
 
                 l = f->f_mapping->host->i_bdev->bd_disk->private_data;
-                if (l->lo_state == Lo_unbound) {
+                if (l->lo_state != Lo_bound) {
                         return -EINVAL;
                 }
                 f = l->lo_backing_file;
diff --git a/drivers/block/paride/pcd.c b/drivers/block/paride/pcd.c
index 96670eefaeb2..377a694dc228 100644
--- a/drivers/block/paride/pcd.c
+++ b/drivers/block/paride/pcd.c
@@ -749,8 +749,12 @@ static int pcd_detect(void)
                 return 0;
 
         printk("%s: No CD-ROM drive found\n", name);
-        for (unit = 0, cd = pcd; unit < PCD_UNITS; unit++, cd++)
+        for (unit = 0, cd = pcd; unit < PCD_UNITS; unit++, cd++) {
+                blk_cleanup_queue(cd->disk->queue);
+                cd->disk->queue = NULL;
+                blk_mq_free_tag_set(&cd->tag_set);
                 put_disk(cd->disk);
+        }
         pi_unregister_driver(par_drv);
         return -1;
 }
diff --git a/drivers/block/paride/pf.c b/drivers/block/paride/pf.c
index e92e7a8eeeb2..103b617cdc31 100644
--- a/drivers/block/paride/pf.c
+++ b/drivers/block/paride/pf.c
@@ -761,8 +761,12 @@ static int pf_detect(void)
                 return 0;
 
         printk("%s: No ATAPI disk detected\n", name);
-        for (pf = units, unit = 0; unit < PF_UNITS; pf++, unit++)
+        for (pf = units, unit = 0; unit < PF_UNITS; pf++, unit++) {
+                blk_cleanup_queue(pf->disk->queue);
+                pf->disk->queue = NULL;
+                blk_mq_free_tag_set(&pf->tag_set);
                 put_disk(pf->disk);
+        }
         pi_unregister_driver(par_drv);
         return -1;
 }
@@ -1047,13 +1051,15 @@ static void __exit pf_exit(void)
         int unit;
         unregister_blkdev(major, name);
         for (pf = units, unit = 0; unit < PF_UNITS; pf++, unit++) {
-                if (!pf->present)
-                        continue;
-                del_gendisk(pf->disk);
+                if (pf->present)
+                        del_gendisk(pf->disk);
+
                 blk_cleanup_queue(pf->disk->queue);
                 blk_mq_free_tag_set(&pf->tag_set);
                 put_disk(pf->disk);
-                pi_release(pf->pi);
+
+                if (pf->present)
+                        pi_release(pf->pi);
         }
 }
 
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 4ba967d65cf9..2210c1b9491b 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -833,7 +833,7 @@ static int parse_rbd_opts_token(char *c, void *private)
                 pctx->opts->queue_depth = intval;
                 break;
         case Opt_alloc_size:
-                if (intval < 1) {
+                if (intval < SECTOR_SIZE) {
                         pr_err("alloc_size out of range\n");
                         return -EINVAL;
                 }
@@ -924,23 +924,6 @@ static void rbd_put_client(struct rbd_client *rbdc)
                 kref_put(&rbdc->kref, rbd_client_release);
 }
 
-static int wait_for_latest_osdmap(struct ceph_client *client)
-{
-        u64 newest_epoch;
-        int ret;
-
-        ret = ceph_monc_get_version(&client->monc, "osdmap", &newest_epoch);
-        if (ret)
-                return ret;
-
-        if (client->osdc.osdmap->epoch >= newest_epoch)
-                return 0;
-
-        ceph_osdc_maybe_request_map(&client->osdc);
-        return ceph_monc_wait_osdmap(&client->monc, newest_epoch,
-                                     client->options->mount_timeout);
-}
-
 /*
  * Get a ceph client with specific addr and configuration, if one does
  * not exist create it.  Either way, ceph_opts is consumed by this
@@ -960,7 +943,8 @@ static struct rbd_client *rbd_get_client(struct ceph_options *ceph_opts)
                  * Using an existing client.  Make sure ->pg_pools is up to
                  * date before we look up the pool id in do_rbd_add().
                  */
-                ret = wait_for_latest_osdmap(rbdc->client);
+                ret = ceph_wait_for_latest_osdmap(rbdc->client,
+                                        rbdc->client->options->mount_timeout);
                 if (ret) {
                         rbd_warn(NULL, "failed to get latest osdmap: %d", ret);
                         rbd_put_client(rbdc);
@@ -4203,12 +4187,12 @@ static int rbd_init_disk(struct rbd_device *rbd_dev)
         q->limits.max_sectors = queue_max_hw_sectors(q);
         blk_queue_max_segments(q, USHRT_MAX);
         blk_queue_max_segment_size(q, UINT_MAX);
-        blk_queue_io_min(q, objset_bytes);
-        blk_queue_io_opt(q, objset_bytes);
+        blk_queue_io_min(q, rbd_dev->opts->alloc_size);
+        blk_queue_io_opt(q, rbd_dev->opts->alloc_size);
 
         if (rbd_dev->opts->trim) {
                 blk_queue_flag_set(QUEUE_FLAG_DISCARD, q);
-                q->limits.discard_granularity = objset_bytes;
+                q->limits.discard_granularity = rbd_dev->opts->alloc_size;
                 blk_queue_max_discard_sectors(q, objset_bytes >> SECTOR_SHIFT);
                 blk_queue_max_write_zeroes_sectors(q, objset_bytes >> SECTOR_SHIFT);
         }
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index a4bc74e72c39..24896ffb04ed 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -926,7 +926,7 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir)
         int err, i, j;
         struct xen_blkif *blkif = ring->blkif;
         struct xenbus_device *dev = blkif->be->dev;
-        unsigned int ring_page_order, nr_grefs, evtchn;
+        unsigned int nr_grefs, evtchn;
 
         err = xenbus_scanf(XBT_NIL, dir, "event-channel", "%u",
                           &evtchn);
@@ -936,43 +936,42 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir)
                 return err;
         }
 
-        err = xenbus_scanf(XBT_NIL, dev->otherend, "ring-page-order", "%u",
-                          &ring_page_order);
-        if (err != 1) {
-                err = xenbus_scanf(XBT_NIL, dir, "ring-ref", "%u", &ring_ref[0]);
+        nr_grefs = blkif->nr_ring_pages;
+
+        if (unlikely(!nr_grefs)) {
+                WARN_ON(true);
+                return -EINVAL;
+        }
+
+        for (i = 0; i < nr_grefs; i++) {
+                char ring_ref_name[RINGREF_NAME_LEN];
+
+                snprintf(ring_ref_name, RINGREF_NAME_LEN, "ring-ref%u", i);
+                err = xenbus_scanf(XBT_NIL, dir, ring_ref_name,
+                                   "%u", &ring_ref[i]);
+
                 if (err != 1) {
+                        if (nr_grefs == 1)
+                                break;
+
                         err = -EINVAL;
-                        xenbus_dev_fatal(dev, err, "reading %s/ring-ref", dir);
+                        xenbus_dev_fatal(dev, err, "reading %s/%s",
+                                         dir, ring_ref_name);
                         return err;
                 }
-                nr_grefs = 1;
-        } else {
-                unsigned int i;
+        }
 
-                if (ring_page_order > xen_blkif_max_ring_order) {
+        if (err != 1) {
+                WARN_ON(nr_grefs != 1);
+
+                err = xenbus_scanf(XBT_NIL, dir, "ring-ref", "%u",
+                                   &ring_ref[0]);
+                if (err != 1) {
                         err = -EINVAL;
-                        xenbus_dev_fatal(dev, err, "%s/request %d ring page order exceed max:%d",
-                                         dir, ring_page_order,
-                                         xen_blkif_max_ring_order);
+                        xenbus_dev_fatal(dev, err, "reading %s/ring-ref", dir);
                         return err;
                 }
-
-                nr_grefs = 1 << ring_page_order;
-                for (i = 0; i < nr_grefs; i++) {
-                        char ring_ref_name[RINGREF_NAME_LEN];
-
-                        snprintf(ring_ref_name, RINGREF_NAME_LEN, "ring-ref%u", i);
-                        err = xenbus_scanf(XBT_NIL, dir, ring_ref_name,
-                                           "%u", &ring_ref[i]);
-                        if (err != 1) {
-                                err = -EINVAL;
-                                xenbus_dev_fatal(dev, err, "reading %s/%s",
-                                                 dir, ring_ref_name);
-                                return err;
-                        }
-                }
         }
-        blkif->nr_ring_pages = nr_grefs;
 
         for (i = 0; i < nr_grefs * XEN_BLKIF_REQS_PER_PAGE; i++) {
                 req = kzalloc(sizeof(*req), GFP_KERNEL);
@@ -1023,6 +1022,7 @@ fail:
 static int connect_ring(struct backend_info *be)
 {
         struct xenbus_device *dev = be->dev;
+        struct xen_blkif *blkif = be->blkif;
         unsigned int pers_grants;
         char protocol[64] = "";
         int err, i;
@@ -1030,28 +1030,29 @@ static int connect_ring(struct backend_info *be)
         size_t xspathsize;
         const size_t xenstore_path_ext_size = 11; /* sufficient for "/queue-NNN" */
         unsigned int requested_num_queues = 0;
+        unsigned int ring_page_order;
 
         pr_debug("%s %s\n", __func__, dev->otherend);
 
-        be->blkif->blk_protocol = BLKIF_PROTOCOL_DEFAULT;
+        blkif->blk_protocol = BLKIF_PROTOCOL_DEFAULT;
         err = xenbus_scanf(XBT_NIL, dev->otherend, "protocol",
                            "%63s", protocol);
         if (err <= 0)
                 strcpy(protocol, "unspecified, assuming default");
         else if (0 == strcmp(protocol, XEN_IO_PROTO_ABI_NATIVE))
-                be->blkif->blk_protocol = BLKIF_PROTOCOL_NATIVE;
+                blkif->blk_protocol = BLKIF_PROTOCOL_NATIVE;
         else if (0 == strcmp(protocol, XEN_IO_PROTO_ABI_X86_32))
-                be->blkif->blk_protocol = BLKIF_PROTOCOL_X86_32;
+                blkif->blk_protocol = BLKIF_PROTOCOL_X86_32;
         else if (0 == strcmp(protocol, XEN_IO_PROTO_ABI_X86_64))
-                be->blkif->blk_protocol = BLKIF_PROTOCOL_X86_64;
+                blkif->blk_protocol = BLKIF_PROTOCOL_X86_64;
         else {
                 xenbus_dev_fatal(dev, err, "unknown fe protocol %s", protocol);
                 return -ENOSYS;
         }
         pers_grants = xenbus_read_unsigned(dev->otherend, "feature-persistent",
                                            0);
-        be->blkif->vbd.feature_gnt_persistent = pers_grants;
-        be->blkif->vbd.overflow_max_grants = 0;
+        blkif->vbd.feature_gnt_persistent = pers_grants;
+        blkif->vbd.overflow_max_grants = 0;
 
         /*
          * Read the number of hardware queues from frontend.
@@ -1067,16 +1068,30 @@ static int connect_ring(struct backend_info *be)
                                 requested_num_queues, xenblk_max_queues);
                 return -ENOSYS;
         }
-        be->blkif->nr_rings = requested_num_queues;
-        if (xen_blkif_alloc_rings(be->blkif))
+        blkif->nr_rings = requested_num_queues;
+        if (xen_blkif_alloc_rings(blkif))
                 return -ENOMEM;
 
         pr_info("%s: using %d queues, protocol %d (%s) %s\n", dev->nodename,
-                 be->blkif->nr_rings, be->blkif->blk_protocol, protocol,
+                 blkif->nr_rings, blkif->blk_protocol, protocol,
                  pers_grants ? "persistent grants" : "");
 
-        if (be->blkif->nr_rings == 1)
-                return read_per_ring_refs(&be->blkif->rings[0], dev->otherend);
+        ring_page_order = xenbus_read_unsigned(dev->otherend,
+                                               "ring-page-order", 0);
+
+        if (ring_page_order > xen_blkif_max_ring_order) {
+                err = -EINVAL;
+                xenbus_dev_fatal(dev, err,
+                                 "requested ring page order %d exceed max:%d",
+                                 ring_page_order,
+                                 xen_blkif_max_ring_order);
+                return err;
+        }
+
+        blkif->nr_ring_pages = 1 << ring_page_order;
+
+        if (blkif->nr_rings == 1)
+                return read_per_ring_refs(&blkif->rings[0], dev->otherend);
         else {
                 xspathsize = strlen(dev->otherend) + xenstore_path_ext_size;
                 xspath = kmalloc(xspathsize, GFP_KERNEL);
@@ -1085,10 +1100,10 @@ static int connect_ring(struct backend_info *be)
                         return -ENOMEM;
                 }
 
-                for (i = 0; i < be->blkif->nr_rings; i++) {
+                for (i = 0; i < blkif->nr_rings; i++) {
                         memset(xspath, 0, xspathsize);
                         snprintf(xspath, xspathsize, "%s/queue-%u", dev->otherend, i);
-                        err = read_per_ring_refs(&be->blkif->rings[i], xspath);
+                        err = read_per_ring_refs(&blkif->rings[i], xspath);
                         if (err) {
                                 kfree(xspath);
                                 return err;
diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index a8b20b65bd4b..aa4ec53281ce 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -1261,6 +1261,13 @@ static enum arch_timer_ppi_nr __init arch_timer_select_ppi(void)
         return ARCH_TIMER_PHYS_SECURE_PPI;
 }
 
+static void __init arch_timer_populate_kvm_info(void)
+{
+        arch_timer_kvm_info.virtual_irq = arch_timer_ppi[ARCH_TIMER_VIRT_PPI];
+        if (is_kernel_in_hyp_mode())
+                arch_timer_kvm_info.physical_irq = arch_timer_ppi[ARCH_TIMER_PHYS_NONSECURE_PPI];
+}
+
 static int __init arch_timer_of_init(struct device_node *np)
 {
         int i, ret;
@@ -1275,7 +1282,7 @@ static int __init arch_timer_of_init(struct device_node *np)
         for (i = ARCH_TIMER_PHYS_SECURE_PPI; i < ARCH_TIMER_MAX_TIMER_PPI; i++)
                 arch_timer_ppi[i] = irq_of_parse_and_map(np, i);
 
-        arch_timer_kvm_info.virtual_irq = arch_timer_ppi[ARCH_TIMER_VIRT_PPI];
+        arch_timer_populate_kvm_info();
 
         rate = arch_timer_get_cntfrq();
         arch_timer_of_configure_rate(rate, np);
@@ -1605,7 +1612,7 @@ static int __init arch_timer_acpi_init(struct acpi_table_header *table)
         arch_timer_ppi[ARCH_TIMER_HYP_PPI] =
                 acpi_gtdt_map_ppi(ARCH_TIMER_HYP_PPI);
 
-        arch_timer_kvm_info.virtual_irq = arch_timer_ppi[ARCH_TIMER_VIRT_PPI];
+        arch_timer_populate_kvm_info();
 
         /*
          * When probing via ACPI, we have no mechanism to override the sysreg
diff --git a/drivers/clocksource/clps711x-timer.c b/drivers/clocksource/clps711x-timer.c
index a8dd80576c95..857f8c086274 100644
--- a/drivers/clocksource/clps711x-timer.c
+++ b/drivers/clocksource/clps711x-timer.c
@@ -31,16 +31,9 @@ static u64 notrace clps711x_sched_clock_read(void)
         return ~readw(tcd);
 }
 
-static int __init _clps711x_clksrc_init(struct clk *clock, void __iomem *base)
+static void __init clps711x_clksrc_init(struct clk *clock, void __iomem *base)
 {
-        unsigned long rate;
-
-        if (!base)
-                return -ENOMEM;
-        if (IS_ERR(clock))
-                return PTR_ERR(clock);
-
-        rate = clk_get_rate(clock);
+        unsigned long rate = clk_get_rate(clock);
 
         tcd = base;
 
@@ -48,8 +41,6 @@ static int __init _clps711x_clksrc_init(struct clk *clock, void __iomem *base)
                               clocksource_mmio_readw_down);
 
         sched_clock_register(clps711x_sched_clock_read, 16, rate);
-
-        return 0;
 }
 
 static irqreturn_t clps711x_timer_interrupt(int irq, void *dev_id)
@@ -67,13 +58,6 @@ static int __init _clps711x_clkevt_init(struct clk *clock, void __iomem *base,
         struct clock_event_device *clkevt;
         unsigned long rate;
 
-        if (!irq)
-                return -EINVAL;
-        if (!base)
-                return -ENOMEM;
-        if (IS_ERR(clock))
-                return PTR_ERR(clock);
-
         clkevt = kzalloc(sizeof(*clkevt), GFP_KERNEL);
         if (!clkevt)
                 return -ENOMEM;
@@ -93,31 +77,29 @@ static int __init _clps711x_clkevt_init(struct clk *clock, void __iomem *base,
                            "clps711x-timer", clkevt);
 }
 
-void __init clps711x_clksrc_init(void __iomem *tc1_base, void __iomem *tc2_base,
-                                 unsigned int irq)
-{
-        struct clk *tc1 = clk_get_sys("clps711x-timer.0", NULL);
-        struct clk *tc2 = clk_get_sys("clps711x-timer.1", NULL);
-
-        BUG_ON(_clps711x_clksrc_init(tc1, tc1_base));
-        BUG_ON(_clps711x_clkevt_init(tc2, tc2_base, irq));
-}
-
-#ifdef CONFIG_TIMER_OF
 static int __init clps711x_timer_init(struct device_node *np)
 {
         unsigned int irq = irq_of_parse_and_map(np, 0);
         struct clk *clock = of_clk_get(np, 0);
         void __iomem *base = of_iomap(np, 0);
 
+        if (!base)
+                return -ENOMEM;
+        if (!irq)
+                return -EINVAL;
+        if (IS_ERR(clock))
+                return PTR_ERR(clock);
+
         switch (of_alias_get_id(np, "timer")) {
         case CLPS711X_CLKSRC_CLOCKSOURCE:
-                return _clps711x_clksrc_init(clock, base);
+                clps711x_clksrc_init(clock, base);
+                break;
         case CLPS711X_CLKSRC_CLOCKEVENT:
                 return _clps711x_clkevt_init(clock, base, irq);
         default:
                 return -EINVAL;
         }
+
+        return 0;
 }
 TIMER_OF_DECLARE(clps711x, "cirrus,ep7209-timer", clps711x_timer_init);
-#endif
diff --git a/drivers/clocksource/mips-gic-timer.c b/drivers/clocksource/mips-gic-timer.c
index 54f8a331b53a..37671a5d4ed9 100644
--- a/drivers/clocksource/mips-gic-timer.c
+++ b/drivers/clocksource/mips-gic-timer.c
@@ -67,7 +67,7 @@ static irqreturn_t gic_compare_interrupt(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
-struct irqaction gic_compare_irqaction = {
+static struct irqaction gic_compare_irqaction = {
         .handler = gic_compare_interrupt,
         .percpu_dev_id = &gic_clockevent_device,
         .flags = IRQF_PERCPU | IRQF_TIMER,
diff --git a/drivers/clocksource/tcb_clksrc.c b/drivers/clocksource/tcb_clksrc.c
index 43f4d5c4d6fa..f987027ca566 100644
--- a/drivers/clocksource/tcb_clksrc.c
+++ b/drivers/clocksource/tcb_clksrc.c
@@ -71,7 +71,7 @@ static u64 tc_get_cycles32(struct clocksource *cs)
         return readl_relaxed(tcaddr + ATMEL_TC_REG(0, CV));
 }
 
-void tc_clksrc_suspend(struct clocksource *cs)
+static void tc_clksrc_suspend(struct clocksource *cs)
 {
         int i;
 
@@ -86,7 +86,7 @@ void tc_clksrc_suspend(struct clocksource *cs)
         bmr_cache = readl(tcaddr + ATMEL_TC_BMR);
 }
 
-void tc_clksrc_resume(struct clocksource *cs)
+static void tc_clksrc_resume(struct clocksource *cs)
 {
         int i;
 
diff --git a/drivers/clocksource/timer-riscv.c b/drivers/clocksource/timer-riscv.c
index e8163693e936..5e6038fbf115 100644
--- a/drivers/clocksource/timer-riscv.c
+++ b/drivers/clocksource/timer-riscv.c
@@ -58,7 +58,7 @@ static u64 riscv_sched_clock(void)
 static DEFINE_PER_CPU(struct clocksource, riscv_clocksource) = {
         .name           = "riscv_clocksource",
         .rating         = 300,
-        .mask           = CLOCKSOURCE_MASK(BITS_PER_LONG),
+        .mask           = CLOCKSOURCE_MASK(64),
         .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
         .read           = riscv_clocksource_rdtime,
 };
@@ -120,8 +120,7 @@ static int __init riscv_timer_init_dt(struct device_node *n)
                 return error;
         }
 
-        sched_clock_register(riscv_sched_clock,
-                        BITS_PER_LONG, riscv_timebase);
+        sched_clock_register(riscv_sched_clock, 64, riscv_timebase);
 
         error = cpuhp_setup_state(CPUHP_AP_RISCV_TIMER_STARTING,
                          "clockevents/riscv/timer:starting",
diff --git a/drivers/clocksource/timer-ti-dm.c b/drivers/clocksource/timer-ti-dm.c
index c364027638e1..3352da6ed61f 100644
--- a/drivers/clocksource/timer-ti-dm.c
+++ b/drivers/clocksource/timer-ti-dm.c
@@ -586,8 +586,8 @@ static int omap_dm_timer_set_load(struct omap_dm_timer *timer, int autoreload,
 }
 
 /* Optimized set_load which removes costly spin wait in timer_start */
-int omap_dm_timer_set_load_start(struct omap_dm_timer *timer, int autoreload,
-                            unsigned int load)
+static int omap_dm_timer_set_load_start(struct omap_dm_timer *timer,
+                                        int autoreload, unsigned int load)
 {
         u32 l;
 
diff --git a/drivers/dax/Kconfig b/drivers/dax/Kconfig
index e0700bf4893a..5ef624fe3934 100644
--- a/drivers/dax/Kconfig
+++ b/drivers/dax/Kconfig
@@ -23,12 +23,38 @@ config DEV_DAX
 config DEV_DAX_PMEM
         tristate "PMEM DAX: direct access to persistent memory"
         depends on LIBNVDIMM && NVDIMM_DAX && DEV_DAX
+        depends on m # until we can kill DEV_DAX_PMEM_COMPAT
         default DEV_DAX
         help
           Support raw access to persistent memory.  Note that this
           driver consumes memory ranges allocated and exported by the
           libnvdimm sub-system.
 
-          Say Y if unsure
+          Say M if unsure
+
+config DEV_DAX_KMEM
+        tristate "KMEM DAX: volatile-use of persistent memory"
+        default DEV_DAX
+        depends on DEV_DAX
+        depends on MEMORY_HOTPLUG # for add_memory() and friends
+        help
+          Support access to persistent memory as if it were RAM.  This
+          allows easier use of persistent memory by unmodified
+          applications.
+
+          To use this feature, a DAX device must be unbound from the
+          device_dax driver (PMEM DAX) and bound to this kmem driver
+          on each boot.
+
+          Say N if unsure.
+
+config DEV_DAX_PMEM_COMPAT
+        tristate "PMEM DAX: support the deprecated /sys/class/dax interface"
+        depends on DEV_DAX_PMEM
+        default DEV_DAX_PMEM
+        help
+          Older versions of the libdaxctl library expect to find all
+          device-dax instances under /sys/class/dax. If libdaxctl in
+          your distribution is older than v58 say M, otherwise say N.
 
 endif
diff --git a/drivers/dax/Makefile b/drivers/dax/Makefile
index 574286fac87c..81f7d54dadfb 100644
--- a/drivers/dax/Makefile
+++ b/drivers/dax/Makefile
@@ -1,8 +1,10 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-$(CONFIG_DAX) += dax.o
 obj-$(CONFIG_DEV_DAX) += device_dax.o
-obj-$(CONFIG_DEV_DAX_PMEM) += dax_pmem.o
+obj-$(CONFIG_DEV_DAX_KMEM) += kmem.o
 
 dax-y := super.o
-dax_pmem-y := pmem.o
+dax-y += bus.o
 device_dax-y := device.o
+
+obj-y += pmem/
diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c
new file mode 100644
index 000000000000..2109cfe80219
--- /dev/null
+++ b/drivers/dax/bus.c
@@ -0,0 +1,503 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 2017-2018 Intel Corporation. All rights reserved. */
+#include <linux/memremap.h>
+#include <linux/device.h>
+#include <linux/mutex.h>
+#include <linux/list.h>
+#include <linux/slab.h>
+#include <linux/dax.h>
+#include "dax-private.h"
+#include "bus.h"
+
+static struct class *dax_class;
+
+static DEFINE_MUTEX(dax_bus_lock);
+
+#define DAX_NAME_LEN 30
+struct dax_id {
+        struct list_head list;
+        char dev_name[DAX_NAME_LEN];
+};
+
+static int dax_bus_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+        /*
+         * We only ever expect to handle device-dax instances, i.e. the
+         * @type argument to MODULE_ALIAS_DAX_DEVICE() is always zero
+         */
+        return add_uevent_var(env, "MODALIAS=" DAX_DEVICE_MODALIAS_FMT, 0);
+}
+
+static struct dax_device_driver *to_dax_drv(struct device_driver *drv)
+{
+        return container_of(drv, struct dax_device_driver, drv);
+}
+
+static struct dax_id *__dax_match_id(struct dax_device_driver *dax_drv,
+                const char *dev_name)
+{
+        struct dax_id *dax_id;
+
+        lockdep_assert_held(&dax_bus_lock);
+
+        list_for_each_entry(dax_id, &dax_drv->ids, list)
+                if (sysfs_streq(dax_id->dev_name, dev_name))
+                        return dax_id;
+        return NULL;
+}
+
+static int dax_match_id(struct dax_device_driver *dax_drv, struct device *dev)
+{
+        int match;
+
+        mutex_lock(&dax_bus_lock);
+        match = !!__dax_match_id(dax_drv, dev_name(dev));
+        mutex_unlock(&dax_bus_lock);
+
+        return match;
+}
+
+enum id_action {
+        ID_REMOVE,
+        ID_ADD,
+};
+
+static ssize_t do_id_store(struct device_driver *drv, const char *buf,
+                size_t count, enum id_action action)
+{
+        struct dax_device_driver *dax_drv = to_dax_drv(drv);
+        unsigned int region_id, id;
+        char devname[DAX_NAME_LEN];
+        struct dax_id *dax_id;
+        ssize_t rc = count;
+        int fields;
+
+        fields = sscanf(buf, "dax%d.%d", &region_id, &id);
+        if (fields != 2)
+                return -EINVAL;
+        sprintf(devname, "dax%d.%d", region_id, id);
+        if (!sysfs_streq(buf, devname))
+                return -EINVAL;
+
+        mutex_lock(&dax_bus_lock);
+        dax_id = __dax_match_id(dax_drv, buf);
+        if (!dax_id) {
+                if (action == ID_ADD) {
+                        dax_id = kzalloc(sizeof(*dax_id), GFP_KERNEL);
+                        if (dax_id) {
+                                strncpy(dax_id->dev_name, buf, DAX_NAME_LEN);
+                                list_add(&dax_id->list, &dax_drv->ids);
+                        } else
+                                rc = -ENOMEM;
+                } else
+                        /* nothing to remove */;
+        } else if (action == ID_REMOVE) {
+                list_del(&dax_id->list);
+                kfree(dax_id);
+        } else
+                /* dax_id already added */;
+        mutex_unlock(&dax_bus_lock);
+
+        if (rc < 0)
+                return rc;
+        if (action == ID_ADD)
+                rc = driver_attach(drv);
+        if (rc)
+                return rc;
+        return count;
+}
+
+static ssize_t new_id_store(struct device_driver *drv, const char *buf,
+                size_t count)
+{
+        return do_id_store(drv, buf, count, ID_ADD);
+}
+static DRIVER_ATTR_WO(new_id);
+
+static ssize_t remove_id_store(struct device_driver *drv, const char *buf,
+                size_t count)
+{
+        return do_id_store(drv, buf, count, ID_REMOVE);
+}
+static DRIVER_ATTR_WO(remove_id);
+
+static struct attribute *dax_drv_attrs[] = {
+        &driver_attr_new_id.attr,
+        &driver_attr_remove_id.attr,
+        NULL,
+};
+ATTRIBUTE_GROUPS(dax_drv);
+
+static int dax_bus_match(struct device *dev, struct device_driver *drv);
+
+static struct bus_type dax_bus_type = {
+        .name = "dax",
+        .uevent = dax_bus_uevent,
+        .match = dax_bus_match,
+        .drv_groups = dax_drv_groups,
+};
+
+static int dax_bus_match(struct device *dev, struct device_driver *drv)
+{
+        struct dax_device_driver *dax_drv = to_dax_drv(drv);
+
+        /*
+         * All but the 'device-dax' driver, which has 'match_always'
+         * set, requires an exact id match.
+         */
+        if (dax_drv->match_always)
+                return 1;
+
+        return dax_match_id(dax_drv, dev);
+}
+
+/*
+ * Rely on the fact that drvdata is set before the attributes are
+ * registered, and that the attributes are unregistered before drvdata
+ * is cleared to assume that drvdata is always valid.
+ */
+static ssize_t id_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct dax_region *dax_region = dev_get_drvdata(dev);
+
+        return sprintf(buf, "%d\n", dax_region->id);
+}
+static DEVICE_ATTR_RO(id);
+
+static ssize_t region_size_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct dax_region *dax_region = dev_get_drvdata(dev);
+
+        return sprintf(buf, "%llu\n", (unsigned long long)
+                        resource_size(&dax_region->res));
+}
+static struct device_attribute dev_attr_region_size = __ATTR(size, 0444,
+                region_size_show, NULL);
+
+static ssize_t align_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct dax_region *dax_region = dev_get_drvdata(dev);
+
+        return sprintf(buf, "%u\n", dax_region->align);
+}
+static DEVICE_ATTR_RO(align);
+
+static struct attribute *dax_region_attributes[] = {
+        &dev_attr_region_size.attr,
+        &dev_attr_align.attr,
+        &dev_attr_id.attr,
+        NULL,
+};
+
+static const struct attribute_group dax_region_attribute_group = {
+        .name = "dax_region",
+        .attrs = dax_region_attributes,
+};
+
+static const struct attribute_group *dax_region_attribute_groups[] = {
+        &dax_region_attribute_group,
+        NULL,
+};
+
+static void dax_region_free(struct kref *kref)
+{
+        struct dax_region *dax_region;
+
+        dax_region = container_of(kref, struct dax_region, kref);
+        kfree(dax_region);
+}
+
+void dax_region_put(struct dax_region *dax_region)
+{
+        kref_put(&dax_region->kref, dax_region_free);
+}
+EXPORT_SYMBOL_GPL(dax_region_put);
+
+static void dax_region_unregister(void *region)
+{
+        struct dax_region *dax_region = region;
+
+        sysfs_remove_groups(&dax_region->dev->kobj,
+                        dax_region_attribute_groups);
+        dax_region_put(dax_region);
+}
+
+struct dax_region *alloc_dax_region(struct device *parent, int region_id,
+                struct resource *res, int target_node, unsigned int align,
+                unsigned long pfn_flags)
+{
+        struct dax_region *dax_region;
+
+        /*
+         * The DAX core assumes that it can store its private data in
+         * parent->driver_data. This WARN is a reminder / safeguard for
+         * developers of device-dax drivers.
+         */
+        if (dev_get_drvdata(parent)) {
+                dev_WARN(parent, "dax core failed to setup private data\n");
+                return NULL;
+        }
+
+        if (!IS_ALIGNED(res->start, align)
+                        || !IS_ALIGNED(resource_size(res), align))
+                return NULL;
+
+        dax_region = kzalloc(sizeof(*dax_region), GFP_KERNEL);
+        if (!dax_region)
+                return NULL;
+
+        dev_set_drvdata(parent, dax_region);
+        memcpy(&dax_region->res, res, sizeof(*res));
+        dax_region->pfn_flags = pfn_flags;
+        kref_init(&dax_region->kref);
+        dax_region->id = region_id;
+        dax_region->align = align;
+        dax_region->dev = parent;
+        dax_region->target_node = target_node;
+        if (sysfs_create_groups(&parent->kobj, dax_region_attribute_groups)) {
+                kfree(dax_region);
+                return NULL;
+        }
+
+        kref_get(&dax_region->kref);
+        if (devm_add_action_or_reset(parent, dax_region_unregister, dax_region))
+                return NULL;
+        return dax_region;
+}
+EXPORT_SYMBOL_GPL(alloc_dax_region);
+
+static ssize_t size_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct dev_dax *dev_dax = to_dev_dax(dev);
+        unsigned long long size = resource_size(&dev_dax->region->res);
+
+        return sprintf(buf, "%llu\n", size);
+}
+static DEVICE_ATTR_RO(size);
+
+static int dev_dax_target_node(struct dev_dax *dev_dax)
+{
+        struct dax_region *dax_region = dev_dax->region;
+
+        return dax_region->target_node;
+}
+
+static ssize_t target_node_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct dev_dax *dev_dax = to_dev_dax(dev);
+
+        return sprintf(buf, "%d\n", dev_dax_target_node(dev_dax));
+}
+static DEVICE_ATTR_RO(target_node);
+
+static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
+                char *buf)
+{
+        /*
+         * We only ever expect to handle device-dax instances, i.e. the
+         * @type argument to MODULE_ALIAS_DAX_DEVICE() is always zero
+         */
+        return sprintf(buf, DAX_DEVICE_MODALIAS_FMT "\n", 0);
+}
+static DEVICE_ATTR_RO(modalias);
+
+static umode_t dev_dax_visible(struct kobject *kobj, struct attribute *a, int n)
+{
+        struct device *dev = container_of(kobj, struct device, kobj);
+        struct dev_dax *dev_dax = to_dev_dax(dev);
+
+        if (a == &dev_attr_target_node.attr && dev_dax_target_node(dev_dax) < 0)
+                return 0;
+        return a->mode;
+}
+
+static struct attribute *dev_dax_attributes[] = {
+        &dev_attr_modalias.attr,
+        &dev_attr_size.attr,
+        &dev_attr_target_node.attr,
+        NULL,
+};
+
+static const struct attribute_group dev_dax_attribute_group = {
+        .attrs = dev_dax_attributes,
+        .is_visible = dev_dax_visible,
+};
+
+static const struct attribute_group *dax_attribute_groups[] = {
+        &dev_dax_attribute_group,
+        NULL,
+};
+
+void kill_dev_dax(struct dev_dax *dev_dax)
+{
+        struct dax_device *dax_dev = dev_dax->dax_dev;
+        struct inode *inode = dax_inode(dax_dev);
+
+        kill_dax(dax_dev);
+        unmap_mapping_range(inode->i_mapping, 0, 0, 1);
+}
+EXPORT_SYMBOL_GPL(kill_dev_dax);
+
+static void dev_dax_release(struct device *dev)
+{
+        struct dev_dax *dev_dax = to_dev_dax(dev);
+        struct dax_region *dax_region = dev_dax->region;
+        struct dax_device *dax_dev = dev_dax->dax_dev;
+
+        dax_region_put(dax_region);
+        put_dax(dax_dev);
+        kfree(dev_dax);
+}
+
+static void unregister_dev_dax(void *dev)
+{
+        struct dev_dax *dev_dax = to_dev_dax(dev);
+
+        dev_dbg(dev, "%s\n", __func__);
+
+        kill_dev_dax(dev_dax);
+        device_del(dev);
+        put_device(dev);
+}
+
+struct dev_dax *__devm_create_dev_dax(struct dax_region *dax_region, int id,
+                struct dev_pagemap *pgmap, enum dev_dax_subsys subsys)
+{
+        struct device *parent = dax_region->dev;
+        struct dax_device *dax_dev;
+        struct dev_dax *dev_dax;
+        struct inode *inode;
+        struct device *dev;
+        int rc = -ENOMEM;
+
+        if (id < 0)
+                return ERR_PTR(-EINVAL);
+
+        dev_dax = kzalloc(sizeof(*dev_dax), GFP_KERNEL);
+        if (!dev_dax)
+                return ERR_PTR(-ENOMEM);
+
+        memcpy(&dev_dax->pgmap, pgmap, sizeof(*pgmap));
+
+        /*
+         * No 'host' or dax_operations since there is no access to this
+         * device outside of mmap of the resulting character device.
+         */
+        dax_dev = alloc_dax(dev_dax, NULL, NULL);
+        if (!dax_dev)
+                goto err;
+
+        /* a device_dax instance is dead while the driver is not attached */
+        kill_dax(dax_dev);
+
+        /* from here on we're committed to teardown via dax_dev_release() */
+        dev = &dev_dax->dev;
+        device_initialize(dev);
+
+        dev_dax->dax_dev = dax_dev;
+        dev_dax->region = dax_region;
+        dev_dax->target_node = dax_region->target_node;
+        kref_get(&dax_region->kref);
+
+        inode = dax_inode(dax_dev);
+        dev->devt = inode->i_rdev;
+        if (subsys == DEV_DAX_BUS)
+                dev->bus = &dax_bus_type;
+        else
+                dev->class = dax_class;
+        dev->parent = parent;
+        dev->groups = dax_attribute_groups;
+        dev->release = dev_dax_release;
+        dev_set_name(dev, "dax%d.%d", dax_region->id, id);
+
+        rc = device_add(dev);
+        if (rc) {
+                kill_dev_dax(dev_dax);
+                put_device(dev);
+                return ERR_PTR(rc);
+        }
+
+        rc = devm_add_action_or_reset(dax_region->dev, unregister_dev_dax, dev);
+        if (rc)
+                return ERR_PTR(rc);
+
+        return dev_dax;
+
+ err:
+        kfree(dev_dax);
+
+        return ERR_PTR(rc);
+}
+EXPORT_SYMBOL_GPL(__devm_create_dev_dax);
+
+static int match_always_count;
+
+int __dax_driver_register(struct dax_device_driver *dax_drv,
+                struct module *module, const char *mod_name)
+{
+        struct device_driver *drv = &dax_drv->drv;
+        int rc = 0;
+
+        INIT_LIST_HEAD(&dax_drv->ids);
+        drv->owner = module;
+        drv->name = mod_name;
+        drv->mod_name = mod_name;
+        drv->bus = &dax_bus_type;
+
+        /* there can only be one default driver */
+        mutex_lock(&dax_bus_lock);
+        match_always_count += dax_drv->match_always;
+        if (match_always_count > 1) {
+                match_always_count--;
+                WARN_ON(1);
+                rc = -EINVAL;
+        }
+        mutex_unlock(&dax_bus_lock);
+        if (rc)
+                return rc;
+        return driver_register(drv);
+}
+EXPORT_SYMBOL_GPL(__dax_driver_register);
+
+void dax_driver_unregister(struct dax_device_driver *dax_drv)
+{
+        struct device_driver *drv = &dax_drv->drv;
+        struct dax_id *dax_id, *_id;
+
+        mutex_lock(&dax_bus_lock);
+        match_always_count -= dax_drv->match_always;
+        list_for_each_entry_safe(dax_id, _id, &dax_drv->ids, list) {
+                list_del(&dax_id->list);
+                kfree(dax_id);
+        }
+        mutex_unlock(&dax_bus_lock);
+        driver_unregister(drv);
+}
+EXPORT_SYMBOL_GPL(dax_driver_unregister);
+
+int __init dax_bus_init(void)
+{
+        int rc;
+
+        if (IS_ENABLED(CONFIG_DEV_DAX_PMEM_COMPAT)) {
+                dax_class = class_create(THIS_MODULE, "dax");
+                if (IS_ERR(dax_class))
+                        return PTR_ERR(dax_class);
+        }
+
+        rc = bus_register(&dax_bus_type);
+        if (rc)
+                class_destroy(dax_class);
+        return rc;
+}
+
+void __exit dax_bus_exit(void)
+{
+        bus_unregister(&dax_bus_type);
+        class_destroy(dax_class);
+}
diff --git a/drivers/dax/bus.h b/drivers/dax/bus.h
new file mode 100644
index 000000000000..8619e3299943
--- /dev/null
+++ b/drivers/dax/bus.h
@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 2016 - 2018 Intel Corporation. All rights reserved. */
+#ifndef __DAX_BUS_H__
+#define __DAX_BUS_H__
+#include <linux/device.h>
+
+struct dev_dax;
+struct resource;
+struct dax_device;
+struct dax_region;
+void dax_region_put(struct dax_region *dax_region);
+struct dax_region *alloc_dax_region(struct device *parent, int region_id,
+                struct resource *res, int target_node, unsigned int align,
+                unsigned long flags);
+
+enum dev_dax_subsys {
+        DEV_DAX_BUS,
+        DEV_DAX_CLASS,
+};
+
+struct dev_dax *__devm_create_dev_dax(struct dax_region *dax_region, int id,
+                struct dev_pagemap *pgmap, enum dev_dax_subsys subsys);
+
+static inline struct dev_dax *devm_create_dev_dax(struct dax_region *dax_region,
+                int id, struct dev_pagemap *pgmap)
+{
+        return __devm_create_dev_dax(dax_region, id, pgmap, DEV_DAX_BUS);
+}
+
+/* to be deleted when DEV_DAX_CLASS is removed */
+struct dev_dax *__dax_pmem_probe(struct device *dev, enum dev_dax_subsys subsys);
+
+struct dax_device_driver {
+        struct device_driver drv;
+        struct list_head ids;
+        int match_always;
+};
+
+int __dax_driver_register(struct dax_device_driver *dax_drv,
+                struct module *module, const char *mod_name);
+#define dax_driver_register(driver) \
+        __dax_driver_register(driver, THIS_MODULE, KBUILD_MODNAME)
+void dax_driver_unregister(struct dax_device_driver *dax_drv);
+void kill_dev_dax(struct dev_dax *dev_dax);
+
+#if IS_ENABLED(CONFIG_DEV_DAX_PMEM_COMPAT)
+int dev_dax_probe(struct device *dev);
+#endif
+
+/*
+ * While run_dax() is potentially a generic operation that could be
+ * defined in include/linux/dax.h we don't want to grow any users
+ * outside of drivers/dax/
+ */
+void run_dax(struct dax_device *dax_dev);
+
+#define MODULE_ALIAS_DAX_DEVICE(type) \
+        MODULE_ALIAS("dax:t" __stringify(type) "*")
+#define DAX_DEVICE_MODALIAS_FMT "dax:t%d"
+
+#endif /* __DAX_BUS_H__ */
diff --git a/drivers/dax/dax-private.h b/drivers/dax/dax-private.h
index b6fc4f04636d..a45612148ca0 100644
--- a/drivers/dax/dax-private.h
+++ b/drivers/dax/dax-private.h
@@ -16,10 +16,17 @@
 #include <linux/device.h>
 #include <linux/cdev.h>
 
+/* private routines between core files */
+struct dax_device;
+struct dax_device *inode_dax(struct inode *inode);
+struct inode *dax_inode(struct dax_device *dax_dev);
+int dax_bus_init(void);
+void dax_bus_exit(void);
+
 /**
  * struct dax_region - mapping infrastructure for dax devices
  * @id: kernel-wide unique region for a memory range
- * @base: linear address corresponding to @res
+ * @target_node: effective numa node if this memory range is onlined
  * @kref: to pin while other agents have a need to do lookups
  * @dev: parent device backing this region
  * @align: allocation and mapping alignment for child dax devices
@@ -28,8 +35,7 @@
  */
 struct dax_region {
         int id;
-        struct ida ida;
-        void *base;
+        int target_node;
         struct kref kref;
         struct device *dev;
         unsigned int align;
@@ -38,20 +44,28 @@ struct dax_region {
 };
 
 /**
- * struct dev_dax - instance data for a subdivision of a dax region
+ * struct dev_dax - instance data for a subdivision of a dax region, and
+ * data while the device is activated in the driver.
  * @region - parent region
  * @dax_dev - core dax functionality
+ * @target_node: effective numa node if dev_dax memory range is onlined
  * @dev - device core
- * @id - child id in the region
- * @num_resources - number of physical address extents in this device
- * @res - array of physical address ranges
+ * @pgmap - pgmap for memmap setup / lifetime (driver owned)
+ * @ref: pgmap reference count (driver owned)
+ * @cmp: @ref final put completion (driver owned)
  */
 struct dev_dax {
         struct dax_region *region;
         struct dax_device *dax_dev;
+        int target_node;
         struct device dev;
-        int id;
-        int num_resources;
-        struct resource res[0];
+        struct dev_pagemap pgmap;
+        struct percpu_ref ref;
+        struct completion cmp;
 };
+
+static inline struct dev_dax *to_dev_dax(struct device *dev)
+{
+        return container_of(dev, struct dev_dax, dev);
+}
 #endif
diff --git a/drivers/dax/dax.h b/drivers/dax/dax.h
deleted file mode 100644
index f9e5feea742c..000000000000
--- a/drivers/dax/dax.h
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Copyright(c) 2016 - 2017 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of version 2 of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- */
-#ifndef __DAX_H__
-#define __DAX_H__
-struct dax_device;
-struct dax_device *inode_dax(struct inode *inode);
-struct inode *dax_inode(struct dax_device *dax_dev);
-#endif /* __DAX_H__ */
diff --git a/drivers/dax/device-dax.h b/drivers/dax/device-dax.h
deleted file mode 100644
index 688b051750bd..000000000000
--- a/drivers/dax/device-dax.h
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright(c) 2016 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of version 2 of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- */
-#ifndef __DEVICE_DAX_H__
-#define __DEVICE_DAX_H__
-struct device;
-struct dev_dax;
-struct resource;
-struct dax_region;
-void dax_region_put(struct dax_region *dax_region);
-struct dax_region *alloc_dax_region(struct device *parent,
-                int region_id, struct resource *res, unsigned int align,
-                void *addr, unsigned long flags);
-struct dev_dax *devm_create_dev_dax(struct dax_region *dax_region,
-                int id, struct resource *res, int count);
-#endif /* __DEVICE_DAX_H__ */
diff --git a/drivers/dax/device.c b/drivers/dax/device.c
index 948806e57cee..e428468ab661 100644
--- a/drivers/dax/device.c
+++ b/drivers/dax/device.c
@@ -1,15 +1,6 @@
-/*
- * Copyright(c) 2016 - 2017 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of version 2 of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- */
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 2016-2018 Intel Corporation. All rights reserved. */
+#include <linux/memremap.h>
 #include <linux/pagemap.h>
 #include <linux/module.h>
 #include <linux/device.h>
@@ -21,161 +12,39 @@
 #include <linux/mm.h>
 #include <linux/mman.h>
 #include "dax-private.h"
-#include "dax.h"
+#include "bus.h"
 
-static struct class *dax_class;
-
-/*
- * Rely on the fact that drvdata is set before the attributes are
- * registered, and that the attributes are unregistered before drvdata
- * is cleared to assume that drvdata is always valid.
- */
-static ssize_t id_show(struct device *dev,
-                struct device_attribute *attr, char *buf)
-{
-        struct dax_region *dax_region = dev_get_drvdata(dev);
-
-        return sprintf(buf, "%d\n", dax_region->id);
-}
-static DEVICE_ATTR_RO(id);
-
-static ssize_t region_size_show(struct device *dev,
-                struct device_attribute *attr, char *buf)
-{
-        struct dax_region *dax_region = dev_get_drvdata(dev);
-
-        return sprintf(buf, "%llu\n", (unsigned long long)
-                        resource_size(&dax_region->res));
-}
-static struct device_attribute dev_attr_region_size = __ATTR(size, 0444,
-                region_size_show, NULL);
-
-static ssize_t align_show(struct device *dev,
-                struct device_attribute *attr, char *buf)
-{
-        struct dax_region *dax_region = dev_get_drvdata(dev);
-
-        return sprintf(buf, "%u\n", dax_region->align);
-}
-static DEVICE_ATTR_RO(align);
-
-static struct attribute *dax_region_attributes[] = {
-        &dev_attr_region_size.attr,
-        &dev_attr_align.attr,
-        &dev_attr_id.attr,
-        NULL,
-};
-
-static const struct attribute_group dax_region_attribute_group = {
-        .name = "dax_region",
-        .attrs = dax_region_attributes,
-};
-
-static const struct attribute_group *dax_region_attribute_groups[] = {
-        &dax_region_attribute_group,
-        NULL,
-};
-
-static void dax_region_free(struct kref *kref)
-{
-        struct dax_region *dax_region;
-
-        dax_region = container_of(kref, struct dax_region, kref);
-        kfree(dax_region);
-}
-
-void dax_region_put(struct dax_region *dax_region)
+static struct dev_dax *ref_to_dev_dax(struct percpu_ref *ref)
 {
-        kref_put(&dax_region->kref, dax_region_free);
+        return container_of(ref, struct dev_dax, ref);
 }
-EXPORT_SYMBOL_GPL(dax_region_put);
 
-static void dax_region_unregister(void *region)
+static void dev_dax_percpu_release(struct percpu_ref *ref)
 {
-        struct dax_region *dax_region = region;
+        struct dev_dax *dev_dax = ref_to_dev_dax(ref);
 
-        sysfs_remove_groups(&dax_region->dev->kobj,
-                        dax_region_attribute_groups);
-        dax_region_put(dax_region);
+        dev_dbg(&dev_dax->dev, "%s\n", __func__);
+        complete(&dev_dax->cmp);
 }
 
-struct dax_region *alloc_dax_region(struct device *parent, int region_id,
-                struct resource *res, unsigned int align, void *addr,
-                unsigned long pfn_flags)
+static void dev_dax_percpu_exit(void *data)
 {
-        struct dax_region *dax_region;
-
-        /*
-         * The DAX core assumes that it can store its private data in
-         * parent->driver_data. This WARN is a reminder / safeguard for
-         * developers of device-dax drivers.
-         */
-        if (dev_get_drvdata(parent)) {
-                dev_WARN(parent, "dax core failed to setup private data\n");
-                return NULL;
-        }
-
-        if (!IS_ALIGNED(res->start, align)
-                        || !IS_ALIGNED(resource_size(res), align))
-                return NULL;
-
-        dax_region = kzalloc(sizeof(*dax_region), GFP_KERNEL);
-        if (!dax_region)
-                return NULL;
-
-        dev_set_drvdata(parent, dax_region);
-        memcpy(&dax_region->res, res, sizeof(*res));
-        dax_region->pfn_flags = pfn_flags;
-        kref_init(&dax_region->kref);
-        dax_region->id = region_id;
-        ida_init(&dax_region->ida);
-        dax_region->align = align;
-        dax_region->dev = parent;
-        dax_region->base = addr;
-        if (sysfs_create_groups(&parent->kobj, dax_region_attribute_groups)) {
-                kfree(dax_region);
-                return NULL;
-        }
+        struct percpu_ref *ref = data;
+        struct dev_dax *dev_dax = ref_to_dev_dax(ref);
 
-        kref_get(&dax_region->kref);
-        if (devm_add_action_or_reset(parent, dax_region_unregister, dax_region))
-                return NULL;
-        return dax_region;
+        dev_dbg(&dev_dax->dev, "%s\n", __func__);
+        wait_for_completion(&dev_dax->cmp);
+        percpu_ref_exit(ref);
 }
-EXPORT_SYMBOL_GPL(alloc_dax_region);
 
-static struct dev_dax *to_dev_dax(struct device *dev)
+static void dev_dax_percpu_kill(struct percpu_ref *data)
 {
-        return container_of(dev, struct dev_dax, dev);
-}
-
-static ssize_t size_show(struct device *dev,
-                struct device_attribute *attr, char *buf)
-{
-        struct dev_dax *dev_dax = to_dev_dax(dev);
-        unsigned long long size = 0;
-        int i;
+        struct percpu_ref *ref = data;
+        struct dev_dax *dev_dax = ref_to_dev_dax(ref);
 
-        for (i = 0; i < dev_dax->num_resources; i++)
-                size += resource_size(&dev_dax->res[i]);
-
-        return sprintf(buf, "%llu\n", size);
+        dev_dbg(&dev_dax->dev, "%s\n", __func__);
+        percpu_ref_kill(ref);
 }
-static DEVICE_ATTR_RO(size);
-
-static struct attribute *dev_dax_attributes[] = {
-        &dev_attr_size.attr,
-        NULL,
-};
-
-static const struct attribute_group dev_dax_attribute_group = {
-        .attrs = dev_dax_attributes,
-};
-
-static const struct attribute_group *dax_attribute_groups[] = {
-        &dev_dax_attribute_group,
-        NULL,
-};
 
 static int check_vma(struct dev_dax *dev_dax, struct vm_area_struct *vma,
                 const char *func)
@@ -226,21 +95,11 @@ static int check_vma(struct dev_dax *dev_dax, struct vm_area_struct *vma,
 __weak phys_addr_t dax_pgoff_to_phys(struct dev_dax *dev_dax, pgoff_t pgoff,
                 unsigned long size)
 {
-        struct resource *res;
-        /* gcc-4.6.3-nolibc for i386 complains that this is uninitialized */
-        phys_addr_t uninitialized_var(phys);
-        int i;
-
-        for (i = 0; i < dev_dax->num_resources; i++) {
-                res = &dev_dax->res[i];
-                phys = pgoff * PAGE_SIZE + res->start;
-                if (phys >= res->start && phys <= res->end)
-                        break;
-                pgoff -= PHYS_PFN(resource_size(res));
-        }
+        struct resource *res = &dev_dax->region->res;
+        phys_addr_t phys;
 
-        if (i < dev_dax->num_resources) {
-                res = &dev_dax->res[i];
+        phys = pgoff * PAGE_SIZE + res->start;
+        if (phys >= res->start && phys <= res->end) {
                 if (phys + size - 1 <= res->end)
                         return phys;
         }
@@ -576,152 +435,100 @@ static const struct file_operations dax_fops = {
         .mmap_supported_flags = MAP_SYNC,
 };
 
-static void dev_dax_release(struct device *dev)
+static void dev_dax_cdev_del(void *cdev)
 {
-        struct dev_dax *dev_dax = to_dev_dax(dev);
-        struct dax_region *dax_region = dev_dax->region;
-        struct dax_device *dax_dev = dev_dax->dax_dev;
-
-        if (dev_dax->id >= 0)
-                ida_simple_remove(&dax_region->ida, dev_dax->id);
-        dax_region_put(dax_region);
-        put_dax(dax_dev);
-        kfree(dev_dax);
+        cdev_del(cdev);
 }
 
-static void kill_dev_dax(struct dev_dax *dev_dax)
+static void dev_dax_kill(void *dev_dax)
 {
-        struct dax_device *dax_dev = dev_dax->dax_dev;
-        struct inode *inode = dax_inode(dax_dev);
-
-        kill_dax(dax_dev);
-        unmap_mapping_range(inode->i_mapping, 0, 0, 1);
+        kill_dev_dax(dev_dax);
 }
 
-static void unregister_dev_dax(void *dev)
+int dev_dax_probe(struct device *dev)
 {
         struct dev_dax *dev_dax = to_dev_dax(dev);
         struct dax_device *dax_dev = dev_dax->dax_dev;
-        struct inode *inode = dax_inode(dax_dev);
-        struct cdev *cdev = inode->i_cdev;
-
-        dev_dbg(dev, "trace\n");
-
-        kill_dev_dax(dev_dax);
-        cdev_device_del(cdev, dev);
-        put_device(dev);
-}
-
-struct dev_dax *devm_create_dev_dax(struct dax_region *dax_region,
-                int id, struct resource *res, int count)
-{
-        struct device *parent = dax_region->dev;
-        struct dax_device *dax_dev;
-        struct dev_dax *dev_dax;
+        struct resource *res = &dev_dax->region->res;
         struct inode *inode;
-        struct device *dev;
         struct cdev *cdev;
-        int rc, i;
-
-        if (!count)
-                return ERR_PTR(-EINVAL);
-
-        dev_dax = kzalloc(struct_size(dev_dax, res, count), GFP_KERNEL);
-        if (!dev_dax)
-                return ERR_PTR(-ENOMEM);
-
-        for (i = 0; i < count; i++) {
-                if (!IS_ALIGNED(res[i].start, dax_region->align)
-                                || !IS_ALIGNED(resource_size(&res[i]),
-                                        dax_region->align)) {
-                        rc = -EINVAL;
-                        break;
-                }
-                dev_dax->res[i].start = res[i].start;
-                dev_dax->res[i].end = res[i].end;
+        void *addr;
+        int rc;
+
+        /* 1:1 map region resource range to device-dax instance range */
+        if (!devm_request_mem_region(dev, res->start, resource_size(res),
+                                dev_name(dev))) {
+                dev_warn(dev, "could not reserve region %pR\n", res);
+                return -EBUSY;
         }
 
-        if (i < count)
-                goto err_id;
+        init_completion(&dev_dax->cmp);
+        rc = percpu_ref_init(&dev_dax->ref, dev_dax_percpu_release, 0,
+                        GFP_KERNEL);
+        if (rc)
+                return rc;
 
-        if (id < 0) {
-                id = ida_simple_get(&dax_region->ida, 0, 0, GFP_KERNEL);
-                dev_dax->id = id;
-                if (id < 0) {
-                        rc = id;
-                        goto err_id;
-                }
-        } else {
-                /* region provider owns @id lifetime */
-                dev_dax->id = -1;
-        }
+        rc = devm_add_action_or_reset(dev, dev_dax_percpu_exit, &dev_dax->ref);
+        if (rc)
+                return rc;
 
-        /*
-         * No 'host' or dax_operations since there is no access to this
-         * device outside of mmap of the resulting character device.
-         */
-        dax_dev = alloc_dax(dev_dax, NULL, NULL);
-        if (!dax_dev) {
-                rc = -ENOMEM;
-                goto err_dax;
+        dev_dax->pgmap.ref = &dev_dax->ref;
+        dev_dax->pgmap.kill = dev_dax_percpu_kill;
+        addr = devm_memremap_pages(dev, &dev_dax->pgmap);
+        if (IS_ERR(addr)) {
+                devm_remove_action(dev, dev_dax_percpu_exit, &dev_dax->ref);
+                percpu_ref_exit(&dev_dax->ref);
+                return PTR_ERR(addr);
         }
 
-        /* from here on we're committed to teardown via dax_dev_release() */
-        dev = &dev_dax->dev;
-        device_initialize(dev);
-
         inode = dax_inode(dax_dev);
         cdev = inode->i_cdev;
         cdev_init(cdev, &dax_fops);
-        cdev->owner = parent->driver->owner;
-
-        dev_dax->num_resources = count;
-        dev_dax->dax_dev = dax_dev;
-        dev_dax->region = dax_region;
-        kref_get(&dax_region->kref);
-
-        dev->devt = inode->i_rdev;
-        dev->class = dax_class;
-        dev->parent = parent;
-        dev->groups = dax_attribute_groups;
-        dev->release = dev_dax_release;
-        dev_set_name(dev, "dax%d.%d", dax_region->id, id);
-
-        rc = cdev_device_add(cdev, dev);
-        if (rc) {
-                kill_dev_dax(dev_dax);
-                put_device(dev);
-                return ERR_PTR(rc);
-        }
-
-        rc = devm_add_action_or_reset(dax_region->dev, unregister_dev_dax, dev);
+        if (dev->class) {
+                /* for the CONFIG_DEV_DAX_PMEM_COMPAT case */
+                cdev->owner = dev->parent->driver->owner;
+        } else
+                cdev->owner = dev->driver->owner;
+        cdev_set_parent(cdev, &dev->kobj);
+        rc = cdev_add(cdev, dev->devt, 1);
         if (rc)
-                return ERR_PTR(rc);
+                return rc;
 
-        return dev_dax;
+        rc = devm_add_action_or_reset(dev, dev_dax_cdev_del, cdev);
+        if (rc)
+                return rc;
 
- err_dax:
-        if (dev_dax->id >= 0)
-                ida_simple_remove(&dax_region->ida, dev_dax->id);
- err_id:
-        kfree(dev_dax);
+        run_dax(dax_dev);
+        return devm_add_action_or_reset(dev, dev_dax_kill, dev_dax);
+}
+EXPORT_SYMBOL_GPL(dev_dax_probe);
 
-        return ERR_PTR(rc);
+static int dev_dax_remove(struct device *dev)
+{
+        /* all probe actions are unwound by devm */
+        return 0;
 }
-EXPORT_SYMBOL_GPL(devm_create_dev_dax);
+
+static struct dax_device_driver device_dax_driver = {
+        .drv = {
+                .probe = dev_dax_probe,
+                .remove = dev_dax_remove,
+        },
+        .match_always = 1,
+};
 
 static int __init dax_init(void)
 {
-        dax_class = class_create(THIS_MODULE, "dax");
-        return PTR_ERR_OR_ZERO(dax_class);
+        return dax_driver_register(&device_dax_driver);
 }
 
 static void __exit dax_exit(void)
 {
-        class_destroy(dax_class);
+        dax_driver_unregister(&device_dax_driver);
 }
 
 MODULE_AUTHOR("Intel Corporation");
 MODULE_LICENSE("GPL v2");
-subsys_initcall(dax_init);
+module_init(dax_init);
 module_exit(dax_exit);
+MODULE_ALIAS_DAX_DEVICE(0);
diff --git a/drivers/dax/kmem.c b/drivers/dax/kmem.c
new file mode 100644
index 000000000000..a02318c6d28a
--- /dev/null
+++ b/drivers/dax/kmem.c
@@ -0,0 +1,108 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 2016-2019 Intel Corporation. All rights reserved. */
+#include <linux/memremap.h>
+#include <linux/pagemap.h>
+#include <linux/memory.h>
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/pfn_t.h>
+#include <linux/slab.h>
+#include <linux/dax.h>
+#include <linux/fs.h>
+#include <linux/mm.h>
+#include <linux/mman.h>
+#include "dax-private.h"
+#include "bus.h"
+
+int dev_dax_kmem_probe(struct device *dev)
+{
+        struct dev_dax *dev_dax = to_dev_dax(dev);
+        struct resource *res = &dev_dax->region->res;
+        resource_size_t kmem_start;
+        resource_size_t kmem_size;
+        resource_size_t kmem_end;
+        struct resource *new_res;
+        int numa_node;
+        int rc;
+
+        /*
+         * Ensure good NUMA information for the persistent memory.
+         * Without this check, there is a risk that slow memory
+         * could be mixed in a node with faster memory, causing
+         * unavoidable performance issues.
+         */
+        numa_node = dev_dax->target_node;
+        if (numa_node < 0) {
+                dev_warn(dev, "rejecting DAX region %pR with invalid node: %d\n",
+                         res, numa_node);
+                return -EINVAL;
+        }
+
+        /* Hotplug starting at the beginning of the next block: */
+        kmem_start = ALIGN(res->start, memory_block_size_bytes());
+
+        kmem_size = resource_size(res);
+        /* Adjust the size down to compensate for moving up kmem_start: */
+        kmem_size -= kmem_start - res->start;
+        /* Align the size down to cover only complete blocks: */
+        kmem_size &= ~(memory_block_size_bytes() - 1);
+        kmem_end = kmem_start + kmem_size;
+
+        /* Region is permanently reserved.  Hot-remove not yet implemented. */
+        new_res = request_mem_region(kmem_start, kmem_size, dev_name(dev));
+        if (!new_res) {
+                dev_warn(dev, "could not reserve region [%pa-%pa]\n",
+                         &kmem_start, &kmem_end);
+                return -EBUSY;
+        }
+
+        /*
+         * Set flags appropriate for System RAM.  Leave ..._BUSY clear
+         * so that add_memory() can add a child resource.  Do not
+         * inherit flags from the parent since it may set new flags
+         * unknown to us that will break add_memory() below.
+         */
+        new_res->flags = IORESOURCE_SYSTEM_RAM;
+        new_res->name = dev_name(dev);
+
+        rc = add_memory(numa_node, new_res->start, resource_size(new_res));
+        if (rc)
+                return rc;
+
+        return 0;
+}
+
+static int dev_dax_kmem_remove(struct device *dev)
+{
+        /*
+         * Purposely leak the request_mem_region() for the device-dax
+         * range and return '0' to ->remove() attempts. The removal of
+         * the device from the driver always succeeds, but the region
+         * is permanently pinned as reserved by the unreleased
+         * request_mem_region().
+         */
+        return 0;
+}
+
+static struct dax_device_driver device_dax_kmem_driver = {
+        .drv = {
+                .probe = dev_dax_kmem_probe,
+                .remove = dev_dax_kmem_remove,
+        },
+};
+
+static int __init dax_kmem_init(void)
+{
+        return dax_driver_register(&device_dax_kmem_driver);
+}
+
+static void __exit dax_kmem_exit(void)
+{
+        dax_driver_unregister(&device_dax_kmem_driver);
+}
+
+MODULE_AUTHOR("Intel Corporation");
+MODULE_LICENSE("GPL v2");
+module_init(dax_kmem_init);
+module_exit(dax_kmem_exit);
+MODULE_ALIAS_DAX_DEVICE(0);
diff --git a/drivers/dax/pmem.c b/drivers/dax/pmem.c
deleted file mode 100644
index 2c1f459c0c63..000000000000
--- a/drivers/dax/pmem.c
+++ /dev/null
@@ -1,153 +0,0 @@
-/*
- * Copyright(c) 2016 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of version 2 of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- */
-#include <linux/percpu-refcount.h>
-#include <linux/memremap.h>
-#include <linux/module.h>
-#include <linux/pfn_t.h>
-#include "../nvdimm/pfn.h"
-#include "../nvdimm/nd.h"
-#include "device-dax.h"
-
-struct dax_pmem {
-        struct device *dev;
-        struct percpu_ref ref;
-        struct dev_pagemap pgmap;
-        struct completion cmp;
-};
-
-static struct dax_pmem *to_dax_pmem(struct percpu_ref *ref)
-{
-        return container_of(ref, struct dax_pmem, ref);
-}
-
-static void dax_pmem_percpu_release(struct percpu_ref *ref)
-{
-        struct dax_pmem *dax_pmem = to_dax_pmem(ref);
-
-        dev_dbg(dax_pmem->dev, "trace\n");
-        complete(&dax_pmem->cmp);
-}
-
-static void dax_pmem_percpu_exit(void *data)
-{
-        struct percpu_ref *ref = data;
-        struct dax_pmem *dax_pmem = to_dax_pmem(ref);
-
-        dev_dbg(dax_pmem->dev, "trace\n");
-        wait_for_completion(&dax_pmem->cmp);
-        percpu_ref_exit(ref);
-}
-
-static void dax_pmem_percpu_kill(struct percpu_ref *ref)
-{
-        struct dax_pmem *dax_pmem = to_dax_pmem(ref);
-
-        dev_dbg(dax_pmem->dev, "trace\n");
-        percpu_ref_kill(ref);
-}
-
-static int dax_pmem_probe(struct device *dev)
-{
-        void *addr;
-        struct resource res;
-        int rc, id, region_id;
-        struct nd_pfn_sb *pfn_sb;
-        struct dev_dax *dev_dax;
-        struct dax_pmem *dax_pmem;
-        struct nd_namespace_io *nsio;
-        struct dax_region *dax_region;
-        struct nd_namespace_common *ndns;
-        struct nd_dax *nd_dax = to_nd_dax(dev);
-        struct nd_pfn *nd_pfn = &nd_dax->nd_pfn;
-
-        ndns = nvdimm_namespace_common_probe(dev);
-        if (IS_ERR(ndns))
-                return PTR_ERR(ndns);
-        nsio = to_nd_namespace_io(&ndns->dev);
-
-        dax_pmem = devm_kzalloc(dev, sizeof(*dax_pmem), GFP_KERNEL);
-        if (!dax_pmem)
-                return -ENOMEM;
-
-        /* parse the 'pfn' info block via ->rw_bytes */
-        rc = devm_nsio_enable(dev, nsio);
-        if (rc)
-                return rc;
-        rc = nvdimm_setup_pfn(nd_pfn, &dax_pmem->pgmap);
-        if (rc)
-                return rc;
-        devm_nsio_disable(dev, nsio);
-
-        pfn_sb = nd_pfn->pfn_sb;
-
-        if (!devm_request_mem_region(dev, nsio->res.start,
-                                resource_size(&nsio->res),
-                                dev_name(&ndns->dev))) {
-                dev_warn(dev, "could not reserve region %pR\n", &nsio->res);
-                return -EBUSY;
-        }
-
-        dax_pmem->dev = dev;
-        init_completion(&dax_pmem->cmp);
-        rc = percpu_ref_init(&dax_pmem->ref, dax_pmem_percpu_release, 0,
-                        GFP_KERNEL);
-        if (rc)
-                return rc;
-
-        rc = devm_add_action(dev, dax_pmem_percpu_exit, &dax_pmem->ref);
-        if (rc) {
-                percpu_ref_exit(&dax_pmem->ref);
-                return rc;
-        }
-
-        dax_pmem->pgmap.ref = &dax_pmem->ref;
-        dax_pmem->pgmap.kill = dax_pmem_percpu_kill;
-        addr = devm_memremap_pages(dev, &dax_pmem->pgmap);
-        if (IS_ERR(addr))
-                return PTR_ERR(addr);
-
-        /* adjust the dax_region resource to the start of data */
-        memcpy(&res, &dax_pmem->pgmap.res, sizeof(res));
-        res.start += le64_to_cpu(pfn_sb->dataoff);
-
-        rc = sscanf(dev_name(&ndns->dev), "namespace%d.%d", &region_id, &id);
-        if (rc != 2)
-                return -EINVAL;
-
-        dax_region = alloc_dax_region(dev, region_id, &res,
-                        le32_to_cpu(pfn_sb->align), addr, PFN_DEV|PFN_MAP);
-        if (!dax_region)
-                return -ENOMEM;
-
-        /* TODO: support for subdividing a dax region... */
-        dev_dax = devm_create_dev_dax(dax_region, id, &res, 1);
-
-        /* child dev_dax instances now own the lifetime of the dax_region */
-        dax_region_put(dax_region);
-
-        return PTR_ERR_OR_ZERO(dev_dax);
-}
-
-static struct nd_device_driver dax_pmem_driver = {
-        .probe = dax_pmem_probe,
-        .drv = {
-                .name = "dax_pmem",
-        },
-        .type = ND_DRIVER_DAX_PMEM,
-};
-
-module_nd_driver(dax_pmem_driver);
-
-MODULE_LICENSE("GPL v2");
-MODULE_AUTHOR("Intel Corporation");
-MODULE_ALIAS_ND_DEVICE(ND_DEVICE_DAX_PMEM);
diff --git a/drivers/dax/pmem/Makefile b/drivers/dax/pmem/Makefile
new file mode 100644
index 000000000000..e2e79bd3fdcf
--- /dev/null
+++ b/drivers/dax/pmem/Makefile
@@ -0,0 +1,7 @@
+obj-$(CONFIG_DEV_DAX_PMEM) += dax_pmem.o
+obj-$(CONFIG_DEV_DAX_PMEM) += dax_pmem_core.o
+obj-$(CONFIG_DEV_DAX_PMEM_COMPAT) += dax_pmem_compat.o
+
+dax_pmem-y := pmem.o
+dax_pmem_core-y := core.o
+dax_pmem_compat-y := compat.o
diff --git a/drivers/dax/pmem/compat.c b/drivers/dax/pmem/compat.c
new file mode 100644
index 000000000000..d7b15e6f30c5
--- /dev/null
+++ b/drivers/dax/pmem/compat.c
@@ -0,0 +1,73 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 2016 - 2018 Intel Corporation. All rights reserved. */
+#include <linux/percpu-refcount.h>
+#include <linux/memremap.h>
+#include <linux/module.h>
+#include <linux/pfn_t.h>
+#include <linux/nd.h>
+#include "../bus.h"
+
+/* we need the private definitions to implement compat suport */
+#include "../dax-private.h"
+
+static int dax_pmem_compat_probe(struct device *dev)
+{
+        struct dev_dax *dev_dax = __dax_pmem_probe(dev, DEV_DAX_CLASS);
+        int rc;
+
+        if (IS_ERR(dev_dax))
+                return PTR_ERR(dev_dax);
+
+        if (!devres_open_group(&dev_dax->dev, dev_dax, GFP_KERNEL))
+                return -ENOMEM;
+
+        device_lock(&dev_dax->dev);
+        rc = dev_dax_probe(&dev_dax->dev);
+        device_unlock(&dev_dax->dev);
+
+        devres_close_group(&dev_dax->dev, dev_dax);
+        if (rc)
+                devres_release_group(&dev_dax->dev, dev_dax);
+
+        return rc;
+}
+
+static int dax_pmem_compat_release(struct device *dev, void *data)
+{
+        device_lock(dev);
+        devres_release_group(dev, to_dev_dax(dev));
+        device_unlock(dev);
+
+        return 0;
+}
+
+static int dax_pmem_compat_remove(struct device *dev)
+{
+        device_for_each_child(dev, NULL, dax_pmem_compat_release);
+        return 0;
+}
+
+static struct nd_device_driver dax_pmem_compat_driver = {
+        .probe = dax_pmem_compat_probe,
+        .remove = dax_pmem_compat_remove,
+        .drv = {
+                .name = "dax_pmem_compat",
+        },
+        .type = ND_DRIVER_DAX_PMEM,
+};
+
+static int __init dax_pmem_compat_init(void)
+{
+        return nd_driver_register(&dax_pmem_compat_driver);
+}
+module_init(dax_pmem_compat_init);
+
+static void __exit dax_pmem_compat_exit(void)
+{
+        driver_unregister(&dax_pmem_compat_driver.drv);
+}
+module_exit(dax_pmem_compat_exit);
+
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Intel Corporation");
+MODULE_ALIAS_ND_DEVICE(ND_DEVICE_DAX_PMEM);
diff --git a/drivers/dax/pmem/core.c b/drivers/dax/pmem/core.c
new file mode 100644
index 000000000000..f71019ce0647
--- /dev/null
+++ b/drivers/dax/pmem/core.c
@@ -0,0 +1,71 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 2016 - 2018 Intel Corporation. All rights reserved. */
+#include <linux/memremap.h>
+#include <linux/module.h>
+#include <linux/pfn_t.h>
+#include "../../nvdimm/pfn.h"
+#include "../../nvdimm/nd.h"
+#include "../bus.h"
+
+struct dev_dax *__dax_pmem_probe(struct device *dev, enum dev_dax_subsys subsys)
+{
+        struct resource res;
+        int rc, id, region_id;
+        resource_size_t offset;
+        struct nd_pfn_sb *pfn_sb;
+        struct dev_dax *dev_dax;
+        struct nd_namespace_io *nsio;
+        struct dax_region *dax_region;
+        struct dev_pagemap pgmap = { 0 };
+        struct nd_namespace_common *ndns;
+        struct nd_dax *nd_dax = to_nd_dax(dev);
+        struct nd_pfn *nd_pfn = &nd_dax->nd_pfn;
+        struct nd_region *nd_region = to_nd_region(dev->parent);
+
+        ndns = nvdimm_namespace_common_probe(dev);
+        if (IS_ERR(ndns))
+                return ERR_CAST(ndns);
+        nsio = to_nd_namespace_io(&ndns->dev);
+
+        /* parse the 'pfn' info block via ->rw_bytes */
+        rc = devm_nsio_enable(dev, nsio);
+        if (rc)
+                return ERR_PTR(rc);
+        rc = nvdimm_setup_pfn(nd_pfn, &pgmap);
+        if (rc)
+                return ERR_PTR(rc);
+        devm_nsio_disable(dev, nsio);
+
+        /* reserve the metadata area, device-dax will reserve the data */
+        pfn_sb = nd_pfn->pfn_sb;
+        offset = le64_to_cpu(pfn_sb->dataoff);
+        if (!devm_request_mem_region(dev, nsio->res.start, offset,
+                                dev_name(&ndns->dev))) {
+                dev_warn(dev, "could not reserve metadata\n");
+                return ERR_PTR(-EBUSY);
+        }
+
+        rc = sscanf(dev_name(&ndns->dev), "namespace%d.%d", &region_id, &id);
+        if (rc != 2)
+                return ERR_PTR(-EINVAL);
+
+        /* adjust the dax_region resource to the start of data */
+        memcpy(&res, &pgmap.res, sizeof(res));
+        res.start += offset;
+        dax_region = alloc_dax_region(dev, region_id, &res,
+                        nd_region->target_node, le32_to_cpu(pfn_sb->align),
+                        PFN_DEV|PFN_MAP);
+        if (!dax_region)
+                return ERR_PTR(-ENOMEM);
+
+        dev_dax = __devm_create_dev_dax(dax_region, id, &pgmap, subsys);
+
+        /* child dev_dax instances now own the lifetime of the dax_region */
+        dax_region_put(dax_region);
+
+        return dev_dax;
+}
+EXPORT_SYMBOL_GPL(__dax_pmem_probe);
+
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Intel Corporation");
diff --git a/drivers/dax/pmem/pmem.c b/drivers/dax/pmem/pmem.c
new file mode 100644
index 000000000000..0ae4238a0ef8
--- /dev/null
+++ b/drivers/dax/pmem/pmem.c
@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 2016 - 2018 Intel Corporation. All rights reserved. */
+#include <linux/percpu-refcount.h>
+#include <linux/memremap.h>
+#include <linux/module.h>
+#include <linux/pfn_t.h>
+#include <linux/nd.h>
+#include "../bus.h"
+
+static int dax_pmem_probe(struct device *dev)
+{
+        return PTR_ERR_OR_ZERO(__dax_pmem_probe(dev, DEV_DAX_BUS));
+}
+
+static struct nd_device_driver dax_pmem_driver = {
+        .probe = dax_pmem_probe,
+        .drv = {
+                .name = "dax_pmem",
+        },
+        .type = ND_DRIVER_DAX_PMEM,
+};
+
+static int __init dax_pmem_init(void)
+{
+        return nd_driver_register(&dax_pmem_driver);
+}
+module_init(dax_pmem_init);
+
+static void __exit dax_pmem_exit(void)
+{
+        driver_unregister(&dax_pmem_driver.drv);
+}
+module_exit(dax_pmem_exit);
+
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Intel Corporation");
+#if !IS_ENABLED(CONFIG_DEV_DAX_PMEM_COMPAT)
+/* For compat builds, don't load this module by default */
+MODULE_ALIAS_ND_DEVICE(ND_DEVICE_DAX_PMEM);
+#endif
diff --git a/drivers/dax/super.c b/drivers/dax/super.c
index 0cb8c30ea278..0a339b85133e 100644
--- a/drivers/dax/super.c
+++ b/drivers/dax/super.c
@@ -22,6 +22,7 @@
 #include <linux/uio.h>
 #include <linux/dax.h>
 #include <linux/fs.h>
+#include "dax-private.h"
 
 static dev_t dax_devt;
 DEFINE_STATIC_SRCU(dax_srcu);
@@ -383,11 +384,15 @@ void kill_dax(struct dax_device *dax_dev)
         spin_lock(&dax_host_lock);
         hlist_del_init(&dax_dev->list);
         spin_unlock(&dax_host_lock);
-
-        dax_dev->private = NULL;
 }
 EXPORT_SYMBOL_GPL(kill_dax);
 
+void run_dax(struct dax_device *dax_dev)
+{
+        set_bit(DAXDEV_ALIVE, &dax_dev->flags);
+}
+EXPORT_SYMBOL_GPL(run_dax);
+
 static struct inode *dax_alloc_inode(struct super_block *sb)
 {
         struct dax_device *dax_dev;
@@ -602,6 +607,8 @@ EXPORT_SYMBOL_GPL(dax_inode);
 
 void *dax_get_private(struct dax_device *dax_dev)
 {
+        if (!test_bit(DAXDEV_ALIVE, &dax_dev->flags))
+                return NULL;
         return dax_dev->private;
 }
 EXPORT_SYMBOL_GPL(dax_get_private);
@@ -615,7 +622,7 @@ static void init_once(void *_dax_dev)
         inode_init_once(inode);
 }
 
-static int __dax_fs_init(void)
+static int dax_fs_init(void)
 {
         int rc;
 
@@ -647,35 +654,45 @@ static int __dax_fs_init(void)
         return rc;
 }
 
-static void __dax_fs_exit(void)
+static void dax_fs_exit(void)
 {
         kern_unmount(dax_mnt);
         unregister_filesystem(&dax_fs_type);
         kmem_cache_destroy(dax_cache);
 }
 
-static int __init dax_fs_init(void)
+static int __init dax_core_init(void)
 {
         int rc;
 
-        rc = __dax_fs_init();
+        rc = dax_fs_init();
         if (rc)
                 return rc;
 
         rc = alloc_chrdev_region(&dax_devt, 0, MINORMASK+1, "dax");
         if (rc)
-                __dax_fs_exit();
-        return rc;
+                goto err_chrdev;
+
+        rc = dax_bus_init();
+        if (rc)
+                goto err_bus;
+        return 0;
+
+err_bus:
+        unregister_chrdev_region(dax_devt, MINORMASK+1);
+err_chrdev:
+        dax_fs_exit();
+        return 0;
 }
 
-static void __exit dax_fs_exit(void)
+static void __exit dax_core_exit(void)
 {
         unregister_chrdev_region(dax_devt, MINORMASK+1);
         ida_destroy(&dax_minor_ida);
-        __dax_fs_exit();
+        dax_fs_exit();
 }
 
 MODULE_AUTHOR("Intel Corporation");
 MODULE_LICENSE("GPL v2");
-subsys_initcall(dax_fs_init);
-module_exit(dax_fs_exit);
+subsys_initcall(dax_core_init);
+module_exit(dax_core_exit);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index ead851413c0a..16fcb56c232b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -700,6 +700,8 @@ int amdgpu_vm_validate_pt_bos(struct amdgpu_device *adev, struct amdgpu_vm *vm,
         struct amdgpu_vm_bo_base *bo_base, *tmp;
         int r = 0;
 
+        vm->bulk_moveable &= list_empty(&vm->evicted);
+
         list_for_each_entry_safe(bo_base, tmp, &vm->evicted, vm_status) {
                 struct amdgpu_bo *bo = bo_base->bo;
 
@@ -947,10 +949,6 @@ int amdgpu_vm_alloc_pts(struct amdgpu_device *adev,
                 if (r)
                         return r;
 
-                r = amdgpu_vm_clear_bo(adev, vm, pt, cursor.level, ats);
-                if (r)
-                        goto error_free_pt;
-
                 if (vm->use_cpu_for_update) {
                         r = amdgpu_bo_kmap(pt, NULL);
                         if (r)
@@ -963,6 +961,10 @@ int amdgpu_vm_alloc_pts(struct amdgpu_device *adev,
                 pt->parent = amdgpu_bo_ref(cursor.parent->base.bo);
 
                 amdgpu_vm_bo_base_init(&entry->base, vm, pt);
+
+                r = amdgpu_vm_clear_bo(adev, vm, pt, cursor.level, ats);
+                if (r)
+                        goto error_free_pt;
         }
 
         return 0;
@@ -3033,13 +3035,14 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm,
         if (r)
                 goto error_unreserve;
 
+        amdgpu_vm_bo_base_init(&vm->root.base, vm, root);
+
         r = amdgpu_vm_clear_bo(adev, vm, root,
                                adev->vm_manager.root_level,
                                vm->pte_support_ats);
         if (r)
                 goto error_unreserve;
 
-        amdgpu_vm_bo_base_init(&vm->root.base, vm, root);
         amdgpu_bo_unreserve(vm->root.base.bo);
 
         if (pasid) {
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index 5533f6e4f4a4..d0309e8c9d12 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -220,6 +220,7 @@ static const struct soc15_reg_golden golden_settings_gc_9_1_rv2[] =
 
 static const struct soc15_reg_golden golden_settings_gc_9_x_common[] =
 {
+        SOC15_REG_GOLDEN_VALUE(GC, 0, mmCP_SD_CNTL, 0xffffffff, 0x000001ff),
         SOC15_REG_GOLDEN_VALUE(GC, 0, mmGRBM_CAM_INDEX, 0xffffffff, 0x00000000),
         SOC15_REG_GOLDEN_VALUE(GC, 0, mmGRBM_CAM_DATA, 0xffffffff, 0x2544c382)
 };
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
index 600259b4e291..2fe8397241ea 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
@@ -742,7 +742,7 @@ static int gmc_v9_0_allocate_vm_inv_eng(struct amdgpu_device *adev)
                 }
 
                 ring->vm_inv_eng = inv_eng - 1;
-                change_bit(inv_eng - 1, (unsigned long *)(&vm_inv_engs[vmhub]));
+                vm_inv_engs[vmhub] &= ~(1 << ring->vm_inv_eng);
 
                 dev_info(adev->dev, "ring %s uses VM inv eng %u on hub %u\n",
                          ring->name, ring->vm_inv_eng, ring->funcs->vmhub);
diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v3_1.c b/drivers/gpu/drm/amd/amdgpu/psp_v3_1.c
index c63de945c021..0487e3a4e9e7 100644
--- a/drivers/gpu/drm/amd/amdgpu/psp_v3_1.c
+++ b/drivers/gpu/drm/amd/amdgpu/psp_v3_1.c
@@ -500,9 +500,7 @@ static bool psp_v3_1_smu_reload_quirk(struct psp_context *psp)
         struct amdgpu_device *adev = psp->adev;
         uint32_t reg;
 
-        reg = smnMP1_FIRMWARE_FLAGS | 0x03b00000;
-        WREG32_SOC15(NBIO, 0, mmPCIE_INDEX2, reg);
-        reg = RREG32_SOC15(NBIO, 0, mmPCIE_DATA2);
+        reg = RREG32_PCIE(smnMP1_FIRMWARE_FLAGS | 0x03b00000);
         return (reg & MP1_FIRMWARE_FLAGS__INTERRUPTS_ENABLED_MASK) ? true : false;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
index 99ebcf29dcb0..ed89a101f73f 100644
--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
+++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
@@ -461,7 +461,6 @@ static int soc15_asic_reset(struct amdgpu_device *adev)
 
         switch (adev->asic_type) {
         case CHIP_VEGA10:
-        case CHIP_VEGA20:
                 soc15_asic_get_baco_capability(adev, &baco_reset);
                 break;
         default:
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c
index 47243165a082..ae90a99909ef 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c
@@ -323,57 +323,7 @@ static int init_mqd_hiq(struct mqd_manager *mm, void **mqd,
                 struct kfd_mem_obj **mqd_mem_obj, uint64_t *gart_addr,
                 struct queue_properties *q)
 {
-        uint64_t addr;
-        struct cik_mqd *m;
-        int retval;
-
-        retval = kfd_gtt_sa_allocate(mm->dev, sizeof(struct cik_mqd),
-                                        mqd_mem_obj);
-
-        if (retval != 0)
-                return -ENOMEM;
-
-        m = (struct cik_mqd *) (*mqd_mem_obj)->cpu_ptr;
-        addr = (*mqd_mem_obj)->gpu_addr;
-
-        memset(m, 0, ALIGN(sizeof(struct cik_mqd), 256));
-
-        m->header = 0xC0310800;
-        m->compute_pipelinestat_enable = 1;
-        m->compute_static_thread_mgmt_se0 = 0xFFFFFFFF;
-        m->compute_static_thread_mgmt_se1 = 0xFFFFFFFF;
-        m->compute_static_thread_mgmt_se2 = 0xFFFFFFFF;
-        m->compute_static_thread_mgmt_se3 = 0xFFFFFFFF;
-
-        m->cp_hqd_persistent_state = DEFAULT_CP_HQD_PERSISTENT_STATE |
-                                        PRELOAD_REQ;
-        m->cp_hqd_quantum = QUANTUM_EN | QUANTUM_SCALE_1MS |
-                                QUANTUM_DURATION(10);
-
-        m->cp_mqd_control             = MQD_CONTROL_PRIV_STATE_EN;
-        m->cp_mqd_base_addr_lo        = lower_32_bits(addr);
-        m->cp_mqd_base_addr_hi        = upper_32_bits(addr);
-
-        m->cp_hqd_ib_control = DEFAULT_MIN_IB_AVAIL_SIZE;
-
-        /*
-         * Pipe Priority
-         * Identifies the pipe relative priority when this queue is connected
-         * to the pipeline. The pipe priority is against the GFX pipe and HP3D.
-         * In KFD we are using a fixed pipe priority set to CS_MEDIUM.
-         * 0 = CS_LOW (typically below GFX)
-         * 1 = CS_MEDIUM (typically between HP3D and GFX
-         * 2 = CS_HIGH (typically above HP3D)
-         */
-        m->cp_hqd_pipe_priority = 1;
-        m->cp_hqd_queue_priority = 15;
-
-        *mqd = m;
-        if (gart_addr)
-                *gart_addr = addr;
-        retval = mm->update_mqd(mm, m, q);
-
-        return retval;
+        return init_mqd(mm, mqd, mqd_mem_obj, gart_addr, q);
 }
 
 static int update_mqd_hiq(struct mqd_manager *mm, void *mqd,
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 2f26581b93ff..fb27783d7a54 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -886,6 +886,7 @@ static void emulated_link_detect(struct dc_link *link)
                 return;
         }
 
+        /* dc_sink_create returns a new reference */
         link->local_sink = sink;
 
         edid_status = dm_helpers_read_local_edid(
@@ -952,6 +953,8 @@ static int dm_resume(void *handle)
                 if (aconnector->fake_enable && aconnector->dc_link->local_sink)
                         aconnector->fake_enable = false;
 
+                if (aconnector->dc_sink)
+                        dc_sink_release(aconnector->dc_sink);
                 aconnector->dc_sink = NULL;
                 amdgpu_dm_update_connector_after_detect(aconnector);
                 mutex_unlock(&aconnector->hpd_lock);
@@ -1061,6 +1064,8 @@ amdgpu_dm_update_connector_after_detect(struct amdgpu_dm_connector *aconnector)
 
 
         sink = aconnector->dc_link->local_sink;
+        if (sink)
+                dc_sink_retain(sink);
 
         /*
          * Edid mgmt connector gets first update only in mode_valid hook and then
@@ -1085,21 +1090,24 @@ amdgpu_dm_update_connector_after_detect(struct amdgpu_dm_connector *aconnector)
                                  * to it anymore after disconnect, so on next crtc to connector
                                  * reshuffle by UMD we will get into unwanted dc_sink release
                                  */
-                                if (aconnector->dc_sink != aconnector->dc_em_sink)
-                                        dc_sink_release(aconnector->dc_sink);
+                                dc_sink_release(aconnector->dc_sink);
                         }
                         aconnector->dc_sink = sink;
+                        dc_sink_retain(aconnector->dc_sink);
                         amdgpu_dm_update_freesync_caps(connector,
                                         aconnector->edid);
                 } else {
                         amdgpu_dm_update_freesync_caps(connector, NULL);
-                        if (!aconnector->dc_sink)
+                        if (!aconnector->dc_sink) {
                                 aconnector->dc_sink = aconnector->dc_em_sink;
-                        else if (aconnector->dc_sink != aconnector->dc_em_sink)
                                 dc_sink_retain(aconnector->dc_sink);
+                        }
                 }
 
                 mutex_unlock(&dev->mode_config.mutex);
+
+                if (sink)
+                        dc_sink_release(sink);
                 return;
         }
 
@@ -1107,8 +1115,10 @@ amdgpu_dm_update_connector_after_detect(struct amdgpu_dm_connector *aconnector)
          * TODO: temporary guard to look for proper fix
          * if this sink is MST sink, we should not do anything
          */
-        if (sink && sink->sink_signal == SIGNAL_TYPE_DISPLAY_PORT_MST)
+        if (sink && sink->sink_signal == SIGNAL_TYPE_DISPLAY_PORT_MST) {
+                dc_sink_release(sink);
                 return;
+        }
 
         if (aconnector->dc_sink == sink) {
                 /*
@@ -1117,6 +1127,8 @@ amdgpu_dm_update_connector_after_detect(struct amdgpu_dm_connector *aconnector)
                  */
                 DRM_DEBUG_DRIVER("DCHPD: connector_id=%d: dc_sink didn't change.\n",
                                 aconnector->connector_id);
+                if (sink)
+                        dc_sink_release(sink);
                 return;
         }
 
@@ -1138,6 +1150,7 @@ amdgpu_dm_update_connector_after_detect(struct amdgpu_dm_connector *aconnector)
                         amdgpu_dm_update_freesync_caps(connector, NULL);
 
                 aconnector->dc_sink = sink;
+                dc_sink_retain(aconnector->dc_sink);
                 if (sink->dc_edid.length == 0) {
                         aconnector->edid = NULL;
                         drm_dp_cec_unset_edid(&aconnector->dm_dp_aux.aux);
@@ -1158,11 +1171,15 @@ amdgpu_dm_update_connector_after_detect(struct amdgpu_dm_connector *aconnector)
                 amdgpu_dm_update_freesync_caps(connector, NULL);
                 drm_connector_update_edid_property(connector, NULL);
                 aconnector->num_modes = 0;
+                dc_sink_release(aconnector->dc_sink);
                 aconnector->dc_sink = NULL;
                 aconnector->edid = NULL;
         }
 
         mutex_unlock(&dev->mode_config.mutex);
+
+        if (sink)
+                dc_sink_release(sink);
 }
 
 static void handle_hpd_irq(void *param)
@@ -2977,6 +2994,7 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
                         return stream;
         } else {
                 sink = aconnector->dc_sink;
+                dc_sink_retain(sink);
         }
 
         stream = dc_create_stream_for_sink(sink);
@@ -3042,8 +3060,7 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
         update_stream_signal(stream, sink);
 
 finish:
-        if (sink && sink->sink_signal == SIGNAL_TYPE_VIRTUAL && aconnector->base.force != DRM_FORCE_ON)
-                dc_sink_release(sink);
+        dc_sink_release(sink);
 
         return stream;
 }
@@ -3301,6 +3318,14 @@ static void amdgpu_dm_connector_destroy(struct drm_connector *connector)
                 dm->backlight_dev = NULL;
         }
 #endif
+
+        if (aconnector->dc_em_sink)
+                dc_sink_release(aconnector->dc_em_sink);
+        aconnector->dc_em_sink = NULL;
+        if (aconnector->dc_sink)
+                dc_sink_release(aconnector->dc_sink);
+        aconnector->dc_sink = NULL;
+
         drm_dp_cec_unregister_connector(&aconnector->dm_dp_aux.aux);
         drm_connector_unregister(connector);
         drm_connector_cleanup(connector);
@@ -3398,10 +3423,12 @@ static void create_eml_sink(struct amdgpu_dm_connector *aconnector)
                 (edid->extensions + 1) * EDID_LENGTH,
                 &init_params);
 
-        if (aconnector->base.force == DRM_FORCE_ON)
+        if (aconnector->base.force == DRM_FORCE_ON) {
                 aconnector->dc_sink = aconnector->dc_link->local_sink ?
                 aconnector->dc_link->local_sink :
                 aconnector->dc_em_sink;
+                dc_sink_retain(aconnector->dc_sink);
+        }
 }
 
 static void handle_edid_mgmt(struct amdgpu_dm_connector *aconnector)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
index f51d52eb52e6..c4ea3a91f17a 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
@@ -191,6 +191,7 @@ static int dm_dp_mst_get_modes(struct drm_connector *connector)
                         &init_params);
 
                 dc_sink->priv = aconnector;
+                /* dc_link_add_remote_sink returns a new reference */
                 aconnector->dc_sink = dc_sink;
 
                 if (aconnector->dc_sink)
diff --git a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
index 12d1842079ae..eb62d10bb65c 100644
--- a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
+++ b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
@@ -1348,12 +1348,12 @@ void dcn_bw_update_from_pplib(struct dc *dc)
         struct dm_pp_clock_levels_with_voltage fclks = {0}, dcfclks = {0};
         bool res;
 
-        kernel_fpu_begin();
-
         /* TODO: This is not the proper way to obtain fabric_and_dram_bandwidth, should be min(fclk, memclk) */
         res = dm_pp_get_clock_levels_by_type_with_voltage(
                         ctx, DM_PP_CLOCK_TYPE_FCLK, &fclks);
 
+        kernel_fpu_begin();
+
         if (res)
                 res = verify_clock_values(&fclks);
 
@@ -1372,9 +1372,13 @@ void dcn_bw_update_from_pplib(struct dc *dc)
         } else
                 BREAK_TO_DEBUGGER();
 
+        kernel_fpu_end();
+
         res = dm_pp_get_clock_levels_by_type_with_voltage(
                         ctx, DM_PP_CLOCK_TYPE_DCFCLK, &dcfclks);
 
+        kernel_fpu_begin();
+
         if (res)
                 res = verify_clock_values(&dcfclks);
 
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 7f5a947ad31d..4eba3c4800b6 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -794,6 +794,7 @@ bool dc_link_detect(struct dc_link *link, enum dc_detect_reason reason)
                 sink->link->dongle_max_pix_clk = sink_caps.max_hdmi_pixel_clock;
                 sink->converter_disable_audio = converter_disable_audio;
 
+                /* dc_sink_create returns a new reference */
                 link->local_sink = sink;
 
                 edid_status = dm_helpers_read_local_edid(
@@ -2037,6 +2038,9 @@ static enum dc_status enable_link(
                 break;
         }
 
+        if (status == DC_OK)
+                pipe_ctx->stream->link->link_status.link_active = true;
+
         return status;
 }
 
@@ -2060,6 +2064,14 @@ static void disable_link(struct dc_link *link, enum signal_type signal)
                         dp_disable_link_phy_mst(link, signal);
         } else
                 link->link_enc->funcs->disable_output(link->link_enc, signal);
+
+        if (signal == SIGNAL_TYPE_DISPLAY_PORT_MST) {
+                /* MST disable link only when no stream use the link */
+                if (link->mst_stream_alloc_table.stream_count <= 0)
+                        link->link_status.link_active = false;
+        } else {
+                link->link_status.link_active = false;
+        }
 }
 
 static bool dp_active_dongle_validate_timing(
@@ -2623,8 +2635,6 @@ void core_link_enable_stream(
                         }
                 }
 
-                stream->link->link_status.link_active = true;
-
                 core_dc->hwss.enable_audio_stream(pipe_ctx);
 
                 /* turn off otg test pattern if enable */
@@ -2659,8 +2669,6 @@ void core_link_disable_stream(struct pipe_ctx *pipe_ctx, int option)
         core_dc->hwss.disable_stream(pipe_ctx, option);
 
         disable_link(pipe_ctx->stream->link, pipe_ctx->stream->signal);
-
-        pipe_ctx->stream->link->link_status.link_active = false;
 }
 
 void core_link_set_avmute(struct pipe_ctx *pipe_ctx, bool enable)
diff --git a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
index 94a84bc57c7a..bfd27f10879e 100644
--- a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
+++ b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
@@ -724,7 +724,7 @@ static void build_vrr_infopacket_v1(enum signal_type signal,
 
 static void build_vrr_infopacket_v2(enum signal_type signal,
                 const struct mod_vrr_params *vrr,
-                const enum color_transfer_func *app_tf,
+                enum color_transfer_func app_tf,
                 struct dc_info_packet *infopacket)
 {
         unsigned int payload_size = 0;
@@ -732,8 +732,7 @@ static void build_vrr_infopacket_v2(enum signal_type signal,
         build_vrr_infopacket_header_v2(signal, infopacket, &payload_size);
         build_vrr_infopacket_data(vrr, infopacket);
 
-        if (app_tf != NULL)
-                build_vrr_infopacket_fs2_data(*app_tf, infopacket);
+        build_vrr_infopacket_fs2_data(app_tf, infopacket);
 
         build_vrr_infopacket_checksum(&payload_size, infopacket);
 
@@ -757,7 +756,7 @@ void mod_freesync_build_vrr_infopacket(struct mod_freesync *mod_freesync,
                 const struct dc_stream_state *stream,
                 const struct mod_vrr_params *vrr,
                 enum vrr_packet_type packet_type,
-                const enum color_transfer_func *app_tf,
+                enum color_transfer_func app_tf,
                 struct dc_info_packet *infopacket)
 {
         /* SPD info packet for FreeSync
diff --git a/drivers/gpu/drm/amd/display/modules/inc/mod_freesync.h b/drivers/gpu/drm/amd/display/modules/inc/mod_freesync.h
index 4222e403b151..dcef85994c45 100644
--- a/drivers/gpu/drm/amd/display/modules/inc/mod_freesync.h
+++ b/drivers/gpu/drm/amd/display/modules/inc/mod_freesync.h
@@ -145,7 +145,7 @@ void mod_freesync_build_vrr_infopacket(struct mod_freesync *mod_freesync,
                 const struct dc_stream_state *stream,
                 const struct mod_vrr_params *vrr,
                 enum vrr_packet_type packet_type,
-                const enum color_transfer_func *app_tf,
+                enum color_transfer_func app_tf,
                 struct dc_info_packet *infopacket);
 
 void mod_freesync_build_vrr_params(struct mod_freesync *mod_freesync,
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c b/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c
index ce177d7f04cb..6bf48934fdc4 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c
@@ -277,8 +277,7 @@ int psm_adjust_power_state_dynamic(struct pp_hwmgr *hwmgr, bool skip_display_set
         if (!skip_display_settings)
                 phm_notify_smc_display_config_after_ps_adjustment(hwmgr);
 
-        if ((hwmgr->request_dpm_level != hwmgr->dpm_level) &&
-            !phm_force_dpm_levels(hwmgr, hwmgr->request_dpm_level))
+        if (!phm_force_dpm_levels(hwmgr, hwmgr->request_dpm_level))
                 hwmgr->dpm_level = hwmgr->request_dpm_level;
 
         if (hwmgr->dpm_level != AMD_DPM_FORCED_LEVEL_MANUAL) {
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomfwctrl.c b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomfwctrl.c
index 4588bddf8b33..615cf2c09e54 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomfwctrl.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomfwctrl.c
@@ -489,15 +489,16 @@ int pp_atomfwctrl_get_gpio_information(struct pp_hwmgr *hwmgr,
 }
 
 int pp_atomfwctrl_get_clk_information_by_clkid(struct pp_hwmgr *hwmgr,
-                                               uint8_t id, uint32_t *frequency)
+                                               uint8_t clk_id, uint8_t syspll_id,
+                                               uint32_t *frequency)
 {
         struct amdgpu_device *adev = hwmgr->adev;
         struct atom_get_smu_clock_info_parameters_v3_1   parameters;
         struct atom_get_smu_clock_info_output_parameters_v3_1 *output;
         uint32_t ix;
 
-        parameters.clk_id = id;
-        parameters.syspll_id = 0;
+        parameters.clk_id = clk_id;
+        parameters.syspll_id = syspll_id;
         parameters.command = GET_SMU_CLOCK_INFO_V3_1_GET_CLOCK_FREQ;
         parameters.dfsdid = 0;
 
@@ -530,20 +531,23 @@ static void pp_atomfwctrl_copy_vbios_bootup_values_3_2(struct pp_hwmgr *hwmgr,
         boot_values->ulSocClk   = 0;
         boot_values->ulDCEFClk   = 0;
 
-        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU11_SYSPLL0_SOCCLK_ID, &frequency))
+        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU11_SYSPLL0_SOCCLK_ID, SMU11_SYSPLL0_ID, &frequency))
                 boot_values->ulSocClk   = frequency;
 
-        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU11_SYSPLL0_DCEFCLK_ID, &frequency))
+        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU11_SYSPLL0_DCEFCLK_ID, SMU11_SYSPLL0_ID, &frequency))
                 boot_values->ulDCEFClk  = frequency;
 
-        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU11_SYSPLL0_ECLK_ID, &frequency))
+        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU11_SYSPLL0_ECLK_ID, SMU11_SYSPLL0_ID, &frequency))
                 boot_values->ulEClk     = frequency;
 
-        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU11_SYSPLL0_VCLK_ID, &frequency))
+        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU11_SYSPLL0_VCLK_ID, SMU11_SYSPLL0_ID, &frequency))
                 boot_values->ulVClk     = frequency;
 
-        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU11_SYSPLL0_DCLK_ID, &frequency))
+        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU11_SYSPLL0_DCLK_ID, SMU11_SYSPLL0_ID, &frequency))
                 boot_values->ulDClk     = frequency;
+
+        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU11_SYSPLL1_0_FCLK_ID, SMU11_SYSPLL1_2_ID, &frequency))
+                boot_values->ulFClk     = frequency;
 }
 
 static void pp_atomfwctrl_copy_vbios_bootup_values_3_1(struct pp_hwmgr *hwmgr,
@@ -563,19 +567,19 @@ static void pp_atomfwctrl_copy_vbios_bootup_values_3_1(struct pp_hwmgr *hwmgr,
         boot_values->ulSocClk   = 0;
         boot_values->ulDCEFClk   = 0;
 
-        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU9_SYSPLL0_SOCCLK_ID, &frequency))
+        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU9_SYSPLL0_SOCCLK_ID, 0, &frequency))
                 boot_values->ulSocClk   = frequency;
 
-        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU9_SYSPLL0_DCEFCLK_ID, &frequency))
+        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU9_SYSPLL0_DCEFCLK_ID, 0, &frequency))
                 boot_values->ulDCEFClk  = frequency;
 
-        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU9_SYSPLL0_ECLK_ID, &frequency))
+        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU9_SYSPLL0_ECLK_ID, 0, &frequency))
                 boot_values->ulEClk     = frequency;
 
-        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU9_SYSPLL0_VCLK_ID, &frequency))
+        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU9_SYSPLL0_VCLK_ID, 0, &frequency))
                 boot_values->ulVClk     = frequency;
 
-        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU9_SYSPLL0_DCLK_ID, &frequency))
+        if (!pp_atomfwctrl_get_clk_information_by_clkid(hwmgr, SMU9_SYSPLL0_DCLK_ID, 0, &frequency))
                 boot_values->ulDClk     = frequency;
 }
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomfwctrl.h b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomfwctrl.h
index fe9e8ceef50e..b7e2651b570b 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomfwctrl.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomfwctrl.h
@@ -139,6 +139,7 @@ struct pp_atomfwctrl_bios_boot_up_values {
         uint32_t   ulEClk;
         uint32_t   ulVClk;
         uint32_t   ulDClk;
+        uint32_t   ulFClk;
         uint16_t   usVddc;
         uint16_t   usVddci;
         uint16_t   usMvddc;
@@ -236,7 +237,8 @@ int pp_atomfwctrl_get_vbios_bootup_values(struct pp_hwmgr *hwmgr,
 int pp_atomfwctrl_get_smc_dpm_information(struct pp_hwmgr *hwmgr,
                         struct pp_atomfwctrl_smc_dpm_parameters *param);
 int pp_atomfwctrl_get_clk_information_by_clkid(struct pp_hwmgr *hwmgr,
-                                        uint8_t id, uint32_t *frequency);
+                                        uint8_t clk_id, uint8_t syspll_id,
+                                        uint32_t *frequency);
 
 #endif
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
index 48187acac59e..83d3d935f3ac 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -3491,14 +3491,14 @@ static int smu7_get_gpu_power(struct pp_hwmgr *hwmgr, u32 *query)
 
         smum_send_msg_to_smc(hwmgr, PPSMC_MSG_PmStatusLogStart);
         cgs_write_ind_register(hwmgr->device, CGS_IND_REG__SMC,
-                                                        ixSMU_PM_STATUS_94, 0);
+                                                        ixSMU_PM_STATUS_95, 0);
 
         for (i = 0; i < 10; i++) {
-                mdelay(1);
+                mdelay(500);
                 smum_send_msg_to_smc(hwmgr, PPSMC_MSG_PmStatusLogSample);
                 tmp = cgs_read_ind_register(hwmgr->device,
                                                 CGS_IND_REG__SMC,
-                                                ixSMU_PM_STATUS_94);
+                                                ixSMU_PM_STATUS_95);
                 if (tmp != 0)
                         break;
         }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
index 5479125ff4f6..5c4f701939ea 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
@@ -2575,10 +2575,10 @@ static int vega10_init_smc_table(struct pp_hwmgr *hwmgr)
                 data->vbios_boot_state.gfx_clock = boot_up_values.ulGfxClk;
                 data->vbios_boot_state.mem_clock = boot_up_values.ulUClk;
                 pp_atomfwctrl_get_clk_information_by_clkid(hwmgr,
-                                SMU9_SYSPLL0_SOCCLK_ID, &boot_up_values.ulSocClk);
+                                SMU9_SYSPLL0_SOCCLK_ID, 0, &boot_up_values.ulSocClk);
 
                 pp_atomfwctrl_get_clk_information_by_clkid(hwmgr,
-                                SMU9_SYSPLL0_DCEFCLK_ID, &boot_up_values.ulDCEFClk);
+                                SMU9_SYSPLL0_DCEFCLK_ID, 0, &boot_up_values.ulDCEFClk);
 
                 data->vbios_boot_state.soc_clock = boot_up_values.ulSocClk;
                 data->vbios_boot_state.dcef_clock = boot_up_values.ulDCEFClk;
@@ -4407,9 +4407,9 @@ static int vega10_set_ppfeature_status(struct pp_hwmgr *hwmgr, uint64_t new_ppfe
                 return ret;
 
         features_to_disable =
-                (features_enabled ^ new_ppfeature_masks) & features_enabled;
+                features_enabled & ~new_ppfeature_masks;
         features_to_enable =
-                (features_enabled ^ new_ppfeature_masks) ^ features_to_disable;
+                ~features_enabled & new_ppfeature_masks;
 
         pr_debug("features_to_disable 0x%llx\n", features_to_disable);
         pr_debug("features_to_enable 0x%llx\n", features_to_enable);
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
index 6c8e78611c03..bdb48e94eff6 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
@@ -2009,9 +2009,9 @@ static int vega12_set_ppfeature_status(struct pp_hwmgr *hwmgr, uint64_t new_ppfe
                 return ret;
 
         features_to_disable =
-                (features_enabled ^ new_ppfeature_masks) & features_enabled;
+                features_enabled & ~new_ppfeature_masks;
         features_to_enable =
-                (features_enabled ^ new_ppfeature_masks) ^ features_to_disable;
+                ~features_enabled & new_ppfeature_masks;
 
         pr_debug("features_to_disable 0x%llx\n", features_to_disable);
         pr_debug("features_to_enable 0x%llx\n", features_to_enable);
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
index aad79affb081..9aa7bec1b5fe 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
@@ -463,9 +463,9 @@ static int vega20_setup_asic_task(struct pp_hwmgr *hwmgr)
 static void vega20_init_dpm_state(struct vega20_dpm_state *dpm_state)
 {
         dpm_state->soft_min_level = 0x0;
-        dpm_state->soft_max_level = 0xffff;
+        dpm_state->soft_max_level = VG20_CLOCK_MAX_DEFAULT;
         dpm_state->hard_min_level = 0x0;
-        dpm_state->hard_max_level = 0xffff;
+        dpm_state->hard_max_level = VG20_CLOCK_MAX_DEFAULT;
 }
 
 static int vega20_get_number_of_dpm_level(struct pp_hwmgr *hwmgr,
@@ -711,8 +711,10 @@ static int vega20_setup_default_dpm_tables(struct pp_hwmgr *hwmgr)
                 PP_ASSERT_WITH_CODE(!ret,
                                 "[SetupDefaultDpmTable] failed to get fclk dpm levels!",
                                 return ret);
-        } else
-                dpm_table->count = 0;
+        } else {
+                dpm_table->count = 1;
+                dpm_table->dpm_levels[0].value = data->vbios_boot_state.fclock / 100;
+        }
         vega20_init_dpm_state(&(dpm_table->dpm_state));
 
         /* save a copy of the default DPM table */
@@ -754,6 +756,7 @@ static int vega20_init_smc_table(struct pp_hwmgr *hwmgr)
         data->vbios_boot_state.eclock = boot_up_values.ulEClk;
         data->vbios_boot_state.vclock = boot_up_values.ulVClk;
         data->vbios_boot_state.dclock = boot_up_values.ulDClk;
+        data->vbios_boot_state.fclock = boot_up_values.ulFClk;
         data->vbios_boot_state.uc_cooling_id = boot_up_values.ucCoolingID;
 
         smum_send_msg_to_smc_with_parameter(hwmgr,
@@ -780,6 +783,8 @@ static int vega20_init_smc_table(struct pp_hwmgr *hwmgr)
 static int vega20_override_pcie_parameters(struct pp_hwmgr *hwmgr)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)(hwmgr->adev);
+        struct vega20_hwmgr *data =
+                        (struct vega20_hwmgr *)(hwmgr->backend);
         uint32_t pcie_gen = 0, pcie_width = 0, smu_pcie_arg;
         int ret;
 
@@ -816,6 +821,10 @@ static int vega20_override_pcie_parameters(struct pp_hwmgr *hwmgr)
                 "[OverridePcieParameters] Attempt to override pcie params failed!",
                 return ret);
 
+        data->pcie_parameters_override = 1;
+        data->pcie_gen_level1 = pcie_gen;
+        data->pcie_width_level1 = pcie_width;
+
         return 0;
 }
 
@@ -979,6 +988,8 @@ static int vega20_od8_set_feature_capabilities(
         }
 
         if (data->smu_features[GNLD_DPM_UCLK].enabled) {
+                pptable_information->od_settings_min[OD8_SETTING_UCLK_FMAX] =
+                        data->dpm_table.mem_table.dpm_levels[data->dpm_table.mem_table.count - 2].value;
                 if (pptable_information->od_feature_capabilities[ATOM_VEGA20_ODFEATURE_UCLK_MAX] &&
                     pptable_information->od_settings_min[OD8_SETTING_UCLK_FMAX] > 0 &&
                     pptable_information->od_settings_max[OD8_SETTING_UCLK_FMAX] > 0 &&
@@ -2314,32 +2325,8 @@ static int vega20_force_dpm_lowest(struct pp_hwmgr *hwmgr)
 
 static int vega20_unforce_dpm_levels(struct pp_hwmgr *hwmgr)
 {
-        struct vega20_hwmgr *data =
-                        (struct vega20_hwmgr *)(hwmgr->backend);
-        uint32_t soft_min_level, soft_max_level;
         int ret = 0;
 
-        soft_min_level = vega20_find_lowest_dpm_level(&(data->dpm_table.gfx_table));
-        soft_max_level = vega20_find_highest_dpm_level(&(data->dpm_table.gfx_table));
-        data->dpm_table.gfx_table.dpm_state.soft_min_level =
-                data->dpm_table.gfx_table.dpm_levels[soft_min_level].value;
-        data->dpm_table.gfx_table.dpm_state.soft_max_level =
-                data->dpm_table.gfx_table.dpm_levels[soft_max_level].value;
-
-        soft_min_level = vega20_find_lowest_dpm_level(&(data->dpm_table.mem_table));
-        soft_max_level = vega20_find_highest_dpm_level(&(data->dpm_table.mem_table));
-        data->dpm_table.mem_table.dpm_state.soft_min_level =
-                data->dpm_table.mem_table.dpm_levels[soft_min_level].value;
-        data->dpm_table.mem_table.dpm_state.soft_max_level =
-                data->dpm_table.mem_table.dpm_levels[soft_max_level].value;
-
-        soft_min_level = vega20_find_lowest_dpm_level(&(data->dpm_table.soc_table));
-        soft_max_level = vega20_find_highest_dpm_level(&(data->dpm_table.soc_table));
-        data->dpm_table.soc_table.dpm_state.soft_min_level =
-                data->dpm_table.soc_table.dpm_levels[soft_min_level].value;
-        data->dpm_table.soc_table.dpm_state.soft_max_level =
-                data->dpm_table.soc_table.dpm_levels[soft_max_level].value;
-
         ret = vega20_upload_dpm_min_level(hwmgr, 0xFFFFFFFF);
         PP_ASSERT_WITH_CODE(!ret,
                         "Failed to upload DPM Bootup Levels!",
@@ -2641,9 +2628,8 @@ static int vega20_get_sclks(struct pp_hwmgr *hwmgr,
         struct vega20_single_dpm_table *dpm_table = &(data->dpm_table.gfx_table);
         int i, count;
 
-        PP_ASSERT_WITH_CODE(data->smu_features[GNLD_DPM_GFXCLK].enabled,
-                "[GetSclks]: gfxclk dpm not enabled!\n",
-                return -EPERM);
+        if (!data->smu_features[GNLD_DPM_GFXCLK].enabled)
+                return -1;
 
         count = (dpm_table->count > MAX_NUM_CLOCKS) ? MAX_NUM_CLOCKS : dpm_table->count;
         clocks->num_levels = count;
@@ -2670,9 +2656,8 @@ static int vega20_get_memclocks(struct pp_hwmgr *hwmgr,
         struct vega20_single_dpm_table *dpm_table = &(data->dpm_table.mem_table);
         int i, count;
 
-        PP_ASSERT_WITH_CODE(data->smu_features[GNLD_DPM_UCLK].enabled,
-                "[GetMclks]: uclk dpm not enabled!\n",
-                return -EPERM);
+        if (!data->smu_features[GNLD_DPM_UCLK].enabled)
+                return -1;
 
         count = (dpm_table->count > MAX_NUM_CLOCKS) ? MAX_NUM_CLOCKS : dpm_table->count;
         clocks->num_levels = data->mclk_latency_table.count = count;
@@ -2696,9 +2681,8 @@ static int vega20_get_dcefclocks(struct pp_hwmgr *hwmgr,
         struct vega20_single_dpm_table *dpm_table = &(data->dpm_table.dcef_table);
         int i, count;
 
-        PP_ASSERT_WITH_CODE(data->smu_features[GNLD_DPM_DCEFCLK].enabled,
-                "[GetDcfclocks]: dcefclk dpm not enabled!\n",
-                return -EPERM);
+        if (!data->smu_features[GNLD_DPM_DCEFCLK].enabled)
+                return -1;
 
         count = (dpm_table->count > MAX_NUM_CLOCKS) ? MAX_NUM_CLOCKS : dpm_table->count;
         clocks->num_levels = count;
@@ -2719,9 +2703,8 @@ static int vega20_get_socclocks(struct pp_hwmgr *hwmgr,
         struct vega20_single_dpm_table *dpm_table = &(data->dpm_table.soc_table);
         int i, count;
 
-        PP_ASSERT_WITH_CODE(data->smu_features[GNLD_DPM_SOCCLK].enabled,
-                "[GetSocclks]: socclk dpm not enabled!\n",
-                return -EPERM);
+        if (!data->smu_features[GNLD_DPM_SOCCLK].enabled)
+                return -1;
 
         count = (dpm_table->count > MAX_NUM_CLOCKS) ? MAX_NUM_CLOCKS : dpm_table->count;
         clocks->num_levels = count;
@@ -2799,7 +2782,6 @@ static int vega20_odn_edit_dpm_table(struct pp_hwmgr *hwmgr,
                         data->od8_settings.od8_settings_array;
         OverDriveTable_t *od_table =
                         &(data->smc_state_table.overdrive_table);
-        struct pp_clock_levels_with_latency clocks;
         int32_t input_index, input_clk, input_vol, i;
         int od8_id;
         int ret;
@@ -2858,11 +2840,6 @@ static int vega20_odn_edit_dpm_table(struct pp_hwmgr *hwmgr,
                         return -EOPNOTSUPP;
                 }
 
-                ret = vega20_get_memclocks(hwmgr, &clocks);
-                PP_ASSERT_WITH_CODE(!ret,
-                                "Attempt to get memory clk levels failed!",
-                                return ret);
-
                 for (i = 0; i < size; i += 2) {
                         if (i + 2 > size) {
                                 pr_info("invalid number of input parameters %d\n",
@@ -2879,11 +2856,11 @@ static int vega20_odn_edit_dpm_table(struct pp_hwmgr *hwmgr,
                                 return -EINVAL;
                         }
 
-                        if (input_clk < clocks.data[0].clocks_in_khz / 1000 ||
+                        if (input_clk < od8_settings[OD8_SETTING_UCLK_FMAX].min_value ||
                             input_clk > od8_settings[OD8_SETTING_UCLK_FMAX].max_value) {
                                 pr_info("clock freq %d is not within allowed range [%d - %d]\n",
                                         input_clk,
-                                        clocks.data[0].clocks_in_khz / 1000,
+                                        od8_settings[OD8_SETTING_UCLK_FMAX].min_value,
                                         od8_settings[OD8_SETTING_UCLK_FMAX].max_value);
                                 return -EINVAL;
                         }
@@ -3088,9 +3065,9 @@ static int vega20_set_ppfeature_status(struct pp_hwmgr *hwmgr, uint64_t new_ppfe
                 return ret;
 
         features_to_disable =
-                (features_enabled ^ new_ppfeature_masks) & features_enabled;
+                features_enabled & ~new_ppfeature_masks;
         features_to_enable =
-                (features_enabled ^ new_ppfeature_masks) ^ features_to_disable;
+                ~features_enabled & new_ppfeature_masks;
 
         pr_debug("features_to_disable 0x%llx\n", features_to_disable);
         pr_debug("features_to_enable 0x%llx\n", features_to_enable);
@@ -3128,7 +3105,7 @@ static int vega20_print_clock_levels(struct pp_hwmgr *hwmgr,
                         &(data->dpm_table.fclk_table);
         int i, now, size = 0;
         int ret = 0;
-        uint32_t gen_speed, lane_width;
+        uint32_t gen_speed, lane_width, current_gen_speed, current_lane_width;
 
         switch (type) {
         case PP_SCLK:
@@ -3137,10 +3114,11 @@ static int vega20_print_clock_levels(struct pp_hwmgr *hwmgr,
                                 "Attempt to get current gfx clk Failed!",
                                 return ret);
 
-                ret = vega20_get_sclks(hwmgr, &clocks);
-                PP_ASSERT_WITH_CODE(!ret,
-                                "Attempt to get gfx clk levels Failed!",
-                                return ret);
+                if (vega20_get_sclks(hwmgr, &clocks)) {
+                        size += sprintf(buf + size, "0: %uMhz * (DPM disabled)\n",
+                                now / 100);
+                        break;
+                }
 
                 for (i = 0; i < clocks.num_levels; i++)
                         size += sprintf(buf + size, "%d: %uMhz %s\n",
@@ -3154,10 +3132,11 @@ static int vega20_print_clock_levels(struct pp_hwmgr *hwmgr,
                                 "Attempt to get current mclk freq Failed!",
                                 return ret);
 
-                ret = vega20_get_memclocks(hwmgr, &clocks);
-                PP_ASSERT_WITH_CODE(!ret,
-                                "Attempt to get memory clk levels Failed!",
-                                return ret);
+                if (vega20_get_memclocks(hwmgr, &clocks)) {
+                        size += sprintf(buf + size, "0: %uMhz * (DPM disabled)\n",
+                                now / 100);
+                        break;
+                }
 
                 for (i = 0; i < clocks.num_levels; i++)
                         size += sprintf(buf + size, "%d: %uMhz %s\n",
@@ -3171,10 +3150,11 @@ static int vega20_print_clock_levels(struct pp_hwmgr *hwmgr,
                                 "Attempt to get current socclk freq Failed!",
                                 return ret);
 
-                ret = vega20_get_socclocks(hwmgr, &clocks);
-                PP_ASSERT_WITH_CODE(!ret,
-                                "Attempt to get soc clk levels Failed!",
-                                return ret);
+                if (vega20_get_socclocks(hwmgr, &clocks)) {
+                        size += sprintf(buf + size, "0: %uMhz * (DPM disabled)\n",
+                                now / 100);
+                        break;
+                }
 
                 for (i = 0; i < clocks.num_levels; i++)
                         size += sprintf(buf + size, "%d: %uMhz %s\n",
@@ -3200,10 +3180,11 @@ static int vega20_print_clock_levels(struct pp_hwmgr *hwmgr,
                                 "Attempt to get current dcefclk freq Failed!",
                                 return ret);
 
-                ret = vega20_get_dcefclocks(hwmgr, &clocks);
-                PP_ASSERT_WITH_CODE(!ret,
-                                "Attempt to get dcefclk levels Failed!",
-                                return ret);
+                if (vega20_get_dcefclocks(hwmgr, &clocks)) {
+                        size += sprintf(buf + size, "0: %uMhz * (DPM disabled)\n",
+                                now / 100);
+                        break;
+                }
 
                 for (i = 0; i < clocks.num_levels; i++)
                         size += sprintf(buf + size, "%d: %uMhz %s\n",
@@ -3212,28 +3193,36 @@ static int vega20_print_clock_levels(struct pp_hwmgr *hwmgr,
                 break;
 
         case PP_PCIE:
-                gen_speed = (RREG32_PCIE(smnPCIE_LC_SPEED_CNTL) &
+                current_gen_speed = (RREG32_PCIE(smnPCIE_LC_SPEED_CNTL) &
                              PSWUSP0_PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE_MASK)
                             >> PSWUSP0_PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE__SHIFT;
-                lane_width = (RREG32_PCIE(smnPCIE_LC_LINK_WIDTH_CNTL) &
+                current_lane_width = (RREG32_PCIE(smnPCIE_LC_LINK_WIDTH_CNTL) &
                               PCIE_LC_LINK_WIDTH_CNTL__LC_LINK_WIDTH_RD_MASK)
                             >> PCIE_LC_LINK_WIDTH_CNTL__LC_LINK_WIDTH_RD__SHIFT;
-                for (i = 0; i < NUM_LINK_LEVELS; i++)
+                for (i = 0; i < NUM_LINK_LEVELS; i++) {
+                        if (i == 1 && data->pcie_parameters_override) {
+                                gen_speed = data->pcie_gen_level1;
+                                lane_width = data->pcie_width_level1;
+                        } else {
+                                gen_speed = pptable->PcieGenSpeed[i];
+                                lane_width = pptable->PcieLaneCount[i];
+                        }
                         size += sprintf(buf + size, "%d: %s %s %dMhz %s\n", i,
-                                        (pptable->PcieGenSpeed[i] == 0) ? "2.5GT/s," :
-                                        (pptable->PcieGenSpeed[i] == 1) ? "5.0GT/s," :
-                                        (pptable->PcieGenSpeed[i] == 2) ? "8.0GT/s," :
-                                        (pptable->PcieGenSpeed[i] == 3) ? "16.0GT/s," : "",
-                                        (pptable->PcieLaneCount[i] == 1) ? "x1" :
-                                        (pptable->PcieLaneCount[i] == 2) ? "x2" :
-                                        (pptable->PcieLaneCount[i] == 3) ? "x4" :
-                                        (pptable->PcieLaneCount[i] == 4) ? "x8" :
-                                        (pptable->PcieLaneCount[i] == 5) ? "x12" :
-                                        (pptable->PcieLaneCount[i] == 6) ? "x16" : "",
+                                        (gen_speed == 0) ? "2.5GT/s," :
+                                        (gen_speed == 1) ? "5.0GT/s," :
+                                        (gen_speed == 2) ? "8.0GT/s," :
+                                        (gen_speed == 3) ? "16.0GT/s," : "",
+                                        (lane_width == 1) ? "x1" :
+                                        (lane_width == 2) ? "x2" :
+                                        (lane_width == 3) ? "x4" :
+                                        (lane_width == 4) ? "x8" :
+                                        (lane_width == 5) ? "x12" :
+                                        (lane_width == 6) ? "x16" : "",
                                         pptable->LclkFreq[i],
-                                        (gen_speed == pptable->PcieGenSpeed[i]) &&
-                                        (lane_width == pptable->PcieLaneCount[i]) ?
+                                        (current_gen_speed == gen_speed) &&
+                                        (current_lane_width == lane_width) ?
                                         "*" : "");
+                }
                 break;
 
         case OD_SCLK:
@@ -3288,13 +3277,8 @@ static int vega20_print_clock_levels(struct pp_hwmgr *hwmgr,
                 }
 
                 if (od8_settings[OD8_SETTING_UCLK_FMAX].feature_id) {
-                        ret = vega20_get_memclocks(hwmgr, &clocks);
-                        PP_ASSERT_WITH_CODE(!ret,
-                                        "Fail to get memory clk levels!",
-                                        return ret);
-
                         size += sprintf(buf + size, "MCLK: %7uMhz %10uMhz\n",
-                                clocks.data[0].clocks_in_khz / 1000,
+                                od8_settings[OD8_SETTING_UCLK_FMAX].min_value,
                                 od8_settings[OD8_SETTING_UCLK_FMAX].max_value);
                 }
 
@@ -3356,6 +3340,31 @@ static int vega20_set_uclk_to_highest_dpm_level(struct pp_hwmgr *hwmgr,
         return ret;
 }
 
+static int vega20_set_fclk_to_highest_dpm_level(struct pp_hwmgr *hwmgr)
+{
+        struct vega20_hwmgr *data = (struct vega20_hwmgr *)(hwmgr->backend);
+        struct vega20_single_dpm_table *dpm_table = &(data->dpm_table.fclk_table);
+        int ret = 0;
+
+        if (data->smu_features[GNLD_DPM_FCLK].enabled) {
+                PP_ASSERT_WITH_CODE(dpm_table->count > 0,
+                                "[SetFclkToHightestDpmLevel] Dpm table has no entry!",
+                                return -EINVAL);
+                PP_ASSERT_WITH_CODE(dpm_table->count <= NUM_FCLK_DPM_LEVELS,
+                                "[SetFclkToHightestDpmLevel] Dpm table has too many entries!",
+                                return -EINVAL);
+
+                dpm_table->dpm_state.soft_min_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
+                PP_ASSERT_WITH_CODE(!(ret = smum_send_msg_to_smc_with_parameter(hwmgr,
+                                PPSMC_MSG_SetSoftMinByFreq,
+                                (PPCLK_FCLK << 16 ) | dpm_table->dpm_state.soft_min_level)),
+                                "[SetFclkToHightestDpmLevel] Set soft min fclk failed!",
+                                return ret);
+        }
+
+        return ret;
+}
+
 static int vega20_pre_display_configuration_changed_task(struct pp_hwmgr *hwmgr)
 {
         struct vega20_hwmgr *data = (struct vega20_hwmgr *)(hwmgr->backend);
@@ -3366,8 +3375,10 @@ static int vega20_pre_display_configuration_changed_task(struct pp_hwmgr *hwmgr)
 
         ret = vega20_set_uclk_to_highest_dpm_level(hwmgr,
                         &data->dpm_table.mem_table);
+        if (ret)
+                return ret;
 
-        return ret;
+        return vega20_set_fclk_to_highest_dpm_level(hwmgr);
 }
 
 static int vega20_display_configuration_changed_task(struct pp_hwmgr *hwmgr)
@@ -3461,9 +3472,9 @@ static int vega20_apply_clocks_adjust_rules(struct pp_hwmgr *hwmgr)
         /* gfxclk */
         dpm_table = &(data->dpm_table.gfx_table);
         dpm_table->dpm_state.soft_min_level = dpm_table->dpm_levels[0].value;
-        dpm_table->dpm_state.soft_max_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
+        dpm_table->dpm_state.soft_max_level = VG20_CLOCK_MAX_DEFAULT;
         dpm_table->dpm_state.hard_min_level = dpm_table->dpm_levels[0].value;
-        dpm_table->dpm_state.hard_max_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
+        dpm_table->dpm_state.hard_max_level = VG20_CLOCK_MAX_DEFAULT;
 
         if (PP_CAP(PHM_PlatformCaps_UMDPState)) {
                 if (VEGA20_UMD_PSTATE_GFXCLK_LEVEL < dpm_table->count) {
@@ -3485,9 +3496,9 @@ static int vega20_apply_clocks_adjust_rules(struct pp_hwmgr *hwmgr)
         /* memclk */
         dpm_table = &(data->dpm_table.mem_table);
         dpm_table->dpm_state.soft_min_level = dpm_table->dpm_levels[0].value;
-        dpm_table->dpm_state.soft_max_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
+        dpm_table->dpm_state.soft_max_level = VG20_CLOCK_MAX_DEFAULT;
         dpm_table->dpm_state.hard_min_level = dpm_table->dpm_levels[0].value;
-        dpm_table->dpm_state.hard_max_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
+        dpm_table->dpm_state.hard_max_level = VG20_CLOCK_MAX_DEFAULT;
 
         if (PP_CAP(PHM_PlatformCaps_UMDPState)) {
                 if (VEGA20_UMD_PSTATE_MCLK_LEVEL < dpm_table->count) {
@@ -3526,12 +3537,21 @@ static int vega20_apply_clocks_adjust_rules(struct pp_hwmgr *hwmgr)
         if (hwmgr->display_config->nb_pstate_switch_disable)
                 dpm_table->dpm_state.hard_min_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
 
+        /* fclk */
+        dpm_table = &(data->dpm_table.fclk_table);
+        dpm_table->dpm_state.soft_min_level = dpm_table->dpm_levels[0].value;
+        dpm_table->dpm_state.soft_max_level = VG20_CLOCK_MAX_DEFAULT;
+        dpm_table->dpm_state.hard_min_level = dpm_table->dpm_levels[0].value;
+        dpm_table->dpm_state.hard_max_level = VG20_CLOCK_MAX_DEFAULT;
+        if (hwmgr->display_config->nb_pstate_switch_disable)
+                dpm_table->dpm_state.soft_min_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
+
         /* vclk */
         dpm_table = &(data->dpm_table.vclk_table);
         dpm_table->dpm_state.soft_min_level = dpm_table->dpm_levels[0].value;
-        dpm_table->dpm_state.soft_max_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
+        dpm_table->dpm_state.soft_max_level = VG20_CLOCK_MAX_DEFAULT;
         dpm_table->dpm_state.hard_min_level = dpm_table->dpm_levels[0].value;
-        dpm_table->dpm_state.hard_max_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
+        dpm_table->dpm_state.hard_max_level = VG20_CLOCK_MAX_DEFAULT;
 
         if (PP_CAP(PHM_PlatformCaps_UMDPState)) {
                 if (VEGA20_UMD_PSTATE_UVDCLK_LEVEL < dpm_table->count) {
@@ -3548,9 +3568,9 @@ static int vega20_apply_clocks_adjust_rules(struct pp_hwmgr *hwmgr)
         /* dclk */
         dpm_table = &(data->dpm_table.dclk_table);
         dpm_table->dpm_state.soft_min_level = dpm_table->dpm_levels[0].value;
-        dpm_table->dpm_state.soft_max_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
+        dpm_table->dpm_state.soft_max_level = VG20_CLOCK_MAX_DEFAULT;
         dpm_table->dpm_state.hard_min_level = dpm_table->dpm_levels[0].value;
-        dpm_table->dpm_state.hard_max_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
+        dpm_table->dpm_state.hard_max_level = VG20_CLOCK_MAX_DEFAULT;
 
         if (PP_CAP(PHM_PlatformCaps_UMDPState)) {
                 if (VEGA20_UMD_PSTATE_UVDCLK_LEVEL < dpm_table->count) {
@@ -3567,9 +3587,9 @@ static int vega20_apply_clocks_adjust_rules(struct pp_hwmgr *hwmgr)
         /* socclk */
         dpm_table = &(data->dpm_table.soc_table);
         dpm_table->dpm_state.soft_min_level = dpm_table->dpm_levels[0].value;
-        dpm_table->dpm_state.soft_max_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
+        dpm_table->dpm_state.soft_max_level = VG20_CLOCK_MAX_DEFAULT;
         dpm_table->dpm_state.hard_min_level = dpm_table->dpm_levels[0].value;
-        dpm_table->dpm_state.hard_max_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
+        dpm_table->dpm_state.hard_max_level = VG20_CLOCK_MAX_DEFAULT;
 
         if (PP_CAP(PHM_PlatformCaps_UMDPState)) {
                 if (VEGA20_UMD_PSTATE_SOCCLK_LEVEL < dpm_table->count) {
@@ -3586,9 +3606,9 @@ static int vega20_apply_clocks_adjust_rules(struct pp_hwmgr *hwmgr)
         /* eclk */
         dpm_table = &(data->dpm_table.eclk_table);
         dpm_table->dpm_state.soft_min_level = dpm_table->dpm_levels[0].value;
-        dpm_table->dpm_state.soft_max_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
+        dpm_table->dpm_state.soft_max_level = VG20_CLOCK_MAX_DEFAULT;
         dpm_table->dpm_state.hard_min_level = dpm_table->dpm_levels[0].value;
-        dpm_table->dpm_state.hard_max_level = dpm_table->dpm_levels[dpm_table->count - 1].value;
+        dpm_table->dpm_state.hard_max_level = VG20_CLOCK_MAX_DEFAULT;
 
         if (PP_CAP(PHM_PlatformCaps_UMDPState)) {
                 if (VEGA20_UMD_PSTATE_VCEMCLK_LEVEL < dpm_table->count) {
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.h b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.h
index 37f5f5e657da..a5bc758ae097 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.h
@@ -42,6 +42,8 @@
 #define AVFS_CURVE 0
 #define OD8_HOTCURVE_TEMPERATURE 85
 
+#define VG20_CLOCK_MAX_DEFAULT 0xFFFF
+
 typedef uint32_t PP_Clock;
 
 enum {
@@ -219,6 +221,7 @@ struct vega20_vbios_boot_state {
         uint32_t    eclock;
         uint32_t    dclock;
         uint32_t    vclock;
+        uint32_t    fclock;
 };
 
 #define DPMTABLE_OD_UPDATE_SCLK     0x00000001
@@ -523,6 +526,10 @@ struct vega20_hwmgr {
 
         unsigned long                  metrics_time;
         SmuMetrics_t                   metrics_table;
+
+        bool                           pcie_parameters_override;
+        uint32_t                       pcie_gen_level1;
+        uint32_t                       pcie_width_level1;
 };
 
 #define VEGA20_DPM2_NEAR_TDP_DEC                      10
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_processpptables.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_processpptables.c
index 97f8a1a970c3..7a7f15d0c53a 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_processpptables.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_processpptables.c
@@ -32,6 +32,8 @@
 #include "cgs_common.h"
 #include "vega20_pptable.h"
 
+#define VEGA20_FAN_TARGET_TEMPERATURE_OVERRIDE 105
+
 static void set_hw_cap(struct pp_hwmgr *hwmgr, bool enable,
                 enum phm_platform_caps cap)
 {
@@ -798,6 +800,17 @@ static int append_vbios_pptable(struct pp_hwmgr *hwmgr, PPTable_t *ppsmc_pptable
         return 0;
 }
 
+static int override_powerplay_table_fantargettemperature(struct pp_hwmgr *hwmgr)
+{
+        struct phm_ppt_v3_information *pptable_information =
+                (struct phm_ppt_v3_information *)hwmgr->pptable;
+        PPTable_t *ppsmc_pptable = (PPTable_t *)(pptable_information->smc_pptable);
+
+        ppsmc_pptable->FanTargetTemperature = VEGA20_FAN_TARGET_TEMPERATURE_OVERRIDE;
+
+        return 0;
+}
+
 #define VEGA20_ENGINECLOCK_HARDMAX 198000
 static int init_powerplay_table_information(
                 struct pp_hwmgr *hwmgr,
@@ -887,6 +900,10 @@ static int init_powerplay_table_information(
 
 
         result = append_vbios_pptable(hwmgr, (pptable_information->smc_pptable));
+        if (result)
+                return result;
+
+        result = override_powerplay_table_fantargettemperature(hwmgr);
 
         return result;
 }
diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
index 52abca065764..2d4cfe14f72e 100644
--- a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
+++ b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
@@ -2330,6 +2330,7 @@ static uint32_t polaris10_get_offsetof(uint32_t type, uint32_t member)
                 case DRAM_LOG_BUFF_SIZE:
                         return offsetof(SMU74_SoftRegisters, DRAM_LOG_BUFF_SIZE);
                 }
+                break;
         case SMU_Discrete_DpmTable:
                 switch (member) {
                 case UvdBootLevel:
@@ -2339,6 +2340,7 @@ static uint32_t polaris10_get_offsetof(uint32_t type, uint32_t member)
                 case LowSclkInterruptThreshold:
                         return offsetof(SMU74_Discrete_DpmTable, LowSclkInterruptThreshold);
                 }
+                break;
         }
         pr_warn("can't get the offset of type %x member %x\n", type, member);
         return 0;
diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/smu9_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/smu9_smumgr.c
index 079fc8e8f709..742b3dc1f6cb 100644
--- a/drivers/gpu/drm/amd/powerplay/smumgr/smu9_smumgr.c
+++ b/drivers/gpu/drm/amd/powerplay/smumgr/smu9_smumgr.c
@@ -40,10 +40,8 @@ bool smu9_is_smc_ram_running(struct pp_hwmgr *hwmgr)
         struct amdgpu_device *adev = hwmgr->adev;
         uint32_t mp1_fw_flags;
 
-        WREG32_SOC15(NBIF, 0, mmPCIE_INDEX2,
-                        (MP1_Public | (smnMP1_FIRMWARE_FLAGS & 0xffffffff)));
-
-        mp1_fw_flags = RREG32_SOC15(NBIF, 0, mmPCIE_DATA2);
+        mp1_fw_flags = RREG32_PCIE(MP1_Public |
+                                   (smnMP1_FIRMWARE_FLAGS & 0xffffffff));
 
         if (mp1_fw_flags & MP1_FIRMWARE_FLAGS__INTERRUPTS_ENABLED_MASK)
                 return true;
diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/vega20_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/vega20_smumgr.c
index b7ff7d4d6f44..ba00744c3413 100644
--- a/drivers/gpu/drm/amd/powerplay/smumgr/vega20_smumgr.c
+++ b/drivers/gpu/drm/amd/powerplay/smumgr/vega20_smumgr.c
@@ -49,10 +49,8 @@ static bool vega20_is_smc_ram_running(struct pp_hwmgr *hwmgr)
         struct amdgpu_device *adev = hwmgr->adev;
         uint32_t mp1_fw_flags;
 
-        WREG32_SOC15(NBIF, 0, mmPCIE_INDEX2,
-                     (MP1_Public | (smnMP1_FIRMWARE_FLAGS & 0xffffffff)));
-
-        mp1_fw_flags = RREG32_SOC15(NBIF, 0, mmPCIE_DATA2);
+        mp1_fw_flags = RREG32_PCIE(MP1_Public |
+                                   (smnMP1_FIRMWARE_FLAGS & 0xffffffff));
 
         if ((mp1_fw_flags & MP1_FIRMWARE_FLAGS__INTERRUPTS_ENABLED_MASK) >>
             MP1_FIRMWARE_FLAGS__INTERRUPTS_ENABLED__SHIFT)
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 540a77a2ade9..40ac19848034 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -3039,9 +3039,31 @@ commit:
         return 0;
 }
 
-static int __drm_atomic_helper_disable_all(struct drm_device *dev,
-                                           struct drm_modeset_acquire_ctx *ctx,
-                                           bool clean_old_fbs)
+/**
+ * drm_atomic_helper_disable_all - disable all currently active outputs
+ * @dev: DRM device
+ * @ctx: lock acquisition context
+ *
+ * Loops through all connectors, finding those that aren't turned off and then
+ * turns them off by setting their DPMS mode to OFF and deactivating the CRTC
+ * that they are connected to.
+ *
+ * This is used for example in suspend/resume to disable all currently active
+ * functions when suspending. If you just want to shut down everything at e.g.
+ * driver unload, look at drm_atomic_helper_shutdown().
+ *
+ * Note that if callers haven't already acquired all modeset locks this might
+ * return -EDEADLK, which must be handled by calling drm_modeset_backoff().
+ *
+ * Returns:
+ * 0 on success or a negative error code on failure.
+ *
+ * See also:
+ * drm_atomic_helper_suspend(), drm_atomic_helper_resume() and
+ * drm_atomic_helper_shutdown().
+ */
+int drm_atomic_helper_disable_all(struct drm_device *dev,
+                                  struct drm_modeset_acquire_ctx *ctx)
 {
         struct drm_atomic_state *state;
         struct drm_connector_state *conn_state;
@@ -3099,35 +3121,6 @@ free:
         drm_atomic_state_put(state);
         return ret;
 }
-
-/**
- * drm_atomic_helper_disable_all - disable all currently active outputs
- * @dev: DRM device
- * @ctx: lock acquisition context
- *
- * Loops through all connectors, finding those that aren't turned off and then
- * turns them off by setting their DPMS mode to OFF and deactivating the CRTC
- * that they are connected to.
- *
- * This is used for example in suspend/resume to disable all currently active
- * functions when suspending. If you just want to shut down everything at e.g.
- * driver unload, look at drm_atomic_helper_shutdown().
- *
- * Note that if callers haven't already acquired all modeset locks this might
- * return -EDEADLK, which must be handled by calling drm_modeset_backoff().
- *
- * Returns:
- * 0 on success or a negative error code on failure.
- *
- * See also:
- * drm_atomic_helper_suspend(), drm_atomic_helper_resume() and
- * drm_atomic_helper_shutdown().
- */
-int drm_atomic_helper_disable_all(struct drm_device *dev,
-                                  struct drm_modeset_acquire_ctx *ctx)
-{
-        return __drm_atomic_helper_disable_all(dev, ctx, false);
-}
 EXPORT_SYMBOL(drm_atomic_helper_disable_all);
 
 /**
@@ -3148,7 +3141,7 @@ void drm_atomic_helper_shutdown(struct drm_device *dev)
 
         DRM_MODESET_LOCK_ALL_BEGIN(dev, ctx, 0, ret);
 
-        ret = __drm_atomic_helper_disable_all(dev, &ctx, true);
+        ret = drm_atomic_helper_disable_all(dev, &ctx);
         if (ret)
                 DRM_ERROR("Disabling all crtc's during unload failed with %i\n", ret);
 
diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index 67b1fca39aa6..0e3043e08c69 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -185,7 +185,7 @@ static int compat_drm_getmap(struct file *file, unsigned int cmd,
         m32.size = map.size;
         m32.type = map.type;
         m32.flags = map.flags;
-        m32.handle = ptr_to_compat(map.handle);
+        m32.handle = ptr_to_compat((void __user *)map.handle);
         m32.mtrr = map.mtrr;
         if (copy_to_user(argp, &m32, sizeof(m32)))
                 return -EFAULT;
@@ -216,7 +216,7 @@ static int compat_drm_addmap(struct file *file, unsigned int cmd,
 
         m32.offset = map.offset;
         m32.mtrr = map.mtrr;
-        m32.handle = ptr_to_compat(map.handle);
+        m32.handle = ptr_to_compat((void __user *)map.handle);
         if (map.handle != compat_ptr(m32.handle))
                 pr_err_ratelimited("compat_drm_addmap truncated handle %p for type %d offset %x\n",
                                    map.handle, m32.type, m32.offset);
@@ -526,7 +526,7 @@ static int compat_drm_getsareactx(struct file *file, unsigned int cmd,
         if (err)
                 return err;
 
-        req32.handle = ptr_to_compat(req.handle);
+        req32.handle = ptr_to_compat((void __user *)req.handle);
         if (copy_to_user(argp, &req32, sizeof(req32)))
                 return -EFAULT;
 
diff --git a/drivers/gpu/drm/etnaviv/Kconfig b/drivers/gpu/drm/etnaviv/Kconfig
index 041a77e400d4..21df44b78df3 100644
--- a/drivers/gpu/drm/etnaviv/Kconfig
+++ b/drivers/gpu/drm/etnaviv/Kconfig
@@ -2,7 +2,6 @@
 config DRM_ETNAVIV
         tristate "ETNAVIV (DRM support for Vivante GPU IP cores)"
         depends on DRM
-        depends on ARCH_MXC || ARCH_DOVE || (ARM && COMPILE_TEST)
         depends on MMU
         select SHMEM
         select SYNC_FILE
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_cmdbuf.h b/drivers/gpu/drm/etnaviv/etnaviv_cmdbuf.h
index acb68c698363..4d5d1a77eb2a 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_cmdbuf.h
+++ b/drivers/gpu/drm/etnaviv/etnaviv_cmdbuf.h
@@ -15,8 +15,6 @@ struct etnaviv_perfmon_request;
 struct etnaviv_cmdbuf {
         /* suballocator this cmdbuf is allocated from */
         struct etnaviv_cmdbuf_suballoc *suballoc;
-        /* user context key, must be unique between all active users */
-        struct etnaviv_file_private *ctx;
         /* cmdbuf properties */
         int suballoc_offset;
         void *vaddr;
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_dump.c b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
index 3fbb4855396c..33854c94cb85 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
@@ -215,7 +215,7 @@ void etnaviv_core_dump(struct etnaviv_gpu *gpu)
                 mutex_lock(&obj->lock);
                 pages = etnaviv_gem_get_pages(obj);
                 mutex_unlock(&obj->lock);
-                if (pages) {
+                if (!IS_ERR(pages)) {
                         int j;
 
                         iter.hdr->data[0] = bomap - bomap_start;
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.h b/drivers/gpu/drm/etnaviv/etnaviv_gem.h
index 76079c2291f8..f0abb744ef95 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.h
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.h
@@ -95,6 +95,7 @@ struct etnaviv_gem_submit_bo {
 struct etnaviv_gem_submit {
         struct drm_sched_job sched_job;
         struct kref refcount;
+        struct etnaviv_file_private *ctx;
         struct etnaviv_gpu *gpu;
         struct dma_fence *out_fence, *in_fence;
         int out_fence_id;
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
index 0566171f8df2..f21529e635e3 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
@@ -15,7 +15,7 @@ struct sg_table *etnaviv_gem_prime_get_sg_table(struct drm_gem_object *obj)
         int npages = obj->size >> PAGE_SHIFT;
 
         if (WARN_ON(!etnaviv_obj->pages))  /* should have already pinned! */
-                return NULL;
+                return ERR_PTR(-EINVAL);
 
         return drm_prime_pages_to_sg(etnaviv_obj->pages, npages);
 }
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
index 30875f8f2933..b2fe3446bfbc 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
@@ -506,7 +506,7 @@ int etnaviv_ioctl_gem_submit(struct drm_device *dev, void *data,
         if (ret)
                 goto err_submit_objects;
 
-        submit->cmdbuf.ctx = file->driver_priv;
+        submit->ctx = file->driver_priv;
         submit->exec_state = args->exec_state;
         submit->flags = args->flags;
 
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_iommu_v2.c b/drivers/gpu/drm/etnaviv/etnaviv_iommu_v2.c
index f1c88d8ad5ba..f794e04be9e6 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_iommu_v2.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_iommu_v2.c
@@ -320,8 +320,8 @@ etnaviv_iommuv2_domain_alloc(struct etnaviv_gpu *gpu)
         domain = &etnaviv_domain->base;
 
         domain->dev = gpu->dev;
-        domain->base = 0;
-        domain->size = (u64)SZ_1G * 4;
+        domain->base = SZ_4K;
+        domain->size = (u64)SZ_1G * 4 - SZ_4K;
         domain->ops = &etnaviv_iommuv2_ops;
 
         ret = etnaviv_iommuv2_init(etnaviv_domain);
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c b/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c
index 9980d81a26e3..4227a4006c34 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c
@@ -113,7 +113,7 @@ static const struct etnaviv_pm_domain doms_3d[] = {
                 .name = "PE",
                 .profile_read = VIVS_MC_PROFILE_PE_READ,
                 .profile_config = VIVS_MC_PROFILE_CONFIG0,
-                .nr_signals = 5,
+                .nr_signals = 4,
                 .signal = (const struct etnaviv_pm_signal[]) {
                         {
                                 "PIXEL_COUNT_KILLED_BY_COLOR_PIPE",
@@ -435,7 +435,7 @@ int etnaviv_pm_query_sig(struct etnaviv_gpu *gpu,
 
         dom = meta->domains + signal->domain;
 
-        if (signal->iter > dom->nr_signals)
+        if (signal->iter >= dom->nr_signals)
                 return -EINVAL;
 
         sig = &dom->signal[signal->iter];
@@ -461,7 +461,7 @@ int etnaviv_pm_req_validate(const struct drm_etnaviv_gem_submit_pmr *r,
 
         dom = meta->domains + r->domain;
 
-        if (r->signal > dom->nr_signals)
+        if (r->signal >= dom->nr_signals)
                 return -EINVAL;
 
         return 0;
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_sched.c b/drivers/gpu/drm/etnaviv/etnaviv_sched.c
index 67ae26602024..6d24fea1766b 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_sched.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_sched.c
@@ -153,7 +153,7 @@ int etnaviv_sched_push_job(struct drm_sched_entity *sched_entity,
         mutex_lock(&submit->gpu->fence_lock);
 
         ret = drm_sched_job_init(&submit->sched_job, sched_entity,
-                                 submit->cmdbuf.ctx);
+                                 submit->ctx);
         if (ret)
                 goto out_unlock;
 
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 0573eab0e190..f35e4ab55b27 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -20,6 +20,7 @@
 #include "regs-vp.h"
 
 #include <linux/kernel.h>
+#include <linux/ktime.h>
 #include <linux/spinlock.h>
 #include <linux/wait.h>
 #include <linux/i2c.h>
@@ -352,15 +353,62 @@ static void mixer_cfg_vp_blend(struct mixer_context *ctx, unsigned int alpha)
         mixer_reg_write(ctx, MXR_VIDEO_CFG, val);
 }
 
-static void mixer_vsync_set_update(struct mixer_context *ctx, bool enable)
+static bool mixer_is_synced(struct mixer_context *ctx)
 {
-        /* block update on vsync */
-        mixer_reg_writemask(ctx, MXR_STATUS, enable ?
-                        MXR_STATUS_SYNC_ENABLE : 0, MXR_STATUS_SYNC_ENABLE);
+        u32 base, shadow;
 
+        if (ctx->mxr_ver == MXR_VER_16_0_33_0 ||
+            ctx->mxr_ver == MXR_VER_128_0_0_184)
+                return !(mixer_reg_read(ctx, MXR_CFG) &
+                         MXR_CFG_LAYER_UPDATE_COUNT_MASK);
+
+        if (test_bit(MXR_BIT_VP_ENABLED, &ctx->flags) &&
+            vp_reg_read(ctx, VP_SHADOW_UPDATE))
+                return false;
+
+        base = mixer_reg_read(ctx, MXR_CFG);
+        shadow = mixer_reg_read(ctx, MXR_CFG_S);
+        if (base != shadow)
+                return false;
+
+        base = mixer_reg_read(ctx, MXR_GRAPHIC_BASE(0));
+        shadow = mixer_reg_read(ctx, MXR_GRAPHIC_BASE_S(0));
+        if (base != shadow)
+                return false;
+
+        base = mixer_reg_read(ctx, MXR_GRAPHIC_BASE(1));
+        shadow = mixer_reg_read(ctx, MXR_GRAPHIC_BASE_S(1));
+        if (base != shadow)
+                return false;
+
+        return true;
+}
+
+static int mixer_wait_for_sync(struct mixer_context *ctx)
+{
+        ktime_t timeout = ktime_add_us(ktime_get(), 100000);
+
+        while (!mixer_is_synced(ctx)) {
+                usleep_range(1000, 2000);
+                if (ktime_compare(ktime_get(), timeout) > 0)
+                        return -ETIMEDOUT;
+        }
+        return 0;
+}
+
+static void mixer_disable_sync(struct mixer_context *ctx)
+{
+        mixer_reg_writemask(ctx, MXR_STATUS, 0, MXR_STATUS_SYNC_ENABLE);
+}
+
+static void mixer_enable_sync(struct mixer_context *ctx)
+{
+        if (ctx->mxr_ver == MXR_VER_16_0_33_0 ||
+            ctx->mxr_ver == MXR_VER_128_0_0_184)
+                mixer_reg_writemask(ctx, MXR_CFG, ~0, MXR_CFG_LAYER_UPDATE);
+        mixer_reg_writemask(ctx, MXR_STATUS, ~0, MXR_STATUS_SYNC_ENABLE);
         if (test_bit(MXR_BIT_VP_ENABLED, &ctx->flags))
-                vp_reg_write(ctx, VP_SHADOW_UPDATE, enable ?
-                        VP_SHADOW_UPDATE_ENABLE : 0);
+                vp_reg_write(ctx, VP_SHADOW_UPDATE, VP_SHADOW_UPDATE_ENABLE);
 }
 
 static void mixer_cfg_scan(struct mixer_context *ctx, int width, int height)
@@ -498,7 +546,6 @@ static void vp_video_buffer(struct mixer_context *ctx,
 
         spin_lock_irqsave(&ctx->reg_slock, flags);
 
-        vp_reg_write(ctx, VP_SHADOW_UPDATE, 1);
         /* interlace or progressive scan mode */
         val = (test_bit(MXR_BIT_INTERLACE, &ctx->flags) ? ~0 : 0);
         vp_reg_writemask(ctx, VP_MODE, val, VP_MODE_LINE_SKIP);
@@ -553,11 +600,6 @@ static void vp_video_buffer(struct mixer_context *ctx,
         vp_regs_dump(ctx);
 }
 
-static void mixer_layer_update(struct mixer_context *ctx)
-{
-        mixer_reg_writemask(ctx, MXR_CFG, ~0, MXR_CFG_LAYER_UPDATE);
-}
-
 static void mixer_graph_buffer(struct mixer_context *ctx,
                                struct exynos_drm_plane *plane)
 {
@@ -640,11 +682,6 @@ static void mixer_graph_buffer(struct mixer_context *ctx,
         mixer_cfg_layer(ctx, win, priority, true);
         mixer_cfg_gfx_blend(ctx, win, pixel_alpha, state->base.alpha);
 
-        /* layer update mandatory for mixer 16.0.33.0 */
-        if (ctx->mxr_ver == MXR_VER_16_0_33_0 ||
-                ctx->mxr_ver == MXR_VER_128_0_0_184)
-                mixer_layer_update(ctx);
-
         spin_unlock_irqrestore(&ctx->reg_slock, flags);
 
         mixer_regs_dump(ctx);
@@ -709,7 +746,7 @@ static void mixer_win_reset(struct mixer_context *ctx)
 static irqreturn_t mixer_irq_handler(int irq, void *arg)
 {
         struct mixer_context *ctx = arg;
-        u32 val, base, shadow;
+        u32 val;
 
         spin_lock(&ctx->reg_slock);
 
@@ -723,26 +760,9 @@ static irqreturn_t mixer_irq_handler(int irq, void *arg)
                 val &= ~MXR_INT_STATUS_VSYNC;
 
                 /* interlace scan need to check shadow register */
-                if (test_bit(MXR_BIT_INTERLACE, &ctx->flags)) {
-                        if (test_bit(MXR_BIT_VP_ENABLED, &ctx->flags) &&
-                            vp_reg_read(ctx, VP_SHADOW_UPDATE))
-                                goto out;
-
-                        base = mixer_reg_read(ctx, MXR_CFG);
-                        shadow = mixer_reg_read(ctx, MXR_CFG_S);
-                        if (base != shadow)
-                                goto out;
-
-                        base = mixer_reg_read(ctx, MXR_GRAPHIC_BASE(0));
-                        shadow = mixer_reg_read(ctx, MXR_GRAPHIC_BASE_S(0));
-                        if (base != shadow)
-                                goto out;
-
-                        base = mixer_reg_read(ctx, MXR_GRAPHIC_BASE(1));
-                        shadow = mixer_reg_read(ctx, MXR_GRAPHIC_BASE_S(1));
-                        if (base != shadow)
-                                goto out;
-                }
+                if (test_bit(MXR_BIT_INTERLACE, &ctx->flags)
+                    && !mixer_is_synced(ctx))
+                        goto out;
 
                 drm_crtc_handle_vblank(&ctx->crtc->base);
         }
@@ -917,12 +937,14 @@ static void mixer_disable_vblank(struct exynos_drm_crtc *crtc)
 
 static void mixer_atomic_begin(struct exynos_drm_crtc *crtc)
 {
-        struct mixer_context *mixer_ctx = crtc->ctx;
+        struct mixer_context *ctx = crtc->ctx;
 
-        if (!test_bit(MXR_BIT_POWERED, &mixer_ctx->flags))
+        if (!test_bit(MXR_BIT_POWERED, &ctx->flags))
                 return;
 
-        mixer_vsync_set_update(mixer_ctx, false);
+        if (mixer_wait_for_sync(ctx))
+                dev_err(ctx->dev, "timeout waiting for VSYNC\n");
+        mixer_disable_sync(ctx);
 }
 
 static void mixer_update_plane(struct exynos_drm_crtc *crtc,
@@ -964,7 +986,7 @@ static void mixer_atomic_flush(struct exynos_drm_crtc *crtc)
         if (!test_bit(MXR_BIT_POWERED, &mixer_ctx->flags))
                 return;
 
-        mixer_vsync_set_update(mixer_ctx, true);
+        mixer_enable_sync(mixer_ctx);
         exynos_crtc_handle_event(crtc);
 }
 
@@ -979,7 +1001,7 @@ static void mixer_enable(struct exynos_drm_crtc *crtc)
 
         exynos_drm_pipe_clk_enable(crtc, true);
 
-        mixer_vsync_set_update(ctx, false);
+        mixer_disable_sync(ctx);
 
         mixer_reg_writemask(ctx, MXR_STATUS, ~0, MXR_STATUS_SOFT_RESET);
 
@@ -992,7 +1014,7 @@ static void mixer_enable(struct exynos_drm_crtc *crtc)
 
         mixer_commit(ctx);
 
-        mixer_vsync_set_update(ctx, true);
+        mixer_enable_sync(ctx);
 
         set_bit(MXR_BIT_POWERED, &ctx->flags);
 }
diff --git a/drivers/gpu/drm/i915/i915_active.c b/drivers/gpu/drm/i915/i915_active.c
index 215b6ff8aa73..db7bb5bd5add 100644
--- a/drivers/gpu/drm/i915/i915_active.c
+++ b/drivers/gpu/drm/i915/i915_active.c
@@ -163,17 +163,25 @@ int i915_active_ref(struct i915_active *ref,
                     struct i915_request *rq)
 {
         struct i915_active_request *active;
+        int err = 0;
+
+        /* Prevent reaping in case we malloc/wait while building the tree */
+        i915_active_acquire(ref);
 
         active = active_instance(ref, timeline);
-        if (IS_ERR(active))
-                return PTR_ERR(active);
+        if (IS_ERR(active)) {
+                err = PTR_ERR(active);
+                goto out;
+        }
 
         if (!i915_active_request_isset(active))
                 ref->count++;
         __i915_active_request_set(active, rq);
 
         GEM_BUG_ON(!ref->count);
-        return 0;
+out:
+        i915_active_release(ref);
+        return err;
 }
 
 bool i915_active_acquire(struct i915_active *ref)
@@ -223,19 +231,25 @@ int i915_request_await_active_request(struct i915_request *rq,
 int i915_request_await_active(struct i915_request *rq, struct i915_active *ref)
 {
         struct active_node *it, *n;
-        int ret;
+        int err = 0;
 
-        ret = i915_request_await_active_request(rq, &ref->last);
-        if (ret)
-                return ret;
+        /* await allocates and so we need to avoid hitting the shrinker */
+        if (i915_active_acquire(ref))
+                goto out; /* was idle */
+
+        err = i915_request_await_active_request(rq, &ref->last);
+        if (err)
+                goto out;
 
         rbtree_postorder_for_each_entry_safe(it, n, &ref->tree, node) {
-                ret = i915_request_await_active_request(rq, &it->base);
-                if (ret)
-                        return ret;
+                err = i915_request_await_active_request(rq, &it->base);
+                if (err)
+                        goto out;
         }
 
-        return 0;
+out:
+        i915_active_release(ref);
+        return err;
 }
 
 #if IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM)
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 6630212f2faf..9df65d386d11 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -757,39 +757,6 @@ static int i915_kick_out_firmware_fb(struct drm_i915_private *dev_priv)
         return ret;
 }
 
-#if !defined(CONFIG_VGA_CONSOLE)
-static int i915_kick_out_vgacon(struct drm_i915_private *dev_priv)
-{
-        return 0;
-}
-#elif !defined(CONFIG_DUMMY_CONSOLE)
-static int i915_kick_out_vgacon(struct drm_i915_private *dev_priv)
-{
-        return -ENODEV;
-}
-#else
-static int i915_kick_out_vgacon(struct drm_i915_private *dev_priv)
-{
-        int ret = 0;
-
-        DRM_INFO("Replacing VGA console driver\n");
-
-        console_lock();
-        if (con_is_bound(&vga_con))
-                ret = do_take_over_console(&dummy_con, 0, MAX_NR_CONSOLES - 1, 1);
-        if (ret == 0) {
-                ret = do_unregister_con_driver(&vga_con);
-
-                /* Ignore "already unregistered". */
-                if (ret == -ENODEV)
-                        ret = 0;
-        }
-        console_unlock();
-
-        return ret;
-}
-#endif
-
 static void intel_init_dpio(struct drm_i915_private *dev_priv)
 {
         /*
@@ -1420,7 +1387,7 @@ static int i915_driver_init_hw(struct drm_i915_private *dev_priv)
                 goto err_ggtt;
         }
 
-        ret = i915_kick_out_vgacon(dev_priv);
+        ret = vga_remove_vgacon(pdev);
         if (ret) {
                 DRM_ERROR("failed to remove conflicting VGA console\n");
                 goto err_ggtt;
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 6728ea5c71d4..8558e81fdc2a 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1688,7 +1688,8 @@ __vma_matches(struct vm_area_struct *vma, struct file *filp,
         if (vma->vm_file != filp)
                 return false;
 
-        return vma->vm_start == addr && (vma->vm_end - vma->vm_start) == size;
+        return vma->vm_start == addr &&
+               (vma->vm_end - vma->vm_start) == PAGE_ALIGN(size);
 }
 
 /**
@@ -1733,8 +1734,13 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
          * pages from.
          */
         if (!obj->base.filp) {
-                i915_gem_object_put(obj);
-                return -ENXIO;
+                addr = -ENXIO;
+                goto err;
+        }
+
+        if (range_overflows(args->offset, args->size, (u64)obj->base.size)) {
+                addr = -EINVAL;
+                goto err;
         }
 
         addr = vm_mmap(obj->base.filp, 0, args->size,
@@ -1748,8 +1754,8 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
                 struct vm_area_struct *vma;
 
                 if (down_write_killable(&mm->mmap_sem)) {
-                        i915_gem_object_put(obj);
-                        return -EINTR;
+                        addr = -EINTR;
+                        goto err;
                 }
                 vma = find_vma(mm, addr);
                 if (vma && __vma_matches(vma, obj->base.filp, addr, args->size))
@@ -1767,12 +1773,10 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
         i915_gem_object_put(obj);
 
         args->addr_ptr = (u64)addr;
-
         return 0;
 
 err:
         i915_gem_object_put(obj);
-
         return addr;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
index 9a65341fec09..aa6791255252 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.c
+++ b/drivers/gpu/drm/i915/i915_gpu_error.c
@@ -1721,7 +1721,7 @@ error_msg(struct i915_gpu_state *error, unsigned long engines, const char *msg)
                         i915_error_generate_code(error, engines));
         if (engines) {
                 /* Just show the first executing process, more is confusing */
-                i = ffs(engines);
+                i = __ffs(engines);
                 len += scnprintf(error->error_msg + len,
                                  sizeof(error->error_msg) - len,
                                  ", in %s [%d]",
diff --git a/drivers/gpu/drm/i915/i915_scheduler.c b/drivers/gpu/drm/i915/i915_scheduler.c
index d01683167c77..8bc042551692 100644
--- a/drivers/gpu/drm/i915/i915_scheduler.c
+++ b/drivers/gpu/drm/i915/i915_scheduler.c
@@ -223,8 +223,14 @@ out:
         return &p->requests[idx];
 }
 
+struct sched_cache {
+        struct list_head *priolist;
+};
+
 static struct intel_engine_cs *
-sched_lock_engine(struct i915_sched_node *node, struct intel_engine_cs *locked)
+sched_lock_engine(const struct i915_sched_node *node,
+                  struct intel_engine_cs *locked,
+                  struct sched_cache *cache)
 {
         struct intel_engine_cs *engine = node_to_request(node)->engine;
 
@@ -232,6 +238,7 @@ sched_lock_engine(struct i915_sched_node *node, struct intel_engine_cs *locked)
 
         if (engine != locked) {
                 spin_unlock(&locked->timeline.lock);
+                memset(cache, 0, sizeof(*cache));
                 spin_lock(&engine->timeline.lock);
         }
 
@@ -253,11 +260,11 @@ static bool inflight(const struct i915_request *rq,
 static void __i915_schedule(struct i915_request *rq,
                             const struct i915_sched_attr *attr)
 {
-        struct list_head *uninitialized_var(pl);
-        struct intel_engine_cs *engine, *last;
+        struct intel_engine_cs *engine;
         struct i915_dependency *dep, *p;
         struct i915_dependency stack;
         const int prio = attr->priority;
+        struct sched_cache cache;
         LIST_HEAD(dfs);
 
         /* Needed in order to use the temporary link inside i915_dependency */
@@ -328,7 +335,7 @@ static void __i915_schedule(struct i915_request *rq,
                 __list_del_entry(&stack.dfs_link);
         }
 
-        last = NULL;
+        memset(&cache, 0, sizeof(cache));
         engine = rq->engine;
         spin_lock_irq(&engine->timeline.lock);
 
@@ -338,7 +345,7 @@ static void __i915_schedule(struct i915_request *rq,
 
                 INIT_LIST_HEAD(&dep->dfs_link);
 
-                engine = sched_lock_engine(node, engine);
+                engine = sched_lock_engine(node, engine, &cache);
                 lockdep_assert_held(&engine->timeline.lock);
 
                 /* Recheck after acquiring the engine->timeline.lock */
@@ -347,11 +354,11 @@ static void __i915_schedule(struct i915_request *rq,
 
                 node->attr.priority = prio;
                 if (!list_empty(&node->link)) {
-                        if (last != engine) {
-                                pl = i915_sched_lookup_priolist(engine, prio);
-                                last = engine;
-                        }
-                        list_move_tail(&node->link, pl);
+                        if (!cache.priolist)
+                                cache.priolist =
+                                        i915_sched_lookup_priolist(engine,
+                                                                   prio);
+                        list_move_tail(&node->link, cache.priolist);
                 } else {
                         /*
                          * If the request is not in the priolist queue because
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index b508d8a735e0..4364f42cac6b 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -1673,6 +1673,7 @@ init_vbt_missing_defaults(struct drm_i915_private *dev_priv)
                 info->supports_dvi = (port != PORT_A && port != PORT_E);
                 info->supports_hdmi = info->supports_dvi;
                 info->supports_dp = (port != PORT_E);
+                info->supports_edp = (port == PORT_A);
         }
 }
 
diff --git a/drivers/gpu/drm/i915/intel_breadcrumbs.c b/drivers/gpu/drm/i915/intel_breadcrumbs.c
index cacaa1d04d17..09ed90c0ba00 100644
--- a/drivers/gpu/drm/i915/intel_breadcrumbs.c
+++ b/drivers/gpu/drm/i915/intel_breadcrumbs.c
@@ -106,16 +106,6 @@ bool intel_engine_breadcrumbs_irq(struct intel_engine_cs *engine)
 
                         GEM_BUG_ON(!test_bit(I915_FENCE_FLAG_SIGNAL,
                                              &rq->fence.flags));
-                        clear_bit(I915_FENCE_FLAG_SIGNAL, &rq->fence.flags);
-
-                        /*
-                         * We may race with direct invocation of
-                         * dma_fence_signal(), e.g. i915_request_retire(),
-                         * in which case we can skip processing it ourselves.
-                         */
-                        if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT,
-                                     &rq->fence.flags))
-                                continue;
 
                         /*
                          * Queue for execution after dropping the signaling
@@ -123,6 +113,14 @@ bool intel_engine_breadcrumbs_irq(struct intel_engine_cs *engine)
                          * more signalers to the same context or engine.
                          */
                         i915_request_get(rq);
+
+                        /*
+                         * We may race with direct invocation of
+                         * dma_fence_signal(), e.g. i915_request_retire(),
+                         * so we need to acquire our reference to the request
+                         * before we cancel the breadcrumb.
+                         */
+                        clear_bit(I915_FENCE_FLAG_SIGNAL, &rq->fence.flags);
                         list_add_tail(&rq->signal_link, &signal);
                 }
 
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index ca705546a0ab..14d580cdefd3 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -3568,6 +3568,13 @@ static void intel_ddi_update_pipe(struct intel_encoder *encoder,
 {
         if (!intel_crtc_has_type(crtc_state, INTEL_OUTPUT_HDMI))
                 intel_ddi_update_pipe_dp(encoder, crtc_state, conn_state);
+
+        if (conn_state->content_protection ==
+            DRM_MODE_CONTENT_PROTECTION_DESIRED)
+                intel_hdcp_enable(to_intel_connector(conn_state->connector));
+        else if (conn_state->content_protection ==
+                 DRM_MODE_CONTENT_PROTECTION_UNDESIRED)
+                intel_hdcp_disable(to_intel_connector(conn_state->connector));
 }
 
 static void intel_ddi_set_fia_lane_count(struct intel_encoder *encoder,
@@ -3962,12 +3969,7 @@ static int modeset_pipe(struct drm_crtc *crtc,
                 goto out;
 
         ret = drm_atomic_commit(state);
-        if (ret)
-                goto out;
-
-        return 0;
-
- out:
+out:
         drm_atomic_state_put(state);
 
         return ret;
diff --git a/drivers/gpu/drm/i915/selftests/i915_gem_context.c b/drivers/gpu/drm/i915/selftests/i915_gem_context.c
index d00d0bb07784..7eb58a9d1319 100644
--- a/drivers/gpu/drm/i915/selftests/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/selftests/i915_gem_context.c
@@ -710,47 +710,45 @@ __sseu_prepare(struct drm_i915_private *i915,
                unsigned int flags,
                struct i915_gem_context *ctx,
                struct intel_engine_cs *engine,
-               struct igt_spinner **spin_out)
+               struct igt_spinner **spin)
 {
-        int ret = 0;
-
-        if (flags & (TEST_BUSY | TEST_RESET)) {
-                struct igt_spinner *spin;
-                struct i915_request *rq;
+        struct i915_request *rq;
+        int ret;
 
-                spin = kzalloc(sizeof(*spin), GFP_KERNEL);
-                if (!spin) {
-                        ret = -ENOMEM;
-                        goto out;
-                }
+        *spin = NULL;
+        if (!(flags & (TEST_BUSY | TEST_RESET)))
+                return 0;
 
-                ret = igt_spinner_init(spin, i915);
-                if (ret)
-                        return ret;
+        *spin = kzalloc(sizeof(**spin), GFP_KERNEL);
+        if (!*spin)
+                return -ENOMEM;
 
-                rq = igt_spinner_create_request(spin, ctx, engine, MI_NOOP);
-                if (IS_ERR(rq)) {
-                        ret = PTR_ERR(rq);
-                        igt_spinner_fini(spin);
-                        kfree(spin);
-                        goto out;
-                }
+        ret = igt_spinner_init(*spin, i915);
+        if (ret)
+                goto err_free;
 
-                i915_request_add(rq);
+        rq = igt_spinner_create_request(*spin, ctx, engine, MI_NOOP);
+        if (IS_ERR(rq)) {
+                ret = PTR_ERR(rq);
+                goto err_fini;
+        }
 
-                if (!igt_wait_for_spinner(spin, rq)) {
-                        pr_err("%s: Spinner failed to start!\n", name);
-                        igt_spinner_end(spin);
-                        igt_spinner_fini(spin);
-                        kfree(spin);
-                        ret = -ETIMEDOUT;
-                        goto out;
-                }
+        i915_request_add(rq);
 
-                *spin_out = spin;
+        if (!igt_wait_for_spinner(*spin, rq)) {
+                pr_err("%s: Spinner failed to start!\n", name);
+                ret = -ETIMEDOUT;
+                goto err_end;
         }
 
-out:
+        return 0;
+
+err_end:
+        igt_spinner_end(*spin);
+err_fini:
+        igt_spinner_fini(*spin);
+err_free:
+        kfree(fetch_and_zero(spin));
         return ret;
 }
 
@@ -897,22 +895,23 @@ __sseu_test(struct drm_i915_private *i915,
 
         ret = __sseu_prepare(i915, name, flags, ctx, engine, &spin);
         if (ret)
-                goto out;
+                goto out_context;
 
         ret = __i915_gem_context_reconfigure_sseu(ctx, engine, sseu);
         if (ret)
-                goto out;
+                goto out_spin;
 
         ret = __sseu_finish(i915, name, flags, ctx, kctx, engine, obj,
                             hweight32(sseu.slice_mask), spin);
 
-out:
+out_spin:
         if (spin) {
                 igt_spinner_end(spin);
                 igt_spinner_fini(spin);
                 kfree(spin);
         }
 
+out_context:
         kernel_context_close(kctx);
 
         return ret;
diff --git a/drivers/gpu/drm/nouveau/nouveau_debugfs.c b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
index 88a52f6b39fe..7dfbbbc1beea 100644
--- a/drivers/gpu/drm/nouveau/nouveau_debugfs.c
+++ b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
@@ -181,7 +181,7 @@ nouveau_debugfs_pstate_set(struct file *file, const char __user *ubuf,
         }
 
         ret = pm_runtime_get_sync(drm->dev);
-        if (IS_ERR_VALUE(ret) && ret != -EACCES)
+        if (ret < 0 && ret != -EACCES)
                 return ret;
         ret = nvif_mthd(ctrl, NVIF_CONTROL_PSTATE_USER, &args, sizeof(args));
         pm_runtime_put_autosuspend(drm->dev);
diff --git a/drivers/gpu/drm/nouveau/nouveau_dmem.c b/drivers/gpu/drm/nouveau/nouveau_dmem.c
index aa9fec80492d..40c47d6a7d78 100644
--- a/drivers/gpu/drm/nouveau/nouveau_dmem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_dmem.c
@@ -100,12 +100,10 @@ static void
 nouveau_dmem_free(struct hmm_devmem *devmem, struct page *page)
 {
         struct nouveau_dmem_chunk *chunk;
-        struct nouveau_drm *drm;
         unsigned long idx;
 
         chunk = (void *)hmm_devmem_page_get_drvdata(page);
         idx = page_to_pfn(page) - chunk->pfn_first;
-        drm = chunk->drm;
 
         /*
          * FIXME:
@@ -456,11 +454,6 @@ nouveau_dmem_resume(struct nouveau_drm *drm)
                 /* FIXME handle pin failure */
                 WARN_ON(ret);
         }
-        list_for_each_entry (chunk, &drm->dmem->chunk_empty, list) {
-                ret = nouveau_bo_pin(chunk->bo, TTM_PL_FLAG_VRAM, false);
-                /* FIXME handle pin failure */
-                WARN_ON(ret);
-        }
         mutex_unlock(&drm->dmem->mutex);
 }
 
@@ -479,9 +472,6 @@ nouveau_dmem_suspend(struct nouveau_drm *drm)
         list_for_each_entry (chunk, &drm->dmem->chunk_full, list) {
                 nouveau_bo_unpin(chunk->bo);
         }
-        list_for_each_entry (chunk, &drm->dmem->chunk_empty, list) {
-                nouveau_bo_unpin(chunk->bo);
-        }
         mutex_unlock(&drm->dmem->mutex);
 }
 
@@ -623,7 +613,7 @@ nouveau_dmem_init(struct nouveau_drm *drm)
          */
         drm->dmem->devmem = hmm_devmem_add(&nouveau_dmem_devmem_ops,
                                            device, size);
-        if (drm->dmem->devmem == NULL) {
+        if (IS_ERR(drm->dmem->devmem)) {
                 kfree(drm->dmem);
                 drm->dmem = NULL;
                 return;
diff --git a/drivers/gpu/drm/qxl/qxl_drv.c b/drivers/gpu/drm/qxl/qxl_drv.c
index bb81e310eb6d..578d867a81d5 100644
--- a/drivers/gpu/drm/qxl/qxl_drv.c
+++ b/drivers/gpu/drm/qxl/qxl_drv.c
@@ -79,6 +79,10 @@ qxl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (ret)
                 goto free_dev;
 
+        ret = drm_fb_helper_remove_conflicting_pci_framebuffers(pdev, 0, "qxl");
+        if (ret)
+                goto disable_pci;
+
         ret = qxl_device_init(qdev, &qxl_driver, pdev);
         if (ret)
                 goto disable_pci;
@@ -94,7 +98,6 @@ qxl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (ret)
                 goto modeset_cleanup;
 
-        drm_fb_helper_remove_conflicting_pci_framebuffers(pdev, 0, "qxl");
         drm_fbdev_generic_setup(&qdev->ddev, 32);
         return 0;
 
diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
index d5a23295dd80..bb7b58407039 100644
--- a/drivers/gpu/drm/udl/udl_gem.c
+++ b/drivers/gpu/drm/udl/udl_gem.c
@@ -224,7 +224,7 @@ int udl_gem_mmap(struct drm_file *file, struct drm_device *dev,
         *offset = drm_vma_node_offset_addr(&gobj->base.vma_node);
 
 out:
-        drm_gem_object_put(&gobj->base);
+        drm_gem_object_put_unlocked(&gobj->base);
 unlock:
         mutex_unlock(&udl->gem_lock);
         return ret;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
index b913a56f3426..2a9112515f46 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
@@ -564,11 +564,9 @@ static int vmw_fb_set_par(struct fb_info *info)
                 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
                 DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC)
         };
-        struct drm_display_mode *old_mode;
         struct drm_display_mode *mode;
         int ret;
 
-        old_mode = par->set_mode;
         mode = drm_mode_duplicate(vmw_priv->dev, &new_mode);
         if (!mode) {
                 DRM_ERROR("Could not create new fb mode.\n");
@@ -579,11 +577,7 @@ static int vmw_fb_set_par(struct fb_info *info)
         mode->vdisplay = var->yres;
         vmw_guess_mode_timing(mode);
 
-        if (old_mode && drm_mode_equal(old_mode, mode)) {
-                drm_mode_destroy(vmw_priv->dev, mode);
-                mode = old_mode;
-                old_mode = NULL;
-        } else if (!vmw_kms_validate_mode_vram(vmw_priv,
+        if (!vmw_kms_validate_mode_vram(vmw_priv,
                                         mode->hdisplay *
                                         DIV_ROUND_UP(var->bits_per_pixel, 8),
                                         mode->vdisplay)) {
@@ -620,8 +614,8 @@ static int vmw_fb_set_par(struct fb_info *info)
         schedule_delayed_work(&par->local_work, 0);
 
 out_unlock:
-        if (old_mode)
-                drm_mode_destroy(vmw_priv->dev, old_mode);
+        if (par->set_mode)
+                drm_mode_destroy(vmw_priv->dev, par->set_mode);
         par->set_mode = mode;
 
         mutex_unlock(&par->bo_mutex);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
index b93c558dd86e..7da752ca1c34 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
@@ -57,7 +57,7 @@ static int vmw_gmrid_man_get_node(struct ttm_mem_type_manager *man,
 
         id = ida_alloc_max(&gman->gmr_ida, gman->max_gmr_ids - 1, GFP_KERNEL);
         if (id < 0)
-                return id;
+                return (id != -ENOMEM ? 0 : id);
 
         spin_lock(&gman->lock);
 
diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
index dc8e039bfab5..f2f3ef8af271 100644
--- a/drivers/gpu/vga/vgaarb.c
+++ b/drivers/gpu/vga/vgaarb.c
@@ -48,6 +48,8 @@
 #include <linux/miscdevice.h>
 #include <linux/slab.h>
 #include <linux/screen_info.h>
+#include <linux/vt.h>
+#include <linux/console.h>
 
 #include <linux/uaccess.h>
 
@@ -168,6 +170,53 @@ void vga_set_default_device(struct pci_dev *pdev)
         vga_default = pci_dev_get(pdev);
 }
 
+/**
+ * vga_remove_vgacon - deactivete vga console
+ *
+ * Unbind and unregister vgacon in case pdev is the default vga
+ * device.  Can be called by gpu drivers on initialization to make
+ * sure vga register access done by vgacon will not disturb the
+ * device.
+ *
+ * @pdev: pci device.
+ */
+#if !defined(CONFIG_VGA_CONSOLE)
+int vga_remove_vgacon(struct pci_dev *pdev)
+{
+        return 0;
+}
+#elif !defined(CONFIG_DUMMY_CONSOLE)
+int vga_remove_vgacon(struct pci_dev *pdev)
+{
+        return -ENODEV;
+}
+#else
+int vga_remove_vgacon(struct pci_dev *pdev)
+{
+        int ret = 0;
+
+        if (pdev != vga_default)
+                return 0;
+        vgaarb_info(&pdev->dev, "deactivate vga console\n");
+
+        console_lock();
+        if (con_is_bound(&vga_con))
+                ret = do_take_over_console(&dummy_con, 0,
+                                           MAX_NR_CONSOLES - 1, 1);
+        if (ret == 0) {
+                ret = do_unregister_con_driver(&vga_con);
+
+                /* Ignore "already unregistered". */
+                if (ret == -ENODEV)
+                        ret = 0;
+        }
+        console_unlock();
+
+        return ret;
+}
+#endif
+EXPORT_SYMBOL(vga_remove_vgacon);
+
 static inline void vga_irq_set_state(struct vga_device *vgadev, bool state)
 {
         if (vgadev->irq_set_state)
diff --git a/drivers/hwtracing/coresight/coresight-etm3x.c b/drivers/hwtracing/coresight/coresight-etm3x.c
index 9a63e87ea5f3..be302ec5f66b 100644
--- a/drivers/hwtracing/coresight/coresight-etm3x.c
+++ b/drivers/hwtracing/coresight/coresight-etm3x.c
@@ -871,7 +871,7 @@ static int etm_probe(struct amba_device *adev, const struct amba_id *id)
         }
 
         pm_runtime_put(&adev->dev);
-        dev_info(dev, "%s initialized\n", (char *)id->data);
+        dev_info(dev, "%s initialized\n", (char *)coresight_get_uci_data(id));
         if (boot_enable) {
                 coresight_enable(drvdata->csdev);
                 drvdata->boot_enable = true;
@@ -915,36 +915,18 @@ static const struct dev_pm_ops etm_dev_pm_ops = {
 };
 
 static const struct amba_id etm_ids[] = {
-        {       /* ETM 3.3 */
-                .id     = 0x000bb921,
-                .mask   = 0x000fffff,
-                .data   = "ETM 3.3",
-        },
-        {       /* ETM 3.5 - Cortex-A5 */
-                .id     = 0x000bb955,
-                .mask   = 0x000fffff,
-                .data   = "ETM 3.5",
-        },
-        {       /* ETM 3.5 */
-                .id     = 0x000bb956,
-                .mask   = 0x000fffff,
-                .data   = "ETM 3.5",
-        },
-        {       /* PTM 1.0 */
-                .id     = 0x000bb950,
-                .mask   = 0x000fffff,
-                .data   = "PTM 1.0",
-        },
-        {       /* PTM 1.1 */
-                .id     = 0x000bb95f,
-                .mask   = 0x000fffff,
-                .data   = "PTM 1.1",
-        },
-        {       /* PTM 1.1 Qualcomm */
-                .id     = 0x000b006f,
-                .mask   = 0x000fffff,
-                .data   = "PTM 1.1",
-        },
+        /* ETM 3.3 */
+        CS_AMBA_ID_DATA(0x000bb921, "ETM 3.3"),
+        /* ETM 3.5 - Cortex-A5 */
+        CS_AMBA_ID_DATA(0x000bb955, "ETM 3.5"),
+        /* ETM 3.5 */
+        CS_AMBA_ID_DATA(0x000bb956, "ETM 3.5"),
+        /* PTM 1.0 */
+        CS_AMBA_ID_DATA(0x000bb950, "PTM 1.0"),
+        /* PTM 1.1 */
+        CS_AMBA_ID_DATA(0x000bb95f, "PTM 1.1"),
+        /* PTM 1.1 Qualcomm */
+        CS_AMBA_ID_DATA(0x000b006f, "PTM 1.1"),
         { 0, 0},
 };
 
diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c
index fe76b176974a..08ce37c9475d 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x.c
@@ -1068,18 +1068,21 @@ err_arch_supported:
         return ret;
 }
 
-#define ETM4x_AMBA_ID(pid)                      \
-        {                                       \
-                .id     = pid,                  \
-                .mask   = 0x000fffff,           \
+static struct amba_cs_uci_id uci_id_etm4[] = {
+        {
+                /*  ETMv4 UCI data */
+                .devarch        = 0x47704a13,
+                .devarch_mask   = 0xfff0ffff,
+                .devtype        = 0x00000013,
         }
+};
 
 static const struct amba_id etm4_ids[] = {
-        ETM4x_AMBA_ID(0x000bb95d),              /* Cortex-A53 */
-        ETM4x_AMBA_ID(0x000bb95e),              /* Cortex-A57 */
-        ETM4x_AMBA_ID(0x000bb95a),              /* Cortex-A72 */
-        ETM4x_AMBA_ID(0x000bb959),              /* Cortex-A73 */
-        ETM4x_AMBA_ID(0x000bb9da),              /* Cortex-A35 */
+        CS_AMBA_ID(0x000bb95d),         /* Cortex-A53 */
+        CS_AMBA_ID(0x000bb95e),         /* Cortex-A57 */
+        CS_AMBA_ID(0x000bb95a),         /* Cortex-A72 */
+        CS_AMBA_ID(0x000bb959),         /* Cortex-A73 */
+        CS_AMBA_UCI_ID(0x000bb9da, uci_id_etm4),        /* Cortex-A35 */
         {},
 };
 
diff --git a/drivers/hwtracing/coresight/coresight-priv.h b/drivers/hwtracing/coresight/coresight-priv.h
index b936c6d7e13f..e0684d06e9ee 100644
--- a/drivers/hwtracing/coresight/coresight-priv.h
+++ b/drivers/hwtracing/coresight/coresight-priv.h
@@ -6,6 +6,7 @@
 #ifndef _CORESIGHT_PRIV_H
 #define _CORESIGHT_PRIV_H
 
+#include <linux/amba/bus.h>
 #include <linux/bitops.h>
 #include <linux/io.h>
 #include <linux/coresight.h>
@@ -160,4 +161,43 @@ static inline int etm_readl_cp14(u32 off, unsigned int *val) { return 0; }
 static inline int etm_writel_cp14(u32 off, u32 val) { return 0; }
 #endif
 
+/*
+ * Macros and inline functions to handle CoreSight UCI data and driver
+ * private data in AMBA ID table entries, and extract data values.
+ */
+
+/* coresight AMBA ID, no UCI, no driver data: id table entry */
+#define CS_AMBA_ID(pid)                 \
+        {                               \
+                .id     = pid,          \
+                .mask   = 0x000fffff,   \
+        }
+
+/* coresight AMBA ID, UCI with driver data only: id table entry. */
+#define CS_AMBA_ID_DATA(pid, dval)                              \
+        {                                                       \
+                .id     = pid,                                  \
+                .mask   = 0x000fffff,                           \
+                .data   =  (void *)&(struct amba_cs_uci_id)     \
+                        {                               \
+                                .data = (void *)dval,   \
+                        }                               \
+        }
+
+/* coresight AMBA ID, full UCI structure: id table entry. */
+#define CS_AMBA_UCI_ID(pid, uci_ptr)    \
+        {                               \
+                .id     = pid,          \
+                .mask   = 0x000fffff,   \
+                .data   = uci_ptr       \
+        }
+
+/* extract the data value from a UCI structure given amba_id pointer. */
+static inline void *coresight_get_uci_data(const struct amba_id *id)
+{
+        if (id->data)
+                return ((struct amba_cs_uci_id *)(id->data))->data;
+        return 0;
+}
+
 #endif
diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c
index f07825df5c7a..9f8a844ed7aa 100644
--- a/drivers/hwtracing/coresight/coresight-stm.c
+++ b/drivers/hwtracing/coresight/coresight-stm.c
@@ -870,7 +870,7 @@ static int stm_probe(struct amba_device *adev, const struct amba_id *id)
 
         pm_runtime_put(&adev->dev);
 
-        dev_info(dev, "%s initialized\n", (char *)id->data);
+        dev_info(dev, "%s initialized\n", (char *)coresight_get_uci_data(id));
         return 0;
 
 stm_unregister:
@@ -905,16 +905,8 @@ static const struct dev_pm_ops stm_dev_pm_ops = {
 };
 
 static const struct amba_id stm_ids[] = {
-        {
-                .id     = 0x000bb962,
-                .mask   = 0x000fffff,
-                .data   = "STM32",
-        },
-        {
-                .id     = 0x000bb963,
-                .mask   = 0x000fffff,
-                .data   = "STM500",
-        },
+        CS_AMBA_ID_DATA(0x000bb962, "STM32"),
+        CS_AMBA_ID_DATA(0x000bb963, "STM500"),
         { 0, 0},
 };
 
diff --git a/drivers/hwtracing/coresight/coresight-tmc.c b/drivers/hwtracing/coresight/coresight-tmc.c
index ea249f0bcd73..2a02da3d630f 100644
--- a/drivers/hwtracing/coresight/coresight-tmc.c
+++ b/drivers/hwtracing/coresight/coresight-tmc.c
@@ -443,7 +443,8 @@ static int tmc_probe(struct amba_device *adev, const struct amba_id *id)
                 desc.type = CORESIGHT_DEV_TYPE_SINK;
                 desc.subtype.sink_subtype = CORESIGHT_DEV_SUBTYPE_SINK_BUFFER;
                 desc.ops = &tmc_etr_cs_ops;
-                ret = tmc_etr_setup_caps(drvdata, devid, id->data);
+                ret = tmc_etr_setup_caps(drvdata, devid,
+                                         coresight_get_uci_data(id));
                 if (ret)
                         goto out;
                 break;
@@ -475,26 +476,13 @@ out:
 }
 
 static const struct amba_id tmc_ids[] = {
-        {
-                .id     = 0x000bb961,
-                .mask   = 0x000fffff,
-        },
-        {
-                /* Coresight SoC 600 TMC-ETR/ETS */
-                .id     = 0x000bb9e8,
-                .mask   = 0x000fffff,
-                .data   = (void *)(unsigned long)CORESIGHT_SOC_600_ETR_CAPS,
-        },
-        {
-                /* Coresight SoC 600 TMC-ETB */
-                .id     = 0x000bb9e9,
-                .mask   = 0x000fffff,
-        },
-        {
-                /* Coresight SoC 600 TMC-ETF */
-                .id     = 0x000bb9ea,
-                .mask   = 0x000fffff,
-        },
+        CS_AMBA_ID(0x000bb961),
+        /* Coresight SoC 600 TMC-ETR/ETS */
+        CS_AMBA_ID_DATA(0x000bb9e8, (unsigned long)CORESIGHT_SOC_600_ETR_CAPS),
+        /* Coresight SoC 600 TMC-ETB */
+        CS_AMBA_ID(0x000bb9e9),
+        /* Coresight SoC 600 TMC-ETF */
+        CS_AMBA_ID(0x000bb9ea),
         { 0, 0},
 };
 
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index ead5e7de3e4d..416f89b8f881 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -86,7 +86,6 @@ static int dw_i2c_acpi_configure(struct platform_device *pdev)
         struct i2c_timings *t = &dev->timings;
         u32 ss_ht = 0, fp_ht = 0, hs_ht = 0, fs_ht = 0;
 
-        dev->adapter.nr = -1;
         dev->tx_fifo_depth = 32;
         dev->rx_fifo_depth = 32;
 
@@ -219,7 +218,7 @@ static void i2c_dw_configure_slave(struct dw_i2c_dev *dev)
         dev->mode = DW_IC_SLAVE;
 }
 
-static void dw_i2c_set_fifo_size(struct dw_i2c_dev *dev, int id)
+static void dw_i2c_set_fifo_size(struct dw_i2c_dev *dev)
 {
         u32 param, tx_fifo_depth, rx_fifo_depth;
 
@@ -233,7 +232,6 @@ static void dw_i2c_set_fifo_size(struct dw_i2c_dev *dev, int id)
         if (!dev->tx_fifo_depth) {
                 dev->tx_fifo_depth = tx_fifo_depth;
                 dev->rx_fifo_depth = rx_fifo_depth;
-                dev->adapter.nr = id;
         } else if (tx_fifo_depth >= 2) {
                 dev->tx_fifo_depth = min_t(u32, dev->tx_fifo_depth,
                                 tx_fifo_depth);
@@ -358,13 +356,14 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
                                 div_u64(clk_khz * t->sda_hold_ns + 500000, 1000000);
         }
 
-        dw_i2c_set_fifo_size(dev, pdev->id);
+        dw_i2c_set_fifo_size(dev);
 
         adap = &dev->adapter;
         adap->owner = THIS_MODULE;
         adap->class = I2C_CLASS_DEPRECATED;
         ACPI_COMPANION_SET(&adap->dev, ACPI_COMPANION(&pdev->dev));
         adap->dev.of_node = pdev->dev.of_node;
+        adap->nr = -1;
 
         dev_pm_set_driver_flags(&pdev->dev,
                                 DPM_FLAG_SMART_PREPARE |
diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
index 660de1ee68ed..684d651612b3 100644
--- a/drivers/i2c/busses/i2c-mt65xx.c
+++ b/drivers/i2c/busses/i2c-mt65xx.c
@@ -503,7 +503,7 @@ static int mtk_i2c_do_transfer(struct mtk_i2c *i2c, struct i2c_msg *msgs,
                 writel(I2C_DMA_INT_FLAG_NONE, i2c->pdmabase + OFFSET_INT_FLAG);
                 writel(I2C_DMA_CON_RX, i2c->pdmabase + OFFSET_CON);
 
-                dma_rd_buf = i2c_get_dma_safe_msg_buf(msgs, 0);
+                dma_rd_buf = i2c_get_dma_safe_msg_buf(msgs, 1);
                 if (!dma_rd_buf)
                         return -ENOMEM;
 
@@ -526,7 +526,7 @@ static int mtk_i2c_do_transfer(struct mtk_i2c *i2c, struct i2c_msg *msgs,
                 writel(I2C_DMA_INT_FLAG_NONE, i2c->pdmabase + OFFSET_INT_FLAG);
                 writel(I2C_DMA_CON_TX, i2c->pdmabase + OFFSET_CON);
 
-                dma_wr_buf = i2c_get_dma_safe_msg_buf(msgs, 0);
+                dma_wr_buf = i2c_get_dma_safe_msg_buf(msgs, 1);
                 if (!dma_wr_buf)
                         return -ENOMEM;
 
@@ -549,7 +549,7 @@ static int mtk_i2c_do_transfer(struct mtk_i2c *i2c, struct i2c_msg *msgs,
                 writel(I2C_DMA_CLR_FLAG, i2c->pdmabase + OFFSET_INT_FLAG);
                 writel(I2C_DMA_CLR_FLAG, i2c->pdmabase + OFFSET_CON);
 
-                dma_wr_buf = i2c_get_dma_safe_msg_buf(msgs, 0);
+                dma_wr_buf = i2c_get_dma_safe_msg_buf(msgs, 1);
                 if (!dma_wr_buf)
                         return -ENOMEM;
 
@@ -561,7 +561,7 @@ static int mtk_i2c_do_transfer(struct mtk_i2c *i2c, struct i2c_msg *msgs,
                         return -ENOMEM;
                 }
 
-                dma_rd_buf = i2c_get_dma_safe_msg_buf((msgs + 1), 0);
+                dma_rd_buf = i2c_get_dma_safe_msg_buf((msgs + 1), 1);
                 if (!dma_rd_buf) {
                         dma_unmap_single(i2c->dev, wpaddr,
                                          msgs->len, DMA_TO_DEVICE);
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index dd52a068b140..a7578f6da979 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -363,9 +363,6 @@ static void rcar_i2c_dma_unmap(struct rcar_i2c_priv *priv)
         struct dma_chan *chan = priv->dma_direction == DMA_FROM_DEVICE
                 ? priv->dma_rx : priv->dma_tx;
 
-        /* Disable DMA Master Received/Transmitted */
-        rcar_i2c_write(priv, ICDMAER, 0);
-
         dma_unmap_single(chan->device->dev, sg_dma_address(&priv->sg),
                          sg_dma_len(&priv->sg), priv->dma_direction);
 
@@ -375,6 +372,9 @@ static void rcar_i2c_dma_unmap(struct rcar_i2c_priv *priv)
                 priv->flags |= ID_P_NO_RXDMA;
 
         priv->dma_direction = DMA_NONE;
+
+        /* Disable DMA Master Received/Transmitted, must be last! */
+        rcar_i2c_write(priv, ICDMAER, 0);
 }
 
 static void rcar_i2c_cleanup_dma(struct rcar_i2c_priv *priv)
@@ -611,6 +611,15 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
         return true;
 }
 
+/*
+ * This driver has a lock-free design because there are IP cores (at least
+ * R-Car Gen2) which have an inherent race condition in their hardware design.
+ * There, we need to clear RCAR_BUS_MASK_DATA bits as soon as possible after
+ * the interrupt was generated, otherwise an unwanted repeated message gets
+ * generated. It turned out that taking a spinlock at the beginning of the ISR
+ * was already causing repeated messages. Thus, this driver was converted to
+ * the now lockless behaviour. Please keep this in mind when hacking the driver.
+ */
 static irqreturn_t rcar_i2c_irq(int irq, void *ptr)
 {
         struct rcar_i2c_priv *priv = ptr;
diff --git a/drivers/i2c/busses/i2c-sis630.c b/drivers/i2c/busses/i2c-sis630.c
index 1e6805b5cef2..a57aa4fe51a4 100644
--- a/drivers/i2c/busses/i2c-sis630.c
+++ b/drivers/i2c/busses/i2c-sis630.c
@@ -478,7 +478,7 @@ static int sis630_setup(struct pci_dev *sis630_dev)
         if (!request_region(smbus_base + SMB_STS, SIS630_SMB_IOREGION,
                             sis630_driver.name)) {
                 dev_err(&sis630_dev->dev,
-                        "I/O Region 0x%04hx-0x%04hx for SMBus already in use.\n",
+                        "I/O Region 0x%04x-0x%04x for SMBus already in use.\n",
                         smbus_base + SMB_STS,
                         smbus_base + SMB_STS + SIS630_SMB_IOREGION - 1);
                 retval = -EBUSY;
@@ -528,7 +528,7 @@ static int sis630_probe(struct pci_dev *dev, const struct pci_device_id *id)
         sis630_adapter.dev.parent = &dev->dev;
 
         snprintf(sis630_adapter.name, sizeof(sis630_adapter.name),
-                 "SMBus SIS630 adapter at %04hx", smbus_base + SMB_STS);
+                 "SMBus SIS630 adapter at %04x", smbus_base + SMB_STS);
 
         return i2c_add_adapter(&sis630_adapter);
 }
diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
index 13e1213561d4..4284fc991cfd 100644
--- a/drivers/i2c/busses/i2c-stm32f7.c
+++ b/drivers/i2c/busses/i2c-stm32f7.c
@@ -432,7 +432,7 @@ static int stm32f7_i2c_compute_timing(struct stm32f7_i2c_dev *i2c_dev,
                  STM32F7_I2C_ANALOG_FILTER_DELAY_MAX : 0);
         dnf_delay = setup->dnf * i2cclk;
 
-        sdadel_min = setup->fall_time - i2c_specs[setup->speed].hddat_min -
+        sdadel_min = i2c_specs[setup->speed].hddat_min + setup->fall_time -
                 af_delay_min - (setup->dnf + 3) * i2cclk;
 
         sdadel_max = i2c_specs[setup->speed].vddat_max - setup->rise_time -
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index cb6c5cb0df0b..38af18645133 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -2258,7 +2258,8 @@ EXPORT_SYMBOL(i2c_put_adapter);
 /**
  * i2c_get_dma_safe_msg_buf() - get a DMA safe buffer for the given i2c_msg
  * @msg: the message to be checked
- * @threshold: the minimum number of bytes for which using DMA makes sense
+ * @threshold: the minimum number of bytes for which using DMA makes sense.
+ *             Should at least be 1.
  *
  * Return: NULL if a DMA safe buffer was not obtained. Use msg->buf with PIO.
  *         Or a valid pointer to be used with DMA. After use, release it by
@@ -2268,7 +2269,11 @@ EXPORT_SYMBOL(i2c_put_adapter);
  */
 u8 *i2c_get_dma_safe_msg_buf(struct i2c_msg *msg, unsigned int threshold)
 {
-        if (msg->len < threshold)
+        /* also skip 0-length msgs for bogus thresholds of 0 */
+        if (!threshold)
+                pr_debug("DMA buffer for addr=0x%02x with length 0 is bogus\n",
+                         msg->addr);
+        if (msg->len < threshold || msg->len == 0)
                 return NULL;
 
         if (msg->flags & I2C_M_DMA_SAFE)
diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c
index c5a881172524..337410f40860 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_utils.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c
@@ -173,7 +173,12 @@ int i40iw_inetaddr_event(struct notifier_block *notifier,
 
                 rcu_read_lock();
                 in = __in_dev_get_rcu(upper_dev);
-                local_ipaddr = ntohl(in->ifa_list->ifa_address);
+
+                if (!in->ifa_list)
+                        local_ipaddr = 0;
+                else
+                        local_ipaddr = ntohl(in->ifa_list->ifa_address);
+
                 rcu_read_unlock();
         } else {
                 local_ipaddr = ntohl(ifa->ifa_address);
@@ -185,6 +190,11 @@ int i40iw_inetaddr_event(struct notifier_block *notifier,
         case NETDEV_UP:
                 /* Fall through */
         case NETDEV_CHANGEADDR:
+
+                /* Just skip if no need to handle ARP cache */
+                if (!local_ipaddr)
+                        break;
+
                 i40iw_manage_arp_cache(iwdev,
                                        netdev->dev_addr,
                                        &local_ipaddr,
diff --git a/drivers/infiniband/hw/mlx4/alias_GUID.c b/drivers/infiniband/hw/mlx4/alias_GUID.c
index 782499abcd98..2a0b59a4b6eb 100644
--- a/drivers/infiniband/hw/mlx4/alias_GUID.c
+++ b/drivers/infiniband/hw/mlx4/alias_GUID.c
@@ -804,8 +804,8 @@ void mlx4_ib_destroy_alias_guid_service(struct mlx4_ib_dev *dev)
         unsigned long flags;
 
         for (i = 0 ; i < dev->num_ports; i++) {
-                cancel_delayed_work(&dev->sriov.alias_guid.ports_guid[i].alias_guid_work);
                 det = &sriov->alias_guid.ports_guid[i];
+                cancel_delayed_work_sync(&det->alias_guid_work);
                 spin_lock_irqsave(&sriov->alias_guid.ag_work_lock, flags);
                 while (!list_empty(&det->cb_list)) {
                         cb_ctx = list_entry(det->cb_list.next,
diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
index eaa055007f28..9e08df7914aa 100644
--- a/drivers/infiniband/hw/mlx5/devx.c
+++ b/drivers/infiniband/hw/mlx5/devx.c
@@ -20,6 +20,7 @@
 
 enum devx_obj_flags {
         DEVX_OBJ_FLAGS_INDIRECT_MKEY = 1 << 0,
+        DEVX_OBJ_FLAGS_DCT = 1 << 1,
 };
 
 struct devx_async_data {
@@ -39,7 +40,10 @@ struct devx_obj {
         u32                     dinlen; /* destroy inbox length */
         u32                     dinbox[MLX5_MAX_DESTROY_INBOX_SIZE_DW];
         u32                     flags;
-        struct mlx5_ib_devx_mr  devx_mr;
+        union {
+                struct mlx5_ib_devx_mr  devx_mr;
+                struct mlx5_core_dct    core_dct;
+        };
 };
 
 struct devx_umem {
@@ -347,7 +351,6 @@ static u64 devx_get_obj_id(const void *in)
                 obj_id = get_enc_obj_id(MLX5_CMD_OP_CREATE_RQ,
                                         MLX5_GET(arm_rq_in, in, srq_number));
                 break;
-        case MLX5_CMD_OP_DRAIN_DCT:
         case MLX5_CMD_OP_ARM_DCT_FOR_KEY_VIOLATION:
                 obj_id = get_enc_obj_id(MLX5_CMD_OP_CREATE_DCT,
                                         MLX5_GET(drain_dct_in, in, dctn));
@@ -618,7 +621,6 @@ static bool devx_is_obj_modify_cmd(const void *in)
         case MLX5_CMD_OP_2RST_QP:
         case MLX5_CMD_OP_ARM_XRC_SRQ:
         case MLX5_CMD_OP_ARM_RQ:
-        case MLX5_CMD_OP_DRAIN_DCT:
         case MLX5_CMD_OP_ARM_DCT_FOR_KEY_VIOLATION:
         case MLX5_CMD_OP_ARM_XRQ:
         case MLX5_CMD_OP_SET_XRQ_DC_PARAMS_ENTRY:
@@ -1124,7 +1126,11 @@ static int devx_obj_cleanup(struct ib_uobject *uobject,
         if (obj->flags & DEVX_OBJ_FLAGS_INDIRECT_MKEY)
                 devx_cleanup_mkey(obj);
 
-        ret = mlx5_cmd_exec(obj->mdev, obj->dinbox, obj->dinlen, out, sizeof(out));
+        if (obj->flags & DEVX_OBJ_FLAGS_DCT)
+                ret = mlx5_core_destroy_dct(obj->mdev, &obj->core_dct);
+        else
+                ret = mlx5_cmd_exec(obj->mdev, obj->dinbox, obj->dinlen, out,
+                                    sizeof(out));
         if (ib_is_destroy_retryable(ret, why, uobject))
                 return ret;
 
@@ -1185,9 +1191,17 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
                 devx_set_umem_valid(cmd_in);
         }
 
-        err = mlx5_cmd_exec(dev->mdev, cmd_in,
-                            cmd_in_len,
-                            cmd_out, cmd_out_len);
+        if (opcode == MLX5_CMD_OP_CREATE_DCT) {
+                obj->flags |= DEVX_OBJ_FLAGS_DCT;
+                err = mlx5_core_create_dct(dev->mdev, &obj->core_dct,
+                                           cmd_in, cmd_in_len,
+                                           cmd_out, cmd_out_len);
+        } else {
+                err = mlx5_cmd_exec(dev->mdev, cmd_in,
+                                    cmd_in_len,
+                                    cmd_out, cmd_out_len);
+        }
+
         if (err)
                 goto obj_free;
 
@@ -1214,7 +1228,11 @@ err_copy:
         if (obj->flags & DEVX_OBJ_FLAGS_INDIRECT_MKEY)
                 devx_cleanup_mkey(obj);
 obj_destroy:
-        mlx5_cmd_exec(obj->mdev, obj->dinbox, obj->dinlen, out, sizeof(out));
+        if (obj->flags & DEVX_OBJ_FLAGS_DCT)
+                mlx5_core_destroy_dct(obj->mdev, &obj->core_dct);
+        else
+                mlx5_cmd_exec(obj->mdev, obj->dinbox, obj->dinlen, out,
+                              sizeof(out));
 obj_free:
         kfree(obj);
         return err;
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 994c19d01211..531ff20b32ad 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -415,10 +415,17 @@ static int translate_eth_ext_proto_oper(u32 eth_proto_oper, u8 *active_speed,
                 *active_speed = IB_SPEED_EDR;
                 break;
         case MLX5E_PROT_MASK(MLX5E_50GAUI_2_LAUI_2_50GBASE_CR2_KR2):
+                *active_width = IB_WIDTH_2X;
+                *active_speed = IB_SPEED_EDR;
+                break;
         case MLX5E_PROT_MASK(MLX5E_50GAUI_1_LAUI_1_50GBASE_CR_KR):
                 *active_width = IB_WIDTH_1X;
                 *active_speed = IB_SPEED_HDR;
                 break;
+        case MLX5E_PROT_MASK(MLX5E_CAUI_4_100GBASE_CR4_KR4):
+                *active_width = IB_WIDTH_4X;
+                *active_speed = IB_SPEED_EDR;
+                break;
         case MLX5E_PROT_MASK(MLX5E_100GAUI_2_100GBASE_CR2_KR2):
                 *active_width = IB_WIDTH_2X;
                 *active_speed = IB_SPEED_HDR;
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 6b1f0e76900b..7cd006da1dae 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -3729,6 +3729,7 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr,
 
         } else if (cur_state == IB_QPS_INIT && new_state == IB_QPS_RTR) {
                 struct mlx5_ib_modify_qp_resp resp = {};
+                u32 out[MLX5_ST_SZ_DW(create_dct_out)] = {0};
                 u32 min_resp_len = offsetof(typeof(resp), dctn) +
                                    sizeof(resp.dctn);
 
@@ -3747,7 +3748,8 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr,
                 MLX5_SET(dctc, dctc, hop_limit, attr->ah_attr.grh.hop_limit);
 
                 err = mlx5_core_create_dct(dev->mdev, &qp->dct.mdct, qp->dct.in,
-                                           MLX5_ST_SZ_BYTES(create_dct_in));
+                                           MLX5_ST_SZ_BYTES(create_dct_in), out,
+                                           sizeof(out));
                 if (err)
                         return err;
                 resp.dctn = qp->dct.mdct.mqp.qpn;
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 6b0760dafb3e..21cb088d6687 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -140,10 +140,14 @@ static struct lock_class_key reserved_rbtree_key;
 static inline int match_hid_uid(struct device *dev,
                                 struct acpihid_map_entry *entry)
 {
+        struct acpi_device *adev = ACPI_COMPANION(dev);
         const char *hid, *uid;
 
-        hid = acpi_device_hid(ACPI_COMPANION(dev));
-        uid = acpi_device_uid(ACPI_COMPANION(dev));
+        if (!adev)
+                return -ENODEV;
+
+        hid = acpi_device_hid(adev);
+        uid = acpi_device_uid(adev);
 
         if (!hid || !(*hid))
                 return -ENODEV;
@@ -2604,7 +2608,12 @@ static int map_sg(struct device *dev, struct scatterlist *sglist,
 
         /* Everything is mapped - write the right values into s->dma_address */
         for_each_sg(sglist, s, nelems, i) {
-                s->dma_address += address + s->offset;
+                /*
+                 * Add in the remaining piece of the scatter-gather offset that
+                 * was masked out when we were determining the physical address
+                 * via (sg_phys(s) & PAGE_MASK) earlier.
+                 */
+                s->dma_address += address + (s->offset & ~PAGE_MASK);
                 s->dma_length   = s->length;
         }
 
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 87274b54febd..28cb713d728c 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -1538,6 +1538,9 @@ static void iommu_disable_protect_mem_regions(struct intel_iommu *iommu)
         u32 pmen;
         unsigned long flags;
 
+        if (!cap_plmr(iommu->cap) && !cap_phmr(iommu->cap))
+                return;
+
         raw_spin_lock_irqsave(&iommu->register_lock, flags);
         pmen = readl(iommu->reg + DMAR_PMEN_REG);
         pmen &= ~DMA_PMEN_EPM;
@@ -5332,7 +5335,7 @@ int intel_iommu_enable_pasid(struct intel_iommu *iommu, struct intel_svm_dev *sd
 
         ctx_lo = context[0].lo;
 
-        sdev->did = domain->iommu_did[iommu->seq_id];
+        sdev->did = FLPT_DEFAULT_DID;
         sdev->sid = PCI_DEVID(info->bus, info->devfn);
 
         if (!(ctx_lo & CONTEXT_PASIDE)) {
diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
index f8d3ba247523..2de8122e218f 100644
--- a/drivers/iommu/iova.c
+++ b/drivers/iommu/iova.c
@@ -207,8 +207,10 @@ static int __alloc_and_insert_iova_range(struct iova_domain *iovad,
                 curr_iova = rb_entry(curr, struct iova, node);
         } while (curr && new_pfn <= curr_iova->pfn_hi);
 
-        if (limit_pfn < size || new_pfn < iovad->start_pfn)
+        if (limit_pfn < size || new_pfn < iovad->start_pfn) {
+                iovad->max32_alloc_size = size;
                 goto iova32_full;
+        }
 
         /* pfn_lo will point to size aligned address if size_aligned is set */
         new->pfn_lo = new_pfn;
@@ -222,7 +224,6 @@ static int __alloc_and_insert_iova_range(struct iova_domain *iovad,
         return 0;
 
 iova32_full:
-        iovad->max32_alloc_size = size;
         spin_unlock_irqrestore(&iovad->iova_rbtree_lock, flags);
         return -ENOMEM;
 }
diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
index 83364fedbf0a..5e4ca139e4ea 100644
--- a/drivers/irqchip/irq-brcmstb-l2.c
+++ b/drivers/irqchip/irq-brcmstb-l2.c
@@ -275,14 +275,14 @@ out_free:
         return ret;
 }
 
-int __init brcmstb_l2_edge_intc_of_init(struct device_node *np,
+static int __init brcmstb_l2_edge_intc_of_init(struct device_node *np,
         struct device_node *parent)
 {
         return brcmstb_l2_intc_of_init(np, parent, &l2_edge_intc_init);
 }
 IRQCHIP_DECLARE(brcmstb_l2_intc, "brcm,l2-intc", brcmstb_l2_edge_intc_of_init);
 
-int __init brcmstb_l2_lvl_intc_of_init(struct device_node *np,
+static int __init brcmstb_l2_lvl_intc_of_init(struct device_node *np,
         struct device_node *parent)
 {
         return brcmstb_l2_intc_of_init(np, parent, &l2_lvl_intc_init);
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 2dd1ff0cf558..7577755bdcf4 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1482,7 +1482,7 @@ static int lpi_range_cmp(void *priv, struct list_head *a, struct list_head *b)
         ra = container_of(a, struct lpi_range, entry);
         rb = container_of(b, struct lpi_range, entry);
 
-        return rb->base_id - ra->base_id;
+        return ra->base_id - rb->base_id;
 }
 
 static void merge_lpi_ranges(void)
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index ba2a37a27a54..fd3110c171ba 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -1089,11 +1089,10 @@ static void gic_init_chip(struct gic_chip_data *gic, struct device *dev,
 #endif
 }
 
-static int gic_init_bases(struct gic_chip_data *gic, int irq_start,
+static int gic_init_bases(struct gic_chip_data *gic,
                           struct fwnode_handle *handle)
 {
-        irq_hw_number_t hwirq_base;
-        int gic_irqs, irq_base, ret;
+        int gic_irqs, ret;
 
         if (IS_ENABLED(CONFIG_GIC_NON_BANKED) && gic->percpu_offset) {
                 /* Frankein-GIC without banked registers... */
@@ -1145,28 +1144,21 @@ static int gic_init_bases(struct gic_chip_data *gic, int irq_start,
         } else {                /* Legacy support */
                 /*
                  * For primary GICs, skip over SGIs.
-                 * For secondary GICs, skip over PPIs, too.
+                 * No secondary GIC support whatsoever.
                  */
-                if (gic == &gic_data[0] && (irq_start & 31) > 0) {
-                        hwirq_base = 16;
-                        if (irq_start != -1)
-                                irq_start = (irq_start & ~31) + 16;
-                } else {
-                        hwirq_base = 32;
-                }
+                int irq_base;
 
-                gic_irqs -= hwirq_base; /* calculate # of irqs to allocate */
+                gic_irqs -= 16; /* calculate # of irqs to allocate */
 
-                irq_base = irq_alloc_descs(irq_start, 16, gic_irqs,
+                irq_base = irq_alloc_descs(16, 16, gic_irqs,
                                            numa_node_id());
                 if (irq_base < 0) {
-                        WARN(1, "Cannot allocate irq_descs @ IRQ%d, assuming pre-allocated\n",
-                             irq_start);
-                        irq_base = irq_start;
+                        WARN(1, "Cannot allocate irq_descs @ IRQ16, assuming pre-allocated\n");
+                        irq_base = 16;
                 }
 
                 gic->domain = irq_domain_add_legacy(NULL, gic_irqs, irq_base,
-                                        hwirq_base, &gic_irq_domain_ops, gic);
+                                                    16, &gic_irq_domain_ops, gic);
         }
 
         if (WARN_ON(!gic->domain)) {
@@ -1195,7 +1187,6 @@ error:
 }
 
 static int __init __gic_init_bases(struct gic_chip_data *gic,
-                                   int irq_start,
                                    struct fwnode_handle *handle)
 {
         char *name;
@@ -1231,32 +1222,28 @@ static int __init __gic_init_bases(struct gic_chip_data *gic,
                 gic_init_chip(gic, NULL, name, false);
         }
 
-        ret = gic_init_bases(gic, irq_start, handle);
+        ret = gic_init_bases(gic, handle);
         if (ret)
                 kfree(name);
 
         return ret;
 }
 
-void __init gic_init(unsigned int gic_nr, int irq_start,
-                     void __iomem *dist_base, void __iomem *cpu_base)
+void __init gic_init(void __iomem *dist_base, void __iomem *cpu_base)
 {
         struct gic_chip_data *gic;
 
-        if (WARN_ON(gic_nr >= CONFIG_ARM_GIC_MAX_NR))
-                return;
-
         /*
          * Non-DT/ACPI systems won't run a hypervisor, so let's not
          * bother with these...
          */
         static_branch_disable(&supports_deactivate_key);
 
-        gic = &gic_data[gic_nr];
+        gic = &gic_data[0];
         gic->raw_dist_base = dist_base;
         gic->raw_cpu_base = cpu_base;
 
-        __gic_init_bases(gic, irq_start, NULL);
+        __gic_init_bases(gic, NULL);
 }
 
 static void gic_teardown(struct gic_chip_data *gic)
@@ -1399,7 +1386,7 @@ int gic_of_init_child(struct device *dev, struct gic_chip_data **gic, int irq)
         if (ret)
                 return ret;
 
-        ret = gic_init_bases(*gic, -1, &dev->of_node->fwnode);
+        ret = gic_init_bases(*gic, &dev->of_node->fwnode);
         if (ret) {
                 gic_teardown(*gic);
                 return ret;
@@ -1459,7 +1446,7 @@ gic_of_init(struct device_node *node, struct device_node *parent)
         if (gic_cnt == 0 && !gic_check_eoimode(node, &gic->raw_cpu_base))
                 static_branch_disable(&supports_deactivate_key);
 
-        ret = __gic_init_bases(gic, -1, &node->fwnode);
+        ret = __gic_init_bases(gic, &node->fwnode);
         if (ret) {
                 gic_teardown(gic);
                 return ret;
@@ -1650,7 +1637,7 @@ static int __init gic_v2_acpi_init(struct acpi_subtable_header *header,
                 return -ENOMEM;
         }
 
-        ret = __gic_init_bases(gic, -1, domain_handle);
+        ret = __gic_init_bases(gic, domain_handle);
         if (ret) {
                 pr_err("Failed to initialise GIC\n");
                 irq_domain_free_fwnode(domain_handle);
diff --git a/drivers/irqchip/irq-imx-irqsteer.c b/drivers/irqchip/irq-imx-irqsteer.c
index d1098f4da6a4..88df3d00052c 100644
--- a/drivers/irqchip/irq-imx-irqsteer.c
+++ b/drivers/irqchip/irq-imx-irqsteer.c
@@ -169,8 +169,12 @@ static int imx_irqsteer_probe(struct platform_device *pdev)
 
         raw_spin_lock_init(&data->lock);
 
-        of_property_read_u32(np, "fsl,num-irqs", &irqs_num);
-        of_property_read_u32(np, "fsl,channel", &data->channel);
+        ret = of_property_read_u32(np, "fsl,num-irqs", &irqs_num);
+        if (ret)
+                return ret;
+        ret = of_property_read_u32(np, "fsl,channel", &data->channel);
+        if (ret)
+                return ret;
 
         /*
          * There is one output irq for each group of 64 inputs.
diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c
index 567b29c47608..98b6e1d4b1a6 100644
--- a/drivers/irqchip/irq-mbigen.c
+++ b/drivers/irqchip/irq-mbigen.c
@@ -161,6 +161,9 @@ static void mbigen_write_msg(struct msi_desc *desc, struct msi_msg *msg)
         void __iomem *base = d->chip_data;
         u32 val;
 
+        if (!msg->address_lo && !msg->address_hi)
+                return;
+ 
         base += get_mbigen_vec_reg(d->hwirq);
         val = readl_relaxed(base);
 
diff --git a/drivers/irqchip/irq-mmp.c b/drivers/irqchip/irq-mmp.c
index 3496b61a312a..8eed478f3b7e 100644
--- a/drivers/irqchip/irq-mmp.c
+++ b/drivers/irqchip/irq-mmp.c
@@ -179,7 +179,7 @@ static int mmp_irq_domain_xlate(struct irq_domain *d, struct device_node *node,
         return 0;
 }
 
-const struct irq_domain_ops mmp_irq_domain_ops = {
+static const struct irq_domain_ops mmp_irq_domain_ops = {
         .map            = mmp_irq_domain_map,
         .xlate          = mmp_irq_domain_xlate,
 };
diff --git a/drivers/irqchip/irq-mvebu-sei.c b/drivers/irqchip/irq-mvebu-sei.c
index add4c9c934c8..18832ccc8ff8 100644
--- a/drivers/irqchip/irq-mvebu-sei.c
+++ b/drivers/irqchip/irq-mvebu-sei.c
@@ -478,7 +478,7 @@ dispose_irq:
         return ret;
 }
 
-struct mvebu_sei_caps mvebu_sei_ap806_caps = {
+static struct mvebu_sei_caps mvebu_sei_ap806_caps = {
         .ap_range = {
                 .first = 0,
                 .size = 21,
diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c
index a93296b9b45d..7bd1d4cb2e19 100644
--- a/drivers/irqchip/irq-stm32-exti.c
+++ b/drivers/irqchip/irq-stm32-exti.c
@@ -716,7 +716,6 @@ stm32_exti_chip_data *stm32_exti_chip_init(struct stm32_exti_host_data *h_data,
         const struct stm32_exti_bank *stm32_bank;
         struct stm32_exti_chip_data *chip_data;
         void __iomem *base = h_data->base;
-        u32 irqs_mask;
 
         stm32_bank = h_data->drv_data->exti_banks[bank_idx];
         chip_data = &h_data->chips_data[bank_idx];
@@ -725,21 +724,12 @@ stm32_exti_chip_data *stm32_exti_chip_init(struct stm32_exti_host_data *h_data,
 
         raw_spin_lock_init(&chip_data->rlock);
 
-        /* Determine number of irqs supported */
-        writel_relaxed(~0UL, base + stm32_bank->rtsr_ofst);
-        irqs_mask = readl_relaxed(base + stm32_bank->rtsr_ofst);
-
         /*
          * This IP has no reset, so after hot reboot we should
          * clear registers to avoid residue
          */
         writel_relaxed(0, base + stm32_bank->imr_ofst);
         writel_relaxed(0, base + stm32_bank->emr_ofst);
-        writel_relaxed(0, base + stm32_bank->rtsr_ofst);
-        writel_relaxed(0, base + stm32_bank->ftsr_ofst);
-        writel_relaxed(~0UL, base + stm32_bank->rpr_ofst);
-        if (stm32_bank->fpr_ofst != UNDEF_REG)
-                writel_relaxed(~0UL, base + stm32_bank->fpr_ofst);
 
         pr_info("%pOF: bank%d\n", h_data->node, bank_idx);
 
diff --git a/drivers/lightnvm/pblk-rl.c b/drivers/lightnvm/pblk-rl.c
index b014957dde0b..a5f8bc2defbc 100644
--- a/drivers/lightnvm/pblk-rl.c
+++ b/drivers/lightnvm/pblk-rl.c
@@ -233,10 +233,15 @@ void pblk_rl_init(struct pblk_rl *rl, int budget, int threshold)
         /* To start with, all buffer is available to user I/O writers */
         rl->rb_budget = budget;
         rl->rb_user_max = budget;
-        rl->rb_max_io = threshold ? (budget - threshold) : (budget - 1);
         rl->rb_gc_max = 0;
         rl->rb_state = PBLK_RL_HIGH;
 
+        /* Maximize I/O size and ansure that back threshold is respected */
+        if (threshold)
+                rl->rb_max_io = budget - pblk->min_write_pgs_data - threshold;
+        else
+                rl->rb_max_io = budget - pblk->min_write_pgs_data - 1;
+
         atomic_set(&rl->rb_user_cnt, 0);
         atomic_set(&rl->rb_gc_cnt, 0);
         atomic_set(&rl->rb_space, -1);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index abb5d382f64d..3b6880dd648d 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -3939,6 +3939,8 @@ static int raid10_run(struct mddev *mddev)
                 set_bit(MD_RECOVERY_RUNNING, &mddev->recovery);
                 mddev->sync_thread = md_register_thread(md_do_sync, mddev,
                                                         "reshape");
+                if (!mddev->sync_thread)
+                        goto out_free_conf;
         }
 
         return 0;
@@ -4670,7 +4672,6 @@ read_more:
         atomic_inc(&r10_bio->remaining);
         read_bio->bi_next = NULL;
         generic_make_request(read_bio);
-        sector_nr += nr_sectors;
         sectors_done += nr_sectors;
         if (sector_nr <= last)
                 goto read_more;
diff --git a/drivers/md/raid5-log.h b/drivers/md/raid5-log.h
index bfb811407061..43c714a8798c 100644
--- a/drivers/md/raid5-log.h
+++ b/drivers/md/raid5-log.h
@@ -45,6 +45,7 @@ extern void ppl_stripe_write_finished(struct stripe_head *sh);
 extern int ppl_modify_log(struct r5conf *conf, struct md_rdev *rdev, bool add);
 extern void ppl_quiesce(struct r5conf *conf, int quiesce);
 extern int ppl_handle_flush_request(struct r5l_log *log, struct bio *bio);
+extern struct md_sysfs_entry ppl_write_hint;
 
 static inline bool raid5_has_log(struct r5conf *conf)
 {
diff --git a/drivers/md/raid5-ppl.c b/drivers/md/raid5-ppl.c
index 0b096ddc9c1e..17e9e7d51097 100644
--- a/drivers/md/raid5-ppl.c
+++ b/drivers/md/raid5-ppl.c
@@ -20,6 +20,7 @@
 #include <linux/raid/md_p.h>
 #include "md.h"
 #include "raid5.h"
+#include "raid5-log.h"
 
 /*
  * PPL consists of a 4KB header (struct ppl_header) and at least 128KB for
@@ -115,6 +116,8 @@ struct ppl_conf {
         /* stripes to retry if failed to allocate io_unit */
         struct list_head no_mem_stripes;
         spinlock_t no_mem_stripes_lock;
+
+        unsigned short write_hint;
 };
 
 struct ppl_log {
@@ -474,6 +477,7 @@ static void ppl_submit_iounit(struct ppl_io_unit *io)
         bio_set_dev(bio, log->rdev->bdev);
         bio->bi_iter.bi_sector = log->next_io_sector;
         bio_add_page(bio, io->header_page, PAGE_SIZE, 0);
+        bio->bi_write_hint = ppl_conf->write_hint;
 
         pr_debug("%s: log->current_io_sector: %llu\n", __func__,
             (unsigned long long)log->next_io_sector);
@@ -503,6 +507,7 @@ static void ppl_submit_iounit(struct ppl_io_unit *io)
                         bio = bio_alloc_bioset(GFP_NOIO, BIO_MAX_PAGES,
                                                &ppl_conf->bs);
                         bio->bi_opf = prev->bi_opf;
+                        bio->bi_write_hint = prev->bi_write_hint;
                         bio_copy_dev(bio, prev);
                         bio->bi_iter.bi_sector = bio_end_sector(prev);
                         bio_add_page(bio, sh->ppl_page, PAGE_SIZE, 0);
@@ -1407,6 +1412,7 @@ int ppl_init_log(struct r5conf *conf)
         atomic64_set(&ppl_conf->seq, 0);
         INIT_LIST_HEAD(&ppl_conf->no_mem_stripes);
         spin_lock_init(&ppl_conf->no_mem_stripes_lock);
+        ppl_conf->write_hint = RWF_WRITE_LIFE_NOT_SET;
 
         if (!mddev->external) {
                 ppl_conf->signature = ~crc32c_le(~0, mddev->uuid, sizeof(mddev->uuid));
@@ -1501,3 +1507,60 @@ int ppl_modify_log(struct r5conf *conf, struct md_rdev *rdev, bool add)
 
         return ret;
 }
+
+static ssize_t
+ppl_write_hint_show(struct mddev *mddev, char *buf)
+{
+        size_t ret = 0;
+        struct r5conf *conf;
+        struct ppl_conf *ppl_conf = NULL;
+
+        spin_lock(&mddev->lock);
+        conf = mddev->private;
+        if (conf && raid5_has_ppl(conf))
+                ppl_conf = conf->log_private;
+        ret = sprintf(buf, "%d\n", ppl_conf ? ppl_conf->write_hint : 0);
+        spin_unlock(&mddev->lock);
+
+        return ret;
+}
+
+static ssize_t
+ppl_write_hint_store(struct mddev *mddev, const char *page, size_t len)
+{
+        struct r5conf *conf;
+        struct ppl_conf *ppl_conf;
+        int err = 0;
+        unsigned short new;
+
+        if (len >= PAGE_SIZE)
+                return -EINVAL;
+        if (kstrtou16(page, 10, &new))
+                return -EINVAL;
+
+        err = mddev_lock(mddev);
+        if (err)
+                return err;
+
+        conf = mddev->private;
+        if (!conf) {
+                err = -ENODEV;
+        } else if (raid5_has_ppl(conf)) {
+                ppl_conf = conf->log_private;
+                if (!ppl_conf)
+                        err = -EINVAL;
+                else
+                        ppl_conf->write_hint = new;
+        } else {
+                err = -EINVAL;
+        }
+
+        mddev_unlock(mddev);
+
+        return err ?: len;
+}
+
+struct md_sysfs_entry
+ppl_write_hint = __ATTR(ppl_write_hint, S_IRUGO | S_IWUSR,
+                        ppl_write_hint_show,
+                        ppl_write_hint_store);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 77ffd09be486..c033bfcb209e 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -6650,6 +6650,7 @@ static struct attribute *raid5_attrs[] =  {
         &raid5_skip_copy.attr,
         &raid5_rmw_level.attr,
         &r5c_journal_mode.attr,
+        &ppl_write_hint.attr,
         NULL,
 };
 static struct attribute_group raid5_attrs_group = {
@@ -7393,6 +7394,8 @@ static int raid5_run(struct mddev *mddev)
                 set_bit(MD_RECOVERY_RUNNING, &mddev->recovery);
                 mddev->sync_thread = md_register_thread(md_do_sync, mddev,
                                                         "reshape");
+                if (!mddev->sync_thread)
+                        goto abort;
         }
 
         /* Ok, everything is just fine now */
diff --git a/drivers/mmc/host/alcor.c b/drivers/mmc/host/alcor.c
index c712b7deb3a9..82a97866e0cf 100644
--- a/drivers/mmc/host/alcor.c
+++ b/drivers/mmc/host/alcor.c
@@ -1044,14 +1044,27 @@ static void alcor_init_mmc(struct alcor_sdmmc_host *host)
         mmc->caps2 = MMC_CAP2_NO_SDIO;
         mmc->ops = &alcor_sdc_ops;
 
-        /* Hardware cannot do scatter lists */
+        /* The hardware does DMA data transfer of 4096 bytes to/from a single
+         * buffer address. Scatterlists are not supported, but upon DMA
+         * completion (signalled via IRQ), the original vendor driver does
+         * then immediately set up another DMA transfer of the next 4096
+         * bytes.
+         *
+         * This means that we need to handle the I/O in 4096 byte chunks.
+         * Lacking a way to limit the sglist entries to 4096 bytes, we instead
+         * impose that only one segment is provided, with maximum size 4096,
+         * which also happens to be the minimum size. This means that the
+         * single-entry sglist handled by this driver can be handed directly
+         * to the hardware, nice and simple.
+         *
+         * Unfortunately though, that means we only do 4096 bytes I/O per
+         * MMC command. A future improvement would be to make the driver
+         * accept sg lists and entries of any size, and simply iterate
+         * through them 4096 bytes at a time.
+         */
         mmc->max_segs = AU6601_MAX_DMA_SEGMENTS;
         mmc->max_seg_size = AU6601_MAX_DMA_BLOCK_SIZE;
-
-        mmc->max_blk_size = mmc->max_seg_size;
-        mmc->max_blk_count = mmc->max_segs;
-
-        mmc->max_req_size = mmc->max_seg_size * mmc->max_segs;
+        mmc->max_req_size = mmc->max_seg_size;
 }
 
 static int alcor_pci_sdmmc_drv_probe(struct platform_device *pdev)
diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c
index 49e0daf2ef5e..f37003df1e01 100644
--- a/drivers/mmc/host/davinci_mmc.c
+++ b/drivers/mmc/host/davinci_mmc.c
@@ -1117,7 +1117,7 @@ static inline void mmc_davinci_cpufreq_deregister(struct mmc_davinci_host *host)
 {
 }
 #endif
-static void __init init_mmcsd_host(struct mmc_davinci_host *host)
+static void init_mmcsd_host(struct mmc_davinci_host *host)
 {
 
         mmc_davinci_reset_ctrl(host, 1);
diff --git a/drivers/mmc/host/mxcmmc.c b/drivers/mmc/host/mxcmmc.c
index d54612257b06..45f7b9b53d48 100644
--- a/drivers/mmc/host/mxcmmc.c
+++ b/drivers/mmc/host/mxcmmc.c
@@ -290,11 +290,8 @@ static void mxcmci_swap_buffers(struct mmc_data *data)
         struct scatterlist *sg;
         int i;
 
-        for_each_sg(data->sg, sg, data->sg_len, i) {
-                void *buf = kmap_atomic(sg_page(sg) + sg->offset);
-                buffer_swap32(buf, sg->length);
-                kunmap_atomic(buf);
-        }
+        for_each_sg(data->sg, sg, data->sg_len, i)
+                buffer_swap32(sg_virt(sg), sg->length);
 }
 #else
 static inline void mxcmci_swap_buffers(struct mmc_data *data) {}
@@ -611,7 +608,6 @@ static int mxcmci_transfer_data(struct mxcmci_host *host)
 {
         struct mmc_data *data = host->req->data;
         struct scatterlist *sg;
-        void *buf;
         int stat, i;
 
         host->data = data;
@@ -619,18 +615,14 @@ static int mxcmci_transfer_data(struct mxcmci_host *host)
 
         if (data->flags & MMC_DATA_READ) {
                 for_each_sg(data->sg, sg, data->sg_len, i) {
-                        buf = kmap_atomic(sg_page(sg) + sg->offset);
-                        stat = mxcmci_pull(host, buf, sg->length);
-                        kunmap(buf);
+                        stat = mxcmci_pull(host, sg_virt(sg), sg->length);
                         if (stat)
                                 return stat;
                         host->datasize += sg->length;
                 }
         } else {
                 for_each_sg(data->sg, sg, data->sg_len, i) {
-                        buf = kmap_atomic(sg_page(sg) + sg->offset);
-                        stat = mxcmci_push(host, buf, sg->length);
-                        kunmap(buf);
+                        stat = mxcmci_push(host, sg_virt(sg), sg->length);
                         if (stat)
                                 return stat;
                         host->datasize += sg->length;
diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index c907bf502a12..c1d3f0e38921 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -162,7 +162,7 @@ static void pxamci_dma_irq(void *param);
 static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data)
 {
         struct dma_async_tx_descriptor *tx;
-        enum dma_data_direction direction;
+        enum dma_transfer_direction direction;
         struct dma_slave_config config;
         struct dma_chan *chan;
         unsigned int nob = data->blocks;
diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
index 71e13844df6c..8742e27e4e8b 100644
--- a/drivers/mmc/host/renesas_sdhi_core.c
+++ b/drivers/mmc/host/renesas_sdhi_core.c
@@ -641,6 +641,7 @@ int renesas_sdhi_probe(struct platform_device *pdev,
         struct renesas_sdhi *priv;
         struct resource *res;
         int irq, ret, i;
+        u16 ver;
 
         of_data = of_device_get_match_data(&pdev->dev);
 
@@ -773,12 +774,17 @@ int renesas_sdhi_probe(struct platform_device *pdev,
         if (ret)
                 goto efree;
 
+        ver = sd_ctrl_read16(host, CTL_VERSION);
+        /* GEN2_SDR104 is first known SDHI to use 32bit block count */
+        if (ver < SDHI_VER_GEN2_SDR104 && mmc_data->max_blk_count > U16_MAX)
+                mmc_data->max_blk_count = U16_MAX;
+
         ret = tmio_mmc_host_probe(host);
         if (ret < 0)
                 goto edisclk;
 
         /* One Gen2 SDHI incarnation does NOT have a CBSY bit */
-        if (sd_ctrl_read16(host, CTL_VERSION) == SDHI_VER_GEN2_SDR50)
+        if (ver == SDHI_VER_GEN2_SDR50)
                 mmc_data->flags &= ~TMIO_MMC_HAVE_CBSY;
 
         /* Enable tuning iff we have an SCC and a supported mode */
diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c
index b1a66ca3821a..5bbed477c9b1 100644
--- a/drivers/mmc/host/sdhci-omap.c
+++ b/drivers/mmc/host/sdhci-omap.c
@@ -1056,6 +1056,9 @@ static int sdhci_omap_probe(struct platform_device *pdev)
                         mmc->f_max = 48000000;
         }
 
+        if (!mmc_can_gpio_ro(mmc))
+                mmc->caps2 |= MMC_CAP2_NO_WRITE_PROTECT;
+
         pltfm_host->clk = devm_clk_get(dev, "fck");
         if (IS_ERR(pltfm_host->clk)) {
                 ret = PTR_ERR(pltfm_host->clk);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
index 370ca94b6775..b8ba74de9555 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
@@ -40,6 +40,9 @@
 #include "mlx5_core.h"
 #include "lib/eq.h"
 
+static int mlx5_core_drain_dct(struct mlx5_core_dev *dev,
+                               struct mlx5_core_dct *dct);
+
 static struct mlx5_core_rsc_common *
 mlx5_get_rsc(struct mlx5_qp_table *table, u32 rsn)
 {
@@ -227,20 +230,49 @@ static void destroy_resource_common(struct mlx5_core_dev *dev,
         wait_for_completion(&qp->common.free);
 }
 
+static int _mlx5_core_destroy_dct(struct mlx5_core_dev *dev,
+                                  struct mlx5_core_dct *dct, bool need_cleanup)
+{
+        u32 out[MLX5_ST_SZ_DW(destroy_dct_out)] = {0};
+        u32 in[MLX5_ST_SZ_DW(destroy_dct_in)]   = {0};
+        struct mlx5_core_qp *qp = &dct->mqp;
+        int err;
+
+        err = mlx5_core_drain_dct(dev, dct);
+        if (err) {
+                if (dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
+                        goto destroy;
+                } else {
+                        mlx5_core_warn(
+                                dev, "failed drain DCT 0x%x with error 0x%x\n",
+                                qp->qpn, err);
+                        return err;
+                }
+        }
+        wait_for_completion(&dct->drained);
+destroy:
+        if (need_cleanup)
+                destroy_resource_common(dev, &dct->mqp);
+        MLX5_SET(destroy_dct_in, in, opcode, MLX5_CMD_OP_DESTROY_DCT);
+        MLX5_SET(destroy_dct_in, in, dctn, qp->qpn);
+        MLX5_SET(destroy_dct_in, in, uid, qp->uid);
+        err = mlx5_cmd_exec(dev, (void *)&in, sizeof(in),
+                            (void *)&out, sizeof(out));
+        return err;
+}
+
 int mlx5_core_create_dct(struct mlx5_core_dev *dev,
                          struct mlx5_core_dct *dct,
-                         u32 *in, int inlen)
+                         u32 *in, int inlen,
+                         u32 *out, int outlen)
 {
-        u32 out[MLX5_ST_SZ_DW(create_dct_out)]   = {0};
-        u32 din[MLX5_ST_SZ_DW(destroy_dct_in)]   = {0};
-        u32 dout[MLX5_ST_SZ_DW(destroy_dct_out)] = {0};
         struct mlx5_core_qp *qp = &dct->mqp;
         int err;
 
         init_completion(&dct->drained);
         MLX5_SET(create_dct_in, in, opcode, MLX5_CMD_OP_CREATE_DCT);
 
-        err = mlx5_cmd_exec(dev, in, inlen, &out, sizeof(out));
+        err = mlx5_cmd_exec(dev, in, inlen, out, outlen);
         if (err) {
                 mlx5_core_warn(dev, "create DCT failed, ret %d\n", err);
                 return err;
@@ -254,11 +286,7 @@ int mlx5_core_create_dct(struct mlx5_core_dev *dev,
 
         return 0;
 err_cmd:
-        MLX5_SET(destroy_dct_in, din, opcode, MLX5_CMD_OP_DESTROY_DCT);
-        MLX5_SET(destroy_dct_in, din, dctn, qp->qpn);
-        MLX5_SET(destroy_dct_in, din, uid, qp->uid);
-        mlx5_cmd_exec(dev, (void *)&in, sizeof(din),
-                      (void *)&out, sizeof(dout));
+        _mlx5_core_destroy_dct(dev, dct, false);
         return err;
 }
 EXPORT_SYMBOL_GPL(mlx5_core_create_dct);
@@ -323,29 +351,7 @@ static int mlx5_core_drain_dct(struct mlx5_core_dev *dev,
 int mlx5_core_destroy_dct(struct mlx5_core_dev *dev,
                           struct mlx5_core_dct *dct)
 {
-        u32 out[MLX5_ST_SZ_DW(destroy_dct_out)] = {0};
-        u32 in[MLX5_ST_SZ_DW(destroy_dct_in)]   = {0};
-        struct mlx5_core_qp *qp = &dct->mqp;
-        int err;
-
-        err = mlx5_core_drain_dct(dev, dct);
-        if (err) {
-                if (dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
-                        goto destroy;
-                } else {
-                        mlx5_core_warn(dev, "failed drain DCT 0x%x with error 0x%x\n", qp->qpn, err);
-                        return err;
-                }
-        }
-        wait_for_completion(&dct->drained);
-destroy:
-        destroy_resource_common(dev, &dct->mqp);
-        MLX5_SET(destroy_dct_in, in, opcode, MLX5_CMD_OP_DESTROY_DCT);
-        MLX5_SET(destroy_dct_in, in, dctn, qp->qpn);
-        MLX5_SET(destroy_dct_in, in, uid, qp->uid);
-        err = mlx5_cmd_exec(dev, (void *)&in, sizeof(in),
-                            (void *)&out, sizeof(out));
-        return err;
+        return _mlx5_core_destroy_dct(dev, dct, true);
 }
 EXPORT_SYMBOL_GPL(mlx5_core_destroy_dct);
 
diff --git a/drivers/ntb/hw/intel/ntb_hw_gen1.c b/drivers/ntb/hw/intel/ntb_hw_gen1.c
index 2ad263f708da..bb57ec239029 100644
--- a/drivers/ntb/hw/intel/ntb_hw_gen1.c
+++ b/drivers/ntb/hw/intel/ntb_hw_gen1.c
@@ -180,7 +180,7 @@ int ndev_mw_to_bar(struct intel_ntb_dev *ndev, int idx)
         return ndev->reg->mw_bar[idx];
 }
 
-static inline int ndev_db_addr(struct intel_ntb_dev *ndev,
+void ndev_db_addr(struct intel_ntb_dev *ndev,
                                phys_addr_t *db_addr, resource_size_t *db_size,
                                phys_addr_t reg_addr, unsigned long reg)
 {
@@ -196,8 +196,6 @@ static inline int ndev_db_addr(struct intel_ntb_dev *ndev,
                 *db_size = ndev->reg->db_size;
                 dev_dbg(&ndev->ntb.pdev->dev, "Peer db size %llx\n", *db_size);
         }
-
-        return 0;
 }
 
 u64 ndev_db_read(struct intel_ntb_dev *ndev,
@@ -1111,13 +1109,28 @@ int intel_ntb_db_clear_mask(struct ntb_dev *ntb, u64 db_bits)
                                   ndev->self_reg->db_mask);
 }
 
-int intel_ntb_peer_db_addr(struct ntb_dev *ntb, phys_addr_t *db_addr,
-                           resource_size_t *db_size)
+static int intel_ntb_peer_db_addr(struct ntb_dev *ntb, phys_addr_t *db_addr,
+                           resource_size_t *db_size, u64 *db_data, int db_bit)
 {
+        u64 db_bits;
         struct intel_ntb_dev *ndev = ntb_ndev(ntb);
 
-        return ndev_db_addr(ndev, db_addr, db_size, ndev->peer_addr,
+        if (unlikely(db_bit >= BITS_PER_LONG_LONG))
+                return -EINVAL;
+
+        db_bits = BIT_ULL(db_bit);
+
+        if (unlikely(db_bits & ~ntb_ndev(ntb)->db_valid_mask))
+                return -EINVAL;
+
+        ndev_db_addr(ndev, db_addr, db_size, ndev->peer_addr,
                             ndev->peer_reg->db_bell);
+
+        if (db_data)
+                *db_data = db_bits;
+
+
+        return 0;
 }
 
 static int intel_ntb_peer_db_set(struct ntb_dev *ntb, u64 db_bits)
diff --git a/drivers/ntb/hw/intel/ntb_hw_gen1.h b/drivers/ntb/hw/intel/ntb_hw_gen1.h
index ad8ec1444436..544cf5c06f4d 100644
--- a/drivers/ntb/hw/intel/ntb_hw_gen1.h
+++ b/drivers/ntb/hw/intel/ntb_hw_gen1.h
@@ -147,6 +147,9 @@ extern struct intel_b2b_addr xeon_b2b_dsd_addr;
 int ndev_init_isr(struct intel_ntb_dev *ndev, int msix_min, int msix_max,
                 int msix_shift, int total_shift);
 enum ntb_topo xeon_ppd_topo(struct intel_ntb_dev *ndev, u8 ppd);
+void ndev_db_addr(struct intel_ntb_dev *ndev,
+                                phys_addr_t *db_addr, resource_size_t *db_size,
+                                phys_addr_t reg_addr, unsigned long reg);
 u64 ndev_db_read(struct intel_ntb_dev *ndev, void __iomem *mmio);
 int ndev_db_write(struct intel_ntb_dev *ndev, u64 db_bits,
                                 void __iomem *mmio);
@@ -166,8 +169,6 @@ int intel_ntb_db_vector_count(struct ntb_dev *ntb);
 u64 intel_ntb_db_vector_mask(struct ntb_dev *ntb, int db_vector);
 int intel_ntb_db_set_mask(struct ntb_dev *ntb, u64 db_bits);
 int intel_ntb_db_clear_mask(struct ntb_dev *ntb, u64 db_bits);
-int intel_ntb_peer_db_addr(struct ntb_dev *ntb, phys_addr_t *db_addr,
-                resource_size_t *db_size);
 int intel_ntb_spad_is_unsafe(struct ntb_dev *ntb);
 int intel_ntb_spad_count(struct ntb_dev *ntb);
 u32 intel_ntb_spad_read(struct ntb_dev *ntb, int idx);
diff --git a/drivers/ntb/hw/intel/ntb_hw_gen3.c b/drivers/ntb/hw/intel/ntb_hw_gen3.c
index b3fa24778f94..f475b56a3f49 100644
--- a/drivers/ntb/hw/intel/ntb_hw_gen3.c
+++ b/drivers/ntb/hw/intel/ntb_hw_gen3.c
@@ -532,6 +532,37 @@ static int intel_ntb3_mw_set_trans(struct ntb_dev *ntb, int pidx, int idx,
         return 0;
 }
 
+int intel_ntb3_peer_db_addr(struct ntb_dev *ntb, phys_addr_t *db_addr,
+                                resource_size_t *db_size,
+                                u64 *db_data, int db_bit)
+{
+        phys_addr_t db_addr_base;
+        struct intel_ntb_dev *ndev = ntb_ndev(ntb);
+
+        if (unlikely(db_bit >= BITS_PER_LONG_LONG))
+                return -EINVAL;
+
+        if (unlikely(BIT_ULL(db_bit) & ~ntb_ndev(ntb)->db_valid_mask))
+                return -EINVAL;
+
+        ndev_db_addr(ndev, &db_addr_base, db_size, ndev->peer_addr,
+                                ndev->peer_reg->db_bell);
+
+        if (db_addr) {
+                *db_addr = db_addr_base + (db_bit * 4);
+                dev_dbg(&ndev->ntb.pdev->dev, "Peer db addr %llx db bit %d\n",
+                                *db_addr, db_bit);
+        }
+
+        if (db_data) {
+                *db_data = 1;
+                dev_dbg(&ndev->ntb.pdev->dev, "Peer db data %llx db bit %d\n",
+                                *db_data, db_bit);
+        }
+
+        return 0;
+}
+
 static int intel_ntb3_peer_db_set(struct ntb_dev *ntb, u64 db_bits)
 {
         struct intel_ntb_dev *ndev = ntb_ndev(ntb);
@@ -584,7 +615,7 @@ const struct ntb_dev_ops intel_ntb3_ops = {
         .db_clear               = intel_ntb3_db_clear,
         .db_set_mask            = intel_ntb_db_set_mask,
         .db_clear_mask          = intel_ntb_db_clear_mask,
-        .peer_db_addr           = intel_ntb_peer_db_addr,
+        .peer_db_addr           = intel_ntb3_peer_db_addr,
         .peer_db_set            = intel_ntb3_peer_db_set,
         .spad_is_unsafe         = intel_ntb_spad_is_unsafe,
         .spad_count             = intel_ntb_spad_count,
diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
index f2df2d39c65b..d905d368d28c 100644
--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
@@ -236,6 +236,7 @@ static void switchtec_ntb_mw_clr_direct(struct switchtec_ntb *sndev, int idx)
         ctl_val &= ~NTB_CTRL_BAR_DIR_WIN_EN;
         iowrite32(ctl_val, &ctl->bar_entry[bar].ctl);
         iowrite32(0, &ctl->bar_entry[bar].win_size);
+        iowrite32(0, &ctl->bar_ext_entry[bar].win_size);
         iowrite64(sndev->self_partition, &ctl->bar_entry[bar].xlate_addr);
 }
 
@@ -258,7 +259,9 @@ static void switchtec_ntb_mw_set_direct(struct switchtec_ntb *sndev, int idx,
         ctl_val |= NTB_CTRL_BAR_DIR_WIN_EN;
 
         iowrite32(ctl_val, &ctl->bar_entry[bar].ctl);
-        iowrite32(xlate_pos | size, &ctl->bar_entry[bar].win_size);
+        iowrite32(xlate_pos | (lower_32_bits(size) & 0xFFFFF000),
+                  &ctl->bar_entry[bar].win_size);
+        iowrite32(upper_32_bits(size), &ctl->bar_ext_entry[bar].win_size);
         iowrite64(sndev->self_partition | addr,
                   &ctl->bar_entry[bar].xlate_addr);
 }
@@ -679,11 +682,16 @@ static u64 switchtec_ntb_db_read_mask(struct ntb_dev *ntb)
 
 static int switchtec_ntb_peer_db_addr(struct ntb_dev *ntb,
                                       phys_addr_t *db_addr,
-                                      resource_size_t *db_size)
+                                      resource_size_t *db_size,
+                                      u64 *db_data,
+                                      int db_bit)
 {
         struct switchtec_ntb *sndev = ntb_sndev(ntb);
         unsigned long offset;
 
+        if (unlikely(db_bit >= BITS_PER_LONG_LONG))
+                return -EINVAL;
+
         offset = (unsigned long)sndev->mmio_peer_dbmsg->odb -
                 (unsigned long)sndev->stdev->mmio;
 
@@ -693,6 +701,8 @@ static int switchtec_ntb_peer_db_addr(struct ntb_dev *ntb,
                 *db_addr = pci_resource_start(ntb->pdev, 0) + offset;
         if (db_size)
                 *db_size = sizeof(u32);
+        if (db_data)
+                *db_data = BIT_ULL(db_bit) << sndev->db_peer_shift;
 
         return 0;
 }
@@ -1025,7 +1035,9 @@ static int crosslink_setup_mws(struct switchtec_ntb *sndev, int ntb_lut_idx,
                 ctl_val |= NTB_CTRL_BAR_DIR_WIN_EN;
 
                 iowrite32(ctl_val, &ctl->bar_entry[bar].ctl);
-                iowrite32(xlate_pos | size, &ctl->bar_entry[bar].win_size);
+                iowrite32(xlate_pos | (lower_32_bits(size) & 0xFFFFF000),
+                          &ctl->bar_entry[bar].win_size);
+                iowrite32(upper_32_bits(size), &ctl->bar_ext_entry[bar].win_size);
                 iowrite64(sndev->peer_partition | addr,
                           &ctl->bar_entry[bar].xlate_addr);
         }
@@ -1092,7 +1104,7 @@ static int crosslink_enum_partition(struct switchtec_ntb *sndev,
 
                 dev_dbg(&sndev->stdev->dev,
                         "Crosslink BAR%d addr: %llx\n",
-                        i, bar_addr);
+                        i*2, bar_addr);
 
                 if (bar_addr != bar_space * i)
                         continue;
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 3bfdb4562408..d4f39ba1d976 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -144,7 +144,9 @@ struct ntb_transport_qp {
         struct list_head tx_free_q;
         spinlock_t ntb_tx_free_q_lock;
         void __iomem *tx_mw;
-        dma_addr_t tx_mw_phys;
+        phys_addr_t tx_mw_phys;
+        size_t tx_mw_size;
+        dma_addr_t tx_mw_dma_addr;
         unsigned int tx_index;
         unsigned int tx_max_entry;
         unsigned int tx_max_frame;
@@ -862,6 +864,9 @@ static void ntb_transport_link_cleanup(struct ntb_transport_ctx *nt)
         if (!nt->link_is_up)
                 cancel_delayed_work_sync(&nt->link_work);
 
+        for (i = 0; i < nt->mw_count; i++)
+                ntb_free_mw(nt, i);
+
         /* The scratchpad registers keep the values if the remote side
          * goes down, blast them now to give them a sane value the next
          * time they are accessed
@@ -1049,6 +1054,7 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt,
         tx_size = (unsigned int)mw_size / num_qps_mw;
         qp_offset = tx_size * (qp_num / mw_count);
 
+        qp->tx_mw_size = tx_size;
         qp->tx_mw = nt->mw_vec[mw_num].vbase + qp_offset;
         if (!qp->tx_mw)
                 return -EINVAL;
@@ -1644,7 +1650,7 @@ static int ntb_async_tx_submit(struct ntb_transport_qp *qp,
         dma_cookie_t cookie;
 
         device = chan->device;
-        dest = qp->tx_mw_phys + qp->tx_max_frame * entry->tx_index;
+        dest = qp->tx_mw_dma_addr + qp->tx_max_frame * entry->tx_index;
         buff_off = (size_t)buf & ~PAGE_MASK;
         dest_off = (size_t)dest & ~PAGE_MASK;
 
@@ -1863,6 +1869,18 @@ ntb_transport_create_queue(void *data, struct device *client_dev,
                 qp->rx_dma_chan = NULL;
         }
 
+        if (qp->tx_dma_chan) {
+                qp->tx_mw_dma_addr =
+                        dma_map_resource(qp->tx_dma_chan->device->dev,
+                                         qp->tx_mw_phys, qp->tx_mw_size,
+                                         DMA_FROM_DEVICE, 0);
+                if (dma_mapping_error(qp->tx_dma_chan->device->dev,
+                                      qp->tx_mw_dma_addr)) {
+                        qp->tx_mw_dma_addr = 0;
+                        goto err1;
+                }
+        }
+
         dev_dbg(&pdev->dev, "Using %s memcpy for TX\n",
                 qp->tx_dma_chan ? "DMA" : "CPU");
 
@@ -1904,6 +1922,10 @@ err1:
         qp->rx_alloc_entry = 0;
         while ((entry = ntb_list_rm(&qp->ntb_rx_q_lock, &qp->rx_free_q)))
                 kfree(entry);
+        if (qp->tx_mw_dma_addr)
+                dma_unmap_resource(qp->tx_dma_chan->device->dev,
+                                   qp->tx_mw_dma_addr, qp->tx_mw_size,
+                                   DMA_FROM_DEVICE, 0);
         if (qp->tx_dma_chan)
                 dma_release_channel(qp->tx_dma_chan);
         if (qp->rx_dma_chan)
@@ -1945,6 +1967,11 @@ void ntb_transport_free_queue(struct ntb_transport_qp *qp)
                  */
                 dma_sync_wait(chan, qp->last_cookie);
                 dmaengine_terminate_all(chan);
+
+                dma_unmap_resource(chan->device->dev,
+                                   qp->tx_mw_dma_addr, qp->tx_mw_size,
+                                   DMA_FROM_DEVICE, 0);
+
                 dma_release_channel(chan);
         }
 
diff --git a/drivers/nvdimm/e820.c b/drivers/nvdimm/e820.c
index 521eaf53a52a..36be9b619187 100644
--- a/drivers/nvdimm/e820.c
+++ b/drivers/nvdimm/e820.c
@@ -47,6 +47,7 @@ static int e820_register_one(struct resource *res, void *data)
         ndr_desc.res = res;
         ndr_desc.attr_groups = e820_pmem_region_attribute_groups;
         ndr_desc.numa_node = e820_range_to_nid(res->start);
+        ndr_desc.target_node = ndr_desc.numa_node;
         set_bit(ND_REGION_PAGEMAP, &ndr_desc.flags);
         if (!nvdimm_pmem_region_create(nvdimm_bus, &ndr_desc))
                 return -ENXIO;
diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h
index 379bf4305e61..a5ac3b240293 100644
--- a/drivers/nvdimm/nd.h
+++ b/drivers/nvdimm/nd.h
@@ -153,7 +153,7 @@ struct nd_region {
         u16 ndr_mappings;
         u64 ndr_size;
         u64 ndr_start;
-        int id, num_lanes, ro, numa_node;
+        int id, num_lanes, ro, numa_node, target_node;
         void *provider_data;
         struct kernfs_node *bb_state;
         struct badblocks bb;
diff --git a/drivers/nvdimm/of_pmem.c b/drivers/nvdimm/of_pmem.c
index 11b9821eba85..a0c8dcfa0bf9 100644
--- a/drivers/nvdimm/of_pmem.c
+++ b/drivers/nvdimm/of_pmem.c
@@ -68,6 +68,7 @@ static int of_pmem_region_probe(struct platform_device *pdev)
                 memset(&ndr_desc, 0, sizeof(ndr_desc));
                 ndr_desc.attr_groups = region_attr_groups;
                 ndr_desc.numa_node = dev_to_node(&pdev->dev);
+                ndr_desc.target_node = ndr_desc.numa_node;
                 ndr_desc.res = &pdev->resource[i];
                 ndr_desc.of_node = np;
                 set_bit(ND_REGION_PAGEMAP, &ndr_desc.flags);
diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
index 3b58baa44b5c..b4ef7d9ff22e 100644
--- a/drivers/nvdimm/region_devs.c
+++ b/drivers/nvdimm/region_devs.c
@@ -1072,6 +1072,7 @@ static struct nd_region *nd_region_create(struct nvdimm_bus *nvdimm_bus,
         nd_region->flags = ndr_desc->flags;
         nd_region->ro = ro;
         nd_region->numa_node = ndr_desc->numa_node;
+        nd_region->target_node = ndr_desc->target_node;
         ida_init(&nd_region->ns_ida);
         ida_init(&nd_region->btt_ida);
         ida_init(&nd_region->pfn_ida);
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 07bf2bff3a76..470601980794 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -179,8 +179,8 @@ static int nvme_delete_ctrl_sync(struct nvme_ctrl *ctrl)
         int ret = 0;
 
         /*
-         * Keep a reference until the work is flushed since ->delete_ctrl
-         * can free the controller.
+         * Keep a reference until nvme_do_delete_ctrl() complete,
+         * since ->delete_ctrl can free the controller.
          */
         nvme_get_ctrl(ctrl);
         if (!nvme_change_ctrl_state(ctrl, NVME_CTRL_DELETING))
@@ -1250,7 +1250,7 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
         if (ns) {
                 if (ctrl->effects)
                         effects = le32_to_cpu(ctrl->effects->iocs[opcode]);
-                if (effects & ~NVME_CMD_EFFECTS_CSUPP)
+                if (effects & ~(NVME_CMD_EFFECTS_CSUPP | NVME_CMD_EFFECTS_LBCC))
                         dev_warn(ctrl->device,
                                  "IO command:%02x has unhandled effects:%08x\n",
                                  opcode, effects);
@@ -1495,10 +1495,10 @@ static void nvme_set_chunk_size(struct nvme_ns *ns)
         blk_queue_chunk_sectors(ns->queue, rounddown_pow_of_two(chunk_size));
 }
 
-static void nvme_config_discard(struct nvme_ns *ns)
+static void nvme_config_discard(struct gendisk *disk, struct nvme_ns *ns)
 {
         struct nvme_ctrl *ctrl = ns->ctrl;
-        struct request_queue *queue = ns->queue;
+        struct request_queue *queue = disk->queue;
         u32 size = queue_logical_block_size(queue);
 
         if (!(ctrl->oncs & NVME_CTRL_ONCS_DSM)) {
@@ -1526,12 +1526,13 @@ static void nvme_config_discard(struct nvme_ns *ns)
                 blk_queue_max_write_zeroes_sectors(queue, UINT_MAX);
 }
 
-static inline void nvme_config_write_zeroes(struct nvme_ns *ns)
+static void nvme_config_write_zeroes(struct gendisk *disk, struct nvme_ns *ns)
 {
         u32 max_sectors;
         unsigned short bs = 1 << ns->lba_shift;
 
-        if (!(ns->ctrl->oncs & NVME_CTRL_ONCS_WRITE_ZEROES))
+        if (!(ns->ctrl->oncs & NVME_CTRL_ONCS_WRITE_ZEROES) ||
+            (ns->ctrl->quirks & NVME_QUIRK_DISABLE_WRITE_ZEROES))
                 return;
         /*
          * Even though NVMe spec explicitly states that MDTS is not
@@ -1548,13 +1549,7 @@ static inline void nvme_config_write_zeroes(struct nvme_ns *ns)
         else
                 max_sectors = ((u32)(ns->ctrl->max_hw_sectors + 1) * bs) >> 9;
 
-        blk_queue_max_write_zeroes_sectors(ns->queue, max_sectors);
-}
-
-static inline void nvme_ns_config_oncs(struct nvme_ns *ns)
-{
-        nvme_config_discard(ns);
-        nvme_config_write_zeroes(ns);
+        blk_queue_max_write_zeroes_sectors(disk->queue, max_sectors);
 }
 
 static void nvme_report_ns_ids(struct nvme_ctrl *ctrl, unsigned int nsid,
@@ -1610,7 +1605,9 @@ static void nvme_update_disk_info(struct gendisk *disk,
                 capacity = 0;
 
         set_capacity(disk, capacity);
-        nvme_ns_config_oncs(ns);
+
+        nvme_config_discard(disk, ns);
+        nvme_config_write_zeroes(disk, ns);
 
         if (id->nsattr & (1 << 0))
                 set_disk_ro(disk, true);
@@ -3304,6 +3301,7 @@ static int nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
         mutex_lock(&ctrl->subsys->lock);
         list_del_rcu(&ns->siblings);
         mutex_unlock(&ctrl->subsys->lock);
+        nvme_put_ns_head(ns->head);
  out_free_id:
         kfree(id);
  out_free_queue:
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index b29b12498a1a..f3b9d91ba0df 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -2107,7 +2107,7 @@ nvme_fc_map_data(struct nvme_fc_ctrl *ctrl, struct request *rq,
 
         freq->sg_cnt = 0;
 
-        if (!blk_rq_payload_bytes(rq))
+        if (!blk_rq_nr_phys_segments(rq))
                 return 0;
 
         freq->sg_table.sgl = freq->first_sgl;
@@ -2304,12 +2304,23 @@ nvme_fc_queue_rq(struct blk_mq_hw_ctx *hctx,
         if (ret)
                 return ret;
 
-        data_len = blk_rq_payload_bytes(rq);
-        if (data_len)
+        /*
+         * nvme core doesn't quite treat the rq opaquely. Commands such
+         * as WRITE ZEROES will return a non-zero rq payload_bytes yet
+         * there is no actual payload to be transferred.
+         * To get it right, key data transmission on there being 1 or
+         * more physical segments in the sg list. If there is no
+         * physical segments, there is no payload.
+         */
+        if (blk_rq_nr_phys_segments(rq)) {
+                data_len = blk_rq_payload_bytes(rq);
                 io_dir = ((rq_data_dir(rq) == WRITE) ?
                                         NVMEFC_FCP_WRITE : NVMEFC_FCP_READ);
-        else
+        } else {
+                data_len = 0;
                 io_dir = NVMEFC_FCP_NODATA;
+        }
+
 
         return nvme_fc_start_fcp_op(ctrl, queue, op, data_len, io_dir);
 }
@@ -2464,6 +2475,7 @@ static int
 nvme_fc_recreate_io_queues(struct nvme_fc_ctrl *ctrl)
 {
         struct nvmf_ctrl_options *opts = ctrl->ctrl.opts;
+        u32 prior_ioq_cnt = ctrl->ctrl.queue_count - 1;
         unsigned int nr_io_queues;
         int ret;
 
@@ -2476,6 +2488,13 @@ nvme_fc_recreate_io_queues(struct nvme_fc_ctrl *ctrl)
                 return ret;
         }
 
+        if (!nr_io_queues && prior_ioq_cnt) {
+                dev_info(ctrl->ctrl.device,
+                        "Fail Reconnect: At least 1 io queue "
+                        "required (was %d)\n", prior_ioq_cnt);
+                return -ENOSPC;
+        }
+
         ctrl->ctrl.queue_count = nr_io_queues + 1;
         /* check for io queues existing */
         if (ctrl->ctrl.queue_count == 1)
@@ -2489,6 +2508,10 @@ nvme_fc_recreate_io_queues(struct nvme_fc_ctrl *ctrl)
         if (ret)
                 goto out_delete_hw_queues;
 
+        if (prior_ioq_cnt != nr_io_queues)
+                dev_info(ctrl->ctrl.device,
+                        "reconnect: revising io queue count from %d to %d\n",
+                        prior_ioq_cnt, nr_io_queues);
         blk_mq_update_nr_hw_queues(&ctrl->tag_set, nr_io_queues);
 
         return 0;
@@ -3006,7 +3029,10 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
 
         ctrl->ctrl.opts = opts;
         ctrl->ctrl.nr_reconnects = 0;
-        ctrl->ctrl.numa_node = dev_to_node(lport->dev);
+        if (lport->dev)
+                ctrl->ctrl.numa_node = dev_to_node(lport->dev);
+        else
+                ctrl->ctrl.numa_node = NUMA_NO_NODE;
         INIT_LIST_HEAD(&ctrl->ctrl_list);
         ctrl->lport = lport;
         ctrl->rport = rport;
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index b91f1838bbd5..527d64545023 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -87,6 +87,11 @@ enum nvme_quirks {
          * Ignore device provided subnqn.
          */
         NVME_QUIRK_IGNORE_DEV_SUBNQN            = (1 << 8),
+
+        /*
+         * Broken Write Zeroes.
+         */
+        NVME_QUIRK_DISABLE_WRITE_ZEROES         = (1 << 9),
 };
 
 /*
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 92bad1c810ac..a90cf5d63aac 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2937,7 +2937,8 @@ static const struct pci_device_id nvme_id_table[] = {
         { PCI_VDEVICE(INTEL, 0xf1a6),   /* Intel 760p/Pro 7600p */
                 .driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, },
         { PCI_VDEVICE(INTEL, 0x5845),   /* Qemu emulated controller */
-                .driver_data = NVME_QUIRK_IDENTIFY_CNS, },
+                .driver_data = NVME_QUIRK_IDENTIFY_CNS |
+                                NVME_QUIRK_DISABLE_WRITE_ZEROES, },
         { PCI_DEVICE(0x1bb1, 0x0100),   /* Seagate Nytro Flash Storage */
                 .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
         { PCI_DEVICE(0x1c58, 0x0003),   /* HGST adapter */
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 208ee518af65..e7e08889865e 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -463,6 +463,15 @@ static int nvme_tcp_handle_c2h_data(struct nvme_tcp_queue *queue,
 
         queue->data_remaining = le32_to_cpu(pdu->data_length);
 
+        if (pdu->hdr.flags & NVME_TCP_F_DATA_SUCCESS &&
+            unlikely(!(pdu->hdr.flags & NVME_TCP_F_DATA_LAST))) {
+                dev_err(queue->ctrl->ctrl.device,
+                        "queue %d tag %#x SUCCESS set but not last PDU\n",
+                        nvme_tcp_queue_id(queue), rq->tag);
+                nvme_tcp_error_recovery(&queue->ctrl->ctrl);
+                return -EPROTO;
+        }
+
         return 0;
 
 }
@@ -618,6 +627,14 @@ static int nvme_tcp_recv_pdu(struct nvme_tcp_queue *queue, struct sk_buff *skb,
         return ret;
 }
 
+static inline void nvme_tcp_end_request(struct request *rq, __le16 status)
+{
+        union nvme_result res = {};
+
+        nvme_end_request(rq, cpu_to_le16(status << 1), res);
+}
+
+
 static int nvme_tcp_recv_data(struct nvme_tcp_queue *queue, struct sk_buff *skb,
                               unsigned int *offset, size_t *len)
 {
@@ -685,6 +702,8 @@ static int nvme_tcp_recv_data(struct nvme_tcp_queue *queue, struct sk_buff *skb,
                         nvme_tcp_ddgst_final(queue->rcv_hash, &queue->exp_ddgst);
                         queue->ddgst_remaining = NVME_TCP_DIGEST_LENGTH;
                 } else {
+                        if (pdu->hdr.flags & NVME_TCP_F_DATA_SUCCESS)
+                                nvme_tcp_end_request(rq, NVME_SC_SUCCESS);
                         nvme_tcp_init_recv_ctx(queue);
                 }
         }
@@ -695,6 +714,7 @@ static int nvme_tcp_recv_data(struct nvme_tcp_queue *queue, struct sk_buff *skb,
 static int nvme_tcp_recv_ddgst(struct nvme_tcp_queue *queue,
                 struct sk_buff *skb, unsigned int *offset, size_t *len)
 {
+        struct nvme_tcp_data_pdu *pdu = (void *)queue->pdu;
         char *ddgst = (char *)&queue->recv_ddgst;
         size_t recv_len = min_t(size_t, *len, queue->ddgst_remaining);
         off_t off = NVME_TCP_DIGEST_LENGTH - queue->ddgst_remaining;
@@ -718,6 +738,13 @@ static int nvme_tcp_recv_ddgst(struct nvme_tcp_queue *queue,
                 return -EIO;
         }
 
+        if (pdu->hdr.flags & NVME_TCP_F_DATA_SUCCESS) {
+                struct request *rq = blk_mq_tag_to_rq(nvme_tcp_tagset(queue),
+                                                pdu->command_id);
+
+                nvme_tcp_end_request(rq, NVME_SC_SUCCESS);
+        }
+
         nvme_tcp_init_recv_ctx(queue);
         return 0;
 }
@@ -815,10 +842,7 @@ static inline void nvme_tcp_done_send_req(struct nvme_tcp_queue *queue)
 
 static void nvme_tcp_fail_request(struct nvme_tcp_request *req)
 {
-        union nvme_result res = {};
-
-        nvme_end_request(blk_mq_rq_from_pdu(req),
-                cpu_to_le16(NVME_SC_DATA_XFER_ERROR), res);
+        nvme_tcp_end_request(blk_mq_rq_from_pdu(req), NVME_SC_DATA_XFER_ERROR);
 }
 
 static int nvme_tcp_try_send_data(struct nvme_tcp_request *req)
diff --git a/drivers/nvme/host/trace.c b/drivers/nvme/host/trace.c
index 58456de78bb2..5f24ea7a28eb 100644
--- a/drivers/nvme/host/trace.c
+++ b/drivers/nvme/host/trace.c
@@ -50,7 +50,19 @@ static const char *nvme_trace_admin_identify(struct trace_seq *p, u8 *cdw10)
         return ret;
 }
 
+static const char *nvme_trace_admin_get_features(struct trace_seq *p,
+                                                 u8 *cdw10)
+{
+        const char *ret = trace_seq_buffer_ptr(p);
+        u8 fid = cdw10[0];
+        u8 sel = cdw10[1] & 0x7;
+        u32 cdw11 = get_unaligned_le32(cdw10 + 4);
+
+        trace_seq_printf(p, "fid=0x%x sel=0x%x cdw11=0x%x", fid, sel, cdw11);
+        trace_seq_putc(p, 0);
 
+        return ret;
+}
 
 static const char *nvme_trace_read_write(struct trace_seq *p, u8 *cdw10)
 {
@@ -101,6 +113,8 @@ const char *nvme_trace_parse_admin_cmd(struct trace_seq *p,
                 return nvme_trace_create_cq(p, cdw10);
         case nvme_admin_identify:
                 return nvme_trace_admin_identify(p, cdw10);
+        case nvme_admin_get_features:
+                return nvme_trace_admin_get_features(p, cdw10);
         default:
                 return nvme_trace_common(p, cdw10);
         }
diff --git a/drivers/nvme/host/trace.h b/drivers/nvme/host/trace.h
index 244d7c177e5a..97d3c77365b8 100644
--- a/drivers/nvme/host/trace.h
+++ b/drivers/nvme/host/trace.h
@@ -108,7 +108,7 @@ TRACE_EVENT(nvme_setup_cmd,
                 __entry->metadata = le64_to_cpu(cmd->common.metadata);
                 __assign_disk_name(__entry->disk, req->rq_disk);
                 memcpy(__entry->cdw10, &cmd->common.cdw10,
-                        6 * sizeof(__entry->cdw10));
+                        sizeof(__entry->cdw10));
             ),
             TP_printk("nvme%d: %sqid=%d, cmdid=%u, nsid=%u, flags=0x%x, meta=0x%llx, cmd=(%s %s)",
                       __entry->ctrl_id, __print_disk_name(__entry->disk),
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index d44ede147263..2d73b66e3686 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -1163,6 +1163,15 @@ static void nvmet_release_p2p_ns_map(struct nvmet_ctrl *ctrl)
         put_device(ctrl->p2p_client);
 }
 
+static void nvmet_fatal_error_handler(struct work_struct *work)
+{
+        struct nvmet_ctrl *ctrl =
+                        container_of(work, struct nvmet_ctrl, fatal_err_work);
+
+        pr_err("ctrl %d fatal error occurred!\n", ctrl->cntlid);
+        ctrl->ops->delete_ctrl(ctrl);
+}
+
 u16 nvmet_alloc_ctrl(const char *subsysnqn, const char *hostnqn,
                 struct nvmet_req *req, u32 kato, struct nvmet_ctrl **ctrlp)
 {
@@ -1205,6 +1214,7 @@ u16 nvmet_alloc_ctrl(const char *subsysnqn, const char *hostnqn,
         INIT_WORK(&ctrl->async_event_work, nvmet_async_event_work);
         INIT_LIST_HEAD(&ctrl->async_events);
         INIT_RADIX_TREE(&ctrl->p2p_ns_map, GFP_KERNEL);
+        INIT_WORK(&ctrl->fatal_err_work, nvmet_fatal_error_handler);
 
         memcpy(ctrl->subsysnqn, subsysnqn, NVMF_NQN_SIZE);
         memcpy(ctrl->hostnqn, hostnqn, NVMF_NQN_SIZE);
@@ -1308,21 +1318,11 @@ void nvmet_ctrl_put(struct nvmet_ctrl *ctrl)
         kref_put(&ctrl->ref, nvmet_ctrl_free);
 }
 
-static void nvmet_fatal_error_handler(struct work_struct *work)
-{
-        struct nvmet_ctrl *ctrl =
-                        container_of(work, struct nvmet_ctrl, fatal_err_work);
-
-        pr_err("ctrl %d fatal error occurred!\n", ctrl->cntlid);
-        ctrl->ops->delete_ctrl(ctrl);
-}
-
 void nvmet_ctrl_fatal_error(struct nvmet_ctrl *ctrl)
 {
         mutex_lock(&ctrl->lock);
         if (!(ctrl->csts & NVME_CSTS_CFS)) {
                 ctrl->csts |= NVME_CSTS_CFS;
-                INIT_WORK(&ctrl->fatal_err_work, nvmet_fatal_error_handler);
                 schedule_work(&ctrl->fatal_err_work);
         }
         mutex_unlock(&ctrl->lock);
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 1e9654f04c60..98b7b1f4ee96 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -1143,10 +1143,8 @@ __nvmet_fc_free_assocs(struct nvmet_fc_tgtport *tgtport)
                                 &tgtport->assoc_list, a_list) {
                 if (!nvmet_fc_tgt_a_get(assoc))
                         continue;
-                spin_unlock_irqrestore(&tgtport->lock, flags);
-                nvmet_fc_delete_target_assoc(assoc);
-                nvmet_fc_tgt_a_put(assoc);
-                spin_lock_irqsave(&tgtport->lock, flags);
+                if (!schedule_work(&assoc->del_work))
+                        nvmet_fc_tgt_a_put(assoc);
         }
         spin_unlock_irqrestore(&tgtport->lock, flags);
 }
@@ -1185,7 +1183,8 @@ nvmet_fc_delete_ctrl(struct nvmet_ctrl *ctrl)
                 nvmet_fc_tgtport_put(tgtport);
 
                 if (found_ctrl) {
-                        schedule_work(&assoc->del_work);
+                        if (!schedule_work(&assoc->del_work))
+                                nvmet_fc_tgt_a_put(assoc);
                         return;
                 }
 
@@ -1503,10 +1502,8 @@ nvmet_fc_ls_disconnect(struct nvmet_fc_tgtport *tgtport,
                         (struct fcnvme_ls_disconnect_rqst *)iod->rqstbuf;
         struct fcnvme_ls_disconnect_acc *acc =
                         (struct fcnvme_ls_disconnect_acc *)iod->rspbuf;
-        struct nvmet_fc_tgt_queue *queue = NULL;
         struct nvmet_fc_tgt_assoc *assoc;
         int ret = 0;
-        bool del_assoc = false;
 
         memset(acc, 0, sizeof(*acc));
 
@@ -1537,18 +1534,7 @@ nvmet_fc_ls_disconnect(struct nvmet_fc_tgtport *tgtport,
                 assoc = nvmet_fc_find_target_assoc(tgtport,
                                 be64_to_cpu(rqst->associd.association_id));
                 iod->assoc = assoc;
-                if (assoc) {
-                        if (rqst->discon_cmd.scope ==
-                                        FCNVME_DISCONN_CONNECTION) {
-                                queue = nvmet_fc_find_target_queue(tgtport,
-                                                be64_to_cpu(
-                                                        rqst->discon_cmd.id));
-                                if (!queue) {
-                                        nvmet_fc_tgt_a_put(assoc);
-                                        ret = VERR_NO_CONN;
-                                }
-                        }
-                } else
+                if (!assoc)
                         ret = VERR_NO_ASSOC;
         }
 
@@ -1576,26 +1562,10 @@ nvmet_fc_ls_disconnect(struct nvmet_fc_tgtport *tgtport,
                                 sizeof(struct fcnvme_ls_disconnect_acc)),
                         FCNVME_LS_DISCONNECT);
 
-
-        /* are we to delete a Connection ID (queue) */
-        if (queue) {
-                int qid = queue->qid;
-
-                nvmet_fc_delete_target_queue(queue);
-
-                /* release the get taken by find_target_queue */
-                nvmet_fc_tgt_q_put(queue);
-
-                /* tear association down if io queue terminated */
-                if (!qid)
-                        del_assoc = true;
-        }
-
         /* release get taken in nvmet_fc_find_target_assoc */
         nvmet_fc_tgt_a_put(iod->assoc);
 
-        if (del_assoc)
-                nvmet_fc_delete_target_assoc(iod->assoc);
+        nvmet_fc_delete_target_assoc(iod->assoc);
 }
 
 
diff --git a/drivers/nvme/target/io-cmd-bdev.c b/drivers/nvme/target/io-cmd-bdev.c
index 71dfedbadc26..a065dbfc43b1 100644
--- a/drivers/nvme/target/io-cmd-bdev.c
+++ b/drivers/nvme/target/io-cmd-bdev.c
@@ -194,11 +194,11 @@ static u16 nvmet_bdev_discard_range(struct nvmet_req *req,
                         le64_to_cpu(range->slba) << (ns->blksize_shift - 9),
                         le32_to_cpu(range->nlb) << (ns->blksize_shift - 9),
                         GFP_KERNEL, 0, bio);
-
-        if (ret)
+        if (ret && ret != -EOPNOTSUPP) {
                 req->error_slba = le64_to_cpu(range->slba);
-
-        return blk_to_nvme_status(req, errno_to_blk_status(ret));
+                return blk_to_nvme_status(req, errno_to_blk_status(ret));
+        }
+        return NVME_SC_SUCCESS;
 }
 
 static void nvmet_bdev_execute_discard(struct nvmet_req *req)
diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c
index 517522305e5c..3e43212d3c1c 100644
--- a/drivers/nvme/target/io-cmd-file.c
+++ b/drivers/nvme/target/io-cmd-file.c
@@ -297,7 +297,7 @@ static void nvmet_file_execute_discard(struct nvmet_req *req)
                 }
 
                 ret = vfs_fallocate(req->ns->file, mode, offset, len);
-                if (ret) {
+                if (ret && ret != -EOPNOTSUPP) {
                         req->error_slba = le64_to_cpu(range.slba);
                         status = errno_to_nvme_status(req, ret);
                         break;
diff --git a/drivers/parport/daisy.c b/drivers/parport/daisy.c
index 56dd83a45e55..5484a46dafda 100644
--- a/drivers/parport/daisy.c
+++ b/drivers/parport/daisy.c
@@ -213,12 +213,10 @@ void parport_daisy_fini(struct parport *port)
 struct pardevice *parport_open(int devnum, const char *name)
 {
         struct daisydev *p = topology;
-        struct pardev_cb par_cb;
         struct parport *port;
         struct pardevice *dev;
         int daisy;
 
-        memset(&par_cb, 0, sizeof(par_cb));
         spin_lock(&topology_lock);
         while (p && p->devnum != devnum)
                 p = p->next;
@@ -232,7 +230,7 @@ struct pardevice *parport_open(int devnum, const char *name)
         port = parport_get_port(p->port);
         spin_unlock(&topology_lock);
 
-        dev = parport_register_dev_model(port, name, &par_cb, devnum);
+        dev = parport_register_device(port, name, NULL, NULL, NULL, 0, NULL);
         parport_put_port(port);
         if (!dev)
                 return NULL;
@@ -482,31 +480,3 @@ static int assign_addrs(struct parport *port)
         kfree(deviceid);
         return detected;
 }
-
-static int daisy_drv_probe(struct pardevice *par_dev)
-{
-        struct device_driver *drv = par_dev->dev.driver;
-
-        if (strcmp(drv->name, "daisy_drv"))
-                return -ENODEV;
-        if (strcmp(par_dev->name, daisy_dev_name))
-                return -ENODEV;
-
-        return 0;
-}
-
-static struct parport_driver daisy_driver = {
-        .name = "daisy_drv",
-        .probe = daisy_drv_probe,
-        .devmodel = true,
-};
-
-int daisy_drv_init(void)
-{
-        return parport_register_driver(&daisy_driver);
-}
-
-void daisy_drv_exit(void)
-{
-        parport_unregister_driver(&daisy_driver);
-}
diff --git a/drivers/parport/probe.c b/drivers/parport/probe.c
index e5e6a463a941..e035174ba205 100644
--- a/drivers/parport/probe.c
+++ b/drivers/parport/probe.c
@@ -257,7 +257,7 @@ static ssize_t parport_read_device_id (struct parport *port, char *buffer,
 ssize_t parport_device_id (int devnum, char *buffer, size_t count)
 {
         ssize_t retval = -ENXIO;
-        struct pardevice *dev = parport_open(devnum, daisy_dev_name);
+        struct pardevice *dev = parport_open (devnum, "Device ID probe");
         if (!dev)
                 return -ENXIO;
 
diff --git a/drivers/parport/share.c b/drivers/parport/share.c
index 0171b8dbcdcd..5dc53d420ca8 100644
--- a/drivers/parport/share.c
+++ b/drivers/parport/share.c
@@ -137,19 +137,11 @@ static struct bus_type parport_bus_type = {
 
 int parport_bus_init(void)
 {
-        int retval;
-
-        retval = bus_register(&parport_bus_type);
-        if (retval)
-                return retval;
-        daisy_drv_init();
-
-        return 0;
+        return bus_register(&parport_bus_type);
 }
 
 void parport_bus_exit(void)
 {
-        daisy_drv_exit();
         bus_unregister(&parport_bus_type);
 }
 
diff --git a/drivers/platform/chrome/cros_ec_debugfs.c b/drivers/platform/chrome/cros_ec_debugfs.c
index 900c7073c46f..71308766e891 100644
--- a/drivers/platform/chrome/cros_ec_debugfs.c
+++ b/drivers/platform/chrome/cros_ec_debugfs.c
@@ -440,7 +440,7 @@ static int cros_ec_debugfs_probe(struct platform_device *pd)
 
         ret = cros_ec_create_pdinfo(debug_info);
         if (ret)
-                goto remove_debugfs;
+                goto remove_log;
 
         ec->debug_info = debug_info;
 
@@ -448,6 +448,8 @@ static int cros_ec_debugfs_probe(struct platform_device *pd)
 
         return 0;
 
+remove_log:
+        cros_ec_cleanup_console_log(debug_info);
 remove_debugfs:
         debugfs_remove_recursive(debug_info->dir);
         return ret;
@@ -467,7 +469,8 @@ static int __maybe_unused cros_ec_debugfs_suspend(struct device *dev)
 {
         struct cros_ec_dev *ec = dev_get_drvdata(dev);
 
-        cancel_delayed_work_sync(&ec->debug_info->log_poll_work);
+        if (ec->debug_info->log_buffer.buf)
+                cancel_delayed_work_sync(&ec->debug_info->log_poll_work);
 
         return 0;
 }
@@ -476,7 +479,8 @@ static int __maybe_unused cros_ec_debugfs_resume(struct device *dev)
 {
         struct cros_ec_dev *ec = dev_get_drvdata(dev);
 
-        schedule_delayed_work(&ec->debug_info->log_poll_work, 0);
+        if (ec->debug_info->log_buffer.buf)
+                schedule_delayed_work(&ec->debug_info->log_poll_work, 0);
 
         return 0;
 }
diff --git a/drivers/platform/chrome/wilco_ec/mailbox.c b/drivers/platform/chrome/wilco_ec/mailbox.c
index f6ff29a11f1a..14355668ddfa 100644
--- a/drivers/platform/chrome/wilco_ec/mailbox.c
+++ b/drivers/platform/chrome/wilco_ec/mailbox.c
@@ -223,11 +223,11 @@ int wilco_ec_mailbox(struct wilco_ec_device *ec, struct wilco_ec_message *msg)
                 msg->command, msg->type, msg->flags, msg->response_size,
                 msg->request_size);
 
+        mutex_lock(&ec->mailbox_lock);
         /* Prepare request packet */
         rq = ec->data_buffer;
         wilco_ec_prepare(msg, rq);
 
-        mutex_lock(&ec->mailbox_lock);
         ret = wilco_ec_transfer(ec, msg, rq);
         mutex_unlock(&ec->mailbox_lock);
 
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index a0baee25134c..4159c63a5fd2 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -1382,3 +1382,40 @@ int chsc_pnso_brinfo(struct subchannel_id schid,
         return chsc_error_from_response(brinfo_area->response.code);
 }
 EXPORT_SYMBOL_GPL(chsc_pnso_brinfo);
+
+int chsc_sgib(u32 origin)
+{
+        struct {
+                struct chsc_header request;
+                u16 op;
+                u8  reserved01[2];
+                u8  reserved02:4;
+                u8  fmt:4;
+                u8  reserved03[7];
+                /* operation data area begin */
+                u8  reserved04[4];
+                u32 gib_origin;
+                u8  reserved05[10];
+                u8  aix;
+                u8  reserved06[4029];
+                struct chsc_header response;
+                u8  reserved07[4];
+        } *sgib_area;
+        int ret;
+
+        spin_lock_irq(&chsc_page_lock);
+        memset(chsc_page, 0, PAGE_SIZE);
+        sgib_area = chsc_page;
+        sgib_area->request.length = 0x0fe0;
+        sgib_area->request.code = 0x0021;
+        sgib_area->op = 0x1;
+        sgib_area->gib_origin = origin;
+
+        ret = chsc(sgib_area);
+        if (ret == 0)
+                ret = chsc_error_from_response(sgib_area->response.code);
+        spin_unlock_irq(&chsc_page_lock);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(chsc_sgib);
diff --git a/drivers/s390/cio/chsc.h b/drivers/s390/cio/chsc.h
index 78aba8d94eec..e57d68e325a3 100644
--- a/drivers/s390/cio/chsc.h
+++ b/drivers/s390/cio/chsc.h
@@ -164,6 +164,7 @@ int chsc_get_channel_measurement_chars(struct channel_path *chp);
 int chsc_ssqd(struct subchannel_id schid, struct chsc_ssqd_area *ssqd);
 int chsc_sadc(struct subchannel_id schid, struct chsc_scssc_area *scssc,
               u64 summary_indicator_addr, u64 subchannel_indicator_addr);
+int chsc_sgib(u32 origin);
 int chsc_error_from_response(int response);
 
 int chsc_siosl(struct subchannel_id schid);
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index a45f81ec80ce..8e28a505f7e8 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -413,13 +413,16 @@ static int aac_slave_configure(struct scsi_device *sdev)
         if (chn < AAC_MAX_BUSES && tid < AAC_MAX_TARGETS && aac->sa_firmware) {
                 devtype = aac->hba_map[chn][tid].devtype;
 
-                if (devtype == AAC_DEVTYPE_NATIVE_RAW)
+                if (devtype == AAC_DEVTYPE_NATIVE_RAW) {
                         depth = aac->hba_map[chn][tid].qd_limit;
-                else if (devtype == AAC_DEVTYPE_ARC_RAW)
+                        set_timeout = 1;
+                        goto common_config;
+                }
+                if (devtype == AAC_DEVTYPE_ARC_RAW) {
                         set_qd_dev_type = true;
-
-                set_timeout = 1;
-                goto common_config;
+                        set_timeout = 1;
+                        goto common_config;
+                }
         }
 
         if (aac->jbod && (sdev->type == TYPE_DISK))
diff --git a/drivers/scsi/hisi_sas/hisi_sas.h b/drivers/scsi/hisi_sas/hisi_sas.h
index 6c87bd34509a..9bfa9f12d81e 100644
--- a/drivers/scsi/hisi_sas/hisi_sas.h
+++ b/drivers/scsi/hisi_sas/hisi_sas.h
@@ -18,6 +18,7 @@
 #include <linux/dmapool.h>
 #include <linux/iopoll.h>
 #include <linux/lcm.h>
+#include <linux/libata.h>
 #include <linux/mfd/syscon.h>
 #include <linux/module.h>
 #include <linux/of_address.h>
@@ -94,6 +95,11 @@ enum {
         PORT_TYPE_SATA = (1U << 0),
 };
 
+enum dev_status {
+        HISI_SAS_DEV_INIT,
+        HISI_SAS_DEV_NORMAL,
+};
+
 enum {
         HISI_SAS_INT_ABT_CMD = 0,
         HISI_SAS_INT_ABT_DEV = 1,
@@ -161,6 +167,7 @@ struct hisi_sas_phy {
         u8              in_reset;
         u8              reserved[2];
         u32             phy_type;
+        u32             code_violation_err_count;
         enum sas_linkrate       minimum_linkrate;
         enum sas_linkrate       maximum_linkrate;
 };
@@ -194,6 +201,7 @@ struct hisi_sas_device {
         struct hisi_sas_dq      *dq;
         struct list_head        list;
         enum sas_device_type    dev_type;
+        enum dev_status dev_status;
         int device_id;
         int sata_idx;
         spinlock_t lock; /* For protecting slots */
diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c
index 13ca5a0bdf6b..14bac4966c87 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
@@ -10,6 +10,7 @@
  */
 
 #include "hisi_sas.h"
+#include "../libsas/sas_internal.h"
 #define DRV_NAME "hisi_sas"
 
 #define DEV_IS_GONE(dev) \
@@ -707,6 +708,7 @@ static struct hisi_sas_device *hisi_sas_alloc_dev(struct domain_device *device)
 
                         hisi_hba->devices[i].device_id = i;
                         sas_dev = &hisi_hba->devices[i];
+                        sas_dev->dev_status = HISI_SAS_DEV_INIT;
                         sas_dev->dev_type = device->dev_type;
                         sas_dev->hisi_hba = hisi_hba;
                         sas_dev->sas_device = device;
@@ -731,6 +733,8 @@ static int hisi_sas_init_device(struct domain_device *device)
         struct hisi_sas_tmf_task tmf_task;
         int retry = HISI_SAS_SRST_ATA_DISK_CNT;
         struct hisi_hba *hisi_hba = dev_to_hisi_hba(device);
+        struct device *dev = hisi_hba->dev;
+        struct sas_phy *local_phy;
 
         switch (device->dev_type) {
         case SAS_END_DEVICE:
@@ -746,6 +750,31 @@ static int hisi_sas_init_device(struct domain_device *device)
         case SAS_SATA_PM:
         case SAS_SATA_PM_PORT:
         case SAS_SATA_PENDING:
+                /*
+                 * send HARD RESET to clear previous affiliation of
+                 * STP target port
+                 */
+                local_phy = sas_get_local_phy(device);
+                if (!scsi_is_sas_phy_local(local_phy)) {
+                        unsigned long deadline = ata_deadline(jiffies, 20000);
+                        struct sata_device *sata_dev = &device->sata_dev;
+                        struct ata_host *ata_host = sata_dev->ata_host;
+                        struct ata_port_operations *ops = ata_host->ops;
+                        struct ata_port *ap = sata_dev->ap;
+                        struct ata_link *link;
+                        unsigned int classes;
+
+                        ata_for_each_link(link, ap, EDGE)
+                                rc = ops->hardreset(link, &classes,
+                                                    deadline);
+                }
+                sas_put_local_phy(local_phy);
+                if (rc) {
+                        dev_warn(dev, "SATA disk hardreset fail: 0x%x\n",
+                                 rc);
+                        return rc;
+                }
+
                 while (retry-- > 0) {
                         rc = hisi_sas_softreset_ata_disk(device);
                         if (!rc)
@@ -808,6 +837,7 @@ static int hisi_sas_dev_found(struct domain_device *device)
         rc = hisi_sas_init_device(device);
         if (rc)
                 goto err_out;
+        sas_dev->dev_status = HISI_SAS_DEV_NORMAL;
         return 0;
 
 err_out:
@@ -980,7 +1010,8 @@ static void hisi_sas_do_release_task(struct hisi_hba *hisi_hba, struct sas_task
                 spin_lock_irqsave(&task->task_state_lock, flags);
                 task->task_state_flags &=
                         ~(SAS_TASK_STATE_PENDING | SAS_TASK_AT_INITIATOR);
-                task->task_state_flags |= SAS_TASK_STATE_DONE;
+                if (!slot->is_internal && task->task_proto != SAS_PROTOCOL_SMP)
+                        task->task_state_flags |= SAS_TASK_STATE_DONE;
                 spin_unlock_irqrestore(&task->task_state_lock, flags);
         }
 
@@ -1713,20 +1744,23 @@ static int hisi_sas_clear_aca(struct domain_device *device, u8 *lun)
 static int hisi_sas_debug_I_T_nexus_reset(struct domain_device *device)
 {
         struct sas_phy *local_phy = sas_get_local_phy(device);
-        int rc, reset_type = (device->dev_type == SAS_SATA_DEV ||
-                        (device->tproto & SAS_PROTOCOL_STP)) ? 0 : 1;
+        struct hisi_sas_device *sas_dev = device->lldd_dev;
         struct hisi_hba *hisi_hba = dev_to_hisi_hba(device);
         struct sas_ha_struct *sas_ha = &hisi_hba->sha;
         struct asd_sas_phy *sas_phy = sas_ha->sas_phy[local_phy->number];
         struct hisi_sas_phy *phy = container_of(sas_phy,
                         struct hisi_sas_phy, sas_phy);
         DECLARE_COMPLETION_ONSTACK(phyreset);
+        int rc, reset_type;
 
         if (scsi_is_sas_phy_local(local_phy)) {
                 phy->in_reset = 1;
                 phy->reset_completion = &phyreset;
         }
 
+        reset_type = (sas_dev->dev_status == HISI_SAS_DEV_INIT ||
+                      !dev_is_sata(device)) ? 1 : 0;
+
         rc = sas_phy_reset(local_phy, reset_type);
         sas_put_local_phy(local_phy);
 
@@ -1742,8 +1776,13 @@ static int hisi_sas_debug_I_T_nexus_reset(struct domain_device *device)
                 /* report PHY down if timed out */
                 if (!ret)
                         hisi_sas_phy_down(hisi_hba, sas_phy->id, 0);
-        } else
+        } else if (sas_dev->dev_status != HISI_SAS_DEV_INIT) {
+                /*
+                 * If in init state, we rely on caller to wait for link to be
+                 * ready; otherwise, delay.
+                 */
                 msleep(2000);
+        }
 
         return rc;
 }
@@ -1762,6 +1801,12 @@ static int hisi_sas_I_T_nexus_reset(struct domain_device *device)
         }
         hisi_sas_dereg_device(hisi_hba, device);
 
+        if (dev_is_sata(device)) {
+                rc = hisi_sas_softreset_ata_disk(device);
+                if (rc)
+                        return TMF_RESP_FUNC_FAILED;
+        }
+
         rc = hisi_sas_debug_I_T_nexus_reset(device);
 
         if ((rc == TMF_RESP_FUNC_COMPLETE) || (rc == -ENODEV))
@@ -2125,9 +2170,18 @@ static int hisi_sas_write_gpio(struct sas_ha_struct *sha, u8 reg_type,
 
 static void hisi_sas_phy_disconnected(struct hisi_sas_phy *phy)
 {
+        struct asd_sas_phy *sas_phy = &phy->sas_phy;
+        struct sas_phy *sphy = sas_phy->phy;
+        struct sas_phy_data *d = sphy->hostdata;
+
         phy->phy_attached = 0;
         phy->phy_type = 0;
         phy->port = NULL;
+
+        if (d->enable)
+                sphy->negotiated_linkrate = SAS_LINK_RATE_UNKNOWN;
+        else
+                sphy->negotiated_linkrate = SAS_PHY_DISABLED;
 }
 
 void hisi_sas_phy_down(struct hisi_hba *hisi_hba, int phy_no, int rdy)
@@ -2253,6 +2307,7 @@ int hisi_sas_alloc(struct hisi_hba *hisi_hba)
         for (i = 0; i < HISI_SAS_MAX_DEVICES; i++) {
                 hisi_hba->devices[i].dev_type = SAS_PHY_UNUSED;
                 hisi_hba->devices[i].device_id = i;
+                hisi_hba->devices[i].dev_status = HISI_SAS_DEV_INIT;
         }
 
         for (i = 0; i < hisi_hba->queue_count; i++) {
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
index e40cc6b3b67b..89160ab3efb0 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
@@ -868,6 +868,7 @@ hisi_sas_device *alloc_dev_quirk_v2_hw(struct domain_device *device)
 
                         hisi_hba->devices[i].device_id = i;
                         sas_dev = &hisi_hba->devices[i];
+                        sas_dev->dev_status = HISI_SAS_DEV_INIT;
                         sas_dev->dev_type = device->dev_type;
                         sas_dev->hisi_hba = hisi_hba;
                         sas_dev->sas_device = device;
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index 9ec8848ec541..086695a4099f 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -129,6 +129,7 @@
 #define PHY_CTRL_RESET_MSK              (0x1 << PHY_CTRL_RESET_OFF)
 #define CMD_HDR_PIR_OFF                 8
 #define CMD_HDR_PIR_MSK                 (0x1 << CMD_HDR_PIR_OFF)
+#define SERDES_CFG                      (PORT_BASE + 0x1c)
 #define SL_CFG                          (PORT_BASE + 0x84)
 #define AIP_LIMIT                       (PORT_BASE + 0x90)
 #define SL_CONTROL                      (PORT_BASE + 0x94)
@@ -181,6 +182,8 @@
 #define CHL_INT1_DMAC_RX_AXI_RD_ERR_OFF 22
 #define CHL_INT2                        (PORT_BASE + 0x1bc)
 #define CHL_INT2_SL_IDAF_TOUT_CONF_OFF  0
+#define CHL_INT2_RX_DISP_ERR_OFF        28
+#define CHL_INT2_RX_CODE_ERR_OFF        29
 #define CHL_INT2_RX_INVLD_DW_OFF        30
 #define CHL_INT2_STP_LINK_TIMEOUT_OFF   31
 #define CHL_INT0_MSK                    (PORT_BASE + 0x1c0)
@@ -523,6 +526,7 @@ static void init_reg_v3_hw(struct hisi_hba *hisi_hba)
                 }
                 hisi_sas_phy_write32(hisi_hba, i, PROG_PHY_LINK_RATE,
                         prog_phy_link_rate);
+                hisi_sas_phy_write32(hisi_hba, i, SERDES_CFG, 0xffc00);
                 hisi_sas_phy_write32(hisi_hba, i, SAS_RX_TRAIN_TIMER, 0x13e80);
                 hisi_sas_phy_write32(hisi_hba, i, CHL_INT0, 0xffffffff);
                 hisi_sas_phy_write32(hisi_hba, i, CHL_INT1, 0xffffffff);
@@ -544,6 +548,8 @@ static void init_reg_v3_hw(struct hisi_hba *hisi_hba)
                 hisi_sas_phy_write32(hisi_hba, i, STP_LINK_TIMER, 0x7f7a120);
                 hisi_sas_phy_write32(hisi_hba, i, CON_CFG_DRIVER, 0x2a0a01);
                 hisi_sas_phy_write32(hisi_hba, i, SAS_SSP_CON_TIMER_CFG, 0x32);
+                hisi_sas_phy_write32(hisi_hba, i, SAS_EC_INT_COAL_TIME,
+                                     0x30f4240);
                 /* used for 12G negotiate */
                 hisi_sas_phy_write32(hisi_hba, i, COARSETUNE_TIME, 0x1e);
                 hisi_sas_phy_write32(hisi_hba, i, AIP_LIMIT, 0x2ffff);
@@ -1344,7 +1350,8 @@ static void prep_abort_v3_hw(struct hisi_hba *hisi_hba,
 
 static irqreturn_t phy_up_v3_hw(int phy_no, struct hisi_hba *hisi_hba)
 {
-        int i, res;
+        int i;
+        irqreturn_t res;
         u32 context, port_id, link_rate;
         struct hisi_sas_phy *phy = &hisi_hba->phy[phy_no];
         struct asd_sas_phy *sas_phy = &phy->sas_phy;
@@ -1575,6 +1582,39 @@ static void handle_chl_int1_v3_hw(struct hisi_hba *hisi_hba, int phy_no)
         hisi_sas_phy_write32(hisi_hba, phy_no, CHL_INT1, irq_value);
 }
 
+static void phy_get_events_v3_hw(struct hisi_hba *hisi_hba, int phy_no)
+{
+        struct hisi_sas_phy *phy = &hisi_hba->phy[phy_no];
+        struct asd_sas_phy *sas_phy = &phy->sas_phy;
+        struct sas_phy *sphy = sas_phy->phy;
+        unsigned long flags;
+        u32 reg_value;
+
+        spin_lock_irqsave(&phy->lock, flags);
+
+        /* loss dword sync */
+        reg_value = hisi_sas_phy_read32(hisi_hba, phy_no, ERR_CNT_DWS_LOST);
+        sphy->loss_of_dword_sync_count += reg_value;
+
+        /* phy reset problem */
+        reg_value = hisi_sas_phy_read32(hisi_hba, phy_no, ERR_CNT_RESET_PROB);
+        sphy->phy_reset_problem_count += reg_value;
+
+        /* invalid dword */
+        reg_value = hisi_sas_phy_read32(hisi_hba, phy_no, ERR_CNT_INVLD_DW);
+        sphy->invalid_dword_count += reg_value;
+
+        /* disparity err */
+        reg_value = hisi_sas_phy_read32(hisi_hba, phy_no, ERR_CNT_DISP_ERR);
+        sphy->running_disparity_error_count += reg_value;
+
+        /* code violation error */
+        reg_value = hisi_sas_phy_read32(hisi_hba, phy_no, ERR_CNT_CODE_ERR);
+        phy->code_violation_err_count += reg_value;
+
+        spin_unlock_irqrestore(&phy->lock, flags);
+}
+
 static void handle_chl_int2_v3_hw(struct hisi_hba *hisi_hba, int phy_no)
 {
         u32 irq_msk = hisi_sas_phy_read32(hisi_hba, phy_no, CHL_INT2_MSK);
@@ -1582,6 +1622,9 @@ static void handle_chl_int2_v3_hw(struct hisi_hba *hisi_hba, int phy_no)
         struct hisi_sas_phy *phy = &hisi_hba->phy[phy_no];
         struct pci_dev *pci_dev = hisi_hba->pci_dev;
         struct device *dev = hisi_hba->dev;
+        static const u32 msk = BIT(CHL_INT2_RX_DISP_ERR_OFF) |
+                        BIT(CHL_INT2_RX_CODE_ERR_OFF) |
+                        BIT(CHL_INT2_RX_INVLD_DW_OFF);
 
         irq_value &= ~irq_msk;
         if (!irq_value)
@@ -1602,6 +1645,25 @@ static void handle_chl_int2_v3_hw(struct hisi_hba *hisi_hba, int phy_no)
                         hisi_sas_notify_phy_event(phy, HISI_PHYE_LINK_RESET);
         }
 
+        if (pci_dev->revision > 0x20 && (irq_value & msk)) {
+                struct asd_sas_phy *sas_phy = &phy->sas_phy;
+                struct sas_phy *sphy = sas_phy->phy;
+
+                phy_get_events_v3_hw(hisi_hba, phy_no);
+
+                if (irq_value & BIT(CHL_INT2_RX_INVLD_DW_OFF))
+                        dev_info(dev, "phy%d invalid dword cnt:   %u\n", phy_no,
+                                 sphy->invalid_dword_count);
+
+                if (irq_value & BIT(CHL_INT2_RX_CODE_ERR_OFF))
+                        dev_info(dev, "phy%d code violation cnt:  %u\n", phy_no,
+                                 phy->code_violation_err_count);
+
+                if (irq_value & BIT(CHL_INT2_RX_DISP_ERR_OFF))
+                        dev_info(dev, "phy%d disparity error cnt: %u\n", phy_no,
+                                 sphy->running_disparity_error_count);
+        }
+
         if ((irq_value & BIT(CHL_INT2_RX_INVLD_DW_OFF)) &&
             (pci_dev->revision == 0x20)) {
                 u32 reg_value;
@@ -2230,31 +2292,6 @@ static u32 get_phys_state_v3_hw(struct hisi_hba *hisi_hba)
         return hisi_sas_read32(hisi_hba, PHY_STATE);
 }
 
-static void phy_get_events_v3_hw(struct hisi_hba *hisi_hba, int phy_no)
-{
-        struct hisi_sas_phy *phy = &hisi_hba->phy[phy_no];
-        struct asd_sas_phy *sas_phy = &phy->sas_phy;
-        struct sas_phy *sphy = sas_phy->phy;
-        u32 reg_value;
-
-        /* loss dword sync */
-        reg_value = hisi_sas_phy_read32(hisi_hba, phy_no, ERR_CNT_DWS_LOST);
-        sphy->loss_of_dword_sync_count += reg_value;
-
-        /* phy reset problem */
-        reg_value = hisi_sas_phy_read32(hisi_hba, phy_no, ERR_CNT_RESET_PROB);
-        sphy->phy_reset_problem_count += reg_value;
-
-        /* invalid dword */
-        reg_value = hisi_sas_phy_read32(hisi_hba, phy_no, ERR_CNT_INVLD_DW);
-        sphy->invalid_dword_count += reg_value;
-
-        /* disparity err */
-        reg_value = hisi_sas_phy_read32(hisi_hba, phy_no, ERR_CNT_DISP_ERR);
-        sphy->running_disparity_error_count += reg_value;
-
-}
-
 static int disable_host_v3_hw(struct hisi_hba *hisi_hba)
 {
         struct device *dev = hisi_hba->dev;
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index 1135e74646e2..8cec5230fe31 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -96,6 +96,7 @@ static int client_reserve = 1;
 static char partition_name[96] = "UNKNOWN";
 static unsigned int partition_number = -1;
 static LIST_HEAD(ibmvscsi_head);
+static DEFINE_SPINLOCK(ibmvscsi_driver_lock);
 
 static struct scsi_transport_template *ibmvscsi_transport_template;
 
@@ -2270,7 +2271,9 @@ static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id)
         }
 
         dev_set_drvdata(&vdev->dev, hostdata);
+        spin_lock(&ibmvscsi_driver_lock);
         list_add_tail(&hostdata->host_list, &ibmvscsi_head);
+        spin_unlock(&ibmvscsi_driver_lock);
         return 0;
 
       add_srp_port_failed:
@@ -2292,15 +2295,27 @@ static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id)
 static int ibmvscsi_remove(struct vio_dev *vdev)
 {
         struct ibmvscsi_host_data *hostdata = dev_get_drvdata(&vdev->dev);
-        list_del(&hostdata->host_list);
-        unmap_persist_bufs(hostdata);
+        unsigned long flags;
+
+        srp_remove_host(hostdata->host);
+        scsi_remove_host(hostdata->host);
+
+        purge_requests(hostdata, DID_ERROR);
+
+        spin_lock_irqsave(hostdata->host->host_lock, flags);
         release_event_pool(&hostdata->pool, hostdata);
+        spin_unlock_irqrestore(hostdata->host->host_lock, flags);
+
         ibmvscsi_release_crq_queue(&hostdata->queue, hostdata,
                                         max_events);
 
         kthread_stop(hostdata->work_thread);
-        srp_remove_host(hostdata->host);
-        scsi_remove_host(hostdata->host);
+        unmap_persist_bufs(hostdata);
+
+        spin_lock(&ibmvscsi_driver_lock);
+        list_del(&hostdata->host_list);
+        spin_unlock(&ibmvscsi_driver_lock);
+
         scsi_host_put(hostdata->host);
 
         return 0;
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 21309d5b456d..e893949a3d11 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -798,7 +798,7 @@ EXPORT_SYMBOL_GPL(iscsi_conn_send_pdu);
  * @datalen: len of buffer
  *
  * iscsi_cmd_rsp sets up the scsi_cmnd fields based on the PDU and
- * then completes the command and task.
+ * then completes the command and task. called under back_lock
  **/
 static void iscsi_scsi_cmd_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
                                struct iscsi_task *task, char *data,
@@ -894,6 +894,9 @@ out:
  * @conn: iscsi connection
  * @hdr:  iscsi pdu
  * @task: scsi command task
+ *
+ * iscsi_data_in_rsp sets up the scsi_cmnd fields based on the data received
+ * then completes the command and task. called under back_lock
  **/
 static void
 iscsi_data_in_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
@@ -978,6 +981,16 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr)
         return 0;
 }
 
+/**
+ * iscsi_nop_out_rsp - SCSI NOP Response processing
+ * @task: scsi command task
+ * @nop: the nop structure
+ * @data: where to put the data
+ * @datalen: length of data
+ *
+ * iscsi_nop_out_rsp handles nop response from use or
+ * from user space. called under back_lock
+ **/
 static int iscsi_nop_out_rsp(struct iscsi_task *task,
                              struct iscsi_nopin *nop, char *data, int datalen)
 {
@@ -1750,7 +1763,9 @@ int iscsi_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *sc)
         return 0;
 
 prepd_reject:
+        spin_lock_bh(&session->back_lock);
         iscsi_complete_task(task, ISCSI_TASK_REQUEUE_SCSIQ);
+        spin_unlock_bh(&session->back_lock);
 reject:
         spin_unlock_bh(&session->frwd_lock);
         ISCSI_DBG_SESSION(session, "cmd 0x%x rejected (%d)\n",
@@ -1758,7 +1773,9 @@ reject:
         return SCSI_MLQUEUE_TARGET_BUSY;
 
 prepd_fault:
+        spin_lock_bh(&session->back_lock);
         iscsi_complete_task(task, ISCSI_TASK_REQUEUE_SCSIQ);
+        spin_unlock_bh(&session->back_lock);
 fault:
         spin_unlock_bh(&session->frwd_lock);
         ISCSI_DBG_SESSION(session, "iscsi: cmd 0x%x is not queued (%d)\n",
@@ -3075,8 +3092,9 @@ fail_mgmt_tasks(struct iscsi_session *session, struct iscsi_conn *conn)
                 state = ISCSI_TASK_ABRT_SESS_RECOV;
                 if (task->state == ISCSI_TASK_PENDING)
                         state = ISCSI_TASK_COMPLETED;
+                spin_lock_bh(&session->back_lock);
                 iscsi_complete_task(task, state);
-
+                spin_unlock_bh(&session->back_lock);
         }
 }
 
diff --git a/drivers/scsi/libiscsi_tcp.c b/drivers/scsi/libiscsi_tcp.c
index 9923e9e3b884..c3fe3f3a78f5 100644
--- a/drivers/scsi/libiscsi_tcp.c
+++ b/drivers/scsi/libiscsi_tcp.c
@@ -129,12 +129,17 @@ static void iscsi_tcp_segment_map(struct iscsi_segment *segment, int recv)
         BUG_ON(sg->length == 0);
 
         /*
+         * We always map for the recv path.
+         *
          * If the page count is greater than one it is ok to send
          * to the network layer's zero copy send path. If not we
-         * have to go the slow sendmsg path. We always map for the
-         * recv path.
+         * have to go the slow sendmsg path.
+         *
+         * Same goes for slab pages: skb_can_coalesce() allows
+         * coalescing neighboring slab objects into a single frag which
+         * triggers one of hardened usercopy checks.
          */
-        if (page_count(sg_page(sg)) >= 1 && !recv)
+        if (!recv && page_count(sg_page(sg)) >= 1 && !PageSlab(sg_page(sg)))
                 return;
 
         if (recv) {
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 3b5873f6751e..7fcdaed3fa94 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -4090,7 +4090,7 @@ lpfc_new_io_buf(struct lpfc_hba *phba, int num_to_alloc)
         /* Sanity check to ensure our sizing is right for both SCSI and NVME */
         if (sizeof(struct lpfc_io_buf) > LPFC_COMMON_IO_BUF_SZ) {
                 lpfc_printf_log(phba, KERN_ERR, LOG_FCP,
-                                "6426 Common buffer size %ld exceeds %d\n",
+                                "6426 Common buffer size %zd exceeds %d\n",
                                 sizeof(struct lpfc_io_buf),
                                 LPFC_COMMON_IO_BUF_SZ);
                 return 0;
@@ -10052,7 +10052,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
 {
         struct pci_dev *pdev = phba->pcidev;
         unsigned long bar0map_len, bar1map_len, bar2map_len;
-        int error = -ENODEV;
+        int error;
         uint32_t if_type;
 
         if (!pdev)
@@ -10071,7 +10071,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
          */
         if (pci_read_config_dword(pdev, LPFC_SLI_INTF,
                                   &phba->sli4_hba.sli_intf.word0)) {
-                return error;
+                return -ENODEV;
         }
 
         /* There is no SLI3 failback for SLI4 devices. */
@@ -10081,7 +10081,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
                                 "2894 SLI_INTF reg contents invalid "
                                 "sli_intf reg 0x%x\n",
                                 phba->sli4_hba.sli_intf.word0);
-                return error;
+                return -ENODEV;
         }
 
         if_type = bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf);
@@ -10105,7 +10105,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
                         dev_printk(KERN_ERR, &pdev->dev,
                                    "ioremap failed for SLI4 PCI config "
                                    "registers.\n");
-                        goto out;
+                        return -ENODEV;
                 }
                 phba->pci_bar0_memmap_p = phba->sli4_hba.conf_regs_memmap_p;
                 /* Set up BAR0 PCI config space register memory map */
@@ -10116,7 +10116,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
                 if (if_type >= LPFC_SLI_INTF_IF_TYPE_2) {
                         dev_printk(KERN_ERR, &pdev->dev,
                            "FATAL - No BAR0 mapping for SLI4, if_type 2\n");
-                        goto out;
+                        return -ENODEV;
                 }
                 phba->sli4_hba.conf_regs_memmap_p =
                                 ioremap(phba->pci_bar0_map, bar0map_len);
@@ -10124,7 +10124,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
                         dev_printk(KERN_ERR, &pdev->dev,
                                 "ioremap failed for SLI4 PCI config "
                                 "registers.\n");
-                        goto out;
+                        return -ENODEV;
                 }
                 lpfc_sli4_bar0_register_memmap(phba, if_type);
         }
@@ -10170,6 +10170,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
                 if (!phba->sli4_hba.drbl_regs_memmap_p) {
                         dev_err(&pdev->dev,
                            "ioremap failed for SLI4 HBA doorbell registers.\n");
+                        error = -ENOMEM;
                         goto out_iounmap_conf;
                 }
                 phba->pci_bar2_memmap_p = phba->sli4_hba.drbl_regs_memmap_p;
@@ -10219,6 +10220,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
                 if (!phba->sli4_hba.dpp_regs_memmap_p) {
                         dev_err(&pdev->dev,
                            "ioremap failed for SLI4 HBA dpp registers.\n");
+                        error = -ENOMEM;
                         goto out_iounmap_ctrl;
                 }
                 phba->pci_bar4_memmap_p = phba->sli4_hba.dpp_regs_memmap_p;
@@ -10249,7 +10251,7 @@ out_iounmap_ctrl:
         iounmap(phba->sli4_hba.ctrl_regs_memmap_p);
 out_iounmap_conf:
         iounmap(phba->sli4_hba.conf_regs_memmap_p);
-out:
+
         return error;
 }
 
@@ -11137,7 +11139,8 @@ lpfc_sli4_hba_unset(struct lpfc_hba *phba)
                 lpfc_sli4_ras_dma_free(phba);
 
         /* Stop the SLI4 device port */
-        phba->pport->work_port_events = 0;
+        if (phba->pport)
+                phba->pport->work_port_events = 0;
 }
 
  /**
diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
index 55ab9d3ee4ba..1aa00d2c3f74 100644
--- a/drivers/scsi/lpfc/lpfc_nvme.c
+++ b/drivers/scsi/lpfc/lpfc_nvme.c
@@ -965,7 +965,7 @@ lpfc_nvme_io_cmd_wqe_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pwqeIn,
         struct lpfc_nodelist *ndlp;
         struct lpfc_nvme_fcpreq_priv *freqpriv;
         struct lpfc_nvme_lport *lport;
-        uint32_t code, status, idx, cpu;
+        uint32_t code, status, idx;
         uint16_t cid, sqhd, data;
         uint32_t *ptr;
 
@@ -1138,6 +1138,7 @@ out_err:
                 lpfc_nvme_ktime(phba, lpfc_ncmd);
         }
         if (phba->cpucheck_on & LPFC_CHECK_NVME_IO) {
+                uint32_t cpu;
                 idx = lpfc_ncmd->cur_iocbq.hba_wqidx;
                 cpu = smp_processor_id();
                 if (cpu < LPFC_CHECK_CPU_CNT) {
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index d0817facdae3..57b4a463b589 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -9881,7 +9881,7 @@ __lpfc_sli_issue_iocb_s4(struct lpfc_hba *phba, uint32_t ring_number,
          * The WQE can be either 64 or 128 bytes,
          */
 
-        lockdep_assert_held(&phba->hbalock);
+        lockdep_assert_held(&pring->ring_lock);
 
         if (piocb->sli4_xritag == NO_XRI) {
                 if (piocb->iocb.ulpCommand == CMD_ABORT_XRI_CN ||
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index dace907744a5..293f5cf524d7 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -3924,12 +3924,12 @@ megasas_transition_to_ready(struct megasas_instance *instance, int ocr)
                 /*
                  * The cur_state should not last for more than max_wait secs
                  */
-                for (i = 0; i < max_wait; i++) {
+                for (i = 0; i < max_wait * 50; i++) {
                         curr_abs_state = instance->instancet->
                                 read_fw_status_reg(instance);
 
                         if (abs_state == curr_abs_state) {
-                                msleep(1000);
+                                msleep(20);
                         } else
                                 break;
                 }
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index 2eb1ae721a7d..f928c4d3a1ef 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -1652,6 +1652,8 @@ qla2x00_port_speed_store(struct device *dev, struct device_attribute *attr,
         }
 
         rval = kstrtol(buf, 10, &type);
+        if (rval)
+                return rval;
         speed = type;
         if (type == 40 || type == 80 || type == 160 ||
             type == 320) {
diff --git a/drivers/scsi/qla2xxx/qla_dfs.c b/drivers/scsi/qla2xxx/qla_dfs.c
index ead17288e2a7..5819a45ac5ef 100644
--- a/drivers/scsi/qla2xxx/qla_dfs.c
+++ b/drivers/scsi/qla2xxx/qla_dfs.c
@@ -193,6 +193,8 @@ qla_dfs_tgt_counters_show(struct seq_file *s, void *unused)
 
         for (i = 0; i < vha->hw->max_qpairs; i++) {
                 qpair = vha->hw->queue_pair_map[i];
+                if (!qpair)
+                        continue;
                 qla_core_sbt_cmd += qpair->tgt_counters.qla_core_sbt_cmd;
                 core_qla_que_buf += qpair->tgt_counters.core_qla_que_buf;
                 qla_core_ret_ctio += qpair->tgt_counters.qla_core_ret_ctio;
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 420045155ba0..0c700b140ce7 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -4991,6 +4991,13 @@ qla2x00_configure_local_loop(scsi_qla_host_t *vha)
                 if ((domain & 0xf0) == 0xf0)
                         continue;
 
+                /* Bypass if not same domain and area of adapter. */
+                if (area && domain && ((area != vha->d_id.b.area) ||
+                    (domain != vha->d_id.b.domain)) &&
+                    (ha->current_topology == ISP_CFG_NL))
+                        continue;
+
+
                 /* Bypass invalid local loop ID. */
                 if (loop_id > LAST_LOCAL_LOOP_ID)
                         continue;
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index 63f8e3c19841..456a41d2e2c6 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -1132,7 +1132,7 @@ qla24xx_walk_and_build_prot_sglist(struct qla_hw_data *ha, srb_t *sp,
         /* if initiator doing write or target doing read */
         if (direction_to_device) {
                 for_each_sg(sgl, sg, tot_dsds, i) {
-                        dma_addr_t sle_phys = sg_phys(sg);
+                        u64 sle_phys = sg_phys(sg);
 
                         /* If SGE addr + len flips bits in upper 32-bits */
                         if (MSD(sle_phys + sg->length) ^ MSD(sle_phys)) {
@@ -1178,7 +1178,7 @@ qla24xx_walk_and_build_prot_sglist(struct qla_hw_data *ha, srb_t *sp,
 
                         ql_dbg(ql_dbg_tgt + ql_dbg_verbose, vha, 0xe023,
                             "%s: sg[%x] (phys=%llx sglen=%x) ldma_sg_len: %x dif_bundl_len: %x ldma_needed: %x\n",
-                            __func__, i, sg_phys(sg), sglen, ldma_sg_len,
+                            __func__, i, (u64)sg_phys(sg), sglen, ldma_sg_len,
                             difctx->dif_bundl_len, ldma_needed);
 
                         while (sglen) {
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 677f82fdf56f..91f576d743fe 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1517,7 +1517,7 @@ __qla2xxx_eh_generic_reset(char *name, enum nexus_wait_type type,
                 goto eh_reset_failed;
         }
         err = 2;
-        if (do_reset(fcport, cmd->device->lun, blk_mq_rq_cpu(cmd->request) + 1)
+        if (do_reset(fcport, cmd->device->lun, 1)
                 != QLA_SUCCESS) {
                 ql_log(ql_log_warn, vha, 0x800c,
                     "do_reset failed for cmd=%p.\n", cmd);
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 20189675677a..601b9f1de267 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -585,10 +585,17 @@ static bool scsi_end_request(struct request *req, blk_status_t error,
         if (!blk_rq_is_scsi(req)) {
                 WARN_ON_ONCE(!(cmd->flags & SCMD_INITIALIZED));
                 cmd->flags &= ~SCMD_INITIALIZED;
-                destroy_rcu_head(&cmd->rcu);
         }
 
         /*
+         * Calling rcu_barrier() is not necessary here because the
+         * SCSI error handler guarantees that the function called by
+         * call_rcu() has been called before scsi_end_request() is
+         * called.
+         */
+        destroy_rcu_head(&cmd->rcu);
+
+        /*
          * In the MQ case the command gets freed by __blk_mq_end_request,
          * so we have to do all cleanup that depends on it earlier.
          *
@@ -2541,8 +2548,10 @@ void scsi_device_resume(struct scsi_device *sdev)
          * device deleted during suspend)
          */
         mutex_lock(&sdev->state_mutex);
-        sdev->quiesced_by = NULL;
-        blk_clear_pm_only(sdev->request_queue);
+        if (sdev->quiesced_by) {
+                sdev->quiesced_by = NULL;
+                blk_clear_pm_only(sdev->request_queue);
+        }
         if (sdev->sdev_state == SDEV_QUIESCE)
                 scsi_device_set_state(sdev, SDEV_RUNNING);
         mutex_unlock(&sdev->state_mutex);
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 0508831d6fb9..0a82e93566dc 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2200,6 +2200,8 @@ void iscsi_remove_session(struct iscsi_cls_session *session)
         scsi_target_unblock(&session->dev, SDEV_TRANSPORT_OFFLINE);
         /* flush running scans then delete devices */
         flush_work(&session->scan_work);
+        /* flush running unbind operations */
+        flush_work(&session->unbind_work);
         __iscsi_unbind_session(&session->unbind_work);
 
         /* hw iscsi may not have removed all connections from session */
diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 5d9ccbab7581..75ec43aa8df3 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -2764,6 +2764,12 @@ static void pqi_process_raid_io_error(struct pqi_io_request *io_request)
                                 sshdr.sense_key == HARDWARE_ERROR &&
                                 sshdr.asc == 0x3e &&
                                 sshdr.ascq == 0x1) {
+                        struct pqi_ctrl_info *ctrl_info = shost_to_hba(scmd->device->host);
+                        struct pqi_scsi_dev *device = scmd->device->hostdata;
+
+                        if (printk_ratelimit())
+                                scmd_printk(KERN_ERR, scmd, "received 'logical unit failure' from controller for scsi %d:%d:%d:%d\n",
+                                        ctrl_info->scsi_host->host_no, device->bus, device->target, device->lun);
                         pqi_take_device_offline(scmd->device, "RAID");
                         host_byte = DID_NO_CONNECT;
                 }
diff --git a/drivers/scsi/ufs/ufs-hisi.c b/drivers/scsi/ufs/ufs-hisi.c
index f2d3df357a97..0e855b5afe82 100644
--- a/drivers/scsi/ufs/ufs-hisi.c
+++ b/drivers/scsi/ufs/ufs-hisi.c
@@ -640,7 +640,7 @@ static int ufs_hi3670_init(struct ufs_hba *hba)
         return 0;
 }
 
-static struct ufs_hba_variant_ops ufs_hba_hi3660_vops = {
+static const struct ufs_hba_variant_ops ufs_hba_hi3660_vops = {
         .name = "hi3660",
         .init = ufs_hi3660_init,
         .link_startup_notify = ufs_hisi_link_startup_notify,
@@ -649,7 +649,7 @@ static struct ufs_hba_variant_ops ufs_hba_hi3660_vops = {
         .resume = ufs_hisi_resume,
 };
 
-static struct ufs_hba_variant_ops ufs_hba_hi3670_vops = {
+static const struct ufs_hba_variant_ops ufs_hba_hi3670_vops = {
         .name = "hi3670",
         .init = ufs_hi3670_init,
         .link_startup_notify = ufs_hisi_link_startup_notify,
@@ -669,13 +669,10 @@ MODULE_DEVICE_TABLE(of, ufs_hisi_of_match);
 static int ufs_hisi_probe(struct platform_device *pdev)
 {
         const struct of_device_id *of_id;
-        struct ufs_hba_variant_ops *vops;
-        struct device *dev = &pdev->dev;
 
-        of_id = of_match_node(ufs_hisi_of_match, dev->of_node);
-        vops = (struct ufs_hba_variant_ops *)of_id->data;
+        of_id = of_match_node(ufs_hisi_of_match, pdev->dev.of_node);
 
-        return ufshcd_pltfrm_init(pdev, vops);
+        return ufshcd_pltfrm_init(pdev, of_id->data);
 }
 
 static int ufs_hisi_remove(struct platform_device *pdev)
diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-pltfrm.c
index 895a9b5ac989..27213676329c 100644
--- a/drivers/scsi/ufs/ufshcd-pltfrm.c
+++ b/drivers/scsi/ufs/ufshcd-pltfrm.c
@@ -297,7 +297,7 @@ static void ufshcd_init_lanes_per_dir(struct ufs_hba *hba)
  * Returns 0 on success, non-zero value on failure
  */
 int ufshcd_pltfrm_init(struct platform_device *pdev,
-                       struct ufs_hba_variant_ops *vops)
+                       const struct ufs_hba_variant_ops *vops)
 {
         struct ufs_hba *hba;
         void __iomem *mmio_base;
diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.h b/drivers/scsi/ufs/ufshcd-pltfrm.h
index df64c4180340..1f29e1fd6d52 100644
--- a/drivers/scsi/ufs/ufshcd-pltfrm.h
+++ b/drivers/scsi/ufs/ufshcd-pltfrm.h
@@ -17,7 +17,7 @@
 #include "ufshcd.h"
 
 int ufshcd_pltfrm_init(struct platform_device *pdev,
-                       struct ufs_hba_variant_ops *vops);
+                       const struct ufs_hba_variant_ops *vops);
 void ufshcd_pltfrm_shutdown(struct platform_device *pdev);
 
 #ifdef CONFIG_PM
diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h
index 69ba7445d2b3..ecfa898b9ccc 100644
--- a/drivers/scsi/ufs/ufshcd.h
+++ b/drivers/scsi/ufs/ufshcd.h
@@ -546,7 +546,7 @@ struct ufs_hba {
         int nutrs;
         int nutmrs;
         u32 ufs_version;
-        struct ufs_hba_variant_ops *vops;
+        const struct ufs_hba_variant_ops *vops;
         void *priv;
         unsigned int irq;
         bool is_irq_enabled;
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 1a6f150cd2d8..8af01777d09c 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -586,7 +586,6 @@ static int virtscsi_device_reset(struct scsi_cmnd *sc)
                 return FAILED;
 
         memset(cmd, 0, sizeof(*cmd));
-        cmd->sc = sc;
         cmd->req.tmf = (struct virtio_scsi_ctrl_tmf_req){
                 .type = VIRTIO_SCSI_T_TMF,
                 .subtype = cpu_to_virtio32(vscsi->vdev,
@@ -645,7 +644,6 @@ static int virtscsi_abort(struct scsi_cmnd *sc)
                 return FAILED;
 
         memset(cmd, 0, sizeof(*cmd));
-        cmd->sc = sc;
         cmd->req.tmf = (struct virtio_scsi_ctrl_tmf_req){
                 .type = VIRTIO_SCSI_T_TMF,
                 .subtype = VIRTIO_SCSI_T_TMF_ABORT_TASK,
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 5831e0eecea1..9704b135a7bc 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -1663,7 +1663,7 @@ static void tcmu_dev_kref_release(struct kref *kref)
         WARN_ON(!all_expired);
 
         tcmu_blocks_release(&udev->data_blocks, 0, udev->dbi_max + 1);
-        kfree(udev->data_bitmap);
+        bitmap_free(udev->data_bitmap);
         mutex_unlock(&udev->cmdr_lock);
 
         call_rcu(&dev->rcu_head, tcmu_dev_call_rcu);
@@ -1794,11 +1794,12 @@ static int tcmu_netlink_event_send(struct tcmu_dev *udev,
 
         ret = genlmsg_multicast_allns(&tcmu_genl_family, skb, 0,
                                       TCMU_MCGRP_CONFIG, GFP_KERNEL);
-        /* We don't care if no one is listening */
-        if (ret == -ESRCH)
-                ret = 0;
-        if (!ret)
-                ret = tcmu_wait_genl_cmd_reply(udev);
+
+        /* Wait during an add as the listener may not be up yet */
+        if (ret == 0 ||
+           (ret == -ESRCH && cmd == TCMU_CMD_ADDED_DEVICE))
+                return tcmu_wait_genl_cmd_reply(udev);
+
         return ret;
 }
 
@@ -1870,9 +1871,7 @@ static int tcmu_configure_device(struct se_device *dev)
         info = &udev->uio_info;
 
         mutex_lock(&udev->cmdr_lock);
-        udev->data_bitmap = kcalloc(BITS_TO_LONGS(udev->max_blocks),
-                                    sizeof(unsigned long),
-                                    GFP_KERNEL);
+        udev->data_bitmap = bitmap_zalloc(udev->max_blocks, GFP_KERNEL);
         mutex_unlock(&udev->cmdr_lock);
         if (!udev->data_bitmap) {
                 ret = -ENOMEM;
@@ -1959,7 +1958,7 @@ err_register:
         vfree(udev->mb_addr);
         udev->mb_addr = NULL;
 err_vzalloc:
-        kfree(udev->data_bitmap);
+        bitmap_free(udev->data_bitmap);
         udev->data_bitmap = NULL;
 err_bitmap_alloc:
         kfree(info->name);
diff --git a/drivers/thermal/broadcom/bcm2835_thermal.c b/drivers/thermal/broadcom/bcm2835_thermal.c
index 720760cd493f..ba39647a690c 100644
--- a/drivers/thermal/broadcom/bcm2835_thermal.c
+++ b/drivers/thermal/broadcom/bcm2835_thermal.c
@@ -119,8 +119,7 @@ static const struct debugfs_reg32 bcm2835_thermal_regs[] = {
 
 static void bcm2835_thermal_debugfs(struct platform_device *pdev)
 {
-        struct thermal_zone_device *tz = platform_get_drvdata(pdev);
-        struct bcm2835_thermal_data *data = tz->devdata;
+        struct bcm2835_thermal_data *data = platform_get_drvdata(pdev);
         struct debugfs_regset32 *regset;
 
         data->debugfsdir = debugfs_create_dir("bcm2835_thermal", NULL);
@@ -266,7 +265,7 @@ static int bcm2835_thermal_probe(struct platform_device *pdev)
 
         data->tz = tz;
 
-        platform_set_drvdata(pdev, tz);
+        platform_set_drvdata(pdev, data);
 
         /*
          * Thermal_zone doesn't enable hwmon as default,
@@ -290,8 +289,8 @@ err_clk:
 
 static int bcm2835_thermal_remove(struct platform_device *pdev)
 {
-        struct thermal_zone_device *tz = platform_get_drvdata(pdev);
-        struct bcm2835_thermal_data *data = tz->devdata;
+        struct bcm2835_thermal_data *data = platform_get_drvdata(pdev);
+        struct thermal_zone_device *tz = data->tz;
 
         debugfs_remove_recursive(data->debugfsdir);
         thermal_zone_of_sensor_unregister(&pdev->dev, tz);
diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index 6fff16113628..f7c1f49ec87f 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -536,12 +536,11 @@ static int cpufreq_power2state(struct thermal_cooling_device *cdev,
                                struct thermal_zone_device *tz, u32 power,
                                unsigned long *state)
 {
-        unsigned int cur_freq, target_freq;
+        unsigned int target_freq;
         u32 last_load, normalised_power;
         struct cpufreq_cooling_device *cpufreq_cdev = cdev->devdata;
         struct cpufreq_policy *policy = cpufreq_cdev->policy;
 
-        cur_freq = cpufreq_quick_get(policy->cpu);
         power = power > 0 ? power : 0;
         last_load = cpufreq_cdev->last_load ?: 1;
         normalised_power = (power * 100) / last_load;
diff --git a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
index 61ca7ce3624e..5f3ed24e26ec 100644
--- a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
+++ b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
@@ -22,6 +22,13 @@ enum int3400_thermal_uuid {
         INT3400_THERMAL_PASSIVE_1,
         INT3400_THERMAL_ACTIVE,
         INT3400_THERMAL_CRITICAL,
+        INT3400_THERMAL_ADAPTIVE_PERFORMANCE,
+        INT3400_THERMAL_EMERGENCY_CALL_MODE,
+        INT3400_THERMAL_PASSIVE_2,
+        INT3400_THERMAL_POWER_BOSS,
+        INT3400_THERMAL_VIRTUAL_SENSOR,
+        INT3400_THERMAL_COOLING_MODE,
+        INT3400_THERMAL_HARDWARE_DUTY_CYCLING,
         INT3400_THERMAL_MAXIMUM_UUID,
 };
 
@@ -29,6 +36,13 @@ static char *int3400_thermal_uuids[INT3400_THERMAL_MAXIMUM_UUID] = {
         "42A441D6-AE6A-462b-A84B-4A8CE79027D3",
         "3A95C389-E4B8-4629-A526-C52C88626BAE",
         "97C68AE7-15FA-499c-B8C9-5DA81D606E0A",
+        "63BE270F-1C11-48FD-A6F7-3AF253FF3E2D",
+        "5349962F-71E6-431D-9AE8-0A635B710AEE",
+        "9E04115A-AE87-4D1C-9500-0F3E340BFE75",
+        "F5A35014-C209-46A4-993A-EB56DE7530A1",
+        "6ED722A7-9240-48A5-B479-31EEF723D7CF",
+        "16CAF1B7-DD38-40ED-B1C1-1B8A1913D531",
+        "BE84BABF-C4D4-403D-B495-3128FD44dAC1",
 };
 
 struct int3400_thermal_priv {
@@ -299,10 +313,9 @@ static int int3400_thermal_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, priv);
 
-        if (priv->uuid_bitmap & 1 << INT3400_THERMAL_PASSIVE_1) {
-                int3400_thermal_ops.get_mode = int3400_thermal_get_mode;
-                int3400_thermal_ops.set_mode = int3400_thermal_set_mode;
-        }
+        int3400_thermal_ops.get_mode = int3400_thermal_get_mode;
+        int3400_thermal_ops.set_mode = int3400_thermal_set_mode;
+
         priv->thermal = thermal_zone_device_register("INT3400 Thermal", 0, 0,
                                                 priv, &int3400_thermal_ops,
                                                 &int3400_thermal_params, 0, 0);
diff --git a/drivers/thermal/intel/intel_powerclamp.c b/drivers/thermal/intel/intel_powerclamp.c
index 7571f7c2e7c9..ac7256b5f020 100644
--- a/drivers/thermal/intel/intel_powerclamp.c
+++ b/drivers/thermal/intel/intel_powerclamp.c
@@ -101,7 +101,7 @@ struct powerclamp_worker_data {
         bool clamping;
 };
 
-static struct powerclamp_worker_data * __percpu worker_data;
+static struct powerclamp_worker_data __percpu *worker_data;
 static struct thermal_cooling_device *cooling_dev;
 static unsigned long *cpu_clamping_mask;  /* bit map for tracking per cpu
                                            * clamping kthread worker
@@ -494,7 +494,7 @@ static void start_power_clamp_worker(unsigned long cpu)
         struct powerclamp_worker_data *w_data = per_cpu_ptr(worker_data, cpu);
         struct kthread_worker *worker;
 
-        worker = kthread_create_worker_on_cpu(cpu, 0, "kidle_inject/%ld", cpu);
+        worker = kthread_create_worker_on_cpu(cpu, 0, "kidle_inj/%ld", cpu);
         if (IS_ERR(worker))
                 return;
 
diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mtk_thermal.c
index 5c07a61447d3..e4ea7f6aef20 100644
--- a/drivers/thermal/mtk_thermal.c
+++ b/drivers/thermal/mtk_thermal.c
@@ -199,6 +199,9 @@ enum {
 #define MT7622_TS1      0
 #define MT7622_NUM_CONTROLLER           1
 
+/* The maximum number of banks */
+#define MAX_NUM_ZONES           8
+
 /* The calibration coefficient of sensor  */
 #define MT7622_CALIBRATION      165
 
@@ -249,7 +252,7 @@ struct mtk_thermal_data {
         const int num_controller;
         const int *controller_offset;
         bool need_switch_bank;
-        struct thermal_bank_cfg bank_data[];
+        struct thermal_bank_cfg bank_data[MAX_NUM_ZONES];
 };
 
 struct mtk_thermal {
@@ -268,7 +271,7 @@ struct mtk_thermal {
         s32 vts[MAX_NUM_VTS];
 
         const struct mtk_thermal_data *conf;
-        struct mtk_thermal_bank banks[];
+        struct mtk_thermal_bank banks[MAX_NUM_ZONES];
 };
 
 /* MT8183 thermal sensor data */
diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c
index 48eef552cba4..fc9399d9c082 100644
--- a/drivers/thermal/samsung/exynos_tmu.c
+++ b/drivers/thermal/samsung/exynos_tmu.c
@@ -666,7 +666,7 @@ static int exynos_get_temp(void *p, int *temp)
         struct exynos_tmu_data *data = p;
         int value, ret = 0;
 
-        if (!data || !data->tmu_read || !data->enabled)
+        if (!data || !data->tmu_read)
                 return -EINVAL;
         else if (!data->enabled)
                 /*
diff --git a/drivers/video/fbdev/aty/radeon_pm.c b/drivers/video/fbdev/aty/radeon_pm.c
index e695adb0e573..2dc5703eac51 100644
--- a/drivers/video/fbdev/aty/radeon_pm.c
+++ b/drivers/video/fbdev/aty/radeon_pm.c
@@ -2844,8 +2844,8 @@ void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk, int ignore_devlis
                  * in some desktop G4s), Via (M9+ chip on iBook G4) and
                  * Snowy (M11 chip on iBook G4 manufactured after July 2005)
                  */
-                if (!strcmp(rinfo->of_node->name, "ATY,JasperParent") ||
-                    !strcmp(rinfo->of_node->name, "ATY,SnowyParent")) {
+                if (of_node_name_eq(rinfo->of_node, "ATY,JasperParent") ||
+                    of_node_name_eq(rinfo->of_node, "ATY,SnowyParent")) {
                         rinfo->reinit_func = radeon_reinitialize_M10;
                         rinfo->pm_mode |= radeon_pm_off;
                 }
@@ -2855,7 +2855,7 @@ void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk, int ignore_devlis
                         rinfo->pm_mode |= radeon_pm_off;
                 }
 #endif
-                if (!strcmp(rinfo->of_node->name, "ATY,ViaParent")) {
+                if (of_node_name_eq(rinfo->of_node, "ATY,ViaParent")) {
                         rinfo->reinit_func = radeon_reinitialize_M9P;
                         rinfo->pm_mode |= radeon_pm_off;
                 }
diff --git a/drivers/video/fbdev/cg14.c b/drivers/video/fbdev/cg14.c
index 9af54c2368fd..a6dce1a78490 100644
--- a/drivers/video/fbdev/cg14.c
+++ b/drivers/video/fbdev/cg14.c
@@ -486,8 +486,8 @@ static int cg14_probe(struct platform_device *op)
                                           info->var.xres);
         info->fix.smem_len = PAGE_ALIGN(linebytes * info->var.yres);
 
-        if (!strcmp(dp->parent->name, "sbus") ||
-            !strcmp(dp->parent->name, "sbi")) {
+        if (of_node_name_eq(dp->parent, "sbus") ||
+            of_node_name_eq(dp->parent, "sbi")) {
                 info->fix.smem_start = op->resource[0].start;
                 par->iospace = op->resource[0].flags & IORESOURCE_BITS;
         } else {
diff --git a/drivers/video/fbdev/cg3.c b/drivers/video/fbdev/cg3.c
index 1bd95b02f3aa..6d42def8436b 100644
--- a/drivers/video/fbdev/cg3.c
+++ b/drivers/video/fbdev/cg3.c
@@ -369,7 +369,7 @@ static int cg3_probe(struct platform_device *op)
         info->var.red.length = 8;
         info->var.green.length = 8;
         info->var.blue.length = 8;
-        if (!strcmp(dp->name, "cgRDI"))
+        if (of_node_name_eq(dp, "cgRDI"))
                 par->flags |= CG3_FLAG_RDI;
         if (par->flags & CG3_FLAG_RDI)
                 cg3_rdi_maybe_fixup_var(&info->var, dp);
diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c
index 40182ed85648..ca549e1532e6 100644
--- a/drivers/video/fbdev/chipsfb.c
+++ b/drivers/video/fbdev/chipsfb.c
@@ -349,7 +349,7 @@ static void init_chips(struct fb_info *p, unsigned long addr)
 static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
 {
         struct fb_info *p;
-        unsigned long addr, size;
+        unsigned long addr;
         unsigned short cmd;
         int rc = -ENODEV;
 
@@ -361,7 +361,6 @@ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
         if ((dp->resource[0].flags & IORESOURCE_MEM) == 0)
                 goto err_disable;
         addr = pci_resource_start(dp, 0);
-        size = pci_resource_len(dp, 0);
         if (addr == 0)
                 goto err_disable;
 
diff --git a/drivers/video/fbdev/core/fb_cmdline.c b/drivers/video/fbdev/core/fb_cmdline.c
index 39509ccd92f1..3b5bd666b952 100644
--- a/drivers/video/fbdev/core/fb_cmdline.c
+++ b/drivers/video/fbdev/core/fb_cmdline.c
@@ -75,36 +75,33 @@ EXPORT_SYMBOL(fb_get_options);
  *      NOTE: This function is a __setup and __init function.
  *            It only stores the options.  Drivers have to call
  *            fb_get_options() as necessary.
- *
- *      Returns zero.
- *
  */
 static int __init video_setup(char *options)
 {
-        int i, global = 0;
-
         if (!options || !*options)
-                global = 1;
+                goto out;
 
-        if (!global && !strncmp(options, "ofonly", 6)) {
+        if (!strncmp(options, "ofonly", 6)) {
                 ofonly = 1;
-                global = 1;
+                goto out;
         }
 
-        if (!global && !strchr(options, ':')) {
-                fb_mode_option = options;
-                global = 1;
-        }
+        if (strchr(options, ':')) {
+                /* named */
+                int i;
 
-        if (!global) {
                 for (i = 0; i < FB_MAX; i++) {
                         if (video_options[i] == NULL) {
                                 video_options[i] = options;
                                 break;
                         }
                 }
+        } else {
+                /* global */
+                fb_mode_option = options;
         }
 
+out:
         return 1;
 }
 __setup("video=", video_setup);
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index bfa1360ec750..cd059a801662 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -656,11 +656,14 @@ static void fbcon_prepare_logo(struct vc_data *vc, struct fb_info *info,
                 kfree(save);
         }
 
+        if (logo_shown == FBCON_LOGO_DONTSHOW)
+                return;
+
         if (logo_lines > vc->vc_bottom) {
                 logo_shown = FBCON_LOGO_CANSHOW;
                 printk(KERN_INFO
                        "fbcon_init: disable boot-logo (boot-logo bigger than screen).\n");
-        } else if (logo_shown != FBCON_LOGO_DONTSHOW) {
+        } else {
                 logo_shown = FBCON_LOGO_DRAW;
                 vc->vc_top = logo_lines;
         }
@@ -999,7 +1002,7 @@ static const char *fbcon_startup(void)
                         if (!softback_buf) {
                                 softback_buf =
                                     (unsigned long)
-                                    kmalloc(fbcon_softback_size,
+                                    kvmalloc(fbcon_softback_size,
                                             GFP_KERNEL);
                                 if (!softback_buf) {
                                         fbcon_softback_size = 0;
@@ -1008,7 +1011,7 @@ static const char *fbcon_startup(void)
                         }
                 } else {
                         if (softback_buf) {
-                                kfree((void *) softback_buf);
+                                kvfree((void *) softback_buf);
                                 softback_buf = 0;
                                 softback_top = 0;
                         }
@@ -1066,6 +1069,9 @@ static void fbcon_init(struct vc_data *vc, int init)
 
         cap = info->flags;
 
+        if (console_loglevel <= CONSOLE_LOGLEVEL_QUIET)
+                logo_shown = FBCON_LOGO_DONTSHOW;
+
         if (vc != svc || logo_shown == FBCON_LOGO_DONTSHOW ||
             (info->fix.type == FB_TYPE_TEXT))
                 logo = 0;
@@ -3672,7 +3678,7 @@ static void fbcon_exit(void)
         }
 #endif
 
-        kfree((void *)softback_buf);
+        kvfree((void *)softback_buf);
         softback_buf = 0UL;
 
         for_each_registered_fb(i) {
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index cb43a2258c51..4721491e6c8c 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -431,6 +431,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
 {
         unsigned int x;
 
+        if (image->width > info->var.xres || image->height > info->var.yres)
+                return;
+
         if (rotate == FB_ROTATE_UR) {
                 for (x = 0;
                      x < num && image->dx + image->width <= info->var.xres;
diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c
index dd3128990776..3558a70a6664 100644
--- a/drivers/video/fbdev/core/fbmon.c
+++ b/drivers/video/fbdev/core/fbmon.c
@@ -978,6 +978,8 @@ void fb_edid_to_monspecs(unsigned char *edid, struct fb_monspecs *specs)
         get_monspecs(edid, specs);
 
         specs->modedb = fb_create_modedb(edid, &specs->modedb_len, specs);
+        if (!specs->modedb)
+                return;
 
         /*
          * Workaround for buggy EDIDs that sets that the first
diff --git a/drivers/video/fbdev/ffb.c b/drivers/video/fbdev/ffb.c
index 6b1915872af1..b7aee0c427a8 100644
--- a/drivers/video/fbdev/ffb.c
+++ b/drivers/video/fbdev/ffb.c
@@ -944,7 +944,7 @@ static int ffb_probe(struct platform_device *op)
 
         info->var.accel_flags = FB_ACCELF_TEXT;
 
-        if (!strcmp(dp->name, "SUNW,afb"))
+        if (of_node_name_eq(dp, "SUNW,afb"))
                 par->flags |= FFB_FLAG_AFB;
 
         par->board_type = of_getintprop_default(dp, "board_type", 0);
diff --git a/drivers/video/fbdev/geode/gxfb_core.c b/drivers/video/fbdev/geode/gxfb_core.c
index f4f76373b2a8..b1906cf5a8f0 100644
--- a/drivers/video/fbdev/geode/gxfb_core.c
+++ b/drivers/video/fbdev/geode/gxfb_core.c
@@ -33,6 +33,8 @@
 #include <linux/pci.h>
 #include <linux/cs5535.h>
 
+#include <asm/olpc.h>
+
 #include "gxfb.h"
 
 static char *mode_option;
@@ -107,9 +109,6 @@ static struct fb_videomode gx_modedb[] = {
           FB_VMODE_NONINTERLACED, FB_MODE_IS_VESA },
 };
 
-#ifdef CONFIG_OLPC
-#include <asm/olpc.h>
-
 static struct fb_videomode gx_dcon_modedb[] = {
         /* The only mode the DCON has is 1200x900 */
         { NULL, 50, 1200, 900, 17460, 24, 8, 4, 5, 8, 3,
@@ -128,14 +127,6 @@ static void get_modedb(struct fb_videomode **modedb, unsigned int *size)
         }
 }
 
-#else
-static void get_modedb(struct fb_videomode **modedb, unsigned int *size)
-{
-        *modedb = (struct fb_videomode *) gx_modedb;
-        *size = ARRAY_SIZE(gx_modedb);
-}
-#endif
-
 static int gxfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
 {
         if (var->xres > 1600 || var->yres > 1200)
diff --git a/drivers/video/fbdev/geode/lxfb_core.c b/drivers/video/fbdev/geode/lxfb_core.c
index 138da6cb6cbc..17ab905811b1 100644
--- a/drivers/video/fbdev/geode/lxfb_core.c
+++ b/drivers/video/fbdev/geode/lxfb_core.c
@@ -23,6 +23,8 @@
 #include <linux/pci.h>
 #include <linux/uaccess.h>
 
+#include <asm/olpc.h>
+
 #include "lxfb.h"
 
 static char *mode_option;
@@ -216,9 +218,6 @@ static struct fb_videomode geode_modedb[] = {
           0, FB_VMODE_NONINTERLACED, 0 },
 };
 
-#ifdef CONFIG_OLPC
-#include <asm/olpc.h>
-
 static struct fb_videomode olpc_dcon_modedb[] = {
         /* The only mode the DCON has is 1200x900 */
         { NULL, 50, 1200, 900, 17460, 24, 8, 4, 5, 8, 3,
@@ -237,14 +236,6 @@ static void get_modedb(struct fb_videomode **modedb, unsigned int *size)
         }
 }
 
-#else
-static void get_modedb(struct fb_videomode **modedb, unsigned int *size)
-{
-        *modedb = (struct fb_videomode *) geode_modedb;
-        *size = ARRAY_SIZE(geode_modedb);
-}
-#endif
-
 static int lxfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
 {
         if (var->xres > 1920 || var->yres > 1440)
diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c
index 5d9670daf60e..4b9615e4ce74 100644
--- a/drivers/video/fbdev/imsttfb.c
+++ b/drivers/video/fbdev/imsttfb.c
@@ -1497,8 +1497,8 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         switch (pdev->device) {
                 case PCI_DEVICE_ID_IMS_TT128: /* IMS,tt128mbA */
                         par->ramdac = IBM;
-                        if (dp && ((strcmp(dp->name, "IMS,tt128mb8") == 0) ||
-                                   (strcmp(dp->name, "IMS,tt128mb8A") == 0)))
+                        if (of_node_name_eq(dp, "IMS,tt128mb8") ||
+                            of_node_name_eq(dp, "IMS,tt128mb8A"))
                                 par->ramdac = TVP;
                         break;
                 case PCI_DEVICE_ID_IMS_TT3D:  /* IMS,tt3d */
diff --git a/drivers/video/fbdev/mbx/mbxdebugfs.c b/drivers/video/fbdev/mbx/mbxdebugfs.c
index 2bd328883178..09af721638fb 100644
--- a/drivers/video/fbdev/mbx/mbxdebugfs.c
+++ b/drivers/video/fbdev/mbx/mbxdebugfs.c
@@ -211,36 +211,22 @@ static const struct file_operations misc_fops = {
 static void mbxfb_debugfs_init(struct fb_info *fbi)
 {
         struct mbxfb_info *mfbi = fbi->par;
-        struct mbxfb_debugfs_data *dbg;
-
-        dbg = kzalloc(sizeof(struct mbxfb_debugfs_data), GFP_KERNEL);
-        mfbi->debugfs_data = dbg;
-
-        dbg->dir = debugfs_create_dir("mbxfb", NULL);
-        dbg->sysconf = debugfs_create_file("sysconf", 0444, dbg->dir,
-                                      fbi, &sysconf_fops);
-        dbg->clock = debugfs_create_file("clock", 0444, dbg->dir,
-                                    fbi, &clock_fops);
-        dbg->display = debugfs_create_file("display", 0444, dbg->dir,
-                                      fbi, &display_fops);
-        dbg->gsctl = debugfs_create_file("gsctl", 0444, dbg->dir,
-                                    fbi, &gsctl_fops);
-        dbg->sdram = debugfs_create_file("sdram", 0444, dbg->dir,
-                                        fbi, &sdram_fops);
-        dbg->misc = debugfs_create_file("misc", 0444, dbg->dir,
-                                        fbi, &misc_fops);
+        struct dentry *dir;
+
+        dir = debugfs_create_dir("mbxfb", NULL);
+        mfbi->debugfs_dir = dir;
+
+        debugfs_create_file("sysconf", 0444, dir, fbi, &sysconf_fops);
+        debugfs_create_file("clock", 0444, dir, fbi, &clock_fops);
+        debugfs_create_file("display", 0444, dir, fbi, &display_fops);
+        debugfs_create_file("gsctl", 0444, dir, fbi, &gsctl_fops);
+        debugfs_create_file("sdram", 0444, dir, fbi, &sdram_fops);
+        debugfs_create_file("misc", 0444, dir, fbi, &misc_fops);
 }
 
 static void mbxfb_debugfs_remove(struct fb_info *fbi)
 {
         struct mbxfb_info *mfbi = fbi->par;
-        struct mbxfb_debugfs_data *dbg = mfbi->debugfs_data;
-
-        debugfs_remove(dbg->misc);
-        debugfs_remove(dbg->sdram);
-        debugfs_remove(dbg->gsctl);
-        debugfs_remove(dbg->display);
-        debugfs_remove(dbg->clock);
-        debugfs_remove(dbg->sysconf);
-        debugfs_remove(dbg->dir);
+
+        debugfs_remove_recursive(mfbi->debugfs_dir);
 }
diff --git a/drivers/video/fbdev/mbx/mbxfb.c b/drivers/video/fbdev/mbx/mbxfb.c
index 539b85da0897..6ded480a69b4 100644
--- a/drivers/video/fbdev/mbx/mbxfb.c
+++ b/drivers/video/fbdev/mbx/mbxfb.c
@@ -74,7 +74,7 @@ struct mbxfb_info {
 
         u32 pseudo_palette[MAX_PALETTES];
 #ifdef CONFIG_FB_MBX_DEBUG
-        void *debugfs_data;
+        struct dentry *debugfs_dir;
 #endif
 
 };
diff --git a/drivers/video/fbdev/offb.c b/drivers/video/fbdev/offb.c
index 057d3cdef92e..fbc6eafb63c7 100644
--- a/drivers/video/fbdev/offb.c
+++ b/drivers/video/fbdev/offb.c
@@ -141,6 +141,7 @@ static int offb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
                 /* Clear PALETTE_ACCESS_CNTL in DAC_CNTL */
                 out_le32(par->cmap_adr + 0x58,
                          in_le32(par->cmap_adr + 0x58) & ~0x20);
+                /* fall through */
         case cmap_r128:
                 /* Set palette index & data */
                 out_8(par->cmap_adr + 0xb0, regno);
@@ -210,6 +211,7 @@ static int offb_blank(int blank, struct fb_info *info)
                                 /* Clear PALETTE_ACCESS_CNTL in DAC_CNTL */
                                 out_le32(par->cmap_adr + 0x58,
                                          in_le32(par->cmap_adr + 0x58) & ~0x20);
+                                /* fall through */
                         case cmap_r128:
                                 /* Set palette index & data */
                                 out_8(par->cmap_adr + 0xb0, i);
@@ -646,7 +648,7 @@ static void __init offb_init_nodriver(struct device_node *dp, int no_real_node)
                 }
 #endif
                 /* kludge for valkyrie */
-                if (strcmp(dp->name, "valkyrie") == 0)
+                if (of_node_name_eq(dp, "valkyrie"))
                         address += 0x1000;
                 offb_init_fb(no_real_node ? "bootx" : NULL,
                              width, height, depth, pitch, address,
diff --git a/drivers/video/fbdev/omap2/omapfb/dss/core.c b/drivers/video/fbdev/omap2/omapfb/dss/core.c
index b4bcf3a4a647..b5956a1a30d4 100644
--- a/drivers/video/fbdev/omap2/omapfb/dss/core.c
+++ b/drivers/video/fbdev/omap2/omapfb/dss/core.c
@@ -110,19 +110,12 @@ DEFINE_SHOW_ATTRIBUTE(dss);
 
 static struct dentry *dss_debugfs_dir;
 
-static int dss_initialize_debugfs(void)
+static void dss_initialize_debugfs(void)
 {
         dss_debugfs_dir = debugfs_create_dir("omapdss", NULL);
-        if (IS_ERR(dss_debugfs_dir)) {
-                int err = PTR_ERR(dss_debugfs_dir);
-                dss_debugfs_dir = NULL;
-                return err;
-        }
 
         debugfs_create_file("clk", S_IRUGO, dss_debugfs_dir,
                         &dss_debug_dump_clocks, &dss_fops);
-
-        return 0;
 }
 
 static void dss_uninitialize_debugfs(void)
@@ -130,26 +123,19 @@ static void dss_uninitialize_debugfs(void)
         debugfs_remove_recursive(dss_debugfs_dir);
 }
 
-int dss_debugfs_create_file(const char *name, void (*write)(struct seq_file *))
+void dss_debugfs_create_file(const char *name, void (*write)(struct seq_file *))
 {
-        struct dentry *d;
-
-        d = debugfs_create_file(name, S_IRUGO, dss_debugfs_dir,
-                        write, &dss_fops);
-
-        return PTR_ERR_OR_ZERO(d);
+        debugfs_create_file(name, S_IRUGO, dss_debugfs_dir, write, &dss_fops);
 }
 #else /* CONFIG_FB_OMAP2_DSS_DEBUGFS */
-static inline int dss_initialize_debugfs(void)
+static inline void dss_initialize_debugfs(void)
 {
-        return 0;
 }
 static inline void dss_uninitialize_debugfs(void)
 {
 }
-int dss_debugfs_create_file(const char *name, void (*write)(struct seq_file *))
+void dss_debugfs_create_file(const char *name, void (*write)(struct seq_file *))
 {
-        return 0;
 }
 #endif /* CONFIG_FB_OMAP2_DSS_DEBUGFS */
 
@@ -182,15 +168,11 @@ static struct notifier_block omap_dss_pm_notif_block = {
 
 static int __init omap_dss_probe(struct platform_device *pdev)
 {
-        int r;
-
         core.pdev = pdev;
 
         dss_features_init(omapdss_get_version());
 
-        r = dss_initialize_debugfs();
-        if (r)
-                goto err_debugfs;
+        dss_initialize_debugfs();
 
         if (def_disp_name)
                 core.default_display_name = def_disp_name;
@@ -198,10 +180,6 @@ static int __init omap_dss_probe(struct platform_device *pdev)
         register_pm_notifier(&omap_dss_pm_notif_block);
 
         return 0;
-
-err_debugfs:
-
-        return r;
 }
 
 static int omap_dss_remove(struct platform_device *pdev)
diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c b/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c
index f1eb8b0f8a2a..5ce893c1923d 100644
--- a/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c
+++ b/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c
@@ -60,7 +60,7 @@ omapdss_of_get_next_port(const struct device_node *parent,
                                 return NULL;
                         }
                         prev = port;
-                } while (of_node_cmp(port->name, "port") != 0);
+                } while (!of_node_name_eq(port, "port"));
 
                 of_node_put(ports);
         }
@@ -83,7 +83,7 @@ omapdss_of_get_next_endpoint(const struct device_node *parent,
                 if (!ep)
                         return NULL;
                 prev = ep;
-        } while (of_node_cmp(ep->name, "endpoint") != 0);
+        } while (!of_node_name_eq(ep, "endpoint"));
 
         return ep;
 }
diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dss.h b/drivers/video/fbdev/omap2/omapfb/dss/dss.h
index a3cc0ca8f9d2..b1a354494144 100644
--- a/drivers/video/fbdev/omap2/omapfb/dss/dss.h
+++ b/drivers/video/fbdev/omap2/omapfb/dss/dss.h
@@ -214,7 +214,7 @@ struct platform_device *dss_get_core_pdev(void);
 int dss_dsi_enable_pads(int dsi_id, unsigned lane_mask);
 void dss_dsi_disable_pads(int dsi_id, unsigned lane_mask);
 int dss_set_min_bus_tput(struct device *dev, unsigned long tput);
-int dss_debugfs_create_file(const char *name, void (*write)(struct seq_file *));
+void dss_debugfs_create_file(const char *name, void (*write)(struct seq_file *));
 
 /* display */
 int dss_suspend_all_devices(void);
diff --git a/drivers/video/fbdev/omap2/omapfb/dss/hdmi4_core.c b/drivers/video/fbdev/omap2/omapfb/dss/hdmi4_core.c
index fa72e735dad2..d146793dd044 100644
--- a/drivers/video/fbdev/omap2/omapfb/dss/hdmi4_core.c
+++ b/drivers/video/fbdev/omap2/omapfb/dss/hdmi4_core.c
@@ -712,7 +712,7 @@ int hdmi4_audio_config(struct hdmi_core_data *core, struct hdmi_wp_data *wp,
         else
                 acore.i2s_cfg.justification = HDMI_AUDIO_JUSTIFY_RIGHT;
         /*
-         * The I2S input word length is twice the lenght given in the IEC-60958
+         * The I2S input word length is twice the length given in the IEC-60958
          * status word. If the word size is greater than
          * 20 bits, increment by one.
          */
diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c
index 4061a20cfe24..3b361bc9feb8 100644
--- a/drivers/video/fbdev/ssd1307fb.c
+++ b/drivers/video/fbdev/ssd1307fb.c
@@ -667,10 +667,10 @@ static int ssd1307fb_probe(struct i2c_client *client,
 
         if (par->reset) {
                 /* Reset the screen */
-                gpiod_set_value_cansleep(par->reset, 0);
-                udelay(4);
                 gpiod_set_value_cansleep(par->reset, 1);
                 udelay(4);
+                gpiod_set_value_cansleep(par->reset, 0);
+                udelay(4);
         }
 
         if (par->vbat_reg) {
diff --git a/drivers/video/fbdev/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c
index 7bb7e90b8f00..bdf5a0ea876d 100644
--- a/drivers/video/fbdev/via/viafbdev.c
+++ b/drivers/video/fbdev/via/viafbdev.c
@@ -2110,7 +2110,7 @@ MODULE_PARM_DESC(viafb_lcd_panel_id,
 
 module_param(viafb_lcd_dsp_method, int, S_IRUSR);
 MODULE_PARM_DESC(viafb_lcd_dsp_method,
-        "Set Flat Panel display scaling method.(Default=Expandsion)");
+        "Set Flat Panel display scaling method.(Default=Expansion)");
 
 module_param(viafb_SAMM_ON, int, S_IRUSR);
 MODULE_PARM_DESC(viafb_SAMM_ON,
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 39b229f9e256..d37dd5bb7a8f 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -604,6 +604,7 @@ int alloc_xenballooned_pages(int nr_pages, struct page **pages)
         while (pgno < nr_pages) {
                 page = balloon_retrieve(true);
                 if (page) {
+                        __ClearPageOffline(page);
                         pages[pgno++] = page;
 #ifdef CONFIG_XEN_HAVE_PVMMU
                         /*
@@ -645,8 +646,10 @@ void free_xenballooned_pages(int nr_pages, struct page **pages)
         mutex_lock(&balloon_mutex);
 
         for (i = 0; i < nr_pages; i++) {
-                if (pages[i])
+                if (pages[i]) {
+                        __SetPageOffline(pages[i]);
                         balloon_append(pages[i]);
+                }
         }
 
         balloon_stats.target_unpopulated -= nr_pages;
diff --git a/fs/9p/v9fs_vfs.h b/fs/9p/v9fs_vfs.h
index 5a0db6dec8d1..aaee1e6584e6 100644
--- a/fs/9p/v9fs_vfs.h
+++ b/fs/9p/v9fs_vfs.h
@@ -40,6 +40,9 @@
  */
 #define P9_LOCK_TIMEOUT (30*HZ)
 
+/* flags for v9fs_stat2inode() & v9fs_stat2inode_dotl() */
+#define V9FS_STAT2INODE_KEEP_ISIZE 1
+
 extern struct file_system_type v9fs_fs_type;
 extern const struct address_space_operations v9fs_addr_operations;
 extern const struct file_operations v9fs_file_operations;
@@ -61,8 +64,10 @@ int v9fs_init_inode(struct v9fs_session_info *v9ses,
                     struct inode *inode, umode_t mode, dev_t);
 void v9fs_evict_inode(struct inode *inode);
 ino_t v9fs_qid2ino(struct p9_qid *qid);
-void v9fs_stat2inode(struct p9_wstat *, struct inode *, struct super_block *);
-void v9fs_stat2inode_dotl(struct p9_stat_dotl *, struct inode *);
+void v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode,
+                      struct super_block *sb, unsigned int flags);
+void v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode,
+                           unsigned int flags);
 int v9fs_dir_release(struct inode *inode, struct file *filp);
 int v9fs_file_open(struct inode *inode, struct file *file);
 void v9fs_inode2stat(struct inode *inode, struct p9_wstat *stat);
@@ -83,4 +88,18 @@ static inline void v9fs_invalidate_inode_attr(struct inode *inode)
 }
 
 int v9fs_open_to_dotl_flags(int flags);
+
+static inline void v9fs_i_size_write(struct inode *inode, loff_t i_size)
+{
+        /*
+         * 32-bit need the lock, concurrent updates could break the
+         * sequences and make i_size_read() loop forever.
+         * 64-bit updates are atomic and can skip the locking.
+         */
+        if (sizeof(i_size) > sizeof(long))
+                spin_lock(&inode->i_lock);
+        i_size_write(inode, i_size);
+        if (sizeof(i_size) > sizeof(long))
+                spin_unlock(&inode->i_lock);
+}
 #endif
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index a25efa782fcc..9a1125305d84 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -446,7 +446,11 @@ v9fs_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
                 i_size = i_size_read(inode);
                 if (iocb->ki_pos > i_size) {
                         inode_add_bytes(inode, iocb->ki_pos - i_size);
-                        i_size_write(inode, iocb->ki_pos);
+                        /*
+                         * Need to serialize against i_size_write() in
+                         * v9fs_stat2inode()
+                         */
+                        v9fs_i_size_write(inode, iocb->ki_pos);
                 }
                 return retval;
         }
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 85ff859d3af5..72b779bc0942 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -538,7 +538,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb,
         if (retval)
                 goto error;
 
-        v9fs_stat2inode(st, inode, sb);
+        v9fs_stat2inode(st, inode, sb, 0);
         v9fs_cache_inode_get_cookie(inode);
         unlock_new_inode(inode);
         return inode;
@@ -1092,7 +1092,7 @@ v9fs_vfs_getattr(const struct path *path, struct kstat *stat,
         if (IS_ERR(st))
                 return PTR_ERR(st);
 
-        v9fs_stat2inode(st, d_inode(dentry), dentry->d_sb);
+        v9fs_stat2inode(st, d_inode(dentry), dentry->d_sb, 0);
         generic_fillattr(d_inode(dentry), stat);
 
         p9stat_free(st);
@@ -1170,12 +1170,13 @@ static int v9fs_vfs_setattr(struct dentry *dentry, struct iattr *iattr)
  * @stat: Plan 9 metadata (mistat) structure
  * @inode: inode to populate
  * @sb: superblock of filesystem
+ * @flags: control flags (e.g. V9FS_STAT2INODE_KEEP_ISIZE)
  *
  */
 
 void
 v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode,
-        struct super_block *sb)
+                 struct super_block *sb, unsigned int flags)
 {
         umode_t mode;
         char ext[32];
@@ -1216,10 +1217,11 @@ v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode,
         mode = p9mode2perm(v9ses, stat);
         mode |= inode->i_mode & ~S_IALLUGO;
         inode->i_mode = mode;
-        i_size_write(inode, stat->length);
 
+        if (!(flags & V9FS_STAT2INODE_KEEP_ISIZE))
+                v9fs_i_size_write(inode, stat->length);
         /* not real number of blocks, but 512 byte ones ... */
-        inode->i_blocks = (i_size_read(inode) + 512 - 1) >> 9;
+        inode->i_blocks = (stat->length + 512 - 1) >> 9;
         v9inode->cache_validity &= ~V9FS_INO_INVALID_ATTR;
 }
 
@@ -1416,9 +1418,9 @@ int v9fs_refresh_inode(struct p9_fid *fid, struct inode *inode)
 {
         int umode;
         dev_t rdev;
-        loff_t i_size;
         struct p9_wstat *st;
         struct v9fs_session_info *v9ses;
+        unsigned int flags;
 
         v9ses = v9fs_inode2v9ses(inode);
         st = p9_client_stat(fid);
@@ -1431,16 +1433,13 @@ int v9fs_refresh_inode(struct p9_fid *fid, struct inode *inode)
         if ((inode->i_mode & S_IFMT) != (umode & S_IFMT))
                 goto out;
 
-        spin_lock(&inode->i_lock);
         /*
          * We don't want to refresh inode->i_size,
          * because we may have cached data
          */
-        i_size = inode->i_size;
-        v9fs_stat2inode(st, inode, inode->i_sb);
-        if (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE)
-                inode->i_size = i_size;
-        spin_unlock(&inode->i_lock);
+        flags = (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) ?
+                V9FS_STAT2INODE_KEEP_ISIZE : 0;
+        v9fs_stat2inode(st, inode, inode->i_sb, flags);
 out:
         p9stat_free(st);
         kfree(st);
diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
index 4823e1c46999..a950a927a626 100644
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -143,7 +143,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb,
         if (retval)
                 goto error;
 
-        v9fs_stat2inode_dotl(st, inode);
+        v9fs_stat2inode_dotl(st, inode, 0);
         v9fs_cache_inode_get_cookie(inode);
         retval = v9fs_get_acl(inode, fid);
         if (retval)
@@ -496,7 +496,7 @@ v9fs_vfs_getattr_dotl(const struct path *path, struct kstat *stat,
         if (IS_ERR(st))
                 return PTR_ERR(st);
 
-        v9fs_stat2inode_dotl(st, d_inode(dentry));
+        v9fs_stat2inode_dotl(st, d_inode(dentry), 0);
         generic_fillattr(d_inode(dentry), stat);
         /* Change block size to what the server returned */
         stat->blksize = st->st_blksize;
@@ -607,11 +607,13 @@ int v9fs_vfs_setattr_dotl(struct dentry *dentry, struct iattr *iattr)
  * v9fs_stat2inode_dotl - populate an inode structure with stat info
  * @stat: stat structure
  * @inode: inode to populate
+ * @flags: ctrl flags (e.g. V9FS_STAT2INODE_KEEP_ISIZE)
  *
  */
 
 void
-v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode)
+v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode,
+                      unsigned int flags)
 {
         umode_t mode;
         struct v9fs_inode *v9inode = V9FS_I(inode);
@@ -631,7 +633,8 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode)
                 mode |= inode->i_mode & ~S_IALLUGO;
                 inode->i_mode = mode;
 
-                i_size_write(inode, stat->st_size);
+                if (!(flags & V9FS_STAT2INODE_KEEP_ISIZE))
+                        v9fs_i_size_write(inode, stat->st_size);
                 inode->i_blocks = stat->st_blocks;
         } else {
                 if (stat->st_result_mask & P9_STATS_ATIME) {
@@ -661,8 +664,9 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode)
                 }
                 if (stat->st_result_mask & P9_STATS_RDEV)
                         inode->i_rdev = new_decode_dev(stat->st_rdev);
-                if (stat->st_result_mask & P9_STATS_SIZE)
-                        i_size_write(inode, stat->st_size);
+                if (!(flags & V9FS_STAT2INODE_KEEP_ISIZE) &&
+                    stat->st_result_mask & P9_STATS_SIZE)
+                        v9fs_i_size_write(inode, stat->st_size);
                 if (stat->st_result_mask & P9_STATS_BLOCKS)
                         inode->i_blocks = stat->st_blocks;
         }
@@ -928,9 +932,9 @@ v9fs_vfs_get_link_dotl(struct dentry *dentry,
 
 int v9fs_refresh_inode_dotl(struct p9_fid *fid, struct inode *inode)
 {
-        loff_t i_size;
         struct p9_stat_dotl *st;
         struct v9fs_session_info *v9ses;
+        unsigned int flags;
 
         v9ses = v9fs_inode2v9ses(inode);
         st = p9_client_getattr_dotl(fid, P9_STATS_ALL);
@@ -942,16 +946,13 @@ int v9fs_refresh_inode_dotl(struct p9_fid *fid, struct inode *inode)
         if ((inode->i_mode & S_IFMT) != (st->st_mode & S_IFMT))
                 goto out;
 
-        spin_lock(&inode->i_lock);
         /*
          * We don't want to refresh inode->i_size,
          * because we may have cached data
          */
-        i_size = inode->i_size;
-        v9fs_stat2inode_dotl(st, inode);
-        if (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE)
-                inode->i_size = i_size;
-        spin_unlock(&inode->i_lock);
+        flags = (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) ?
+                V9FS_STAT2INODE_KEEP_ISIZE : 0;
+        v9fs_stat2inode_dotl(st, inode, flags);
 out:
         kfree(st);
         return 0;
diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c
index 10d3bd3f534b..d13d35cf69c0 100644
--- a/fs/9p/vfs_super.c
+++ b/fs/9p/vfs_super.c
@@ -172,7 +172,7 @@ static struct dentry *v9fs_mount(struct file_system_type *fs_type, int flags,
                         goto release_sb;
                 }
                 d_inode(root)->i_ino = v9fs_qid2ino(&st->qid);
-                v9fs_stat2inode_dotl(st, d_inode(root));
+                v9fs_stat2inode_dotl(st, d_inode(root), 0);
                 kfree(st);
         } else {
                 struct p9_wstat *st = NULL;
@@ -183,7 +183,7 @@ static struct dentry *v9fs_mount(struct file_system_type *fs_type, int flags,
                 }
 
                 d_inode(root)->i_ino = v9fs_qid2ino(&st->qid);
-                v9fs_stat2inode(st, d_inode(root), sb);
+                v9fs_stat2inode(st, d_inode(root), sb, 0);
 
                 p9stat_free(st);
                 kfree(st);
diff --git a/fs/block_dev.c b/fs/block_dev.c
index e9faa52bb489..78d3257435c0 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -336,12 +336,14 @@ static void blkdev_bio_end_io(struct bio *bio)
         if (should_dirty) {
                 bio_check_pages_dirty(bio);
         } else {
-                struct bio_vec *bvec;
-                int i;
-                struct bvec_iter_all iter_all;
+                if (!bio_flagged(bio, BIO_NO_PAGE_REF)) {
+                        struct bvec_iter_all iter_all;
+                        struct bio_vec *bvec;
+                        int i;
 
-                bio_for_each_segment_all(bvec, bio, i, iter_all)
-                        put_page(bvec->bv_page);
+                        bio_for_each_segment_all(bvec, bio, i, iter_all)
+                                put_page(bvec->bv_page);
+                }
                 bio_put(bio);
         }
 }
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 1d49694e6ae3..c5880329ae37 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -6174,7 +6174,7 @@ static void btrfs_calculate_inode_block_rsv_size(struct btrfs_fs_info *fs_info,
          *
          * This is overestimating in most cases.
          */
-        qgroup_rsv_size = outstanding_extents * fs_info->nodesize;
+        qgroup_rsv_size = (u64)outstanding_extents * fs_info->nodesize;
 
         spin_lock(&block_rsv->lock);
         block_rsv->size = reserve_size;
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index eb680b715dd6..e659d9d61107 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1922,8 +1922,8 @@ static int qgroup_trace_new_subtree_blocks(struct btrfs_trans_handle* trans,
         int i;
 
         /* Level sanity check */
-        if (cur_level < 0 || cur_level >= BTRFS_MAX_LEVEL ||
-            root_level < 0 || root_level >= BTRFS_MAX_LEVEL ||
+        if (cur_level < 0 || cur_level >= BTRFS_MAX_LEVEL - 1 ||
+            root_level < 0 || root_level >= BTRFS_MAX_LEVEL - 1 ||
             root_level < cur_level) {
                 btrfs_err_rl(fs_info,
                         "%s: bad levels, cur_level=%d root_level=%d",
diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
index 1869ba8e5981..67a6f7d47402 100644
--- a/fs/btrfs/raid56.c
+++ b/fs/btrfs/raid56.c
@@ -2430,8 +2430,9 @@ static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio,
                         bitmap_clear(rbio->dbitmap, pagenr, 1);
                 kunmap(p);
 
-                for (stripe = 0; stripe < rbio->real_stripes; stripe++)
+                for (stripe = 0; stripe < nr_data; stripe++)
                         kunmap(page_in_rbio(rbio, stripe, pagenr, 0));
+                kunmap(p_page);
         }
 
         __free_page(p_page);
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index acdad6d658f5..e4e665f422fc 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1886,8 +1886,10 @@ static void btrfs_cleanup_pending_block_groups(struct btrfs_trans_handle *trans)
        }
 }
 
-static inline int btrfs_start_delalloc_flush(struct btrfs_fs_info *fs_info)
+static inline int btrfs_start_delalloc_flush(struct btrfs_trans_handle *trans)
 {
+        struct btrfs_fs_info *fs_info = trans->fs_info;
+
         /*
          * We use writeback_inodes_sb here because if we used
          * btrfs_start_delalloc_roots we would deadlock with fs freeze.
@@ -1897,15 +1899,50 @@ static inline int btrfs_start_delalloc_flush(struct btrfs_fs_info *fs_info)
          * from already being in a transaction and our join_transaction doesn't
          * have to re-take the fs freeze lock.
          */
-        if (btrfs_test_opt(fs_info, FLUSHONCOMMIT))
+        if (btrfs_test_opt(fs_info, FLUSHONCOMMIT)) {
                 writeback_inodes_sb(fs_info->sb, WB_REASON_SYNC);
+        } else {
+                struct btrfs_pending_snapshot *pending;
+                struct list_head *head = &trans->transaction->pending_snapshots;
+
+                /*
+                 * Flush dellaloc for any root that is going to be snapshotted.
+                 * This is done to avoid a corrupted version of files, in the
+                 * snapshots, that had both buffered and direct IO writes (even
+                 * if they were done sequentially) due to an unordered update of
+                 * the inode's size on disk.
+                 */
+                list_for_each_entry(pending, head, list) {
+                        int ret;
+
+                        ret = btrfs_start_delalloc_snapshot(pending->root);
+                        if (ret)
+                                return ret;
+                }
+        }
         return 0;
 }
 
-static inline void btrfs_wait_delalloc_flush(struct btrfs_fs_info *fs_info)
+static inline void btrfs_wait_delalloc_flush(struct btrfs_trans_handle *trans)
 {
-        if (btrfs_test_opt(fs_info, FLUSHONCOMMIT))
+        struct btrfs_fs_info *fs_info = trans->fs_info;
+
+        if (btrfs_test_opt(fs_info, FLUSHONCOMMIT)) {
                 btrfs_wait_ordered_roots(fs_info, U64_MAX, 0, (u64)-1);
+        } else {
+                struct btrfs_pending_snapshot *pending;
+                struct list_head *head = &trans->transaction->pending_snapshots;
+
+                /*
+                 * Wait for any dellaloc that we started previously for the roots
+                 * that are going to be snapshotted. This is to avoid a corrupted
+                 * version of files in the snapshots that had both buffered and
+                 * direct IO writes (even if they were done sequentially).
+                 */
+                list_for_each_entry(pending, head, list)
+                        btrfs_wait_ordered_extents(pending->root,
+                                                   U64_MAX, 0, U64_MAX);
+        }
 }
 
 int btrfs_commit_transaction(struct btrfs_trans_handle *trans)
@@ -2023,7 +2060,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans)
 
         extwriter_counter_dec(cur_trans, trans->type);
 
-        ret = btrfs_start_delalloc_flush(fs_info);
+        ret = btrfs_start_delalloc_flush(trans);
         if (ret)
                 goto cleanup_transaction;
 
@@ -2039,7 +2076,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans)
         if (ret)
                 goto cleanup_transaction;
 
-        btrfs_wait_delalloc_flush(fs_info);
+        btrfs_wait_delalloc_flush(trans);
 
         btrfs_scrub_pause(fs_info);
         /*
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index f06454a55e00..561884f60d35 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3578,9 +3578,16 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans,
         }
         btrfs_release_path(path);
 
-        /* find the first key from this transaction again */
+        /*
+         * Find the first key from this transaction again.  See the note for
+         * log_new_dir_dentries, if we're logging a directory recursively we
+         * won't be holding its i_mutex, which means we can modify the directory
+         * while we're logging it.  If we remove an entry between our first
+         * search and this search we'll not find the key again and can just
+         * bail.
+         */
         ret = btrfs_search_slot(NULL, root, &min_key, path, 0, 0);
-        if (WARN_ON(ret != 0))
+        if (ret != 0)
                 goto done;
 
         /*
@@ -4544,6 +4551,19 @@ static int logged_inode_size(struct btrfs_root *log, struct btrfs_inode *inode,
                 item = btrfs_item_ptr(path->nodes[0], path->slots[0],
                                       struct btrfs_inode_item);
                 *size_ret = btrfs_inode_size(path->nodes[0], item);
+                /*
+                 * If the in-memory inode's i_size is smaller then the inode
+                 * size stored in the btree, return the inode's i_size, so
+                 * that we get a correct inode size after replaying the log
+                 * when before a power failure we had a shrinking truncate
+                 * followed by addition of a new name (rename / new hard link).
+                 * Otherwise return the inode size from the btree, to avoid
+                 * data loss when replaying a log due to previously doing a
+                 * write that expands the inode's size and logging a new name
+                 * immediately after.
+                 */
+                if (*size_ret > inode->vfs_inode.i_size)
+                        *size_ret = inode->vfs_inode.i_size;
         }
 
         btrfs_release_path(path);
@@ -4705,15 +4725,8 @@ static int btrfs_log_trailing_hole(struct btrfs_trans_handle *trans,
                                         struct btrfs_file_extent_item);
 
                 if (btrfs_file_extent_type(leaf, extent) ==
-                    BTRFS_FILE_EXTENT_INLINE) {
-                        len = btrfs_file_extent_ram_bytes(leaf, extent);
-                        ASSERT(len == i_size ||
-                               (len == fs_info->sectorsize &&
-                                btrfs_file_extent_compression(leaf, extent) !=
-                                BTRFS_COMPRESS_NONE) ||
-                               (len < i_size && i_size < fs_info->sectorsize));
+                    BTRFS_FILE_EXTENT_INLINE)
                         return 0;
-                }
 
                 len = btrfs_file_extent_num_bytes(leaf, extent);
                 /* Last extent goes beyond i_size, no need to log a hole. */
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 9024eee889b9..db934ceae9c1 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -6407,7 +6407,7 @@ static void btrfs_end_bio(struct bio *bio)
                                 if (bio_op(bio) == REQ_OP_WRITE)
                                         btrfs_dev_stat_inc_and_print(dev,
                                                 BTRFS_DEV_STAT_WRITE_ERRS);
-                                else
+                                else if (!(bio->bi_opf & REQ_RAHEAD))
                                         btrfs_dev_stat_inc_and_print(dev,
                                                 BTRFS_DEV_STAT_READ_ERRS);
                                 if (bio->bi_opf & REQ_PREFLUSH)
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index e92a2fee3c57..13c1288b04a7 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -115,7 +115,12 @@ static void cifs_debug_tcon(struct seq_file *m, struct cifs_tcon *tcon)
                 seq_puts(m, " type: CDROM ");
         else
                 seq_printf(m, " type: %d ", dev_type);
-        if (tcon->seal)
+
+        seq_printf(m, "Serial Number: 0x%x", tcon->vol_serial_number);
+
+        if ((tcon->seal) ||
+            (tcon->ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) ||
+            (tcon->share_flags & SHI1005_FLAGS_ENCRYPT_DATA))
                 seq_printf(m, " Encrypted");
         if (tcon->nocase)
                 seq_printf(m, " nocase");
@@ -371,6 +376,10 @@ skip_rdma:
                                 atomic_read(&server->in_send),
                                 atomic_read(&server->num_waiters));
 #endif
+                        if (ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA)
+                                seq_puts(m, " encrypted");
+                        if (ses->sign)
+                                seq_puts(m, " signed");
 
                         seq_puts(m, "\n\tShares:");
                         j = 0;
diff --git a/fs/cifs/cifs_ioctl.h b/fs/cifs/cifs_ioctl.h
index d8bce2f862de..086ddc5108af 100644
--- a/fs/cifs/cifs_ioctl.h
+++ b/fs/cifs/cifs_ioctl.h
@@ -43,6 +43,9 @@ struct smb_snapshot_array {
         /*      snapshots[]; */
 } __packed;
 
+/* query_info flags */
+#define PASSTHRU_QUERY_INFO     0x00000000
+#define PASSTHRU_FSCTL          0x00000001
 struct smb_query_info {
         __u32   info_type;
         __u32   file_info_class;
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 217276b8b942..f9b71c12cc9f 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -1008,7 +1008,7 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off,
         unsigned int xid;
         int rc;
 
-        if (remap_flags & ~REMAP_FILE_ADVISORY)
+        if (remap_flags & ~(REMAP_FILE_DEDUP | REMAP_FILE_ADVISORY))
                 return -EINVAL;
 
         cifs_dbg(FYI, "clone range\n");
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index 142164ef1f05..5c0298b9998f 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -150,5 +150,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* CONFIG_CIFS_NFSD_EXPORT */
 
-#define CIFS_VERSION   "2.18"
+#define CIFS_VERSION   "2.19"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index f293e052e351..38feae812b47 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -479,6 +479,14 @@ struct smb_version_operations {
                                 struct cifs_tcon *tcon,
                                 __le16 *path, int is_dir,
                                 unsigned long p);
+        /* make unix special files (block, char, fifo, socket) */
+        int (*make_node)(unsigned int xid,
+                         struct inode *inode,
+                         struct dentry *dentry,
+                         struct cifs_tcon *tcon,
+                         char *full_path,
+                         umode_t mode,
+                         dev_t device_number);
 };
 
 struct smb_version_values {
@@ -735,13 +743,13 @@ in_flight(struct TCP_Server_Info *server)
 }
 
 static inline bool
-has_credits(struct TCP_Server_Info *server, int *credits)
+has_credits(struct TCP_Server_Info *server, int *credits, int num_credits)
 {
         int num;
         spin_lock(&server->req_lock);
         num = *credits;
         spin_unlock(&server->req_lock);
-        return num > 0;
+        return num >= num_credits;
 }
 
 static inline void
@@ -962,11 +970,14 @@ cap_unix(struct cifs_ses *ses)
 
 struct cached_fid {
         bool is_valid:1;        /* Do we have a useable root fid */
+        bool file_all_info_is_valid:1;
+
         struct kref refcount;
         struct cifs_fid *fid;
         struct mutex fid_mutex;
         struct cifs_tcon *tcon;
         struct work_struct lease_break;
+        struct smb2_file_all_info file_all_info;
 };
 
 /*
@@ -1735,6 +1746,7 @@ require use of the stronger protocol */
  *  GlobalMid_Lock protects:
  *      list operations on pending_mid_q and oplockQ
  *      updates to XID counters, multiplex id  and SMB sequence numbers
+ *      list operations on global DnotifyReqList
  *  tcp_ses_lock protects:
  *      list operations on tcp and SMB session lists
  *  tcon->open_file_lock protects the list of open files hanging off the tcon
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index b95db2b593cb..a8e9738db691 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1191,10 +1191,6 @@ next_pdu:
                         continue;
                 }
 
-                if (server->large_buf)
-                        buf = server->bigbuf;
-
-
                 server->lstrp = jiffies;
 
                 for (i = 0; i < num_mids; i++) {
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 907e85d65bb4..f26a48dd2e39 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -621,20 +621,10 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, umode_t mode,
 {
         int rc = -EPERM;
         unsigned int xid;
-        int create_options = CREATE_NOT_DIR | CREATE_OPTION_SPECIAL;
         struct cifs_sb_info *cifs_sb;
         struct tcon_link *tlink;
         struct cifs_tcon *tcon;
-        struct cifs_io_parms io_parms;
         char *full_path = NULL;
-        struct inode *newinode = NULL;
-        __u32 oplock = 0;
-        struct cifs_fid fid;
-        struct cifs_open_parms oparms;
-        FILE_ALL_INFO *buf = NULL;
-        unsigned int bytes_written;
-        struct win_dev *pdev;
-        struct kvec iov[2];
 
         if (!old_valid_dev(device_number))
                 return -EINVAL;
@@ -654,103 +644,12 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, umode_t mode,
                 goto mknod_out;
         }
 
-        if (tcon->unix_ext) {
-                struct cifs_unix_set_info_args args = {
-                        .mode   = mode & ~current_umask(),
-                        .ctime  = NO_CHANGE_64,
-                        .atime  = NO_CHANGE_64,
-                        .mtime  = NO_CHANGE_64,
-                        .device = device_number,
-                };
-                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID) {
-                        args.uid = current_fsuid();
-                        args.gid = current_fsgid();
-                } else {
-                        args.uid = INVALID_UID; /* no change */
-                        args.gid = INVALID_GID; /* no change */
-                }
-                rc = CIFSSMBUnixSetPathInfo(xid, tcon, full_path, &args,
-                                            cifs_sb->local_nls,
-                                            cifs_remap(cifs_sb));
-                if (rc)
-                        goto mknod_out;
-
-                rc = cifs_get_inode_info_unix(&newinode, full_path,
-                                                inode->i_sb, xid);
-
-                if (rc == 0)
-                        d_instantiate(direntry, newinode);
-                goto mknod_out;
-        }
-
-        if (!S_ISCHR(mode) && !S_ISBLK(mode))
-                goto mknod_out;
-
-        if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL))
-                goto mknod_out;
-
-
-        cifs_dbg(FYI, "sfu compat create special file\n");
-
-        buf = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
-        if (buf == NULL) {
-                rc = -ENOMEM;
-                goto mknod_out;
-        }
-
-        if (backup_cred(cifs_sb))
-                create_options |= CREATE_OPEN_BACKUP_INTENT;
-
-        oparms.tcon = tcon;
-        oparms.cifs_sb = cifs_sb;
-        oparms.desired_access = GENERIC_WRITE;
-        oparms.create_options = create_options;
-        oparms.disposition = FILE_CREATE;
-        oparms.path = full_path;
-        oparms.fid = &fid;
-        oparms.reconnect = false;
-
-        if (tcon->ses->server->oplocks)
-                oplock = REQ_OPLOCK;
-        else
-                oplock = 0;
-        rc = tcon->ses->server->ops->open(xid, &oparms, &oplock, buf);
-        if (rc)
-                goto mknod_out;
-
-        /*
-         * BB Do not bother to decode buf since no local inode yet to put
-         * timestamps in, but we can reuse it safely.
-         */
-
-        pdev = (struct win_dev *)buf;
-        io_parms.pid = current->tgid;
-        io_parms.tcon = tcon;
-        io_parms.offset = 0;
-        io_parms.length = sizeof(struct win_dev);
-        iov[1].iov_base = buf;
-        iov[1].iov_len = sizeof(struct win_dev);
-        if (S_ISCHR(mode)) {
-                memcpy(pdev->type, "IntxCHR", 8);
-                pdev->major = cpu_to_le64(MAJOR(device_number));
-                pdev->minor = cpu_to_le64(MINOR(device_number));
-                rc = tcon->ses->server->ops->sync_write(xid, &fid, &io_parms,
-                                                        &bytes_written, iov, 1);
-        } else if (S_ISBLK(mode)) {
-                memcpy(pdev->type, "IntxBLK", 8);
-                pdev->major = cpu_to_le64(MAJOR(device_number));
-                pdev->minor = cpu_to_le64(MINOR(device_number));
-                rc = tcon->ses->server->ops->sync_write(xid, &fid, &io_parms,
-                                                        &bytes_written, iov, 1);
-        }
-        tcon->ses->server->ops->close(xid, tcon, &fid);
-        d_drop(direntry);
-
-        /* FIXME: add code here to set EAs */
+        rc = tcon->ses->server->ops->make_node(xid, inode, direntry, tcon,
+                                               full_path, mode,
+                                               device_number);
 
 mknod_out:
         kfree(full_path);
-        kfree(buf);
         free_xid(xid);
         cifs_put_tlink(tlink);
         return rc;
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 4c144c1f50eb..89006e044973 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -1645,8 +1645,20 @@ cifs_setlk(struct file *file, struct file_lock *flock, __u32 type,
                 rc = server->ops->mand_unlock_range(cfile, flock, xid);
 
 out:
-        if (flock->fl_flags & FL_POSIX && !rc)
+        if (flock->fl_flags & FL_POSIX) {
+                /*
+                 * If this is a request to remove all locks because we
+                 * are closing the file, it doesn't matter if the
+                 * unlocking failed as both cifs.ko and the SMB server
+                 * remove the lock on file close
+                 */
+                if (rc) {
+                        cifs_dbg(VFS, "%s failed rc=%d\n", __func__, rc);
+                        if (!(flock->fl_flags & FL_CLOSE))
+                                return rc;
+                }
                 rc = locks_lock_file_wait(file, flock);
+        }
         return rc;
 }
 
@@ -2620,43 +2632,56 @@ cifs_resend_wdata(struct cifs_writedata *wdata, struct list_head *wdata_list,
         struct TCP_Server_Info *server =
                 tlink_tcon(wdata->cfile->tlink)->ses->server;
 
-        /*
-         * Wait for credits to resend this wdata.
-         * Note: we are attempting to resend the whole wdata not in segments
-         */
         do {
-                rc = server->ops->wait_mtu_credits(server, wdata->bytes, &wsize,
-                                                   &credits);
+                if (wdata->cfile->invalidHandle) {
+                        rc = cifs_reopen_file(wdata->cfile, false);
+                        if (rc == -EAGAIN)
+                                continue;
+                        else if (rc)
+                                break;
+                }
 
-                if (rc)
-                        goto out;
 
-                if (wsize < wdata->bytes) {
-                        add_credits_and_wake_if(server, &credits, 0);
-                        msleep(1000);
-                }
-        } while (wsize < wdata->bytes);
+                /*
+                 * Wait for credits to resend this wdata.
+                 * Note: we are attempting to resend the whole wdata not in
+                 * segments
+                 */
+                do {
+                        rc = server->ops->wait_mtu_credits(server, wdata->bytes,
+                                                &wsize, &credits);
+                        if (rc)
+                                goto fail;
+
+                        if (wsize < wdata->bytes) {
+                                add_credits_and_wake_if(server, &credits, 0);
+                                msleep(1000);
+                        }
+                } while (wsize < wdata->bytes);
+                wdata->credits = credits;
 
-        wdata->credits = credits;
-        rc = -EAGAIN;
-        while (rc == -EAGAIN) {
-                rc = 0;
-                if (wdata->cfile->invalidHandle)
-                        rc = cifs_reopen_file(wdata->cfile, false);
-                if (!rc)
-                        rc = server->ops->async_writev(wdata,
+                rc = adjust_credits(server, &wdata->credits, wdata->bytes);
+
+                if (!rc) {
+                        if (wdata->cfile->invalidHandle)
+                                rc = -EAGAIN;
+                        else
+                                rc = server->ops->async_writev(wdata,
                                         cifs_uncached_writedata_release);
-        }
+                }
 
-        if (!rc) {
-                list_add_tail(&wdata->list, wdata_list);
-                return 0;
-        }
+                /* If the write was successfully sent, we are done */
+                if (!rc) {
+                        list_add_tail(&wdata->list, wdata_list);
+                        return 0;
+                }
 
-        add_credits_and_wake_if(server, &wdata->credits, 0);
-out:
-        kref_put(&wdata->refcount, cifs_uncached_writedata_release);
+                /* Roll back credits and retry if needed */
+                add_credits_and_wake_if(server, &wdata->credits, 0);
+        } while (rc == -EAGAIN);
 
+fail:
+        kref_put(&wdata->refcount, cifs_uncached_writedata_release);
         return rc;
 }
 
@@ -2884,12 +2909,12 @@ restart_loop:
                                                 wdata->bytes, &tmp_from,
                                                 ctx->cfile, cifs_sb, &tmp_list,
                                                 ctx);
+
+                                        kref_put(&wdata->refcount,
+                                                cifs_uncached_writedata_release);
                                 }
 
                                 list_splice(&tmp_list, &ctx->list);
-
-                                kref_put(&wdata->refcount,
-                                         cifs_uncached_writedata_release);
                                 goto restart_loop;
                         }
                 }
@@ -3336,44 +3361,55 @@ static int cifs_resend_rdata(struct cifs_readdata *rdata,
         struct TCP_Server_Info *server =
                 tlink_tcon(rdata->cfile->tlink)->ses->server;
 
-        /*
-         * Wait for credits to resend this rdata.
-         * Note: we are attempting to resend the whole rdata not in segments
-         */
         do {
-                rc = server->ops->wait_mtu_credits(server, rdata->bytes,
+                if (rdata->cfile->invalidHandle) {
+                        rc = cifs_reopen_file(rdata->cfile, true);
+                        if (rc == -EAGAIN)
+                                continue;
+                        else if (rc)
+                                break;
+                }
+
+                /*
+                 * Wait for credits to resend this rdata.
+                 * Note: we are attempting to resend the whole rdata not in
+                 * segments
+                 */
+                do {
+                        rc = server->ops->wait_mtu_credits(server, rdata->bytes,
                                                 &rsize, &credits);
 
-                if (rc)
-                        goto out;
+                        if (rc)
+                                goto fail;
 
-                if (rsize < rdata->bytes) {
-                        add_credits_and_wake_if(server, &credits, 0);
-                        msleep(1000);
-                }
-        } while (rsize < rdata->bytes);
+                        if (rsize < rdata->bytes) {
+                                add_credits_and_wake_if(server, &credits, 0);
+                                msleep(1000);
+                        }
+                } while (rsize < rdata->bytes);
+                rdata->credits = credits;
 
-        rdata->credits = credits;
-        rc = -EAGAIN;
-        while (rc == -EAGAIN) {
-                rc = 0;
-                if (rdata->cfile->invalidHandle)
-                        rc = cifs_reopen_file(rdata->cfile, true);
-                if (!rc)
-                        rc = server->ops->async_readv(rdata);
-        }
+                rc = adjust_credits(server, &rdata->credits, rdata->bytes);
+                if (!rc) {
+                        if (rdata->cfile->invalidHandle)
+                                rc = -EAGAIN;
+                        else
+                                rc = server->ops->async_readv(rdata);
+                }
 
-        if (!rc) {
-                /* Add to aio pending list */
-                list_add_tail(&rdata->list, rdata_list);
-                return 0;
-        }
+                /* If the read was successfully sent, we are done */
+                if (!rc) {
+                        /* Add to aio pending list */
+                        list_add_tail(&rdata->list, rdata_list);
+                        return 0;
+                }
 
-        add_credits_and_wake_if(server, &rdata->credits, 0);
-out:
-        kref_put(&rdata->refcount,
-                cifs_uncached_readdata_release);
+                /* Roll back credits and retry if needed */
+                add_credits_and_wake_if(server, &rdata->credits, 0);
+        } while (rc == -EAGAIN);
 
+fail:
+        kref_put(&rdata->refcount, cifs_uncached_readdata_release);
         return rc;
 }
 
diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
index f0ce27c3c6e4..c711f1f39bf2 100644
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -1027,6 +1027,131 @@ cifs_can_echo(struct TCP_Server_Info *server)
         return false;
 }
 
+static int
+cifs_make_node(unsigned int xid, struct inode *inode,
+               struct dentry *dentry, struct cifs_tcon *tcon,
+               char *full_path, umode_t mode, dev_t dev)
+{
+        struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
+        struct inode *newinode = NULL;
+        int rc = -EPERM;
+        int create_options = CREATE_NOT_DIR | CREATE_OPTION_SPECIAL;
+        FILE_ALL_INFO *buf = NULL;
+        struct cifs_io_parms io_parms;
+        __u32 oplock = 0;
+        struct cifs_fid fid;
+        struct cifs_open_parms oparms;
+        unsigned int bytes_written;
+        struct win_dev *pdev;
+        struct kvec iov[2];
+
+        if (tcon->unix_ext) {
+                /*
+                 * SMB1 Unix Extensions: requires server support but
+                 * works with all special files
+                 */
+                struct cifs_unix_set_info_args args = {
+                        .mode   = mode & ~current_umask(),
+                        .ctime  = NO_CHANGE_64,
+                        .atime  = NO_CHANGE_64,
+                        .mtime  = NO_CHANGE_64,
+                        .device = dev,
+                };
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID) {
+                        args.uid = current_fsuid();
+                        args.gid = current_fsgid();
+                } else {
+                        args.uid = INVALID_UID; /* no change */
+                        args.gid = INVALID_GID; /* no change */
+                }
+                rc = CIFSSMBUnixSetPathInfo(xid, tcon, full_path, &args,
+                                            cifs_sb->local_nls,
+                                            cifs_remap(cifs_sb));
+                if (rc)
+                        goto out;
+
+                rc = cifs_get_inode_info_unix(&newinode, full_path,
+                                              inode->i_sb, xid);
+
+                if (rc == 0)
+                        d_instantiate(dentry, newinode);
+                goto out;
+        }
+
+        /*
+         * SMB1 SFU emulation: should work with all servers, but only
+         * support block and char device (no socket & fifo)
+         */
+        if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL))
+                goto out;
+
+        if (!S_ISCHR(mode) && !S_ISBLK(mode))
+                goto out;
+
+        cifs_dbg(FYI, "sfu compat create special file\n");
+
+        buf = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
+        if (buf == NULL) {
+                rc = -ENOMEM;
+                goto out;
+        }
+
+        if (backup_cred(cifs_sb))
+                create_options |= CREATE_OPEN_BACKUP_INTENT;
+
+        oparms.tcon = tcon;
+        oparms.cifs_sb = cifs_sb;
+        oparms.desired_access = GENERIC_WRITE;
+        oparms.create_options = create_options;
+        oparms.disposition = FILE_CREATE;
+        oparms.path = full_path;
+        oparms.fid = &fid;
+        oparms.reconnect = false;
+
+        if (tcon->ses->server->oplocks)
+                oplock = REQ_OPLOCK;
+        else
+                oplock = 0;
+        rc = tcon->ses->server->ops->open(xid, &oparms, &oplock, buf);
+        if (rc)
+                goto out;
+
+        /*
+         * BB Do not bother to decode buf since no local inode yet to put
+         * timestamps in, but we can reuse it safely.
+         */
+
+        pdev = (struct win_dev *)buf;
+        io_parms.pid = current->tgid;
+        io_parms.tcon = tcon;
+        io_parms.offset = 0;
+        io_parms.length = sizeof(struct win_dev);
+        iov[1].iov_base = buf;
+        iov[1].iov_len = sizeof(struct win_dev);
+        if (S_ISCHR(mode)) {
+                memcpy(pdev->type, "IntxCHR", 8);
+                pdev->major = cpu_to_le64(MAJOR(dev));
+                pdev->minor = cpu_to_le64(MINOR(dev));
+                rc = tcon->ses->server->ops->sync_write(xid, &fid, &io_parms,
+                                                        &bytes_written, iov, 1);
+        } else if (S_ISBLK(mode)) {
+                memcpy(pdev->type, "IntxBLK", 8);
+                pdev->major = cpu_to_le64(MAJOR(dev));
+                pdev->minor = cpu_to_le64(MINOR(dev));
+                rc = tcon->ses->server->ops->sync_write(xid, &fid, &io_parms,
+                                                        &bytes_written, iov, 1);
+        }
+        tcon->ses->server->ops->close(xid, tcon, &fid);
+        d_drop(dentry);
+
+        /* FIXME: add code here to set EAs */
+out:
+        kfree(buf);
+        return rc;
+}
+
+
+
 struct smb_version_operations smb1_operations = {
         .send_cancel = send_nt_cancel,
         .compare_fids = cifs_compare_fids,
@@ -1110,6 +1235,7 @@ struct smb_version_operations smb1_operations = {
         .get_acl_by_fid = get_cifs_acl_by_fid,
         .set_acl = set_cifs_acl,
 #endif /* CIFS_ACL */
+        .make_node = cifs_make_node,
 };
 
 struct smb_version_values smb1_values = {
diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c
index 01a76bccdb8d..278405d26c47 100644
--- a/fs/cifs/smb2inode.c
+++ b/fs/cifs/smb2inode.c
@@ -37,6 +37,16 @@
 #include "smb2pdu.h"
 #include "smb2proto.h"
 
+static void
+free_set_inf_compound(struct smb_rqst *rqst)
+{
+        if (rqst[1].rq_iov)
+                SMB2_set_info_free(&rqst[1]);
+        if (rqst[2].rq_iov)
+                SMB2_close_free(&rqst[2]);
+}
+
+
 static int
 smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon,
                  struct cifs_sb_info *cifs_sb, const char *full_path,
@@ -112,14 +122,18 @@ smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon,
                                           PATH_MAX * 2, 0, NULL);
                 smb2_set_next_command(tcon, &rqst[num_rqst]);
                 smb2_set_related(&rqst[num_rqst++]);
+                trace_smb3_query_info_compound_enter(xid, ses->Suid, tcon->tid,
+                                                     full_path);
                 break;
         case SMB2_OP_DELETE:
+                trace_smb3_delete_enter(xid, ses->Suid, tcon->tid, full_path);
                 break;
         case SMB2_OP_MKDIR:
                 /*
                  * Directories are created through parameters in the
                  * SMB2_open() call.
                  */
+                trace_smb3_mkdir_enter(xid, ses->Suid, tcon->tid, full_path);
                 break;
         case SMB2_OP_RMDIR:
                 memset(&si_iov, 0, sizeof(si_iov));
@@ -135,6 +149,7 @@ smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon,
                                         SMB2_O_INFO_FILE, 0, data, size);
                 smb2_set_next_command(tcon, &rqst[num_rqst]);
                 smb2_set_related(&rqst[num_rqst++]);
+                trace_smb3_rmdir_enter(xid, ses->Suid, tcon->tid, full_path);
                 break;
         case SMB2_OP_SET_EOF:
                 memset(&si_iov, 0, sizeof(si_iov));
@@ -150,6 +165,7 @@ smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon,
                                         SMB2_O_INFO_FILE, 0, data, size);
                 smb2_set_next_command(tcon, &rqst[num_rqst]);
                 smb2_set_related(&rqst[num_rqst++]);
+                trace_smb3_set_eof_enter(xid, ses->Suid, tcon->tid, full_path);
                 break;
         case SMB2_OP_SET_INFO:
                 memset(&si_iov, 0, sizeof(si_iov));
@@ -166,6 +182,8 @@ smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon,
                                         SMB2_O_INFO_FILE, 0, data, size);
                 smb2_set_next_command(tcon, &rqst[num_rqst]);
                 smb2_set_related(&rqst[num_rqst++]);
+                trace_smb3_set_info_compound_enter(xid, ses->Suid, tcon->tid,
+                                                   full_path);
                 break;
         case SMB2_OP_RENAME:
                 memset(&si_iov, 0, sizeof(si_iov));
@@ -190,6 +208,7 @@ smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon,
                                         SMB2_O_INFO_FILE, 0, data, size);
                 smb2_set_next_command(tcon, &rqst[num_rqst]);
                 smb2_set_related(&rqst[num_rqst++]);
+                trace_smb3_rename_enter(xid, ses->Suid, tcon->tid, full_path);
                 break;
         case SMB2_OP_HARDLINK:
                 memset(&si_iov, 0, sizeof(si_iov));
@@ -214,6 +233,7 @@ smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon,
                                         SMB2_O_INFO_FILE, 0, data, size);
                 smb2_set_next_command(tcon, &rqst[num_rqst]);
                 smb2_set_related(&rqst[num_rqst++]);
+                trace_smb3_hardlink_enter(xid, ses->Suid, tcon->tid, full_path);
                 break;
         default:
                 cifs_dbg(VFS, "Invalid command\n");
@@ -252,21 +272,65 @@ smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon,
                         SMB2_query_info_free(&rqst[1]);
                 if (rqst[2].rq_iov)
                         SMB2_close_free(&rqst[2]);
+                if (rc)
+                        trace_smb3_query_info_compound_err(xid,  ses->Suid,
+                                                tcon->tid, rc);
+                else
+                        trace_smb3_query_info_compound_done(xid, ses->Suid,
+                                                tcon->tid);
                 break;
         case SMB2_OP_DELETE:
+                if (rc)
+                        trace_smb3_delete_err(xid,  ses->Suid, tcon->tid, rc);
+                else
+                        trace_smb3_delete_done(xid, ses->Suid, tcon->tid);
+                if (rqst[1].rq_iov)
+                        SMB2_close_free(&rqst[1]);
+                break;
         case SMB2_OP_MKDIR:
+                if (rc)
+                        trace_smb3_mkdir_err(xid,  ses->Suid, tcon->tid, rc);
+                else
+                        trace_smb3_mkdir_done(xid, ses->Suid, tcon->tid);
                 if (rqst[1].rq_iov)
                         SMB2_close_free(&rqst[1]);
                 break;
         case SMB2_OP_HARDLINK:
+                if (rc)
+                        trace_smb3_hardlink_err(xid,  ses->Suid, tcon->tid, rc);
+                else
+                        trace_smb3_hardlink_done(xid, ses->Suid, tcon->tid);
+                free_set_inf_compound(rqst);
+                break;
         case SMB2_OP_RENAME:
+                if (rc)
+                        trace_smb3_rename_err(xid,  ses->Suid, tcon->tid, rc);
+                else
+                        trace_smb3_rename_done(xid, ses->Suid, tcon->tid);
+                free_set_inf_compound(rqst);
+                break;
         case SMB2_OP_RMDIR:
+                if (rc)
+                        trace_smb3_rmdir_err(xid,  ses->Suid, tcon->tid, rc);
+                else
+                        trace_smb3_rmdir_done(xid, ses->Suid, tcon->tid);
+                free_set_inf_compound(rqst);
+                break;
         case SMB2_OP_SET_EOF:
+                if (rc)
+                        trace_smb3_set_eof_err(xid,  ses->Suid, tcon->tid, rc);
+                else
+                        trace_smb3_set_eof_done(xid, ses->Suid, tcon->tid);
+                free_set_inf_compound(rqst);
+                break;
         case SMB2_OP_SET_INFO:
-                if (rqst[1].rq_iov)
-                        SMB2_set_info_free(&rqst[1]);
-                if (rqst[2].rq_iov)
-                        SMB2_close_free(&rqst[2]);
+                if (rc)
+                        trace_smb3_set_info_compound_err(xid,  ses->Suid,
+                                                tcon->tid, rc);
+                else
+                        trace_smb3_set_info_compound_done(xid, ses->Suid,
+                                                tcon->tid);
+                free_set_inf_compound(rqst);
                 break;
         }
         free_rsp_buf(resp_buftype[0], rsp_iov[0].iov_base);
@@ -309,12 +373,17 @@ smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon,
                 rc = open_shroot(xid, tcon, &fid);
                 if (rc)
                         goto out;
-                rc = SMB2_query_info(xid, tcon, fid.persistent_fid,
-                                     fid.volatile_fid, smb2_data);
+
+                if (tcon->crfid.file_all_info_is_valid) {
+                        move_smb2_info_to_cifs(data,
+                                               &tcon->crfid.file_all_info);
+                } else {
+                        rc = SMB2_query_info(xid, tcon, fid.persistent_fid,
+                                             fid.volatile_fid, smb2_data);
+                        if (!rc)
+                                move_smb2_info_to_cifs(data, smb2_data);
+                }
                 close_shroot(&tcon->crfid);
-                if (rc)
-                        goto out;
-                move_smb2_info_to_cifs(data, smb2_data);
                 goto out;
         }
 
diff --git a/fs/cifs/smb2maperror.c b/fs/cifs/smb2maperror.c
index 924269cec135..e32c264e3adb 100644
--- a/fs/cifs/smb2maperror.c
+++ b/fs/cifs/smb2maperror.c
@@ -1036,7 +1036,8 @@ static const struct status_to_posix_error smb2_error_map_table[] = {
         {STATUS_UNFINISHED_CONTEXT_DELETED, -EIO,
         "STATUS_UNFINISHED_CONTEXT_DELETED"},
         {STATUS_NO_TGT_REPLY, -EIO, "STATUS_NO_TGT_REPLY"},
-        {STATUS_OBJECTID_NOT_FOUND, -EIO, "STATUS_OBJECTID_NOT_FOUND"},
+        /* Note that ENOATTTR and ENODATA are the same errno */
+        {STATUS_OBJECTID_NOT_FOUND, -ENODATA, "STATUS_OBJECTID_NOT_FOUND"},
         {STATUS_NO_IP_ADDRESSES, -EIO, "STATUS_NO_IP_ADDRESSES"},
         {STATUS_WRONG_CREDENTIAL_HANDLE, -EIO,
         "STATUS_WRONG_CREDENTIAL_HANDLE"},
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 085e91436da7..1022a3771e14 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -185,7 +185,7 @@ smb2_wait_mtu_credits(struct TCP_Server_Info *server, unsigned int size,
                         spin_unlock(&server->req_lock);
                         cifs_num_waiters_inc(server);
                         rc = wait_event_killable(server->request_q,
-                                        has_credits(server, &server->credits));
+                                has_credits(server, &server->credits, 1));
                         cifs_num_waiters_dec(server);
                         if (rc)
                                 return rc;
@@ -619,6 +619,7 @@ smb2_close_cached_fid(struct kref *ref)
                 SMB2_close(0, cfid->tcon, cfid->fid->persistent_fid,
                            cfid->fid->volatile_fid);
                 cfid->is_valid = false;
+                cfid->file_all_info_is_valid = false;
         }
 }
 
@@ -643,9 +644,18 @@ smb2_cached_lease_break(struct work_struct *work)
  */
 int open_shroot(unsigned int xid, struct cifs_tcon *tcon, struct cifs_fid *pfid)
 {
-        struct cifs_open_parms oparams;
-        int rc;
-        __le16 srch_path = 0; /* Null - since an open of top of share */
+        struct cifs_ses *ses = tcon->ses;
+        struct TCP_Server_Info *server = ses->server;
+        struct cifs_open_parms oparms;
+        struct smb2_create_rsp *o_rsp = NULL;
+        struct smb2_query_info_rsp *qi_rsp = NULL;
+        int resp_buftype[2];
+        struct smb_rqst rqst[2];
+        struct kvec rsp_iov[2];
+        struct kvec open_iov[SMB2_CREATE_IOV_SIZE];
+        struct kvec qi_iov[1];
+        int rc, flags = 0;
+        __le16 utf16_path = 0; /* Null - since an open of top of share */
         u8 oplock = SMB2_OPLOCK_LEVEL_II;
 
         mutex_lock(&tcon->crfid.fid_mutex);
@@ -657,22 +667,89 @@ int open_shroot(unsigned int xid, struct cifs_tcon *tcon, struct cifs_fid *pfid)
                 return 0;
         }
 
-        oparams.tcon = tcon;
-        oparams.create_options = 0;
-        oparams.desired_access = FILE_READ_ATTRIBUTES;
-        oparams.disposition = FILE_OPEN;
-        oparams.fid = pfid;
-        oparams.reconnect = false;
-
-        rc = SMB2_open(xid, &oparams, &srch_path, &oplock, NULL, NULL, NULL);
-        if (rc == 0) {
-                memcpy(tcon->crfid.fid, pfid, sizeof(struct cifs_fid));
-                tcon->crfid.tcon = tcon;
-                tcon->crfid.is_valid = true;
-                kref_init(&tcon->crfid.refcount);
-                kref_get(&tcon->crfid.refcount);
-        }
+        if (smb3_encryption_required(tcon))
+                flags |= CIFS_TRANSFORM_REQ;
+
+        memset(rqst, 0, sizeof(rqst));
+        resp_buftype[0] = resp_buftype[1] = CIFS_NO_BUFFER;
+        memset(rsp_iov, 0, sizeof(rsp_iov));
+
+        /* Open */
+        memset(&open_iov, 0, sizeof(open_iov));
+        rqst[0].rq_iov = open_iov;
+        rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE;
+
+        oparms.tcon = tcon;
+        oparms.create_options = 0;
+        oparms.desired_access = FILE_READ_ATTRIBUTES;
+        oparms.disposition = FILE_OPEN;
+        oparms.fid = pfid;
+        oparms.reconnect = false;
+
+        rc = SMB2_open_init(tcon, &rqst[0], &oplock, &oparms, &utf16_path);
+        if (rc)
+                goto oshr_exit;
+        smb2_set_next_command(tcon, &rqst[0]);
+
+        memset(&qi_iov, 0, sizeof(qi_iov));
+        rqst[1].rq_iov = qi_iov;
+        rqst[1].rq_nvec = 1;
+
+        rc = SMB2_query_info_init(tcon, &rqst[1], COMPOUND_FID,
+                                  COMPOUND_FID, FILE_ALL_INFORMATION,
+                                  SMB2_O_INFO_FILE, 0,
+                                  sizeof(struct smb2_file_all_info) +
+                                  PATH_MAX * 2, 0, NULL);
+        if (rc)
+                goto oshr_exit;
+
+        smb2_set_related(&rqst[1]);
+
+        rc = compound_send_recv(xid, ses, flags, 2, rqst,
+                                resp_buftype, rsp_iov);
+        if (rc)
+                goto oshr_exit;
+
+        o_rsp = (struct smb2_create_rsp *)rsp_iov[0].iov_base;
+        oparms.fid->persistent_fid = o_rsp->PersistentFileId;
+        oparms.fid->volatile_fid = o_rsp->VolatileFileId;
+#ifdef CONFIG_CIFS_DEBUG2
+        oparms.fid->mid = le64_to_cpu(o_rsp->sync_hdr.MessageId);
+#endif /* CIFS_DEBUG2 */
+
+        if (o_rsp->OplockLevel == SMB2_OPLOCK_LEVEL_LEASE)
+                oplock = smb2_parse_lease_state(server, o_rsp,
+                                                &oparms.fid->epoch,
+                                                oparms.fid->lease_key);
+        else
+                goto oshr_exit;
+
+
+        memcpy(tcon->crfid.fid, pfid, sizeof(struct cifs_fid));
+        tcon->crfid.tcon = tcon;
+        tcon->crfid.is_valid = true;
+        kref_init(&tcon->crfid.refcount);
+        kref_get(&tcon->crfid.refcount);
+
+
+        qi_rsp = (struct smb2_query_info_rsp *)rsp_iov[1].iov_base;
+        if (le32_to_cpu(qi_rsp->OutputBufferLength) < sizeof(struct smb2_file_all_info))
+                goto oshr_exit;
+        rc = smb2_validate_and_copy_iov(
+                                le16_to_cpu(qi_rsp->OutputBufferOffset),
+                                sizeof(struct smb2_file_all_info),
+                                &rsp_iov[1], sizeof(struct smb2_file_all_info),
+                                (char *)&tcon->crfid.file_all_info);
+        if (rc)
+                goto oshr_exit;
+        tcon->crfid.file_all_info_is_valid = 1;
+
+ oshr_exit:
         mutex_unlock(&tcon->crfid.fid_mutex);
+        SMB2_open_free(&rqst[0]);
+        SMB2_query_info_free(&rqst[1]);
+        free_rsp_buf(resp_buftype[0], rsp_iov[0].iov_base);
+        free_rsp_buf(resp_buftype[1], rsp_iov[1].iov_base);
         return rc;
 }
 
@@ -1253,7 +1330,8 @@ smb2_ioctl_query_info(const unsigned int xid,
         struct smb_query_info __user *pqi;
         int rc = 0;
         int flags = 0;
-        struct smb2_query_info_rsp *rsp = NULL;
+        struct smb2_query_info_rsp *qi_rsp = NULL;
+        struct smb2_ioctl_rsp *io_rsp = NULL;
         void *buffer = NULL;
         struct smb_rqst rqst[3];
         int resp_buftype[3];
@@ -1263,6 +1341,7 @@ smb2_ioctl_query_info(const unsigned int xid,
         u8 oplock = SMB2_OPLOCK_LEVEL_NONE;
         struct cifs_fid fid;
         struct kvec qi_iov[1];
+        struct kvec io_iov[SMB2_IOCTL_IOV_SIZE];
         struct kvec close_iov[1];
 
         memset(rqst, 0, sizeof(rqst));
@@ -1313,15 +1392,35 @@ smb2_ioctl_query_info(const unsigned int xid,
         smb2_set_next_command(tcon, &rqst[0]);
 
         /* Query */
-        memset(&qi_iov, 0, sizeof(qi_iov));
-        rqst[1].rq_iov = qi_iov;
-        rqst[1].rq_nvec = 1;
-
-        rc = SMB2_query_info_init(tcon, &rqst[1], COMPOUND_FID, COMPOUND_FID,
-                                  qi.file_info_class, qi.info_type,
-                                  qi.additional_information,
+        if (qi.flags & PASSTHRU_FSCTL) {
+                /* Can eventually relax perm check since server enforces too */
+                if (!capable(CAP_SYS_ADMIN))
+                        rc = -EPERM;
+                else  {
+                        memset(&io_iov, 0, sizeof(io_iov));
+                        rqst[1].rq_iov = io_iov;
+                        rqst[1].rq_nvec = SMB2_IOCTL_IOV_SIZE;
+
+                        rc = SMB2_ioctl_init(tcon, &rqst[1],
+                                             COMPOUND_FID, COMPOUND_FID,
+                                             qi.info_type, true, NULL,
+                                             0);
+                }
+        } else if (qi.flags == PASSTHRU_QUERY_INFO) {
+                memset(&qi_iov, 0, sizeof(qi_iov));
+                rqst[1].rq_iov = qi_iov;
+                rqst[1].rq_nvec = 1;
+
+                rc = SMB2_query_info_init(tcon, &rqst[1], COMPOUND_FID,
+                                  COMPOUND_FID, qi.file_info_class,
+                                  qi.info_type, qi.additional_information,
                                   qi.input_buffer_length,
                                   qi.output_buffer_length, buffer);
+        } else { /* unknown flags */
+                cifs_dbg(VFS, "invalid passthru query flags: 0x%x\n", qi.flags);
+                rc = -EINVAL;
+        }
+
         if (rc)
                 goto iqinf_exit;
         smb2_set_next_command(tcon, &rqst[1]);
@@ -1341,24 +1440,44 @@ smb2_ioctl_query_info(const unsigned int xid,
                                 resp_buftype, rsp_iov);
         if (rc)
                 goto iqinf_exit;
-        pqi = (struct smb_query_info __user *)arg;
-        rsp = (struct smb2_query_info_rsp *)rsp_iov[1].iov_base;
-        if (le32_to_cpu(rsp->OutputBufferLength) < qi.input_buffer_length)
-                qi.input_buffer_length = le32_to_cpu(rsp->OutputBufferLength);
-        if (copy_to_user(&pqi->input_buffer_length, &qi.input_buffer_length,
-                         sizeof(qi.input_buffer_length))) {
-                rc = -EFAULT;
-                goto iqinf_exit;
-        }
-        if (copy_to_user(pqi + 1, rsp->Buffer, qi.input_buffer_length)) {
-                rc = -EFAULT;
-                goto iqinf_exit;
+        if (qi.flags & PASSTHRU_FSCTL) {
+                pqi = (struct smb_query_info __user *)arg;
+                io_rsp = (struct smb2_ioctl_rsp *)rsp_iov[1].iov_base;
+                if (le32_to_cpu(io_rsp->OutputCount) < qi.input_buffer_length)
+                        qi.input_buffer_length = le32_to_cpu(io_rsp->OutputCount);
+                if (copy_to_user(&pqi->input_buffer_length, &qi.input_buffer_length,
+                                 sizeof(qi.input_buffer_length))) {
+                        rc = -EFAULT;
+                        goto iqinf_exit;
+                }
+                if (copy_to_user(pqi + 1, &io_rsp[1], qi.input_buffer_length)) {
+                        rc = -EFAULT;
+                        goto iqinf_exit;
+                }
+        } else {
+                pqi = (struct smb_query_info __user *)arg;
+                qi_rsp = (struct smb2_query_info_rsp *)rsp_iov[1].iov_base;
+                if (le32_to_cpu(qi_rsp->OutputBufferLength) < qi.input_buffer_length)
+                        qi.input_buffer_length = le32_to_cpu(qi_rsp->OutputBufferLength);
+                if (copy_to_user(&pqi->input_buffer_length, &qi.input_buffer_length,
+                                 sizeof(qi.input_buffer_length))) {
+                        rc = -EFAULT;
+                        goto iqinf_exit;
+                }
+                if (copy_to_user(pqi + 1, qi_rsp->Buffer, qi.input_buffer_length)) {
+                        rc = -EFAULT;
+                        goto iqinf_exit;
+                }
         }
 
  iqinf_exit:
         kfree(buffer);
         SMB2_open_free(&rqst[0]);
-        SMB2_query_info_free(&rqst[1]);
+        if (qi.flags & PASSTHRU_FSCTL)
+                SMB2_ioctl_free(&rqst[1]);
+        else
+                SMB2_query_info_free(&rqst[1]);
+
         SMB2_close_free(&rqst[2]);
         free_rsp_buf(resp_buftype[0], rsp_iov[0].iov_base);
         free_rsp_buf(resp_buftype[1], rsp_iov[1].iov_base);
@@ -2472,22 +2591,38 @@ get_smb2_acl(struct cifs_sb_info *cifs_sb,
 static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon,
                             loff_t offset, loff_t len, bool keep_size)
 {
+        struct cifs_ses *ses = tcon->ses;
         struct inode *inode;
         struct cifsInodeInfo *cifsi;
         struct cifsFileInfo *cfile = file->private_data;
         struct file_zero_data_information fsctl_buf;
+        struct smb_rqst rqst[2];
+        int resp_buftype[2];
+        struct kvec rsp_iov[2];
+        struct kvec io_iov[SMB2_IOCTL_IOV_SIZE];
+        struct kvec si_iov[1];
+        unsigned int size[1];
+        void *data[1];
         long rc;
         unsigned int xid;
+        int num = 0, flags = 0;
+        __le64 eof;
 
         xid = get_xid();
 
         inode = d_inode(cfile->dentry);
         cifsi = CIFS_I(inode);
 
+        trace_smb3_zero_enter(xid, cfile->fid.persistent_fid, tcon->tid,
+                              ses->Suid, offset, len);
+
+
         /* if file not oplocked can't be sure whether asking to extend size */
         if (!CIFS_CACHE_READ(cifsi))
                 if (keep_size == false) {
                         rc = -EOPNOTSUPP;
+                        trace_smb3_zero_err(xid, cfile->fid.persistent_fid,
+                                tcon->tid, ses->Suid, offset, len, rc);
                         free_xid(xid);
                         return rc;
                 }
@@ -2498,33 +2633,73 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon,
          */
         if (!(cifsi->cifsAttrs & FILE_ATTRIBUTE_SPARSE_FILE)) {
                 rc = -EOPNOTSUPP;
+                trace_smb3_zero_err(xid, cfile->fid.persistent_fid, tcon->tid,
+                              ses->Suid, offset, len, rc);
                 free_xid(xid);
                 return rc;
         }
 
-        /*
-         * need to make sure we are not asked to extend the file since the SMB3
-         * fsctl does not change the file size. In the future we could change
-         * this to zero the first part of the range then set the file size
-         * which for a non sparse file would zero the newly extended range
-         */
-        if (keep_size == false)
-                if (i_size_read(inode) < offset + len) {
-                        rc = -EOPNOTSUPP;
-                        free_xid(xid);
-                        return rc;
-                }
-
         cifs_dbg(FYI, "offset %lld len %lld", offset, len);
 
         fsctl_buf.FileOffset = cpu_to_le64(offset);
         fsctl_buf.BeyondFinalZero = cpu_to_le64(offset + len);
 
-        rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid,
-                        cfile->fid.volatile_fid, FSCTL_SET_ZERO_DATA,
-                        true /* is_fctl */, (char *)&fsctl_buf,
-                        sizeof(struct file_zero_data_information), NULL, NULL);
+        if (smb3_encryption_required(tcon))
+                flags |= CIFS_TRANSFORM_REQ;
+
+        memset(rqst, 0, sizeof(rqst));
+        resp_buftype[0] = resp_buftype[1] = CIFS_NO_BUFFER;
+        memset(rsp_iov, 0, sizeof(rsp_iov));
+
+
+        memset(&io_iov, 0, sizeof(io_iov));
+        rqst[num].rq_iov = io_iov;
+        rqst[num].rq_nvec = SMB2_IOCTL_IOV_SIZE;
+        rc = SMB2_ioctl_init(tcon, &rqst[num++], cfile->fid.persistent_fid,
+                             cfile->fid.volatile_fid, FSCTL_SET_ZERO_DATA,
+                             true /* is_fctl */, (char *)&fsctl_buf,
+                             sizeof(struct file_zero_data_information));
+        if (rc)
+                goto zero_range_exit;
+
+        /*
+         * do we also need to change the size of the file?
+         */
+        if (keep_size == false && i_size_read(inode) < offset + len) {
+                smb2_set_next_command(tcon, &rqst[0]);
+
+                memset(&si_iov, 0, sizeof(si_iov));
+                rqst[num].rq_iov = si_iov;
+                rqst[num].rq_nvec = 1;
+
+                eof = cpu_to_le64(offset + len);
+                size[0] = 8; /* sizeof __le64 */
+                data[0] = &eof;
+
+                rc = SMB2_set_info_init(tcon, &rqst[num++],
+                                        cfile->fid.persistent_fid,
+                                        cfile->fid.persistent_fid,
+                                        current->tgid,
+                                        FILE_END_OF_FILE_INFORMATION,
+                                        SMB2_O_INFO_FILE, 0, data, size);
+                smb2_set_related(&rqst[1]);
+        }
+
+        rc = compound_send_recv(xid, ses, flags, num, rqst,
+                                resp_buftype, rsp_iov);
+
+ zero_range_exit:
+        SMB2_ioctl_free(&rqst[0]);
+        SMB2_set_info_free(&rqst[1]);
+        free_rsp_buf(resp_buftype[0], rsp_iov[0].iov_base);
+        free_rsp_buf(resp_buftype[1], rsp_iov[1].iov_base);
         free_xid(xid);
+        if (rc)
+                trace_smb3_zero_err(xid, cfile->fid.persistent_fid, tcon->tid,
+                              ses->Suid, offset, len, rc);
+        else
+                trace_smb3_zero_done(xid, cfile->fid.persistent_fid, tcon->tid,
+                              ses->Suid, offset, len);
         return rc;
 }
 
@@ -2573,15 +2748,20 @@ static long smb3_simple_falloc(struct file *file, struct cifs_tcon *tcon,
         struct cifsFileInfo *cfile = file->private_data;
         long rc = -EOPNOTSUPP;
         unsigned int xid;
+        __le64 eof;
 
         xid = get_xid();
 
         inode = d_inode(cfile->dentry);
         cifsi = CIFS_I(inode);
 
+        trace_smb3_falloc_enter(xid, cfile->fid.persistent_fid, tcon->tid,
+                                tcon->ses->Suid, off, len);
         /* if file not oplocked can't be sure whether asking to extend size */
         if (!CIFS_CACHE_READ(cifsi))
                 if (keep_size == false) {
+                        trace_smb3_falloc_err(xid, cfile->fid.persistent_fid,
+                                tcon->tid, tcon->ses->Suid, off, len, rc);
                         free_xid(xid);
                         return rc;
                 }
@@ -2601,6 +2781,12 @@ static long smb3_simple_falloc(struct file *file, struct cifs_tcon *tcon,
                 /* BB: in future add else clause to extend file */
                 else
                         rc = -EOPNOTSUPP;
+                if (rc)
+                        trace_smb3_falloc_err(xid, cfile->fid.persistent_fid,
+                                tcon->tid, tcon->ses->Suid, off, len, rc);
+                else
+                        trace_smb3_falloc_done(xid, cfile->fid.persistent_fid,
+                                tcon->tid, tcon->ses->Suid, off, len);
                 free_xid(xid);
                 return rc;
         }
@@ -2616,14 +2802,31 @@ static long smb3_simple_falloc(struct file *file, struct cifs_tcon *tcon,
                  */
                 if ((off > 8192) || (off + len + 8192 < i_size_read(inode))) {
                         rc = -EOPNOTSUPP;
+                        trace_smb3_falloc_err(xid, cfile->fid.persistent_fid,
+                                tcon->tid, tcon->ses->Suid, off, len, rc);
                         free_xid(xid);
                         return rc;
                 }
 
-                rc = smb2_set_sparse(xid, tcon, cfile, inode, false);
+                smb2_set_sparse(xid, tcon, cfile, inode, false);
+                rc = 0;
+        } else {
+                smb2_set_sparse(xid, tcon, cfile, inode, false);
+                rc = 0;
+                if (i_size_read(inode) < off + len) {
+                        eof = cpu_to_le64(off + len);
+                        rc = SMB2_set_eof(xid, tcon, cfile->fid.persistent_fid,
+                                          cfile->fid.volatile_fid, cfile->pid,
+                                          &eof);
+                }
         }
-        /* BB: else ... in future add code to extend file and set sparse */
 
+        if (rc)
+                trace_smb3_falloc_err(xid, cfile->fid.persistent_fid, tcon->tid,
+                                tcon->ses->Suid, off, len, rc);
+        else
+                trace_smb3_falloc_done(xid, cfile->fid.persistent_fid, tcon->tid,
+                                tcon->ses->Suid, off, len);
 
         free_xid(xid);
         return rc;
@@ -3604,6 +3807,104 @@ smb2_next_header(char *buf)
         return le32_to_cpu(hdr->NextCommand);
 }
 
+static int
+smb2_make_node(unsigned int xid, struct inode *inode,
+               struct dentry *dentry, struct cifs_tcon *tcon,
+               char *full_path, umode_t mode, dev_t dev)
+{
+        struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
+        int rc = -EPERM;
+        int create_options = CREATE_NOT_DIR | CREATE_OPTION_SPECIAL;
+        FILE_ALL_INFO *buf = NULL;
+        struct cifs_io_parms io_parms;
+        __u32 oplock = 0;
+        struct cifs_fid fid;
+        struct cifs_open_parms oparms;
+        unsigned int bytes_written;
+        struct win_dev *pdev;
+        struct kvec iov[2];
+
+        /*
+         * Check if mounted with mount parm 'sfu' mount parm.
+         * SFU emulation should work with all servers, but only
+         * supports block and char device (no socket & fifo),
+         * and was used by default in earlier versions of Windows
+         */
+        if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL))
+                goto out;
+
+        /*
+         * TODO: Add ability to create instead via reparse point. Windows (e.g.
+         * their current NFS server) uses this approach to expose special files
+         * over SMB2/SMB3 and Samba will do this with SMB3.1.1 POSIX Extensions
+         */
+
+        if (!S_ISCHR(mode) && !S_ISBLK(mode))
+                goto out;
+
+        cifs_dbg(FYI, "sfu compat create special file\n");
+
+        buf = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
+        if (buf == NULL) {
+                rc = -ENOMEM;
+                goto out;
+        }
+
+        if (backup_cred(cifs_sb))
+                create_options |= CREATE_OPEN_BACKUP_INTENT;
+
+        oparms.tcon = tcon;
+        oparms.cifs_sb = cifs_sb;
+        oparms.desired_access = GENERIC_WRITE;
+        oparms.create_options = create_options;
+        oparms.disposition = FILE_CREATE;
+        oparms.path = full_path;
+        oparms.fid = &fid;
+        oparms.reconnect = false;
+
+        if (tcon->ses->server->oplocks)
+                oplock = REQ_OPLOCK;
+        else
+                oplock = 0;
+        rc = tcon->ses->server->ops->open(xid, &oparms, &oplock, buf);
+        if (rc)
+                goto out;
+
+        /*
+         * BB Do not bother to decode buf since no local inode yet to put
+         * timestamps in, but we can reuse it safely.
+         */
+
+        pdev = (struct win_dev *)buf;
+        io_parms.pid = current->tgid;
+        io_parms.tcon = tcon;
+        io_parms.offset = 0;
+        io_parms.length = sizeof(struct win_dev);
+        iov[1].iov_base = buf;
+        iov[1].iov_len = sizeof(struct win_dev);
+        if (S_ISCHR(mode)) {
+                memcpy(pdev->type, "IntxCHR", 8);
+                pdev->major = cpu_to_le64(MAJOR(dev));
+                pdev->minor = cpu_to_le64(MINOR(dev));
+                rc = tcon->ses->server->ops->sync_write(xid, &fid, &io_parms,
+                                                        &bytes_written, iov, 1);
+        } else if (S_ISBLK(mode)) {
+                memcpy(pdev->type, "IntxBLK", 8);
+                pdev->major = cpu_to_le64(MAJOR(dev));
+                pdev->minor = cpu_to_le64(MINOR(dev));
+                rc = tcon->ses->server->ops->sync_write(xid, &fid, &io_parms,
+                                                        &bytes_written, iov, 1);
+        }
+        tcon->ses->server->ops->close(xid, tcon, &fid);
+        d_drop(dentry);
+
+        /* FIXME: add code here to set EAs */
+out:
+        kfree(buf);
+        return rc;
+}
+
+
 struct smb_version_operations smb20_operations = {
         .compare_fids = smb2_compare_fids,
         .setup_request = smb2_setup_request,
@@ -3698,6 +3999,7 @@ struct smb_version_operations smb20_operations = {
 #endif /* CIFS_ACL */
         .next_header = smb2_next_header,
         .ioctl_query_info = smb2_ioctl_query_info,
+        .make_node = smb2_make_node,
 };
 
 struct smb_version_operations smb21_operations = {
@@ -3796,6 +4098,7 @@ struct smb_version_operations smb21_operations = {
 #endif /* CIFS_ACL */
         .next_header = smb2_next_header,
         .ioctl_query_info = smb2_ioctl_query_info,
+        .make_node = smb2_make_node,
 };
 
 struct smb_version_operations smb30_operations = {
@@ -3903,6 +4206,7 @@ struct smb_version_operations smb30_operations = {
 #endif /* CIFS_ACL */
         .next_header = smb2_next_header,
         .ioctl_query_info = smb2_ioctl_query_info,
+        .make_node = smb2_make_node,
 };
 
 struct smb_version_operations smb311_operations = {
@@ -4011,6 +4315,7 @@ struct smb_version_operations smb311_operations = {
 #endif /* CIFS_ACL */
         .next_header = smb2_next_header,
         .ioctl_query_info = smb2_ioctl_query_info,
+        .make_node = smb2_make_node,
 };
 
 struct smb_version_values smb20_values = {
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 60fbe306f604..21ac19ff19cb 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1628,9 +1628,16 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
         iov[1].iov_base = unc_path;
         iov[1].iov_len = unc_path_len;
 
-        /* 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1 */
+        /*
+         * 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1
+         * unless it is guest or anonymous user. See MS-SMB2 3.2.5.3.1
+         * (Samba servers don't always set the flag so also check if null user)
+         */
         if ((ses->server->dialect == SMB311_PROT_ID) &&
-            !smb3_encryption_required(tcon))
+            !smb3_encryption_required(tcon) &&
+            !(ses->session_flags &
+                    (SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)) &&
+            ((ses->user_name != NULL) || (ses->sectype == Kerberos)))
                 req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
 
         memset(&rqst, 0, sizeof(struct smb_rqst));
@@ -1797,9 +1804,10 @@ create_reconnect_durable_buf(struct cifs_fid *fid)
         return buf;
 }
 
-static __u8
-parse_lease_state(struct TCP_Server_Info *server, struct smb2_create_rsp *rsp,
-                  unsigned int *epoch, char *lease_key)
+__u8
+smb2_parse_lease_state(struct TCP_Server_Info *server,
+                       struct smb2_create_rsp *rsp,
+                       unsigned int *epoch, char *lease_key)
 {
         char *data_offset;
         struct create_context *cc;
@@ -2456,8 +2464,9 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path,
         }
 
         if (rsp->OplockLevel == SMB2_OPLOCK_LEVEL_LEASE)
-                *oplock = parse_lease_state(server, rsp, &oparms->fid->epoch,
-                                            oparms->fid->lease_key);
+                *oplock = smb2_parse_lease_state(server, rsp,
+                                                 &oparms->fid->epoch,
+                                                 oparms->fid->lease_key);
         else
                 *oplock = rsp->OplockLevel;
 creat_exit:
@@ -2466,65 +2475,46 @@ creat_exit:
         return rc;
 }
 
-/*
- *      SMB2 IOCTL is used for both IOCTLs and FSCTLs
- */
 int
-SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
-           u64 volatile_fid, u32 opcode, bool is_fsctl,
-           char *in_data, u32 indatalen,
-           char **out_data, u32 *plen /* returned data len */)
+SMB2_ioctl_init(struct cifs_tcon *tcon, struct smb_rqst *rqst,
+                u64 persistent_fid, u64 volatile_fid, u32 opcode,
+                bool is_fsctl, char *in_data, u32 indatalen)
 {
-        struct smb_rqst rqst;
         struct smb2_ioctl_req *req;
-        struct smb2_ioctl_rsp *rsp;
-        struct cifs_ses *ses;
-        struct kvec iov[2];
-        struct kvec rsp_iov;
-        int resp_buftype;
-        int n_iov;
-        int rc = 0;
-        int flags = 0;
+        struct kvec *iov = rqst->rq_iov;
         unsigned int total_len;
-
-        cifs_dbg(FYI, "SMB2 IOCTL\n");
-
-        if (out_data != NULL)
-                *out_data = NULL;
-
-        /* zero out returned data len, in case of error */
-        if (plen)
-                *plen = 0;
-
-        if (tcon)
-                ses = tcon->ses;
-        else
-                return -EIO;
-
-        if (!ses || !(ses->server))
-                return -EIO;
+        int rc;
 
         rc = smb2_plain_req_init(SMB2_IOCTL, tcon, (void **) &req, &total_len);
         if (rc)
                 return rc;
 
-        if (smb3_encryption_required(tcon))
-                flags |= CIFS_TRANSFORM_REQ;
-
         req->CtlCode = cpu_to_le32(opcode);
         req->PersistentFileId = persistent_fid;
         req->VolatileFileId = volatile_fid;
 
+        iov[0].iov_base = (char *)req;
+        /*
+         * If no input data, the size of ioctl struct in
+         * protocol spec still includes a 1 byte data buffer,
+         * but if input data passed to ioctl, we do not
+         * want to double count this, so we do not send
+         * the dummy one byte of data in iovec[0] if sending
+         * input data (in iovec[1]).
+         */
         if (indatalen) {
                 req->InputCount = cpu_to_le32(indatalen);
                 /* do not set InputOffset if no input data */
                 req->InputOffset =
                        cpu_to_le32(offsetof(struct smb2_ioctl_req, Buffer));
+                rqst->rq_nvec = 2;
+                iov[0].iov_len = total_len - 1;
                 iov[1].iov_base = in_data;
                 iov[1].iov_len = indatalen;
-                n_iov = 2;
-        } else
-                n_iov = 1;
+        } else {
+                rqst->rq_nvec = 1;
+                iov[0].iov_len = total_len;
+        }
 
         req->OutputOffset = 0;
         req->OutputCount = 0; /* MBZ */
@@ -2546,33 +2536,70 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
         else
                 req->Flags = 0;
 
-        iov[0].iov_base = (char *)req;
-
-        /*
-         * If no input data, the size of ioctl struct in
-         * protocol spec still includes a 1 byte data buffer,
-         * but if input data passed to ioctl, we do not
-         * want to double count this, so we do not send
-         * the dummy one byte of data in iovec[0] if sending
-         * input data (in iovec[1]).
-         */
-
-        if (indatalen) {
-                iov[0].iov_len = total_len - 1;
-        } else
-                iov[0].iov_len = total_len;
-
         /* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */
         if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO)
                 req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
 
+        return 0;
+}
+
+void
+SMB2_ioctl_free(struct smb_rqst *rqst)
+{
+        if (rqst && rqst->rq_iov)
+                cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
+}
+
+/*
+ *      SMB2 IOCTL is used for both IOCTLs and FSCTLs
+ */
+int
+SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
+           u64 volatile_fid, u32 opcode, bool is_fsctl,
+           char *in_data, u32 indatalen,
+           char **out_data, u32 *plen /* returned data len */)
+{
+        struct smb_rqst rqst;
+        struct smb2_ioctl_rsp *rsp = NULL;
+        struct cifs_ses *ses;
+        struct kvec iov[SMB2_IOCTL_IOV_SIZE];
+        struct kvec rsp_iov = {NULL, 0};
+        int resp_buftype = CIFS_NO_BUFFER;
+        int rc = 0;
+        int flags = 0;
+
+        cifs_dbg(FYI, "SMB2 IOCTL\n");
+
+        if (out_data != NULL)
+                *out_data = NULL;
+
+        /* zero out returned data len, in case of error */
+        if (plen)
+                *plen = 0;
+
+        if (tcon)
+                ses = tcon->ses;
+        else
+                return -EIO;
+
+        if (!ses || !(ses->server))
+                return -EIO;
+
+        if (smb3_encryption_required(tcon))
+                flags |= CIFS_TRANSFORM_REQ;
+
         memset(&rqst, 0, sizeof(struct smb_rqst));
+        memset(&iov, 0, sizeof(iov));
         rqst.rq_iov = iov;
-        rqst.rq_nvec = n_iov;
+        rqst.rq_nvec = SMB2_IOCTL_IOV_SIZE;
+
+        rc = SMB2_ioctl_init(tcon, &rqst, persistent_fid, volatile_fid,
+                             opcode, is_fsctl, in_data, indatalen);
+        if (rc)
+                goto ioctl_exit;
 
         rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags,
                             &rsp_iov);
-        cifs_small_buf_release(req);
         rsp = (struct smb2_ioctl_rsp *)rsp_iov.iov_base;
 
         if (rc != 0)
@@ -2622,6 +2649,7 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
         }
 
 ioctl_exit:
+        SMB2_ioctl_free(&rqst);
         free_rsp_buf(resp_buftype, rsp);
         return rc;
 }
diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
index 0bd4d4802701..ee8977688e21 100644
--- a/fs/cifs/smb2pdu.h
+++ b/fs/cifs/smb2pdu.h
@@ -959,6 +959,13 @@ struct duplicate_extents_to_file {
         __le64 ByteCount;  /* Bytes to be copied */
 } __packed;
 
+/*
+ * Maximum number of iovs we need for an ioctl request.
+ * [0] : struct smb2_ioctl_req
+ * [1] : in_data
+ */
+#define SMB2_IOCTL_IOV_SIZE 2
+
 struct smb2_ioctl_req {
         struct smb2_sync_hdr sync_hdr;
         __le16 StructureSize;   /* Must be 57 */
diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h
index 87733b27a65f..3c32d0cfea69 100644
--- a/fs/cifs/smb2proto.h
+++ b/fs/cifs/smb2proto.h
@@ -144,6 +144,10 @@ extern int SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon,
                      u64 persistent_fid, u64 volatile_fid, u32 opcode,
                      bool is_fsctl, char *in_data, u32 indatalen,
                      char **out_data, u32 *plen /* returned data len */);
+extern int SMB2_ioctl_init(struct cifs_tcon *tcon, struct smb_rqst *rqst,
+                           u64 persistent_fid, u64 volatile_fid, u32 opcode,
+                           bool is_fsctl, char *in_data, u32 indatalen);
+extern void SMB2_ioctl_free(struct smb_rqst *rqst);
 extern int SMB2_close(const unsigned int xid, struct cifs_tcon *tcon,
                       u64 persistent_file_id, u64 volatile_file_id);
 extern int SMB2_close_flags(const unsigned int xid, struct cifs_tcon *tcon,
@@ -223,6 +227,9 @@ extern int smb3_validate_negotiate(const unsigned int, struct cifs_tcon *);
 
 extern enum securityEnum smb2_select_sectype(struct TCP_Server_Info *,
                                         enum securityEnum);
+extern __u8 smb2_parse_lease_state(struct TCP_Server_Info *server,
+                                   struct smb2_create_rsp *rsp,
+                                   unsigned int *epoch, char *lease_key);
 extern int smb3_encryption_required(const struct cifs_tcon *tcon);
 extern int smb2_validate_iov(unsigned int offset, unsigned int buffer_length,
                              struct kvec *iov, unsigned int min_buf_size);
diff --git a/fs/cifs/smb2status.h b/fs/cifs/smb2status.h
index 3d5f62150de4..447c0c6e4c64 100644
--- a/fs/cifs/smb2status.h
+++ b/fs/cifs/smb2status.h
@@ -30,9 +30,9 @@
  */
 
 #define STATUS_SEVERITY_SUCCESS __constant_cpu_to_le32(0x0000)
-#define STATUS_SEVERITY_INFORMATIONAL __constanst_cpu_to_le32(0x0001)
-#define STATUS_SEVERITY_WARNING __constanst_cpu_to_le32(0x0002)
-#define STATUS_SEVERITY_ERROR __constanst_cpu_to_le32(0x0003)
+#define STATUS_SEVERITY_INFORMATIONAL cpu_to_le32(0x0001)
+#define STATUS_SEVERITY_WARNING cpu_to_le32(0x0002)
+#define STATUS_SEVERITY_ERROR cpu_to_le32(0x0003)
 
 struct ntstatus {
         /* Facility is the high 12 bits of the following field */
diff --git a/fs/cifs/trace.h b/fs/cifs/trace.h
index d8b049afa606..99c4d799c24b 100644
--- a/fs/cifs/trace.h
+++ b/fs/cifs/trace.h
@@ -59,6 +59,8 @@ DEFINE_EVENT(smb3_rw_err_class, smb3_##name,    \
 DEFINE_SMB3_RW_ERR_EVENT(write_err);
 DEFINE_SMB3_RW_ERR_EVENT(read_err);
 DEFINE_SMB3_RW_ERR_EVENT(query_dir_err);
+DEFINE_SMB3_RW_ERR_EVENT(zero_err);
+DEFINE_SMB3_RW_ERR_EVENT(falloc_err);
 
 
 /* For logging successful read or write */
@@ -104,9 +106,13 @@ DEFINE_EVENT(smb3_rw_done_class, smb3_##name,   \
 DEFINE_SMB3_RW_DONE_EVENT(write_enter);
 DEFINE_SMB3_RW_DONE_EVENT(read_enter);
 DEFINE_SMB3_RW_DONE_EVENT(query_dir_enter);
+DEFINE_SMB3_RW_DONE_EVENT(zero_enter);
+DEFINE_SMB3_RW_DONE_EVENT(falloc_enter);
 DEFINE_SMB3_RW_DONE_EVENT(write_done);
 DEFINE_SMB3_RW_DONE_EVENT(read_done);
 DEFINE_SMB3_RW_DONE_EVENT(query_dir_done);
+DEFINE_SMB3_RW_DONE_EVENT(zero_done);
+DEFINE_SMB3_RW_DONE_EVENT(falloc_done);
 
 /*
  * For handle based calls other than read and write, and get/set info
@@ -242,6 +248,123 @@ DEFINE_SMB3_INF_ERR_EVENT(query_info_err);
 DEFINE_SMB3_INF_ERR_EVENT(set_info_err);
 DEFINE_SMB3_INF_ERR_EVENT(fsctl_err);
 
+DECLARE_EVENT_CLASS(smb3_inf_compound_enter_class,
+        TP_PROTO(unsigned int xid,
+                __u32   tid,
+                __u64   sesid,
+                const char *full_path),
+        TP_ARGS(xid, tid, sesid, full_path),
+        TP_STRUCT__entry(
+                __field(unsigned int, xid)
+                __field(__u32, tid)
+                __field(__u64, sesid)
+                __string(path, full_path)
+        ),
+        TP_fast_assign(
+                __entry->xid = xid;
+                __entry->tid = tid;
+                __entry->sesid = sesid;
+                __assign_str(path, full_path);
+        ),
+        TP_printk("xid=%u sid=0x%llx tid=0x%x path=%s",
+                __entry->xid, __entry->sesid, __entry->tid,
+                __get_str(path))
+)
+
+#define DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(name)     \
+DEFINE_EVENT(smb3_inf_compound_enter_class, smb3_##name,    \
+        TP_PROTO(unsigned int xid,              \
+                __u32   tid,                    \
+                __u64   sesid,                  \
+                const char *full_path),         \
+        TP_ARGS(xid, tid, sesid, full_path))
+
+DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(query_info_compound_enter);
+DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(hardlink_enter);
+DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(rename_enter);
+DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(rmdir_enter);
+DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(set_eof_enter);
+DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(set_info_compound_enter);
+DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(delete_enter);
+DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(mkdir_enter);
+
+
+DECLARE_EVENT_CLASS(smb3_inf_compound_done_class,
+        TP_PROTO(unsigned int xid,
+                __u32   tid,
+                __u64   sesid),
+        TP_ARGS(xid, tid, sesid),
+        TP_STRUCT__entry(
+                __field(unsigned int, xid)
+                __field(__u32, tid)
+                __field(__u64, sesid)
+        ),
+        TP_fast_assign(
+                __entry->xid = xid;
+                __entry->tid = tid;
+                __entry->sesid = sesid;
+        ),
+        TP_printk("xid=%u sid=0x%llx tid=0x%x",
+                __entry->xid, __entry->sesid, __entry->tid)
+)
+
+#define DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(name)     \
+DEFINE_EVENT(smb3_inf_compound_done_class, smb3_##name,    \
+        TP_PROTO(unsigned int xid,              \
+                __u32   tid,                    \
+                __u64   sesid),                 \
+        TP_ARGS(xid, tid, sesid))
+
+DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(query_info_compound_done);
+DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(hardlink_done);
+DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(rename_done);
+DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(rmdir_done);
+DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(set_eof_done);
+DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(set_info_compound_done);
+DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(delete_done);
+DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(mkdir_done);
+
+
+DECLARE_EVENT_CLASS(smb3_inf_compound_err_class,
+        TP_PROTO(unsigned int xid,
+                __u32   tid,
+                __u64   sesid,
+                int     rc),
+        TP_ARGS(xid, tid, sesid, rc),
+        TP_STRUCT__entry(
+                __field(unsigned int, xid)
+                __field(__u32, tid)
+                __field(__u64, sesid)
+                __field(int, rc)
+        ),
+        TP_fast_assign(
+                __entry->xid = xid;
+                __entry->tid = tid;
+                __entry->sesid = sesid;
+                __entry->rc = rc;
+        ),
+        TP_printk("xid=%u sid=0x%llx tid=0x%x rc=%d",
+                __entry->xid, __entry->sesid, __entry->tid,
+                __entry->rc)
+)
+
+#define DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(name)     \
+DEFINE_EVENT(smb3_inf_compound_err_class, smb3_##name,    \
+        TP_PROTO(unsigned int xid,              \
+                __u32   tid,                    \
+                __u64   sesid,                  \
+                int rc),                        \
+        TP_ARGS(xid, tid, sesid, rc))
+
+DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(query_info_compound_err);
+DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(hardlink_err);
+DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(rename_err);
+DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(rmdir_err);
+DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(set_eof_err);
+DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(set_info_compound_err);
+DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(mkdir_err);
+DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(delete_err);
+
 /*
  * For logging SMB3 Status code and Command for responses which return errors
  */
@@ -426,19 +549,19 @@ DECLARE_EVENT_CLASS(smb3_tcon_class,
                 __field(unsigned int, xid)
                 __field(__u32, tid)
                 __field(__u64, sesid)
-                __field(const char *,  unc_name)
+                __string(name, unc_name)
                 __field(int, rc)
         ),
         TP_fast_assign(
                 __entry->xid = xid;
                 __entry->tid = tid;
                 __entry->sesid = sesid;
-                __entry->unc_name = unc_name;
+                __assign_str(name, unc_name);
                 __entry->rc = rc;
         ),
         TP_printk("xid=%u sid=0x%llx tid=0x%x unc_name=%s rc=%d",
                 __entry->xid, __entry->sesid, __entry->tid,
-                __entry->unc_name, __entry->rc)
+                __get_str(name), __entry->rc)
 )
 
 #define DEFINE_SMB3_TCON_EVENT(name)          \
@@ -713,6 +836,7 @@ DEFINE_EVENT(smb3_credit_class, smb3_##name,  \
         TP_ARGS(currmid, hostname, credits))
 
 DEFINE_SMB3_CREDIT_EVENT(reconnect_with_invalid_credits);
+DEFINE_SMB3_CREDIT_EVENT(credit_timeout);
 
 #endif /* _CIFS_TRACE_H */
 
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 7ce8a585abd6..1de8e996e566 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -486,15 +486,31 @@ smb_send(struct TCP_Server_Info *server, struct smb_hdr *smb_buffer,
 }
 
 static int
-wait_for_free_credits(struct TCP_Server_Info *server, const int timeout,
-                      int *credits, unsigned int *instance)
+wait_for_free_credits(struct TCP_Server_Info *server, const int num_credits,
+                      const int timeout, const int flags,
+                      unsigned int *instance)
 {
         int rc;
+        int *credits;
+        int optype;
+        long int t;
+
+        if (timeout < 0)
+                t = MAX_JIFFY_OFFSET;
+        else
+                t = msecs_to_jiffies(timeout);
+
+        optype = flags & CIFS_OP_MASK;
 
         *instance = 0;
 
+        credits = server->ops->get_credits_field(server, optype);
+        /* Since an echo is already inflight, no need to wait to send another */
+        if (*credits <= 0 && optype == CIFS_ECHO_OP)
+                return -EAGAIN;
+
         spin_lock(&server->req_lock);
-        if (timeout == CIFS_ASYNC_OP) {
+        if ((flags & CIFS_TIMEOUT_MASK) == CIFS_ASYNC_OP) {
                 /* oplock breaks must not be held up */
                 server->in_flight++;
                 *credits -= 1;
@@ -504,14 +520,21 @@ wait_for_free_credits(struct TCP_Server_Info *server, const int timeout,
         }
 
         while (1) {
-                if (*credits <= 0) {
+                if (*credits < num_credits) {
                         spin_unlock(&server->req_lock);
                         cifs_num_waiters_inc(server);
-                        rc = wait_event_killable(server->request_q,
-                                                 has_credits(server, credits));
+                        rc = wait_event_killable_timeout(server->request_q,
+                                has_credits(server, credits, num_credits), t);
                         cifs_num_waiters_dec(server);
-                        if (rc)
-                                return rc;
+                        if (!rc) {
+                                trace_smb3_credit_timeout(server->CurrentMid,
+                                        server->hostname, num_credits);
+                                cifs_dbg(VFS, "wait timed out after %d ms\n",
+                                         timeout);
+                                return -ENOTSUPP;
+                        }
+                        if (rc == -ERESTARTSYS)
+                                return -ERESTARTSYS;
                         spin_lock(&server->req_lock);
                 } else {
                         if (server->tcpStatus == CifsExiting) {
@@ -520,14 +543,52 @@ wait_for_free_credits(struct TCP_Server_Info *server, const int timeout,
                         }
 
                         /*
+                         * For normal commands, reserve the last MAX_COMPOUND
+                         * credits to compound requests.
+                         * Otherwise these compounds could be permanently
+                         * starved for credits by single-credit requests.
+                         *
+                         * To prevent spinning CPU, block this thread until
+                         * there are >MAX_COMPOUND credits available.
+                         * But only do this is we already have a lot of
+                         * credits in flight to avoid triggering this check
+                         * for servers that are slow to hand out credits on
+                         * new sessions.
+                         */
+                        if (!optype && num_credits == 1 &&
+                            server->in_flight > 2 * MAX_COMPOUND &&
+                            *credits <= MAX_COMPOUND) {
+                                spin_unlock(&server->req_lock);
+                                cifs_num_waiters_inc(server);
+                                rc = wait_event_killable_timeout(
+                                        server->request_q,
+                                        has_credits(server, credits,
+                                                    MAX_COMPOUND + 1),
+                                        t);
+                                cifs_num_waiters_dec(server);
+                                if (!rc) {
+                                        trace_smb3_credit_timeout(
+                                                server->CurrentMid,
+                                                server->hostname, num_credits);
+                                        cifs_dbg(VFS, "wait timed out after %d ms\n",
+                                                 timeout);
+                                        return -ENOTSUPP;
+                                }
+                                if (rc == -ERESTARTSYS)
+                                        return -ERESTARTSYS;
+                                spin_lock(&server->req_lock);
+                                continue;
+                        }
+
+                        /*
                          * Can not count locking commands against total
                          * as they are allowed to block on server.
                          */
 
                         /* update # of requests on the wire to server */
-                        if (timeout != CIFS_BLOCKING_OP) {
-                                *credits -= 1;
-                                server->in_flight++;
+                        if ((flags & CIFS_TIMEOUT_MASK) != CIFS_BLOCKING_OP) {
+                                *credits -= num_credits;
+                                server->in_flight += num_credits;
                                 *instance = server->reconnect_instance;
                         }
                         spin_unlock(&server->req_lock);
@@ -538,16 +599,36 @@ wait_for_free_credits(struct TCP_Server_Info *server, const int timeout,
 }
 
 static int
-wait_for_free_request(struct TCP_Server_Info *server, const int timeout,
-                      const int optype, unsigned int *instance)
+wait_for_free_request(struct TCP_Server_Info *server, const int flags,
+                      unsigned int *instance)
 {
-        int *val;
+        return wait_for_free_credits(server, 1, -1, flags,
+                                     instance);
+}
 
-        val = server->ops->get_credits_field(server, optype);
-        /* Since an echo is already inflight, no need to wait to send another */
-        if (*val <= 0 && optype == CIFS_ECHO_OP)
-                return -EAGAIN;
-        return wait_for_free_credits(server, timeout, val, instance);
+static int
+wait_for_compound_request(struct TCP_Server_Info *server, int num,
+                          const int flags, unsigned int *instance)
+{
+        int *credits;
+
+        credits = server->ops->get_credits_field(server, flags & CIFS_OP_MASK);
+
+        spin_lock(&server->req_lock);
+        if (*credits < num) {
+                /*
+                 * Return immediately if not too many requests in flight since
+                 * we will likely be stuck on waiting for credits.
+                 */
+                if (server->in_flight < num - *credits) {
+                        spin_unlock(&server->req_lock);
+                        return -ENOTSUPP;
+                }
+        }
+        spin_unlock(&server->req_lock);
+
+        return wait_for_free_credits(server, num, 60000, flags,
+                                     instance);
 }
 
 int
@@ -646,16 +727,16 @@ cifs_call_async(struct TCP_Server_Info *server, struct smb_rqst *rqst,
                 mid_handle_t *handle, void *cbdata, const int flags,
                 const struct cifs_credits *exist_credits)
 {
-        int rc, timeout, optype;
+        int rc;
         struct mid_q_entry *mid;
         struct cifs_credits credits = { .value = 0, .instance = 0 };
         unsigned int instance;
+        int optype;
 
-        timeout = flags & CIFS_TIMEOUT_MASK;
         optype = flags & CIFS_OP_MASK;
 
         if ((flags & CIFS_HAS_CREDITS) == 0) {
-                rc = wait_for_free_request(server, timeout, optype, &instance);
+                rc = wait_for_free_request(server, flags, &instance);
                 if (rc)
                         return rc;
                 credits.value = 1;
@@ -871,18 +952,15 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
                    const int flags, const int num_rqst, struct smb_rqst *rqst,
                    int *resp_buf_type, struct kvec *resp_iov)
 {
-        int i, j, rc = 0;
-        int timeout, optype;
+        int i, j, optype, rc = 0;
         struct mid_q_entry *midQ[MAX_COMPOUND];
         bool cancelled_mid[MAX_COMPOUND] = {false};
         struct cifs_credits credits[MAX_COMPOUND] = {
                 { .value = 0, .instance = 0 }
         };
         unsigned int instance;
-        unsigned int first_instance = 0;
         char *buf;
 
-        timeout = flags & CIFS_TIMEOUT_MASK;
         optype = flags & CIFS_OP_MASK;
 
         for (i = 0; i < num_rqst; i++)
@@ -896,81 +974,24 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
         if (ses->server->tcpStatus == CifsExiting)
                 return -ENOENT;
 
-        spin_lock(&ses->server->req_lock);
-        if (ses->server->credits < num_rqst) {
-                /*
-                 * Return immediately if not too many requests in flight since
-                 * we will likely be stuck on waiting for credits.
-                 */
-                if (ses->server->in_flight < num_rqst - ses->server->credits) {
-                        spin_unlock(&ses->server->req_lock);
-                        return -ENOTSUPP;
-                }
-        } else {
-                /* enough credits to send the whole compounded request */
-                ses->server->credits -= num_rqst;
-                ses->server->in_flight += num_rqst;
-                first_instance = ses->server->reconnect_instance;
-        }
-        spin_unlock(&ses->server->req_lock);
-
-        if (first_instance) {
-                cifs_dbg(FYI, "Acquired %d credits at once\n", num_rqst);
-                for (i = 0; i < num_rqst; i++) {
-                        credits[i].value = 1;
-                        credits[i].instance = first_instance;
-                }
-                goto setup_rqsts;
-        }
-
         /*
-         * There are not enough credits to send the whole compound request but
-         * there are requests in flight that may bring credits from the server.
+         * Wait for all the requests to become available.
          * This approach still leaves the possibility to be stuck waiting for
          * credits if the server doesn't grant credits to the outstanding
-         * requests. This should be fixed by returning immediately and letting
-         * a caller fallback to sequential commands instead of compounding.
-         * Ensure we obtain 1 credit per request in the compound chain.
+         * requests and if the client is completely idle, not generating any
+         * other requests.
+         * This can be handled by the eventual session reconnect.
          */
-        for (i = 0; i < num_rqst; i++) {
-                rc = wait_for_free_request(ses->server, timeout, optype,
-                                           &instance);
-
-                if (rc == 0) {
-                        credits[i].value = 1;
-                        credits[i].instance = instance;
-                        /*
-                         * All parts of the compound chain must get credits from
-                         * the same session, otherwise we may end up using more
-                         * credits than the server granted. If there were
-                         * reconnects in between, return -EAGAIN and let callers
-                         * handle it.
-                         */
-                        if (i == 0)
-                                first_instance = instance;
-                        else if (first_instance != instance) {
-                                i++;
-                                rc = -EAGAIN;
-                        }
-                }
+        rc = wait_for_compound_request(ses->server, num_rqst, flags,
+                                       &instance);
+        if (rc)
+                return rc;
 
-                if (rc) {
-                        /*
-                         * We haven't sent an SMB packet to the server yet but
-                         * we already obtained credits for i requests in the
-                         * compound chain - need to return those credits back
-                         * for future use. Note that we need to call add_credits
-                         * multiple times to match the way we obtained credits
-                         * in the first place and to account for in flight
-                         * requests correctly.
-                         */
-                        for (j = 0; j < i; j++)
-                                add_credits(ses->server, &credits[j], optype);
-                        return rc;
-                }
+        for (i = 0; i < num_rqst; i++) {
+                credits[i].value = 1;
+                credits[i].instance = instance;
         }
 
-setup_rqsts:
         /*
          * Make sure that we sign in the same order that we send on this socket
          * and avoid races inside tcp sendmsg code that could cause corruption
@@ -981,14 +1002,12 @@ setup_rqsts:
 
         /*
          * All the parts of the compound chain belong obtained credits from the
-         * same session (see the appropriate checks above). In the same time
-         * there might be reconnects after those checks but before we acquired
-         * the srv_mutex. We can not use credits obtained from the previous
+         * same session. We can not use credits obtained from the previous
          * session to send this request. Check if there were reconnects after
          * we obtained credits and return -EAGAIN in such cases to let callers
          * handle it.
          */
-        if (first_instance != ses->server->reconnect_instance) {
+        if (instance != ses->server->reconnect_instance) {
                 mutex_unlock(&ses->server->srv_mutex);
                 for (j = 0; j < num_rqst; j++)
                         add_credits(ses->server, &credits[j], optype);
@@ -1057,7 +1076,7 @@ setup_rqsts:
                 smb311_update_preauth_hash(ses, rqst[0].rq_iov,
                                            rqst[0].rq_nvec);
 
-        if (timeout == CIFS_ASYNC_OP)
+        if ((flags & CIFS_TIMEOUT_MASK) == CIFS_ASYNC_OP)
                 goto out;
 
         for (i = 0; i < num_rqst; i++) {
@@ -1194,7 +1213,7 @@ SendReceive2(const unsigned int xid, struct cifs_ses *ses,
 int
 SendReceive(const unsigned int xid, struct cifs_ses *ses,
             struct smb_hdr *in_buf, struct smb_hdr *out_buf,
-            int *pbytes_returned, const int timeout)
+            int *pbytes_returned, const int flags)
 {
         int rc = 0;
         struct mid_q_entry *midQ;
@@ -1225,7 +1244,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,
                 return -EIO;
         }
 
-        rc = wait_for_free_request(ses->server, timeout, 0, &credits.instance);
+        rc = wait_for_free_request(ses->server, flags, &credits.instance);
         if (rc)
                 return rc;
 
@@ -1264,7 +1283,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,
         if (rc < 0)
                 goto out;
 
-        if (timeout == CIFS_ASYNC_OP)
+        if ((flags & CIFS_TIMEOUT_MASK) == CIFS_ASYNC_OP)
                 goto out;
 
         rc = wait_for_response(ses->server, midQ);
@@ -1367,8 +1386,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
                 return -EIO;
         }
 
-        rc = wait_for_free_request(ses->server, CIFS_BLOCKING_OP, 0,
-                                   &instance);
+        rc = wait_for_free_request(ses->server, CIFS_BLOCKING_OP, &instance);
         if (rc)
                 return rc;
 
diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
index a1ac7e9245ec..75a5309f2231 100644
--- a/fs/ext4/ext4_jbd2.h
+++ b/fs/ext4/ext4_jbd2.h
@@ -384,7 +384,7 @@ static inline void ext4_update_inode_fsync_trans(handle_t *handle,
 {
         struct ext4_inode_info *ei = EXT4_I(inode);
 
-        if (ext4_handle_valid(handle)) {
+        if (ext4_handle_valid(handle) && !is_handle_aborted(handle)) {
                 ei->i_sync_tid = handle->h_transaction->t_tid;
                 if (datasync)
                         ei->i_datasync_tid = handle->h_transaction->t_tid;
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 69d65d49837b..98ec11f69cd4 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -125,7 +125,7 @@ ext4_unaligned_aio(struct inode *inode, struct iov_iter *from, loff_t pos)
         struct super_block *sb = inode->i_sb;
         int blockmask = sb->s_blocksize - 1;
 
-        if (pos >= i_size_read(inode))
+        if (pos >= ALIGN(i_size_read(inode), sb->s_blocksize))
                 return 0;
 
         if ((pos | iov_iter_alignment(from)) & blockmask)
diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
index c2225f0d31b5..2024d3fa5504 100644
--- a/fs/ext4/indirect.c
+++ b/fs/ext4/indirect.c
@@ -1222,6 +1222,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode *inode,
         ext4_lblk_t offsets[4], offsets2[4];
         Indirect chain[4], chain2[4];
         Indirect *partial, *partial2;
+        Indirect *p = NULL, *p2 = NULL;
         ext4_lblk_t max_block;
         __le32 nr = 0, nr2 = 0;
         int n = 0, n2 = 0;
@@ -1263,7 +1264,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode *inode,
                 }
 
 
-                partial = ext4_find_shared(inode, n, offsets, chain, &nr);
+                partial = p = ext4_find_shared(inode, n, offsets, chain, &nr);
                 if (nr) {
                         if (partial == chain) {
                                 /* Shared branch grows from the inode */
@@ -1288,13 +1289,11 @@ int ext4_ind_remove_space(handle_t *handle, struct inode *inode,
                                 partial->p + 1,
                                 (__le32 *)partial->bh->b_data+addr_per_block,
                                 (chain+n-1) - partial);
-                        BUFFER_TRACE(partial->bh, "call brelse");
-                        brelse(partial->bh);
                         partial--;
                 }
 
 end_range:
-                partial2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2);
+                partial2 = p2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2);
                 if (nr2) {
                         if (partial2 == chain2) {
                                 /*
@@ -1324,16 +1323,14 @@ end_range:
                                            (__le32 *)partial2->bh->b_data,
                                            partial2->p,
                                            (chain2+n2-1) - partial2);
-                        BUFFER_TRACE(partial2->bh, "call brelse");
-                        brelse(partial2->bh);
                         partial2--;
                 }
                 goto do_indirects;
         }
 
         /* Punch happened within the same level (n == n2) */
-        partial = ext4_find_shared(inode, n, offsets, chain, &nr);
-        partial2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2);
+        partial = p = ext4_find_shared(inode, n, offsets, chain, &nr);
+        partial2 = p2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2);
 
         /* Free top, but only if partial2 isn't its subtree. */
         if (nr) {
@@ -1390,11 +1387,7 @@ end_range:
                                            partial->p + 1,
                                            partial2->p,
                                            (chain+n-1) - partial);
-                        BUFFER_TRACE(partial->bh, "call brelse");
-                        brelse(partial->bh);
-                        BUFFER_TRACE(partial2->bh, "call brelse");
-                        brelse(partial2->bh);
-                        return 0;
+                        goto cleanup;
                 }
 
                 /*
@@ -1409,8 +1402,6 @@ end_range:
                                            partial->p + 1,
                                            (__le32 *)partial->bh->b_data+addr_per_block,
                                            (chain+n-1) - partial);
-                        BUFFER_TRACE(partial->bh, "call brelse");
-                        brelse(partial->bh);
                         partial--;
                 }
                 if (partial2 > chain2 && depth2 <= depth) {
@@ -1418,11 +1409,21 @@ end_range:
                                            (__le32 *)partial2->bh->b_data,
                                            partial2->p,
                                            (chain2+n2-1) - partial2);
-                        BUFFER_TRACE(partial2->bh, "call brelse");
-                        brelse(partial2->bh);
                         partial2--;
                 }
         }
+
+cleanup:
+        while (p && p > chain) {
+                BUFFER_TRACE(p->bh, "call brelse");
+                brelse(p->bh);
+                p--;
+        }
+        while (p2 && p2 > chain2) {
+                BUFFER_TRACE(p2->bh, "call brelse");
+                brelse(p2->bh);
+                p2--;
+        }
         return 0;
 
 do_indirects:
@@ -1430,7 +1431,7 @@ do_indirects:
         switch (offsets[0]) {
         default:
                 if (++n >= n2)
-                        return 0;
+                        break;
                 nr = i_data[EXT4_IND_BLOCK];
                 if (nr) {
                         ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 1);
@@ -1439,7 +1440,7 @@ do_indirects:
                 /* fall through */
         case EXT4_IND_BLOCK:
                 if (++n >= n2)
-                        return 0;
+                        break;
                 nr = i_data[EXT4_DIND_BLOCK];
                 if (nr) {
                         ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 2);
@@ -1448,7 +1449,7 @@ do_indirects:
                 /* fall through */
         case EXT4_DIND_BLOCK:
                 if (++n >= n2)
-                        return 0;
+                        break;
                 nr = i_data[EXT4_TIND_BLOCK];
                 if (nr) {
                         ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 3);
@@ -1458,5 +1459,5 @@ do_indirects:
         case EXT4_TIND_BLOCK:
                 ;
         }
-        return 0;
+        goto cleanup;
 }
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index b54b261ded36..b32a57bc5d5d 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -6080,36 +6080,6 @@ out:
         return;
 }
 
-#if 0
-/*
- * Bind an inode's backing buffer_head into this transaction, to prevent
- * it from being flushed to disk early.  Unlike
- * ext4_reserve_inode_write, this leaves behind no bh reference and
- * returns no iloc structure, so the caller needs to repeat the iloc
- * lookup to mark the inode dirty later.
- */
-static int ext4_pin_inode(handle_t *handle, struct inode *inode)
-{
-        struct ext4_iloc iloc;
-
-        int err = 0;
-        if (handle) {
-                err = ext4_get_inode_loc(inode, &iloc);
-                if (!err) {
-                        BUFFER_TRACE(iloc.bh, "get_write_access");
-                        err = jbd2_journal_get_write_access(handle, iloc.bh);
-                        if (!err)
-                                err = ext4_handle_dirty_metadata(handle,
-                                                                 NULL,
-                                                                 iloc.bh);
-                        brelse(iloc.bh);
-                }
-        }
-        ext4_std_error(inode->i_sb, err);
-        return err;
-}
-#endif
-
 int ext4_change_inode_journal_flag(struct inode *inode, int val)
 {
         journal_t *journal;
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 3c4f8bb59f8a..bab3da4f1e0d 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -1000,6 +1000,13 @@ resizefs_out:
                 if (!blk_queue_discard(q))
                         return -EOPNOTSUPP;
 
+                /*
+                 * We haven't replayed the journal, so we cannot use our
+                 * block-bitmap-guided storage zapping commands.
+                 */
+                if (test_opt(sb, NOLOAD) && ext4_has_feature_journal(sb))
+                        return -EROFS;
+
                 if (copy_from_user(&range, (struct fstrim_range __user *)arg,
                     sizeof(range)))
                         return -EFAULT;
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index 3d9b18505c0c..e7ae26e36c9c 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -932,11 +932,18 @@ static int add_new_gdb_meta_bg(struct super_block *sb,
         memcpy(n_group_desc, o_group_desc,
                EXT4_SB(sb)->s_gdb_count * sizeof(struct buffer_head *));
         n_group_desc[gdb_num] = gdb_bh;
+
+        BUFFER_TRACE(gdb_bh, "get_write_access");
+        err = ext4_journal_get_write_access(handle, gdb_bh);
+        if (err) {
+                kvfree(n_group_desc);
+                brelse(gdb_bh);
+                return err;
+        }
+
         EXT4_SB(sb)->s_group_desc = n_group_desc;
         EXT4_SB(sb)->s_gdb_count++;
         kvfree(o_group_desc);
-        BUFFER_TRACE(gdb_bh, "get_write_access");
-        err = ext4_journal_get_write_access(handle, gdb_bh);
         return err;
 }
 
@@ -2073,6 +2080,10 @@ out:
                 free_flex_gd(flex_gd);
         if (resize_inode != NULL)
                 iput(resize_inode);
-        ext4_msg(sb, KERN_INFO, "resized filesystem to %llu", n_blocks_count);
+        if (err)
+                ext4_warning(sb, "error (%d) occurred during "
+                             "file system resize", err);
+        ext4_msg(sb, KERN_INFO, "resized filesystem to %llu",
+                 ext4_blocks_count(es));
         return err;
 }
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index f5b828bf1299..6ed4eb81e674 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -430,6 +430,12 @@ static void ext4_journal_commit_callback(journal_t *journal, transaction_t *txn)
         spin_unlock(&sbi->s_md_lock);
 }
 
+static bool system_going_down(void)
+{
+        return system_state == SYSTEM_HALT || system_state == SYSTEM_POWER_OFF
+                || system_state == SYSTEM_RESTART;
+}
+
 /* Deal with the reporting of failure conditions on a filesystem such as
  * inconsistencies detected or read IO failures.
  *
@@ -460,7 +466,12 @@ static void ext4_handle_error(struct super_block *sb)
                 if (journal)
                         jbd2_journal_abort(journal, -EIO);
         }
-        if (test_opt(sb, ERRORS_RO)) {
+        /*
+         * We force ERRORS_RO behavior when system is rebooting. Otherwise we
+         * could panic during 'reboot -f' as the underlying device got already
+         * disabled.
+         */
+        if (test_opt(sb, ERRORS_RO) || system_going_down()) {
                 ext4_msg(sb, KERN_CRIT, "Remounting filesystem read-only");
                 /*
                  * Make sure updated value of ->s_mount_flags will be visible
@@ -468,8 +479,7 @@ static void ext4_handle_error(struct super_block *sb)
                  */
                 smp_wmb();
                 sb->s_flags |= SB_RDONLY;
-        }
-        if (test_opt(sb, ERRORS_PANIC)) {
+        } else if (test_opt(sb, ERRORS_PANIC)) {
                 if (EXT4_SB(sb)->s_journal &&
                   !(EXT4_SB(sb)->s_journal->j_flags & JBD2_REC_ERR))
                         return;
diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
index f955cd3e0677..a98e1b02279e 100644
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -306,8 +306,9 @@ static int f2fs_write_meta_pages(struct address_space *mapping,
                 goto skip_write;
 
         /* collect a number of dirty meta pages and write together */
-        if (wbc->for_kupdate ||
-                get_pages(sbi, F2FS_DIRTY_META) < nr_pages_to_skip(sbi, META))
+        if (wbc->sync_mode != WB_SYNC_ALL &&
+                        get_pages(sbi, F2FS_DIRTY_META) <
+                                        nr_pages_to_skip(sbi, META))
                 goto skip_write;
 
         /* if locked failed, cp will flush dirty pages instead */
@@ -405,7 +406,7 @@ static int f2fs_set_meta_page_dirty(struct page *page)
         if (!PageDirty(page)) {
                 __set_page_dirty_nobuffers(page);
                 inc_page_count(F2FS_P_SB(page), F2FS_DIRTY_META);
-                SetPagePrivate(page);
+                f2fs_set_page_private(page, 0);
                 f2fs_trace_pid(page);
                 return 1;
         }
@@ -956,7 +957,7 @@ void f2fs_update_dirty_page(struct inode *inode, struct page *page)
         inode_inc_dirty_pages(inode);
         spin_unlock(&sbi->inode_lock[type]);
 
-        SetPagePrivate(page);
+        f2fs_set_page_private(page, 0);
         f2fs_trace_pid(page);
 }
 
@@ -1259,10 +1260,17 @@ static void update_ckpt_flags(struct f2fs_sb_info *sbi, struct cp_control *cpc)
         else
                 __clear_ckpt_flags(ckpt, CP_DISABLED_FLAG);
 
+        if (is_sbi_flag_set(sbi, SBI_CP_DISABLED_QUICK))
+                __set_ckpt_flags(ckpt, CP_DISABLED_QUICK_FLAG);
+        else
+                __clear_ckpt_flags(ckpt, CP_DISABLED_QUICK_FLAG);
+
         if (is_sbi_flag_set(sbi, SBI_QUOTA_SKIP_FLUSH))
                 __set_ckpt_flags(ckpt, CP_QUOTA_NEED_FSCK_FLAG);
-        else
-                __clear_ckpt_flags(ckpt, CP_QUOTA_NEED_FSCK_FLAG);
+        /*
+         * TODO: we count on fsck.f2fs to clear this flag until we figure out
+         * missing cases which clear it incorrectly.
+         */
 
         if (is_sbi_flag_set(sbi, SBI_QUOTA_NEED_REPAIR))
                 __set_ckpt_flags(ckpt, CP_QUOTA_NEED_FSCK_FLAG);
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 568e1d09eb48..9727944139f2 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -301,9 +301,10 @@ static inline void __submit_bio(struct f2fs_sb_info *sbi,
                 for (; start < F2FS_IO_SIZE(sbi); start++) {
                         struct page *page =
                                 mempool_alloc(sbi->write_io_dummy,
-                                        GFP_NOIO | __GFP_ZERO | __GFP_NOFAIL);
+                                              GFP_NOIO | __GFP_NOFAIL);
                         f2fs_bug_on(sbi, !page);
 
+                        zero_user_segment(page, 0, PAGE_SIZE);
                         SetPagePrivate(page);
                         set_page_private(page, (unsigned long)DUMMY_WRITTEN_PAGE);
                         lock_page(page);
@@ -1553,6 +1554,9 @@ static int f2fs_mpage_readpages(struct address_space *mapping,
                 if (last_block > last_block_in_file)
                         last_block = last_block_in_file;
 
+                /* just zeroing out page which is beyond EOF */
+                if (block_in_file >= last_block)
+                        goto zero_out;
                 /*
                  * Map blocks using the previous result first.
                  */
@@ -1565,16 +1569,11 @@ static int f2fs_mpage_readpages(struct address_space *mapping,
                  * Then do more f2fs_map_blocks() calls until we are
                  * done with this page.
                  */
-                map.m_flags = 0;
-
-                if (block_in_file < last_block) {
-                        map.m_lblk = block_in_file;
-                        map.m_len = last_block - block_in_file;
+                map.m_lblk = block_in_file;
+                map.m_len = last_block - block_in_file;
 
-                        if (f2fs_map_blocks(inode, &map, 0,
-                                                F2FS_GET_BLOCK_DEFAULT))
-                                goto set_error_page;
-                }
+                if (f2fs_map_blocks(inode, &map, 0, F2FS_GET_BLOCK_DEFAULT))
+                        goto set_error_page;
 got_it:
                 if ((map.m_flags & F2FS_MAP_MAPPED)) {
                         block_nr = map.m_pblk + block_in_file - map.m_lblk;
@@ -1589,6 +1588,7 @@ got_it:
                                                                 DATA_GENERIC))
                                 goto set_error_page;
                 } else {
+zero_out:
                         zero_user_segment(page, 0, PAGE_SIZE);
                         if (!PageUptodate(page))
                                 SetPageUptodate(page);
@@ -1863,8 +1863,13 @@ got_it:
                 if (fio->need_lock == LOCK_REQ)
                         f2fs_unlock_op(fio->sbi);
                 err = f2fs_inplace_write_data(fio);
-                if (err && PageWriteback(page))
-                        end_page_writeback(page);
+                if (err) {
+                        if (f2fs_encrypted_file(inode))
+                                fscrypt_pullback_bio_page(&fio->encrypted_page,
+                                                                        true);
+                        if (PageWriteback(page))
+                                end_page_writeback(page);
+                }
                 trace_f2fs_do_write_data_page(fio->page, IPU);
                 set_inode_flag(inode, FI_UPDATE_WRITE);
                 return err;
@@ -2315,7 +2320,8 @@ static void f2fs_write_failed(struct address_space *mapping, loff_t to)
                 down_write(&F2FS_I(inode)->i_mmap_sem);
 
                 truncate_pagecache(inode, i_size);
-                f2fs_truncate_blocks(inode, i_size, true, true);
+                if (!IS_NOQUOTA(inode))
+                        f2fs_truncate_blocks(inode, i_size, true);
 
                 up_write(&F2FS_I(inode)->i_mmap_sem);
                 up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
@@ -2585,14 +2591,11 @@ static void f2fs_dio_submit_bio(struct bio *bio, struct inode *inode,
 {
         struct f2fs_private_dio *dio;
         bool write = (bio_op(bio) == REQ_OP_WRITE);
-        int err;
 
         dio = f2fs_kzalloc(F2FS_I_SB(inode),
                         sizeof(struct f2fs_private_dio), GFP_NOFS);
-        if (!dio) {
-                err = -ENOMEM;
+        if (!dio)
                 goto out;
-        }
 
         dio->inode = inode;
         dio->orig_end_io = bio->bi_end_io;
@@ -2710,12 +2713,10 @@ void f2fs_invalidate_page(struct page *page, unsigned int offset,
 
         clear_cold_data(page);
 
-        /* This is atomic written page, keep Private */
         if (IS_ATOMIC_WRITTEN_PAGE(page))
                 return f2fs_drop_inmem_page(inode, page);
 
-        set_page_private(page, 0);
-        ClearPagePrivate(page);
+        f2fs_clear_page_private(page);
 }
 
 int f2fs_release_page(struct page *page, gfp_t wait)
@@ -2729,8 +2730,7 @@ int f2fs_release_page(struct page *page, gfp_t wait)
                 return 0;
 
         clear_cold_data(page);
-        set_page_private(page, 0);
-        ClearPagePrivate(page);
+        f2fs_clear_page_private(page);
         return 1;
 }
 
@@ -2798,12 +2798,8 @@ int f2fs_migrate_page(struct address_space *mapping,
                         return -EAGAIN;
         }
 
-        /*
-         * A reference is expected if PagePrivate set when move mapping,
-         * however F2FS breaks this for maintaining dirty page counts when
-         * truncating pages. So here adjusting the 'extra_count' make it work.
-         */
-        extra_count = (atomic_written ? 1 : 0) - page_has_private(page);
+        /* one extra reference was held for atomic_write page */
+        extra_count = atomic_written ? 1 : 0;
         rc = migrate_page_move_mapping(mapping, newpage,
                                 page, mode, extra_count);
         if (rc != MIGRATEPAGE_SUCCESS) {
@@ -2824,9 +2820,10 @@ int f2fs_migrate_page(struct address_space *mapping,
                 get_page(newpage);
         }
 
-        if (PagePrivate(page))
-                SetPagePrivate(newpage);
-        set_page_private(newpage, page_private(page));
+        if (PagePrivate(page)) {
+                f2fs_set_page_private(newpage, page_private(page));
+                f2fs_clear_page_private(page);
+        }
 
         if (mode != MIGRATE_SYNC_NO_COPY)
                 migrate_page_copy(newpage, page);
diff --git a/fs/f2fs/debug.c b/fs/f2fs/debug.c
index fd7f170e2f2d..99e9a5c37b71 100644
--- a/fs/f2fs/debug.c
+++ b/fs/f2fs/debug.c
@@ -96,8 +96,10 @@ static void update_general_status(struct f2fs_sb_info *sbi)
         si->free_secs = free_sections(sbi);
         si->prefree_count = prefree_segments(sbi);
         si->dirty_count = dirty_segments(sbi);
-        si->node_pages = NODE_MAPPING(sbi)->nrpages;
-        si->meta_pages = META_MAPPING(sbi)->nrpages;
+        if (sbi->node_inode)
+                si->node_pages = NODE_MAPPING(sbi)->nrpages;
+        if (sbi->meta_inode)
+                si->meta_pages = META_MAPPING(sbi)->nrpages;
         si->nats = NM_I(sbi)->nat_cnt;
         si->dirty_nats = NM_I(sbi)->dirty_nat_cnt;
         si->sits = MAIN_SEGS(sbi);
@@ -175,7 +177,6 @@ static void update_sit_info(struct f2fs_sb_info *sbi)
 static void update_mem_info(struct f2fs_sb_info *sbi)
 {
         struct f2fs_stat_info *si = F2FS_STAT(sbi);
-        unsigned npages;
         int i;
 
         if (si->base_mem)
@@ -258,10 +259,14 @@ get_cache:
                                                 sizeof(struct extent_node);
 
         si->page_mem = 0;
-        npages = NODE_MAPPING(sbi)->nrpages;
-        si->page_mem += (unsigned long long)npages << PAGE_SHIFT;
-        npages = META_MAPPING(sbi)->nrpages;
-        si->page_mem += (unsigned long long)npages << PAGE_SHIFT;
+        if (sbi->node_inode) {
+                unsigned npages = NODE_MAPPING(sbi)->nrpages;
+                si->page_mem += (unsigned long long)npages << PAGE_SHIFT;
+        }
+        if (sbi->meta_inode) {
+                unsigned npages = META_MAPPING(sbi)->nrpages;
+                si->page_mem += (unsigned long long)npages << PAGE_SHIFT;
+        }
 }
 
 static int stat_show(struct seq_file *s, void *v)
diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
index 713b36a10a79..59bc46017855 100644
--- a/fs/f2fs/dir.c
+++ b/fs/f2fs/dir.c
@@ -728,7 +728,7 @@ void f2fs_delete_entry(struct f2fs_dir_entry *dentry, struct page *page,
                 !f2fs_truncate_hole(dir, page->index, page->index + 1)) {
                 f2fs_clear_page_cache_dirty_tag(page);
                 clear_page_dirty_for_io(page);
-                ClearPagePrivate(page);
+                f2fs_clear_page_private(page);
                 ClearPageUptodate(page);
                 clear_cold_data(page);
                 inode_dec_dirty_pages(dir);
@@ -800,6 +800,10 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
                 if (de->name_len == 0) {
                         bit_pos++;
                         ctx->pos = start_pos + bit_pos;
+                        printk_ratelimited(
+                                "%s, invalid namelen(0), ino:%u, run fsck to fix.",
+                                KERN_WARNING, le32_to_cpu(de->ino));
+                        set_sbi_flag(sbi, SBI_NEED_FSCK);
                         continue;
                 }
 
@@ -810,7 +814,8 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
 
                 /* check memory boundary before moving forward */
                 bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len));
-                if (unlikely(bit_pos > d->max)) {
+                if (unlikely(bit_pos > d->max ||
+                                le16_to_cpu(de->name_len) > F2FS_NAME_LEN)) {
                         f2fs_msg(sbi->sb, KERN_WARNING,
                                 "%s: corrupted namelen=%d, run fsck to fix.",
                                 __func__, le16_to_cpu(de->name_len));
@@ -891,7 +896,7 @@ static int f2fs_readdir(struct file *file, struct dir_context *ctx)
                         page_cache_sync_readahead(inode->i_mapping, ra, file, n,
                                 min(npages - n, (pgoff_t)MAX_DIR_RA_PAGES));
 
-                dentry_page = f2fs_get_lock_data_page(inode, n, false);
+                dentry_page = f2fs_find_data_page(inode, n);
                 if (IS_ERR(dentry_page)) {
                         err = PTR_ERR(dentry_page);
                         if (err == -ENOENT) {
@@ -909,11 +914,11 @@ static int f2fs_readdir(struct file *file, struct dir_context *ctx)
                 err = f2fs_fill_dentries(ctx, &d,
                                 n * NR_DENTRY_IN_BLOCK, &fstr);
                 if (err) {
-                        f2fs_put_page(dentry_page, 1);
+                        f2fs_put_page(dentry_page, 0);
                         break;
                 }
 
-                f2fs_put_page(dentry_page, 1);
+                f2fs_put_page(dentry_page, 0);
         }
 out_free:
         fscrypt_fname_free_buffer(&fstr);
diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c
index 1cb0fcc67d2d..caf77fe8ac07 100644
--- a/fs/f2fs/extent_cache.c
+++ b/fs/f2fs/extent_cache.c
@@ -506,7 +506,7 @@ static void f2fs_update_extent_tree_range(struct inode *inode,
         unsigned int end = fofs + len;
         unsigned int pos = (unsigned int)fofs;
         bool updated = false;
-        bool leftmost;
+        bool leftmost = false;
 
         if (!et)
                 return;
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 7ea5c9cede37..87f75ebd2fd6 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -190,6 +190,8 @@ enum {
 #define DEF_CP_INTERVAL                 60      /* 60 secs */
 #define DEF_IDLE_INTERVAL               5       /* 5 secs */
 #define DEF_DISABLE_INTERVAL            5       /* 5 secs */
+#define DEF_DISABLE_QUICK_INTERVAL      1       /* 1 secs */
+#define DEF_UMOUNT_DISCARD_TIMEOUT      5       /* 5 secs */
 
 struct cp_control {
         int reason;
@@ -253,7 +255,7 @@ struct discard_entry {
 /* max discard pend list number */
 #define MAX_PLIST_NUM           512
 #define plist_idx(blk_num)      ((blk_num) >= MAX_PLIST_NUM ?           \
-                                        (MAX_PLIST_NUM - 1) : (blk_num - 1))
+                                        (MAX_PLIST_NUM - 1) : ((blk_num) - 1))
 
 enum {
         D_PREP,                 /* initial */
@@ -309,6 +311,7 @@ struct discard_policy {
         bool sync;                      /* submit discard with REQ_SYNC flag */
         bool ordered;                   /* issue discard by lba order */
         unsigned int granularity;       /* discard granularity */
+        int timeout;                    /* discard timeout for put_super */
 };
 
 struct discard_cmd_control {
@@ -455,7 +458,6 @@ struct f2fs_flush_device {
 
 /* for inline stuff */
 #define DEF_INLINE_RESERVED_SIZE        1
-#define DEF_MIN_INLINE_SIZE             1
 static inline int get_extra_isize(struct inode *inode);
 static inline int get_inline_xattr_addrs(struct inode *inode);
 #define MAX_INLINE_DATA(inode)  (sizeof(__le32) *                       \
@@ -1098,6 +1100,7 @@ enum {
         SBI_IS_SHUTDOWN,                        /* shutdown by ioctl */
         SBI_IS_RECOVERED,                       /* recovered orphan/data */
         SBI_CP_DISABLED,                        /* CP was disabled last mount */
+        SBI_CP_DISABLED_QUICK,                  /* CP was disabled quickly */
         SBI_QUOTA_NEED_FLUSH,                   /* need to flush quota info in CP */
         SBI_QUOTA_SKIP_FLUSH,                   /* skip flushing quota in current CP */
         SBI_QUOTA_NEED_REPAIR,                  /* quota file may be corrupted */
@@ -1109,6 +1112,7 @@ enum {
         DISCARD_TIME,
         GC_TIME,
         DISABLE_TIME,
+        UMOUNT_DISCARD_TIMEOUT,
         MAX_TIME,
 };
 
@@ -1237,8 +1241,6 @@ struct f2fs_sb_info {
 
         unsigned int nquota_files;              /* # of quota sysfile */
 
-        u32 s_next_generation;                  /* for NFS support */
-
         /* # of pages, see count_type */
         atomic_t nr_pages[NR_COUNT_TYPE];
         /* # of allocated blocks */
@@ -1798,13 +1800,12 @@ static inline void inc_page_count(struct f2fs_sb_info *sbi, int count_type)
 {
         atomic_inc(&sbi->nr_pages[count_type]);
 
-        if (count_type == F2FS_DIRTY_DATA || count_type == F2FS_INMEM_PAGES ||
-                count_type == F2FS_WB_CP_DATA || count_type == F2FS_WB_DATA ||
-                count_type == F2FS_RD_DATA || count_type == F2FS_RD_NODE ||
-                count_type == F2FS_RD_META)
-                return;
-
-        set_sbi_flag(sbi, SBI_IS_DIRTY);
+        if (count_type == F2FS_DIRTY_DENTS ||
+                        count_type == F2FS_DIRTY_NODES ||
+                        count_type == F2FS_DIRTY_META ||
+                        count_type == F2FS_DIRTY_QDATA ||
+                        count_type == F2FS_DIRTY_IMETA)
+                set_sbi_flag(sbi, SBI_IS_DIRTY);
 }
 
 static inline void inode_inc_dirty_pages(struct inode *inode)
@@ -2156,10 +2157,17 @@ static inline bool is_idle(struct f2fs_sb_info *sbi, int type)
                 get_pages(sbi, F2FS_RD_META) || get_pages(sbi, F2FS_WB_DATA) ||
                 get_pages(sbi, F2FS_WB_CP_DATA) ||
                 get_pages(sbi, F2FS_DIO_READ) ||
-                get_pages(sbi, F2FS_DIO_WRITE) ||
-                atomic_read(&SM_I(sbi)->dcc_info->queued_discard) ||
-                atomic_read(&SM_I(sbi)->fcc_info->queued_flush))
+                get_pages(sbi, F2FS_DIO_WRITE))
                 return false;
+
+        if (SM_I(sbi) && SM_I(sbi)->dcc_info &&
+                        atomic_read(&SM_I(sbi)->dcc_info->queued_discard))
+                return false;
+
+        if (SM_I(sbi) && SM_I(sbi)->fcc_info &&
+                        atomic_read(&SM_I(sbi)->fcc_info->queued_flush))
+                return false;
+
         return f2fs_time_over(sbi, type);
 }
 
@@ -2300,11 +2308,12 @@ static inline void f2fs_change_bit(unsigned int nr, char *addr)
 #define F2FS_EXTENTS_FL                 0x00080000 /* Inode uses extents */
 #define F2FS_EA_INODE_FL                0x00200000 /* Inode used for large EA */
 #define F2FS_EOFBLOCKS_FL               0x00400000 /* Blocks allocated beyond EOF */
+#define F2FS_NOCOW_FL                   0x00800000 /* Do not cow file */
 #define F2FS_INLINE_DATA_FL             0x10000000 /* Inode has inline data. */
 #define F2FS_PROJINHERIT_FL             0x20000000 /* Create with parents projid */
 #define F2FS_RESERVED_FL                0x80000000 /* reserved for ext4 lib */
 
-#define F2FS_FL_USER_VISIBLE            0x304BDFFF /* User visible flags */
+#define F2FS_FL_USER_VISIBLE            0x30CBDFFF /* User visible flags */
 #define F2FS_FL_USER_MODIFIABLE         0x204BC0FF /* User modifiable flags */
 
 /* Flags we can manipulate with through F2FS_IOC_FSSETXATTR */
@@ -2761,9 +2770,9 @@ static inline int get_inline_xattr_addrs(struct inode *inode)
 
 #define F2FS_OLD_ATTRIBUTE_SIZE (offsetof(struct f2fs_inode, i_addr))
 #define F2FS_FITS_IN_INODE(f2fs_inode, extra_isize, field)              \
-                ((offsetof(typeof(*f2fs_inode), field) +        \
+                ((offsetof(typeof(*(f2fs_inode)), field) +      \
                 sizeof((f2fs_inode)->field))                    \
-                <= (F2FS_OLD_ATTRIBUTE_SIZE + extra_isize))     \
+                <= (F2FS_OLD_ATTRIBUTE_SIZE + (extra_isize)))   \
 
 static inline void f2fs_reset_iostat(struct f2fs_sb_info *sbi)
 {
@@ -2792,8 +2801,8 @@ static inline void f2fs_update_iostat(struct f2fs_sb_info *sbi,
 
 #define __is_large_section(sbi)         ((sbi)->segs_per_sec > 1)
 
-#define __is_meta_io(fio) (PAGE_TYPE_OF_BIO(fio->type) == META &&       \
-                                (!is_read_io(fio->op) || fio->is_meta))
+#define __is_meta_io(fio) (PAGE_TYPE_OF_BIO((fio)->type) == META &&     \
+                                (!is_read_io((fio)->op) || (fio)->is_meta))
 
 bool f2fs_is_valid_blkaddr(struct f2fs_sb_info *sbi,
                                         block_t blkaddr, int type);
@@ -2825,13 +2834,33 @@ static inline bool is_valid_data_blkaddr(struct f2fs_sb_info *sbi,
         return true;
 }
 
+static inline void f2fs_set_page_private(struct page *page,
+                                                unsigned long data)
+{
+        if (PagePrivate(page))
+                return;
+
+        get_page(page);
+        SetPagePrivate(page);
+        set_page_private(page, data);
+}
+
+static inline void f2fs_clear_page_private(struct page *page)
+{
+        if (!PagePrivate(page))
+                return;
+
+        set_page_private(page, 0);
+        ClearPagePrivate(page);
+        f2fs_put_page(page, 0);
+}
+
 /*
  * file.c
  */
 int f2fs_sync_file(struct file *file, loff_t start, loff_t end, int datasync);
 void f2fs_truncate_data_blocks(struct dnode_of_data *dn);
-int f2fs_truncate_blocks(struct inode *inode, u64 from, bool lock,
-                                                        bool buf_write);
+int f2fs_truncate_blocks(struct inode *inode, u64 from, bool lock);
 int f2fs_truncate(struct inode *inode);
 int f2fs_getattr(const struct path *path, struct kstat *stat,
                         u32 request_mask, unsigned int flags);
@@ -3005,7 +3034,7 @@ void f2fs_invalidate_blocks(struct f2fs_sb_info *sbi, block_t addr);
 bool f2fs_is_checkpointed_data(struct f2fs_sb_info *sbi, block_t blkaddr);
 void f2fs_drop_discard_cmd(struct f2fs_sb_info *sbi);
 void f2fs_stop_discard_thread(struct f2fs_sb_info *sbi);
-bool f2fs_wait_discard_bios(struct f2fs_sb_info *sbi);
+bool f2fs_issue_discard_timeout(struct f2fs_sb_info *sbi);
 void f2fs_clear_prefree_segments(struct f2fs_sb_info *sbi,
                                         struct cp_control *cpc);
 void f2fs_dirty_to_prefree(struct f2fs_sb_info *sbi);
@@ -3610,8 +3639,6 @@ extern void f2fs_build_fault_attr(struct f2fs_sb_info *sbi, unsigned int rate,
 #define f2fs_build_fault_attr(sbi, rate, type)          do { } while (0)
 #endif
 
-#endif
-
 static inline bool is_journalled_quota(struct f2fs_sb_info *sbi)
 {
 #ifdef CONFIG_QUOTA
@@ -3624,3 +3651,5 @@ static inline bool is_journalled_quota(struct f2fs_sb_info *sbi)
 #endif
         return false;
 }
+
+#endif
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index ba5954f41e14..5742ab8b57dc 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -589,8 +589,7 @@ truncate_out:
         return 0;
 }
 
-int f2fs_truncate_blocks(struct inode *inode, u64 from, bool lock,
-                                                        bool buf_write)
+int f2fs_truncate_blocks(struct inode *inode, u64 from, bool lock)
 {
         struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
         struct dnode_of_data dn;
@@ -598,7 +597,6 @@ int f2fs_truncate_blocks(struct inode *inode, u64 from, bool lock,
         int count = 0, err = 0;
         struct page *ipage;
         bool truncate_page = false;
-        int flag = buf_write ? F2FS_GET_BLOCK_PRE_AIO : F2FS_GET_BLOCK_PRE_DIO;
 
         trace_f2fs_truncate_blocks_enter(inode, from);
 
@@ -608,7 +606,7 @@ int f2fs_truncate_blocks(struct inode *inode, u64 from, bool lock,
                 goto free_partial;
 
         if (lock)
-                __do_map_lock(sbi, flag, true);
+                f2fs_lock_op(sbi);
 
         ipage = f2fs_get_node_page(sbi, inode->i_ino);
         if (IS_ERR(ipage)) {
@@ -646,7 +644,7 @@ free_next:
         err = f2fs_truncate_inode_blocks(inode, free_from);
 out:
         if (lock)
-                __do_map_lock(sbi, flag, false);
+                f2fs_unlock_op(sbi);
 free_partial:
         /* lastly zero out the first data page */
         if (!err)
@@ -681,7 +679,7 @@ int f2fs_truncate(struct inode *inode)
                         return err;
         }
 
-        err = f2fs_truncate_blocks(inode, i_size_read(inode), true, false);
+        err = f2fs_truncate_blocks(inode, i_size_read(inode), true);
         if (err)
                 return err;
 
@@ -768,7 +766,6 @@ int f2fs_setattr(struct dentry *dentry, struct iattr *attr)
 {
         struct inode *inode = d_inode(dentry);
         int err;
-        bool size_changed = false;
 
         if (unlikely(f2fs_cp_error(F2FS_I_SB(inode))))
                 return -EIO;
@@ -843,8 +840,6 @@ int f2fs_setattr(struct dentry *dentry, struct iattr *attr)
                 down_write(&F2FS_I(inode)->i_sem);
                 F2FS_I(inode)->last_disk_size = i_size_read(inode);
                 up_write(&F2FS_I(inode)->i_sem);
-
-                size_changed = true;
         }
 
         __setattr_copy(inode, attr);
@@ -858,7 +853,7 @@ int f2fs_setattr(struct dentry *dentry, struct iattr *attr)
         }
 
         /* file size may changed here */
-        f2fs_mark_inode_dirty_sync(inode, size_changed);
+        f2fs_mark_inode_dirty_sync(inode, true);
 
         /* inode change will produce dirty node pages flushed by checkpoint */
         f2fs_balance_fs(F2FS_I_SB(inode), true);
@@ -1262,7 +1257,7 @@ static int f2fs_collapse_range(struct inode *inode, loff_t offset, loff_t len)
         new_size = i_size_read(inode) - len;
         truncate_pagecache(inode, new_size);
 
-        ret = f2fs_truncate_blocks(inode, new_size, true, false);
+        ret = f2fs_truncate_blocks(inode, new_size, true);
         up_write(&F2FS_I(inode)->i_mmap_sem);
         if (!ret)
                 f2fs_i_size_write(inode, new_size);
@@ -1447,7 +1442,7 @@ static int f2fs_insert_range(struct inode *inode, loff_t offset, loff_t len)
         f2fs_balance_fs(sbi, true);
 
         down_write(&F2FS_I(inode)->i_mmap_sem);
-        ret = f2fs_truncate_blocks(inode, i_size_read(inode), true, false);
+        ret = f2fs_truncate_blocks(inode, i_size_read(inode), true);
         up_write(&F2FS_I(inode)->i_mmap_sem);
         if (ret)
                 return ret;
@@ -1651,6 +1646,8 @@ static int f2fs_ioc_getflags(struct file *filp, unsigned long arg)
                 flags |= F2FS_ENCRYPT_FL;
         if (f2fs_has_inline_data(inode) || f2fs_has_inline_dentry(inode))
                 flags |= F2FS_INLINE_DATA_FL;
+        if (is_inode_flag_set(inode, FI_PIN_FILE))
+                flags |= F2FS_NOCOW_FL;
 
         flags &= F2FS_FL_USER_VISIBLE;
 
@@ -1750,10 +1747,12 @@ static int f2fs_ioc_start_atomic_write(struct file *filp)
 
         down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
 
-        if (!get_dirty_pages(inode))
-                goto skip_flush;
-
-        f2fs_msg(F2FS_I_SB(inode)->sb, KERN_WARNING,
+        /*
+         * Should wait end_io to count F2FS_WB_CP_DATA correctly by
+         * f2fs_is_atomic_file.
+         */
+        if (get_dirty_pages(inode))
+                f2fs_msg(F2FS_I_SB(inode)->sb, KERN_WARNING,
                 "Unexpected flush for atomic writes: ino=%lu, npages=%u",
                                         inode->i_ino, get_dirty_pages(inode));
         ret = filemap_write_and_wait_range(inode->i_mapping, 0, LLONG_MAX);
@@ -1761,7 +1760,7 @@ static int f2fs_ioc_start_atomic_write(struct file *filp)
                 up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
                 goto out;
         }
-skip_flush:
+
         set_inode_flag(inode, FI_ATOMIC_FILE);
         clear_inode_flag(inode, FI_ATOMIC_REVOKE_REQUEST);
         up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
@@ -1968,11 +1967,11 @@ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg)
                 break;
         case F2FS_GOING_DOWN_NEED_FSCK:
                 set_sbi_flag(sbi, SBI_NEED_FSCK);
+                set_sbi_flag(sbi, SBI_CP_DISABLED_QUICK);
+                set_sbi_flag(sbi, SBI_IS_DIRTY);
                 /* do checkpoint only */
                 ret = f2fs_sync_fs(sb, 1);
-                if (ret)
-                        goto out;
-                break;
+                goto out;
         default:
                 ret = -EINVAL;
                 goto out;
@@ -1988,6 +1987,9 @@ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg)
 out:
         if (in != F2FS_GOING_DOWN_FULLSYNC)
                 mnt_drop_write_file(filp);
+
+        trace_f2fs_shutdown(sbi, in, ret);
+
         return ret;
 }
 
@@ -2871,8 +2873,8 @@ static int f2fs_ioc_set_pin_file(struct file *filp, unsigned long arg)
         __u32 pin;
         int ret = 0;
 
-        if (!inode_owner_or_capable(inode))
-                return -EACCES;
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
 
         if (get_user(pin, (__u32 __user *)arg))
                 return -EFAULT;
diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
index d636cbcf68f2..bb6a152310ef 100644
--- a/fs/f2fs/inline.c
+++ b/fs/f2fs/inline.c
@@ -298,7 +298,7 @@ process_inline:
                 clear_inode_flag(inode, FI_INLINE_DATA);
                 f2fs_put_page(ipage, 1);
         } else if (ri && (ri->i_inline & F2FS_INLINE_DATA)) {
-                if (f2fs_truncate_blocks(inode, 0, false, false))
+                if (f2fs_truncate_blocks(inode, 0, false))
                         return false;
                 goto process_inline;
         }
@@ -470,7 +470,7 @@ static int f2fs_add_inline_entries(struct inode *dir, void *inline_dentry)
         return 0;
 punch_dentry_pages:
         truncate_inode_pages(&dir->i_data, 0);
-        f2fs_truncate_blocks(dir, 0, false, false);
+        f2fs_truncate_blocks(dir, 0, false);
         f2fs_remove_dirty_inode(dir);
         return err;
 }
@@ -659,6 +659,12 @@ int f2fs_read_inline_dir(struct file *file, struct dir_context *ctx,
         if (IS_ERR(ipage))
                 return PTR_ERR(ipage);
 
+        /*
+         * f2fs_readdir was protected by inode.i_rwsem, it is safe to access
+         * ipage without page's lock held.
+         */
+        unlock_page(ipage);
+
         inline_dentry = inline_data_addr(inode, ipage);
 
         make_dentry_ptr_inline(inode, &d, inline_dentry);
@@ -667,7 +673,7 @@ int f2fs_read_inline_dir(struct file *file, struct dir_context *ctx,
         if (!err)
                 ctx->pos = d.max;
 
-        f2fs_put_page(ipage, 1);
+        f2fs_put_page(ipage, 0);
         return err < 0 ? err : 0;
 }
 
diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
index d910a820ae67..e7f2e8759315 100644
--- a/fs/f2fs/inode.c
+++ b/fs/f2fs/inode.c
@@ -14,6 +14,7 @@
 #include "f2fs.h"
 #include "node.h"
 #include "segment.h"
+#include "xattr.h"
 
 #include <trace/events/f2fs.h>
 
@@ -248,6 +249,20 @@ static bool sanity_check_inode(struct inode *inode, struct page *node_page)
                 return false;
         }
 
+        if (f2fs_has_extra_attr(inode) &&
+                f2fs_sb_has_flexible_inline_xattr(sbi) &&
+                f2fs_has_inline_xattr(inode) &&
+                (!fi->i_inline_xattr_size ||
+                fi->i_inline_xattr_size > MAX_INLINE_XATTR_SIZE)) {
+                set_sbi_flag(sbi, SBI_NEED_FSCK);
+                f2fs_msg(sbi->sb, KERN_WARNING,
+                        "%s: inode (ino=%lx) has corrupted "
+                        "i_inline_xattr_size: %d, max: %zu",
+                        __func__, inode->i_ino, fi->i_inline_xattr_size,
+                        MAX_INLINE_XATTR_SIZE);
+                return false;
+        }
+
         if (F2FS_I(inode)->extent_tree) {
                 struct extent_info *ei = &F2FS_I(inode)->extent_tree->largest;
 
diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
index e967d27c1a89..f5e34e467003 100644
--- a/fs/f2fs/namei.c
+++ b/fs/f2fs/namei.c
@@ -10,6 +10,7 @@
 #include <linux/pagemap.h>
 #include <linux/sched.h>
 #include <linux/ctype.h>
+#include <linux/random.h>
 #include <linux/dcache.h>
 #include <linux/namei.h>
 #include <linux/quotaops.h>
@@ -50,7 +51,7 @@ static struct inode *f2fs_new_inode(struct inode *dir, umode_t mode)
         inode->i_blocks = 0;
         inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
         F2FS_I(inode)->i_crtime = inode->i_mtime;
-        inode->i_generation = sbi->s_next_generation++;
+        inode->i_generation = prandom_u32();
 
         if (S_ISDIR(inode->i_mode))
                 F2FS_I(inode)->i_current_depth = 1;
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index 4f450e573312..3f99ab288695 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -1920,7 +1920,9 @@ static int f2fs_write_node_pages(struct address_space *mapping,
         f2fs_balance_fs_bg(sbi);
 
         /* collect a number of dirty node pages and write together */
-        if (get_pages(sbi, F2FS_DIRTY_NODES) < nr_pages_to_skip(sbi, NODE))
+        if (wbc->sync_mode != WB_SYNC_ALL &&
+                        get_pages(sbi, F2FS_DIRTY_NODES) <
+                                        nr_pages_to_skip(sbi, NODE))
                 goto skip_write;
 
         if (wbc->sync_mode == WB_SYNC_ALL)
@@ -1959,7 +1961,7 @@ static int f2fs_set_node_page_dirty(struct page *page)
         if (!PageDirty(page)) {
                 __set_page_dirty_nobuffers(page);
                 inc_page_count(F2FS_P_SB(page), F2FS_DIRTY_NODES);
-                SetPagePrivate(page);
+                f2fs_set_page_private(page, 0);
                 f2fs_trace_pid(page);
                 return 1;
         }
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 9b79056d705d..aa7fe79b62b2 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -191,8 +191,7 @@ void f2fs_register_inmem_page(struct inode *inode, struct page *page)
 
         f2fs_trace_pid(page);
 
-        set_page_private(page, (unsigned long)ATOMIC_WRITTEN_PAGE);
-        SetPagePrivate(page);
+        f2fs_set_page_private(page, (unsigned long)ATOMIC_WRITTEN_PAGE);
 
         new = f2fs_kmem_cache_alloc(inmem_entry_slab, GFP_NOFS);
 
@@ -215,7 +214,8 @@ void f2fs_register_inmem_page(struct inode *inode, struct page *page)
 }
 
 static int __revoke_inmem_pages(struct inode *inode,
-                                struct list_head *head, bool drop, bool recover)
+                                struct list_head *head, bool drop, bool recover,
+                                bool trylock)
 {
         struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
         struct inmem_pages *cur, *tmp;
@@ -227,7 +227,16 @@ static int __revoke_inmem_pages(struct inode *inode,
                 if (drop)
                         trace_f2fs_commit_inmem_page(page, INMEM_DROP);
 
-                lock_page(page);
+                if (trylock) {
+                        /*
+                         * to avoid deadlock in between page lock and
+                         * inmem_lock.
+                         */
+                        if (!trylock_page(page))
+                                continue;
+                } else {
+                        lock_page(page);
+                }
 
                 f2fs_wait_on_page_writeback(page, DATA, true, true);
 
@@ -270,8 +279,7 @@ next:
                         ClearPageUptodate(page);
                         clear_cold_data(page);
                 }
-                set_page_private(page, 0);
-                ClearPagePrivate(page);
+                f2fs_clear_page_private(page);
                 f2fs_put_page(page, 1);
 
                 list_del(&cur->list);
@@ -318,13 +326,19 @@ void f2fs_drop_inmem_pages(struct inode *inode)
         struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
         struct f2fs_inode_info *fi = F2FS_I(inode);
 
-        mutex_lock(&fi->inmem_lock);
-        __revoke_inmem_pages(inode, &fi->inmem_pages, true, false);
-        spin_lock(&sbi->inode_lock[ATOMIC_FILE]);
-        if (!list_empty(&fi->inmem_ilist))
-                list_del_init(&fi->inmem_ilist);
-        spin_unlock(&sbi->inode_lock[ATOMIC_FILE]);
-        mutex_unlock(&fi->inmem_lock);
+        while (!list_empty(&fi->inmem_pages)) {
+                mutex_lock(&fi->inmem_lock);
+                __revoke_inmem_pages(inode, &fi->inmem_pages,
+                                                true, false, true);
+
+                if (list_empty(&fi->inmem_pages)) {
+                        spin_lock(&sbi->inode_lock[ATOMIC_FILE]);
+                        if (!list_empty(&fi->inmem_ilist))
+                                list_del_init(&fi->inmem_ilist);
+                        spin_unlock(&sbi->inode_lock[ATOMIC_FILE]);
+                }
+                mutex_unlock(&fi->inmem_lock);
+        }
 
         clear_inode_flag(inode, FI_ATOMIC_FILE);
         fi->i_gc_failures[GC_FAILURE_ATOMIC] = 0;
@@ -354,8 +368,7 @@ void f2fs_drop_inmem_page(struct inode *inode, struct page *page)
         kmem_cache_free(inmem_entry_slab, cur);
 
         ClearPageUptodate(page);
-        set_page_private(page, 0);
-        ClearPagePrivate(page);
+        f2fs_clear_page_private(page);
         f2fs_put_page(page, 0);
 
         trace_f2fs_commit_inmem_page(page, INMEM_INVALIDATE);
@@ -429,12 +442,15 @@ retry:
                  * recovery or rewrite & commit last transaction. For other
                  * error number, revoking was done by filesystem itself.
                  */
-                err = __revoke_inmem_pages(inode, &revoke_list, false, true);
+                err = __revoke_inmem_pages(inode, &revoke_list,
+                                                false, true, false);
 
                 /* drop all uncommitted pages */
-                __revoke_inmem_pages(inode, &fi->inmem_pages, true, false);
+                __revoke_inmem_pages(inode, &fi->inmem_pages,
+                                                true, false, false);
         } else {
-                __revoke_inmem_pages(inode, &revoke_list, false, false);
+                __revoke_inmem_pages(inode, &revoke_list,
+                                                false, false, false);
         }
 
         return err;
@@ -542,9 +558,13 @@ void f2fs_balance_fs_bg(struct f2fs_sb_info *sbi)
 static int __submit_flush_wait(struct f2fs_sb_info *sbi,
                                 struct block_device *bdev)
 {
-        struct bio *bio = f2fs_bio_alloc(sbi, 0, true);
+        struct bio *bio;
         int ret;
 
+        bio = f2fs_bio_alloc(sbi, 0, false);
+        if (!bio)
+                return -ENOMEM;
+
         bio->bi_opf = REQ_OP_WRITE | REQ_SYNC | REQ_PREFLUSH;
         bio_set_dev(bio, bdev);
         ret = submit_bio_wait(bio);
@@ -868,6 +888,9 @@ int f2fs_disable_cp_again(struct f2fs_sb_info *sbi)
 
         if (holes[DATA] > ovp || holes[NODE] > ovp)
                 return -EAGAIN;
+        if (is_sbi_flag_set(sbi, SBI_CP_DISABLED_QUICK) &&
+                dirty_segments(sbi) > overprovision_segments(sbi))
+                return -EAGAIN;
         return 0;
 }
 
@@ -1037,6 +1060,7 @@ static void __init_discard_policy(struct f2fs_sb_info *sbi,
 
         dpolicy->max_requests = DEF_MAX_DISCARD_REQUEST;
         dpolicy->io_aware_gran = MAX_PLIST_NUM;
+        dpolicy->timeout = 0;
 
         if (discard_type == DPOLICY_BG) {
                 dpolicy->min_interval = DEF_MIN_DISCARD_ISSUE_TIME;
@@ -1059,6 +1083,8 @@ static void __init_discard_policy(struct f2fs_sb_info *sbi,
         } else if (discard_type == DPOLICY_UMOUNT) {
                 dpolicy->max_requests = UINT_MAX;
                 dpolicy->io_aware = false;
+                /* we need to issue all to keep CP_TRIMMED_FLAG */
+                dpolicy->granularity = 1;
         }
 }
 
@@ -1424,7 +1450,14 @@ static int __issue_discard_cmd(struct f2fs_sb_info *sbi,
         int i, issued = 0;
         bool io_interrupted = false;
 
+        if (dpolicy->timeout != 0)
+                f2fs_update_time(sbi, dpolicy->timeout);
+
         for (i = MAX_PLIST_NUM - 1; i >= 0; i--) {
+                if (dpolicy->timeout != 0 &&
+                                f2fs_time_over(sbi, dpolicy->timeout))
+                        break;
+
                 if (i + 1 < dpolicy->granularity)
                         break;
 
@@ -1611,7 +1644,7 @@ void f2fs_stop_discard_thread(struct f2fs_sb_info *sbi)
 }
 
 /* This comes from f2fs_put_super */
-bool f2fs_wait_discard_bios(struct f2fs_sb_info *sbi)
+bool f2fs_issue_discard_timeout(struct f2fs_sb_info *sbi)
 {
         struct discard_cmd_control *dcc = SM_I(sbi)->dcc_info;
         struct discard_policy dpolicy;
@@ -1619,6 +1652,7 @@ bool f2fs_wait_discard_bios(struct f2fs_sb_info *sbi)
 
         __init_discard_policy(sbi, &dpolicy, DPOLICY_UMOUNT,
                                         dcc->discard_granularity);
+        dpolicy.timeout = UMOUNT_DISCARD_TIMEOUT;
         __issue_discard_cmd(sbi, &dpolicy);
         dropped = __drop_discard_cmd(sbi);
 
@@ -3164,10 +3198,10 @@ int f2fs_inplace_write_data(struct f2fs_io_info *fio)
         stat_inc_inplace_blocks(fio->sbi);
 
         err = f2fs_submit_page_bio(fio);
-        if (!err)
+        if (!err) {
                 update_device_state(fio);
-
-        f2fs_update_iostat(fio->sbi, fio->io_type, F2FS_BLKSIZE);
+                f2fs_update_iostat(fio->sbi, fio->io_type, F2FS_BLKSIZE);
+        }
 
         return err;
 }
diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h
index a77f76f528b6..5c7ed0442d6e 100644
--- a/fs/f2fs/segment.h
+++ b/fs/f2fs/segment.h
@@ -865,7 +865,7 @@ static inline void wake_up_discard_thread(struct f2fs_sb_info *sbi, bool force)
                 }
         }
         mutex_unlock(&dcc->cmd_lock);
-        if (!wakeup)
+        if (!wakeup || !is_idle(sbi, DISCARD_TIME))
                 return;
 wake_up:
         dcc->discard_wake = 1;
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index d1ccc52afc93..f2aaa2cc6b3e 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -269,7 +269,7 @@ static int f2fs_set_qf_name(struct super_block *sb, int qtype,
         if (!qname) {
                 f2fs_msg(sb, KERN_ERR,
                         "Not enough memory for storing quotafile name");
-                return -EINVAL;
+                return -ENOMEM;
         }
         if (F2FS_OPTION(sbi).s_qf_names[qtype]) {
                 if (strcmp(F2FS_OPTION(sbi).s_qf_names[qtype], qname) == 0)
@@ -586,7 +586,7 @@ static int parse_options(struct super_block *sb, char *options)
                 case Opt_io_size_bits:
                         if (args->from && match_int(args, &arg))
                                 return -EINVAL;
-                        if (arg > __ilog2_u32(BIO_MAX_PAGES)) {
+                        if (arg <= 0 || arg > __ilog2_u32(BIO_MAX_PAGES)) {
                                 f2fs_msg(sb, KERN_WARNING,
                                         "Not support %d, larger than %d",
                                         1 << arg, BIO_MAX_PAGES);
@@ -821,6 +821,8 @@ static int parse_options(struct super_block *sb, char *options)
         }
 
         if (test_opt(sbi, INLINE_XATTR_SIZE)) {
+                int min_size, max_size;
+
                 if (!f2fs_sb_has_extra_attr(sbi) ||
                         !f2fs_sb_has_flexible_inline_xattr(sbi)) {
                         f2fs_msg(sb, KERN_ERR,
@@ -834,14 +836,15 @@ static int parse_options(struct super_block *sb, char *options)
                                         "set with inline_xattr option");
                         return -EINVAL;
                 }
-                if (!F2FS_OPTION(sbi).inline_xattr_size ||
-                        F2FS_OPTION(sbi).inline_xattr_size >=
-                                        DEF_ADDRS_PER_INODE -
-                                        F2FS_TOTAL_EXTRA_ATTR_SIZE -
-                                        DEF_INLINE_RESERVED_SIZE -
-                                        DEF_MIN_INLINE_SIZE) {
+
+                min_size = sizeof(struct f2fs_xattr_header) / sizeof(__le32);
+                max_size = MAX_INLINE_XATTR_SIZE;
+
+                if (F2FS_OPTION(sbi).inline_xattr_size < min_size ||
+                                F2FS_OPTION(sbi).inline_xattr_size > max_size) {
                         f2fs_msg(sb, KERN_ERR,
-                                        "inline xattr size is out of range");
+                                "inline xattr size is out of range: %d ~ %d",
+                                min_size, max_size);
                         return -EINVAL;
                 }
         }
@@ -915,6 +918,10 @@ static int f2fs_drop_inode(struct inode *inode)
                         sb_start_intwrite(inode->i_sb);
                         f2fs_i_size_write(inode, 0);
 
+                        f2fs_submit_merged_write_cond(F2FS_I_SB(inode),
+                                        inode, NULL, 0, DATA);
+                        truncate_inode_pages_final(inode->i_mapping);
+
                         if (F2FS_HAS_BLOCKS(inode))
                                 f2fs_truncate(inode);
 
@@ -1048,7 +1055,7 @@ static void f2fs_put_super(struct super_block *sb)
         }
 
         /* be sure to wait for any on-going discard commands */
-        dropped = f2fs_wait_discard_bios(sbi);
+        dropped = f2fs_issue_discard_timeout(sbi);
 
         if ((f2fs_hw_support_discard(sbi) || f2fs_hw_should_discard(sbi)) &&
                                         !sbi->discard_blks && !dropped) {
@@ -1075,7 +1082,10 @@ static void f2fs_put_super(struct super_block *sb)
         f2fs_bug_on(sbi, sbi->fsync_node_num);
 
         iput(sbi->node_inode);
+        sbi->node_inode = NULL;
+
         iput(sbi->meta_inode);
+        sbi->meta_inode = NULL;
 
         /*
          * iput() can update stat information, if f2fs_write_checkpoint()
@@ -1455,9 +1465,16 @@ static int f2fs_enable_quotas(struct super_block *sb);
 
 static int f2fs_disable_checkpoint(struct f2fs_sb_info *sbi)
 {
+        unsigned int s_flags = sbi->sb->s_flags;
         struct cp_control cpc;
-        int err;
+        int err = 0;
+        int ret;
 
+        if (s_flags & SB_RDONLY) {
+                f2fs_msg(sbi->sb, KERN_ERR,
+                                "checkpoint=disable on readonly fs");
+                return -EINVAL;
+        }
         sbi->sb->s_flags |= SB_ACTIVE;
 
         f2fs_update_time(sbi, DISABLE_TIME);
@@ -1465,18 +1482,24 @@ static int f2fs_disable_checkpoint(struct f2fs_sb_info *sbi)
         while (!f2fs_time_over(sbi, DISABLE_TIME)) {
                 mutex_lock(&sbi->gc_mutex);
                 err = f2fs_gc(sbi, true, false, NULL_SEGNO);
-                if (err == -ENODATA)
+                if (err == -ENODATA) {
+                        err = 0;
                         break;
+                }
                 if (err && err != -EAGAIN)
-                        return err;
+                        break;
         }
 
-        err = sync_filesystem(sbi->sb);
-        if (err)
-                return err;
+        ret = sync_filesystem(sbi->sb);
+        if (ret || err) {
+                err = ret ? ret: err;
+                goto restore_flag;
+        }
 
-        if (f2fs_disable_cp_again(sbi))
-                return -EAGAIN;
+        if (f2fs_disable_cp_again(sbi)) {
+                err = -EAGAIN;
+                goto restore_flag;
+        }
 
         mutex_lock(&sbi->gc_mutex);
         cpc.reason = CP_PAUSE;
@@ -1485,7 +1508,9 @@ static int f2fs_disable_checkpoint(struct f2fs_sb_info *sbi)
 
         sbi->unusable_block_count = 0;
         mutex_unlock(&sbi->gc_mutex);
-        return 0;
+restore_flag:
+        sbi->sb->s_flags = s_flags;     /* Restore MS_RDONLY status */
+        return err;
 }
 
 static void f2fs_enable_checkpoint(struct f2fs_sb_info *sbi)
@@ -2023,6 +2048,12 @@ void f2fs_quota_off_umount(struct super_block *sb)
                         set_sbi_flag(F2FS_SB(sb), SBI_QUOTA_NEED_REPAIR);
                 }
         }
+        /*
+         * In case of checkpoint=disable, we must flush quota blocks.
+         * This can cause NULL exception for node_inode in end_io, since
+         * put_super already dropped it.
+         */
+        sync_filesystem(sb);
 }
 
 static void f2fs_truncate_quota_inode_pages(struct super_block *sb)
@@ -2703,6 +2734,8 @@ static void init_sb_info(struct f2fs_sb_info *sbi)
         sbi->interval_time[DISCARD_TIME] = DEF_IDLE_INTERVAL;
         sbi->interval_time[GC_TIME] = DEF_IDLE_INTERVAL;
         sbi->interval_time[DISABLE_TIME] = DEF_DISABLE_INTERVAL;
+        sbi->interval_time[UMOUNT_DISCARD_TIMEOUT] =
+                                DEF_UMOUNT_DISCARD_TIMEOUT;
         clear_sbi_flag(sbi, SBI_NEED_FSCK);
 
         for (i = 0; i < NR_COUNT_TYPE; i++)
@@ -3022,10 +3055,11 @@ static int f2fs_fill_super(struct super_block *sb, void *data, int silent)
         struct f2fs_super_block *raw_super;
         struct inode *root;
         int err;
-        bool retry = true, need_fsck = false;
+        bool skip_recovery = false, need_fsck = false;
         char *options = NULL;
         int recovery, i, valid_super_block;
         struct curseg_info *seg_i;
+        int retry_cnt = 1;
 
 try_onemore:
         err = -EINVAL;
@@ -3097,7 +3131,6 @@ try_onemore:
         sb->s_maxbytes = sbi->max_file_blocks <<
                                 le32_to_cpu(raw_super->log_blocksize);
         sb->s_max_links = F2FS_LINK_MAX;
-        get_random_bytes(&sbi->s_next_generation, sizeof(u32));
 
 #ifdef CONFIG_QUOTA
         sb->dq_op = &f2fs_quota_operations;
@@ -3200,6 +3233,10 @@ try_onemore:
 
         if (__is_set_ckpt_flags(F2FS_CKPT(sbi), CP_QUOTA_NEED_FSCK_FLAG))
                 set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR);
+        if (__is_set_ckpt_flags(F2FS_CKPT(sbi), CP_DISABLED_QUICK_FLAG)) {
+                set_sbi_flag(sbi, SBI_CP_DISABLED_QUICK);
+                sbi->interval_time[DISABLE_TIME] = DEF_DISABLE_QUICK_INTERVAL;
+        }
 
         /* Initialize device list */
         err = f2fs_scan_devices(sbi);
@@ -3288,7 +3325,7 @@ try_onemore:
         sb->s_root = d_make_root(root); /* allocate root dentry */
         if (!sb->s_root) {
                 err = -ENOMEM;
-                goto free_root_inode;
+                goto free_node_inode;
         }
 
         err = f2fs_register_sysfs(sbi);
@@ -3310,7 +3347,7 @@ try_onemore:
                 goto free_meta;
 
         if (unlikely(is_set_ckpt_flags(sbi, CP_DISABLED_FLAG)))
-                goto skip_recovery;
+                goto reset_checkpoint;
 
         /* recover fsynced data */
         if (!test_opt(sbi, DISABLE_ROLL_FORWARD)) {
@@ -3327,11 +3364,13 @@ try_onemore:
                 if (need_fsck)
                         set_sbi_flag(sbi, SBI_NEED_FSCK);
 
-                if (!retry)
-                        goto skip_recovery;
+                if (skip_recovery)
+                        goto reset_checkpoint;
 
                 err = f2fs_recover_fsync_data(sbi, false);
                 if (err < 0) {
+                        if (err != -ENOMEM)
+                                skip_recovery = true;
                         need_fsck = true;
                         f2fs_msg(sb, KERN_ERR,
                                 "Cannot recover all fsync data errno=%d", err);
@@ -3347,14 +3386,14 @@ try_onemore:
                         goto free_meta;
                 }
         }
-skip_recovery:
+reset_checkpoint:
         /* f2fs_recover_fsync_data() cleared this already */
         clear_sbi_flag(sbi, SBI_POR_DOING);
 
         if (test_opt(sbi, DISABLE_CHECKPOINT)) {
                 err = f2fs_disable_checkpoint(sbi);
                 if (err)
-                        goto free_meta;
+                        goto sync_free_meta;
         } else if (is_set_ckpt_flags(sbi, CP_DISABLED_FLAG)) {
                 f2fs_enable_checkpoint(sbi);
         }
@@ -3367,7 +3406,7 @@ skip_recovery:
                 /* After POR, we can run background GC thread.*/
                 err = f2fs_start_gc_thread(sbi);
                 if (err)
-                        goto free_meta;
+                        goto sync_free_meta;
         }
         kvfree(options);
 
@@ -3387,8 +3426,14 @@ skip_recovery:
                                 cur_cp_version(F2FS_CKPT(sbi)));
         f2fs_update_time(sbi, CP_TIME);
         f2fs_update_time(sbi, REQ_TIME);
+        clear_sbi_flag(sbi, SBI_CP_DISABLED_QUICK);
         return 0;
 
+sync_free_meta:
+        /* safe to flush all the data */
+        sync_filesystem(sbi->sb);
+        retry_cnt = 0;
+
 free_meta:
 #ifdef CONFIG_QUOTA
         f2fs_truncate_quota_inode_pages(sb);
@@ -3402,6 +3447,8 @@ free_meta:
          * falls into an infinite loop in f2fs_sync_meta_pages().
          */
         truncate_inode_pages_final(META_MAPPING(sbi));
+        /* evict some inodes being cached by GC */
+        evict_inodes(sb);
         f2fs_unregister_sysfs(sbi);
 free_root_inode:
         dput(sb->s_root);
@@ -3410,6 +3457,7 @@ free_node_inode:
         f2fs_release_ino_entry(sbi, true);
         truncate_inode_pages_final(NODE_MAPPING(sbi));
         iput(sbi->node_inode);
+        sbi->node_inode = NULL;
 free_stats:
         f2fs_destroy_stats(sbi);
 free_nm:
@@ -3422,6 +3470,7 @@ free_devices:
 free_meta_inode:
         make_bad_inode(sbi->meta_inode);
         iput(sbi->meta_inode);
+        sbi->meta_inode = NULL;
 free_io_dummy:
         mempool_destroy(sbi->write_io_dummy);
 free_percpu:
@@ -3443,8 +3492,8 @@ free_sbi:
         kvfree(sbi);
 
         /* give only one another chance */
-        if (retry) {
-                retry = false;
+        if (retry_cnt > 0 && skip_recovery) {
+                retry_cnt--;
                 shrink_dcache_sb(sb);
                 goto try_onemore;
         }
diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
index 70da6801c86f..729f46a3c9ee 100644
--- a/fs/f2fs/sysfs.c
+++ b/fs/f2fs/sysfs.c
@@ -222,6 +222,8 @@ out:
 #ifdef CONFIG_F2FS_FAULT_INJECTION
         if (a->struct_type == FAULT_INFO_TYPE && t >= (1 << FAULT_MAX))
                 return -EINVAL;
+        if (a->struct_type == FAULT_INFO_RATE && t >= UINT_MAX)
+                return -EINVAL;
 #endif
         if (a->struct_type == RESERVED_BLOCKS) {
                 spin_lock(&sbi->stat_lock);
@@ -278,10 +280,16 @@ out:
                 return count;
         }
 
-        *ui = t;
 
-        if (!strcmp(a->attr.name, "iostat_enable") && *ui == 0)
-                f2fs_reset_iostat(sbi);
+        if (!strcmp(a->attr.name, "iostat_enable")) {
+                sbi->iostat_enable = !!t;
+                if (!sbi->iostat_enable)
+                        f2fs_reset_iostat(sbi);
+                return count;
+        }
+
+        *ui = (unsigned int)t;
+
         return count;
 }
 
@@ -418,6 +426,8 @@ F2FS_RW_ATTR(F2FS_SBI, f2fs_sb_info, idle_interval, interval_time[REQ_TIME]);
 F2FS_RW_ATTR(F2FS_SBI, f2fs_sb_info, discard_idle_interval,
                                         interval_time[DISCARD_TIME]);
 F2FS_RW_ATTR(F2FS_SBI, f2fs_sb_info, gc_idle_interval, interval_time[GC_TIME]);
+F2FS_RW_ATTR(F2FS_SBI, f2fs_sb_info,
+                umount_discard_timeout, interval_time[UMOUNT_DISCARD_TIMEOUT]);
 F2FS_RW_ATTR(F2FS_SBI, f2fs_sb_info, iostat_enable, iostat_enable);
 F2FS_RW_ATTR(F2FS_SBI, f2fs_sb_info, readdir_ra, readdir_ra);
 F2FS_RW_ATTR(F2FS_SBI, f2fs_sb_info, gc_pin_file_thresh, gc_pin_file_threshold);
@@ -475,6 +485,7 @@ static struct attribute *f2fs_attrs[] = {
         ATTR_LIST(idle_interval),
         ATTR_LIST(discard_idle_interval),
         ATTR_LIST(gc_idle_interval),
+        ATTR_LIST(umount_discard_timeout),
         ATTR_LIST(iostat_enable),
         ATTR_LIST(readdir_ra),
         ATTR_LIST(gc_pin_file_thresh),
diff --git a/fs/f2fs/trace.c b/fs/f2fs/trace.c
index ce2a5eb210b6..d0ab533a9ce8 100644
--- a/fs/f2fs/trace.c
+++ b/fs/f2fs/trace.c
@@ -14,7 +14,7 @@
 #include "trace.h"
 
 static RADIX_TREE(pids, GFP_ATOMIC);
-static struct mutex pids_lock;
+static spinlock_t pids_lock;
 static struct last_io_info last_io;
 
 static inline void __print_last_io(void)
@@ -58,23 +58,29 @@ void f2fs_trace_pid(struct page *page)
 
         set_page_private(page, (unsigned long)pid);
 
+retry:
         if (radix_tree_preload(GFP_NOFS))
                 return;
 
-        mutex_lock(&pids_lock);
+        spin_lock(&pids_lock);
         p = radix_tree_lookup(&pids, pid);
         if (p == current)
                 goto out;
         if (p)
                 radix_tree_delete(&pids, pid);
 
-        f2fs_radix_tree_insert(&pids, pid, current);
+        if (radix_tree_insert(&pids, pid, current)) {
+                spin_unlock(&pids_lock);
+                radix_tree_preload_end();
+                cond_resched();
+                goto retry;
+        }
 
         trace_printk("%3x:%3x %4x %-16s\n",
                         MAJOR(inode->i_sb->s_dev), MINOR(inode->i_sb->s_dev),
                         pid, current->comm);
 out:
-        mutex_unlock(&pids_lock);
+        spin_unlock(&pids_lock);
         radix_tree_preload_end();
 }
 
@@ -119,7 +125,7 @@ void f2fs_trace_ios(struct f2fs_io_info *fio, int flush)
 
 void f2fs_build_trace_ios(void)
 {
-        mutex_init(&pids_lock);
+        spin_lock_init(&pids_lock);
 }
 
 #define PIDVEC_SIZE     128
@@ -147,7 +153,7 @@ void f2fs_destroy_trace_ios(void)
         pid_t next_pid = 0;
         unsigned int found;
 
-        mutex_lock(&pids_lock);
+        spin_lock(&pids_lock);
         while ((found = gang_lookup_pids(pid, next_pid, PIDVEC_SIZE))) {
                 unsigned idx;
 
@@ -155,5 +161,5 @@ void f2fs_destroy_trace_ios(void)
                 for (idx = 0; idx < found; idx++)
                         radix_tree_delete(&pids, pid[idx]);
         }
-        mutex_unlock(&pids_lock);
+        spin_unlock(&pids_lock);
 }
diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c
index 18d5ffbc5e8c..848a785abe25 100644
--- a/fs/f2fs/xattr.c
+++ b/fs/f2fs/xattr.c
@@ -224,11 +224,11 @@ static struct f2fs_xattr_entry *__find_inline_xattr(struct inode *inode,
 {
         struct f2fs_xattr_entry *entry;
         unsigned int inline_size = inline_xattr_size(inode);
+        void *max_addr = base_addr + inline_size;
 
         list_for_each_xattr(entry, base_addr) {
-                if ((void *)entry + sizeof(__u32) > base_addr + inline_size ||
-                        (void *)XATTR_NEXT_ENTRY(entry) + sizeof(__u32) >
-                        base_addr + inline_size) {
+                if ((void *)entry + sizeof(__u32) > max_addr ||
+                        (void *)XATTR_NEXT_ENTRY(entry) > max_addr) {
                         *last_addr = entry;
                         return NULL;
                 }
@@ -239,6 +239,13 @@ static struct f2fs_xattr_entry *__find_inline_xattr(struct inode *inode,
                 if (!memcmp(entry->e_name, name, len))
                         break;
         }
+
+        /* inline xattr header or entry across max inline xattr size */
+        if (IS_XATTR_LAST_ENTRY(entry) &&
+                (void *)entry + sizeof(__u32) > max_addr) {
+                *last_addr = entry;
+                return NULL;
+        }
         return entry;
 }
 
@@ -340,7 +347,7 @@ check:
         *base_addr = txattr_addr;
         return 0;
 out:
-        kzfree(txattr_addr);
+        kvfree(txattr_addr);
         return err;
 }
 
@@ -383,7 +390,7 @@ static int read_all_xattrs(struct inode *inode, struct page *ipage,
         *base_addr = txattr_addr;
         return 0;
 fail:
-        kzfree(txattr_addr);
+        kvfree(txattr_addr);
         return err;
 }
 
@@ -510,7 +517,7 @@ int f2fs_getxattr(struct inode *inode, int index, const char *name,
         }
         error = size;
 out:
-        kzfree(base_addr);
+        kvfree(base_addr);
         return error;
 }
 
@@ -538,7 +545,7 @@ ssize_t f2fs_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size)
                 if (!handler || (handler->list && !handler->list(dentry)))
                         continue;
 
-                prefix = handler->prefix ?: handler->name;
+                prefix = xattr_prefix(handler);
                 prefix_len = strlen(prefix);
                 size = prefix_len + entry->e_name_len + 1;
                 if (buffer) {
@@ -556,7 +563,7 @@ ssize_t f2fs_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size)
         }
         error = buffer_size - rest;
 cleanup:
-        kzfree(base_addr);
+        kvfree(base_addr);
         return error;
 }
 
@@ -687,7 +694,7 @@ static int __f2fs_setxattr(struct inode *inode, int index,
         if (!error && S_ISDIR(inode->i_mode))
                 set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_CP);
 exit:
-        kzfree(base_addr);
+        kvfree(base_addr);
         return error;
 }
 
diff --git a/fs/f2fs/xattr.h b/fs/f2fs/xattr.h
index 67db134da0f5..9172ee082ca8 100644
--- a/fs/f2fs/xattr.h
+++ b/fs/f2fs/xattr.h
@@ -78,6 +78,12 @@ struct f2fs_xattr_entry {
                                 sizeof(struct f2fs_xattr_header) -      \
                                 sizeof(struct f2fs_xattr_entry))
 
+#define MAX_INLINE_XATTR_SIZE                                           \
+                        (DEF_ADDRS_PER_INODE -                          \
+                        F2FS_TOTAL_EXTRA_ATTR_SIZE / sizeof(__le32) -   \
+                        DEF_INLINE_RESERVED_SIZE -                      \
+                        MIN_INLINE_DENTRY_SIZE / sizeof(__le32))
+
 /*
  * On-disk structure of f2fs_xattr
  * We use inline xattrs space + 1 block for xattr.
diff --git a/fs/io_uring.c b/fs/io_uring.c
index c88088d92613..6aaa30580a2b 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -189,17 +189,28 @@ struct sqe_submit {
         bool                            needs_fixed_file;
 };
 
+/*
+ * First field must be the file pointer in all the
+ * iocb unions! See also 'struct kiocb' in <linux/fs.h>
+ */
 struct io_poll_iocb {
         struct file                     *file;
         struct wait_queue_head          *head;
         __poll_t                        events;
-        bool                            woken;
+        bool                            done;
         bool                            canceled;
         struct wait_queue_entry         wait;
 };
 
+/*
+ * NOTE! Each of the iocb union members has the file pointer
+ * as the first entry in their struct definition. So you can
+ * access the file pointer through any of the sub-structs,
+ * or directly as just 'ki_filp' in this struct.
+ */
 struct io_kiocb {
         union {
+                struct file             *file;
                 struct kiocb            rw;
                 struct io_poll_iocb     poll;
         };
@@ -214,6 +225,7 @@ struct io_kiocb {
 #define REQ_F_IOPOLL_COMPLETED  2       /* polled IO has completed */
 #define REQ_F_FIXED_FILE        4       /* ctx owns file */
 #define REQ_F_SEQ_PREV          8       /* sequential with previous */
+#define REQ_F_PREPPED           16      /* prep already done */
         u64                     user_data;
         u64                     error;
 
@@ -355,20 +367,25 @@ static void io_cqring_fill_event(struct io_ring_ctx *ctx, u64 ki_user_data,
         }
 }
 
-static void io_cqring_add_event(struct io_ring_ctx *ctx, u64 ki_user_data,
+static void io_cqring_ev_posted(struct io_ring_ctx *ctx)
+{
+        if (waitqueue_active(&ctx->wait))
+                wake_up(&ctx->wait);
+        if (waitqueue_active(&ctx->sqo_wait))
+                wake_up(&ctx->sqo_wait);
+}
+
+static void io_cqring_add_event(struct io_ring_ctx *ctx, u64 user_data,
                                 long res, unsigned ev_flags)
 {
         unsigned long flags;
 
         spin_lock_irqsave(&ctx->completion_lock, flags);
-        io_cqring_fill_event(ctx, ki_user_data, res, ev_flags);
+        io_cqring_fill_event(ctx, user_data, res, ev_flags);
         io_commit_cqring(ctx);
         spin_unlock_irqrestore(&ctx->completion_lock, flags);
 
-        if (waitqueue_active(&ctx->wait))
-                wake_up(&ctx->wait);
-        if (waitqueue_active(&ctx->sqo_wait))
-                wake_up(&ctx->sqo_wait);
+        io_cqring_ev_posted(ctx);
 }
 
 static void io_ring_drop_ctx_refs(struct io_ring_ctx *ctx, unsigned refs)
@@ -382,13 +399,14 @@ static void io_ring_drop_ctx_refs(struct io_ring_ctx *ctx, unsigned refs)
 static struct io_kiocb *io_get_req(struct io_ring_ctx *ctx,
                                    struct io_submit_state *state)
 {
+        gfp_t gfp = GFP_KERNEL | __GFP_NOWARN;
         struct io_kiocb *req;
 
         if (!percpu_ref_tryget(&ctx->refs))
                 return NULL;
 
         if (!state) {
-                req = kmem_cache_alloc(req_cachep, __GFP_NOWARN);
+                req = kmem_cache_alloc(req_cachep, gfp);
                 if (unlikely(!req))
                         goto out;
         } else if (!state->free_reqs) {
@@ -396,10 +414,18 @@ static struct io_kiocb *io_get_req(struct io_ring_ctx *ctx,
                 int ret;
 
                 sz = min_t(size_t, state->ios_left, ARRAY_SIZE(state->reqs));
-                ret = kmem_cache_alloc_bulk(req_cachep, __GFP_NOWARN, sz,
-                                                state->reqs);
-                if (unlikely(ret <= 0))
-                        goto out;
+                ret = kmem_cache_alloc_bulk(req_cachep, gfp, sz, state->reqs);
+
+                /*
+                 * Bulk alloc is all-or-nothing. If we fail to get a batch,
+                 * retry single alloc to be on the safe side.
+                 */
+                if (unlikely(ret <= 0)) {
+                        state->reqs[0] = kmem_cache_alloc(req_cachep, gfp);
+                        if (!state->reqs[0])
+                                goto out;
+                        ret = 1;
+                }
                 state->free_reqs = ret - 1;
                 state->cur_req = 1;
                 req = state->reqs[0];
@@ -411,7 +437,8 @@ static struct io_kiocb *io_get_req(struct io_ring_ctx *ctx,
 
         req->ctx = ctx;
         req->flags = 0;
-        refcount_set(&req->refs, 0);
+        /* one is dropped after submission, the other at completion */
+        refcount_set(&req->refs, 2);
         return req;
 out:
         io_ring_drop_ctx_refs(ctx, 1);
@@ -429,10 +456,16 @@ static void io_free_req_many(struct io_ring_ctx *ctx, void **reqs, int *nr)
 
 static void io_free_req(struct io_kiocb *req)
 {
-        if (!refcount_read(&req->refs) || refcount_dec_and_test(&req->refs)) {
-                io_ring_drop_ctx_refs(req->ctx, 1);
-                kmem_cache_free(req_cachep, req);
-        }
+        if (req->file && !(req->flags & REQ_F_FIXED_FILE))
+                fput(req->file);
+        io_ring_drop_ctx_refs(req->ctx, 1);
+        kmem_cache_free(req_cachep, req);
+}
+
+static void io_put_req(struct io_kiocb *req)
+{
+        if (refcount_dec_and_test(&req->refs))
+                io_free_req(req);
 }
 
 /*
@@ -442,44 +475,34 @@ static void io_iopoll_complete(struct io_ring_ctx *ctx, unsigned int *nr_events,
                                struct list_head *done)
 {
         void *reqs[IO_IOPOLL_BATCH];
-        int file_count, to_free;
-        struct file *file = NULL;
         struct io_kiocb *req;
+        int to_free;
 
-        file_count = to_free = 0;
+        to_free = 0;
         while (!list_empty(done)) {
                 req = list_first_entry(done, struct io_kiocb, list);
                 list_del(&req->list);
 
                 io_cqring_fill_event(ctx, req->user_data, req->error, 0);
-
-                reqs[to_free++] = req;
                 (*nr_events)++;
 
-                /*
-                 * Batched puts of the same file, to avoid dirtying the
-                 * file usage count multiple times, if avoidable.
-                 */
-                if (!(req->flags & REQ_F_FIXED_FILE)) {
-                        if (!file) {
-                                file = req->rw.ki_filp;
-                                file_count = 1;
-                        } else if (file == req->rw.ki_filp) {
-                                file_count++;
+                if (refcount_dec_and_test(&req->refs)) {
+                        /* If we're not using fixed files, we have to pair the
+                         * completion part with the file put. Use regular
+                         * completions for those, only batch free for fixed
+                         * file.
+                         */
+                        if (req->flags & REQ_F_FIXED_FILE) {
+                                reqs[to_free++] = req;
+                                if (to_free == ARRAY_SIZE(reqs))
+                                        io_free_req_many(ctx, reqs, &to_free);
                         } else {
-                                fput_many(file, file_count);
-                                file = req->rw.ki_filp;
-                                file_count = 1;
+                                io_free_req(req);
                         }
                 }
-
-                if (to_free == ARRAY_SIZE(reqs))
-                        io_free_req_many(ctx, reqs, &to_free);
         }
-        io_commit_cqring(ctx);
 
-        if (file)
-                fput_many(file, file_count);
+        io_commit_cqring(ctx);
         io_free_req_many(ctx, reqs, &to_free);
 }
 
@@ -602,21 +625,14 @@ static void kiocb_end_write(struct kiocb *kiocb)
         }
 }
 
-static void io_fput(struct io_kiocb *req)
-{
-        if (!(req->flags & REQ_F_FIXED_FILE))
-                fput(req->rw.ki_filp);
-}
-
 static void io_complete_rw(struct kiocb *kiocb, long res, long res2)
 {
         struct io_kiocb *req = container_of(kiocb, struct io_kiocb, rw);
 
         kiocb_end_write(kiocb);
 
-        io_fput(req);
         io_cqring_add_event(req->ctx, req->user_data, res, 0);
-        io_free_req(req);
+        io_put_req(req);
 }
 
 static void io_complete_rw_iopoll(struct kiocb *kiocb, long res, long res2)
@@ -731,31 +747,18 @@ static int io_prep_rw(struct io_kiocb *req, const struct sqe_submit *s,
         const struct io_uring_sqe *sqe = s->sqe;
         struct io_ring_ctx *ctx = req->ctx;
         struct kiocb *kiocb = &req->rw;
-        unsigned ioprio, flags;
-        int fd, ret;
+        unsigned ioprio;
+        int ret;
 
+        if (!req->file)
+                return -EBADF;
         /* For -EAGAIN retry, everything is already prepped */
-        if (kiocb->ki_filp)
+        if (req->flags & REQ_F_PREPPED)
                 return 0;
 
-        flags = READ_ONCE(sqe->flags);
-        fd = READ_ONCE(sqe->fd);
+        if (force_nonblock && !io_file_supports_async(req->file))
+                force_nonblock = false;
 
-        if (flags & IOSQE_FIXED_FILE) {
-                if (unlikely(!ctx->user_files ||
-                    (unsigned) fd >= ctx->nr_user_files))
-                        return -EBADF;
-                kiocb->ki_filp = ctx->user_files[fd];
-                req->flags |= REQ_F_FIXED_FILE;
-        } else {
-                if (s->needs_fixed_file)
-                        return -EBADF;
-                kiocb->ki_filp = io_file_get(state, fd);
-                if (unlikely(!kiocb->ki_filp))
-                        return -EBADF;
-                if (force_nonblock && !io_file_supports_async(kiocb->ki_filp))
-                        force_nonblock = false;
-        }
         kiocb->ki_pos = READ_ONCE(sqe->off);
         kiocb->ki_flags = iocb_flags(kiocb->ki_filp);
         kiocb->ki_hint = ki_hint_validate(file_write_hint(kiocb->ki_filp));
@@ -764,7 +767,7 @@ static int io_prep_rw(struct io_kiocb *req, const struct sqe_submit *s,
         if (ioprio) {
                 ret = ioprio_check_cap(ioprio);
                 if (ret)
-                        goto out_fput;
+                        return ret;
 
                 kiocb->ki_ioprio = ioprio;
         } else
@@ -772,38 +775,26 @@ static int io_prep_rw(struct io_kiocb *req, const struct sqe_submit *s,
 
         ret = kiocb_set_rw_flags(kiocb, READ_ONCE(sqe->rw_flags));
         if (unlikely(ret))
-                goto out_fput;
+                return ret;
         if (force_nonblock) {
                 kiocb->ki_flags |= IOCB_NOWAIT;
                 req->flags |= REQ_F_FORCE_NONBLOCK;
         }
         if (ctx->flags & IORING_SETUP_IOPOLL) {
-                ret = -EOPNOTSUPP;
                 if (!(kiocb->ki_flags & IOCB_DIRECT) ||
                     !kiocb->ki_filp->f_op->iopoll)
-                        goto out_fput;
+                        return -EOPNOTSUPP;
 
                 req->error = 0;
                 kiocb->ki_flags |= IOCB_HIPRI;
                 kiocb->ki_complete = io_complete_rw_iopoll;
         } else {
-                if (kiocb->ki_flags & IOCB_HIPRI) {
-                        ret = -EINVAL;
-                        goto out_fput;
-                }
+                if (kiocb->ki_flags & IOCB_HIPRI)
+                        return -EINVAL;
                 kiocb->ki_complete = io_complete_rw;
         }
+        req->flags |= REQ_F_PREPPED;
         return 0;
-out_fput:
-        if (!(flags & IOSQE_FIXED_FILE)) {
-                /*
-                 * in case of error, we didn't use this file reference. drop it.
-                 */
-                if (state)
-                        state->used_refs--;
-                io_file_put(state, kiocb->ki_filp);
-        }
-        return ret;
 }
 
 static inline void io_rw_done(struct kiocb *kiocb, ssize_t ret)
@@ -864,6 +855,9 @@ static int io_import_fixed(struct io_ring_ctx *ctx, int rw,
         iov_iter_bvec(iter, rw, imu->bvec, imu->nr_bvecs, offset + len);
         if (offset)
                 iov_iter_advance(iter, offset);
+
+        /* don't drop a reference to these pages */
+        iter->type |= ITER_BVEC_FLAG_NO_REF;
         return 0;
 }
 
@@ -887,7 +881,7 @@ static int io_import_iovec(struct io_ring_ctx *ctx, int rw,
         opcode = READ_ONCE(sqe->opcode);
         if (opcode == IORING_OP_READ_FIXED ||
             opcode == IORING_OP_WRITE_FIXED) {
-                ssize_t ret = io_import_fixed(ctx, rw, sqe, iter);
+                int ret = io_import_fixed(ctx, rw, sqe, iter);
                 *iovec = NULL;
                 return ret;
         }
@@ -945,31 +939,29 @@ static void io_async_list_note(int rw, struct io_kiocb *req, size_t len)
         async_list->io_end = io_end;
 }
 
-static ssize_t io_read(struct io_kiocb *req, const struct sqe_submit *s,
-                       bool force_nonblock, struct io_submit_state *state)
+static int io_read(struct io_kiocb *req, const struct sqe_submit *s,
+                   bool force_nonblock, struct io_submit_state *state)
 {
         struct iovec inline_vecs[UIO_FASTIOV], *iovec = inline_vecs;
         struct kiocb *kiocb = &req->rw;
         struct iov_iter iter;
         struct file *file;
         size_t iov_count;
-        ssize_t ret;
+        int ret;
 
         ret = io_prep_rw(req, s, force_nonblock, state);
         if (ret)
                 return ret;
         file = kiocb->ki_filp;
 
-        ret = -EBADF;
         if (unlikely(!(file->f_mode & FMODE_READ)))
-                goto out_fput;
-        ret = -EINVAL;
+                return -EBADF;
         if (unlikely(!file->f_op->read_iter))
-                goto out_fput;
+                return -EINVAL;
 
         ret = io_import_iovec(req->ctx, READ, s, &iovec, &iter);
         if (ret)
-                goto out_fput;
+                return ret;
 
         iov_count = iov_iter_count(&iter);
         ret = rw_verify_area(READ, file, &kiocb->ki_pos, iov_count);
@@ -991,38 +983,32 @@ static ssize_t io_read(struct io_kiocb *req, const struct sqe_submit *s,
                 }
         }
         kfree(iovec);
-out_fput:
-        /* Hold on to the file for -EAGAIN */
-        if (unlikely(ret && ret != -EAGAIN))
-                io_fput(req);
         return ret;
 }
 
-static ssize_t io_write(struct io_kiocb *req, const struct sqe_submit *s,
-                        bool force_nonblock, struct io_submit_state *state)
+static int io_write(struct io_kiocb *req, const struct sqe_submit *s,
+                    bool force_nonblock, struct io_submit_state *state)
 {
         struct iovec inline_vecs[UIO_FASTIOV], *iovec = inline_vecs;
         struct kiocb *kiocb = &req->rw;
         struct iov_iter iter;
         struct file *file;
         size_t iov_count;
-        ssize_t ret;
+        int ret;
 
         ret = io_prep_rw(req, s, force_nonblock, state);
         if (ret)
                 return ret;
 
-        ret = -EBADF;
         file = kiocb->ki_filp;
         if (unlikely(!(file->f_mode & FMODE_WRITE)))
-                goto out_fput;
-        ret = -EINVAL;
+                return -EBADF;
         if (unlikely(!file->f_op->write_iter))
-                goto out_fput;
+                return -EINVAL;
 
         ret = io_import_iovec(req->ctx, WRITE, s, &iovec, &iter);
         if (ret)
-                goto out_fput;
+                return ret;
 
         iov_count = iov_iter_count(&iter);
 
@@ -1054,10 +1040,6 @@ static ssize_t io_write(struct io_kiocb *req, const struct sqe_submit *s,
         }
 out_free:
         kfree(iovec);
-out_fput:
-        /* Hold on to the file for -EAGAIN */
-        if (unlikely(ret && ret != -EAGAIN))
-                io_fput(req);
         return ret;
 }
 
@@ -1072,29 +1054,19 @@ static int io_nop(struct io_kiocb *req, u64 user_data)
         if (unlikely(ctx->flags & IORING_SETUP_IOPOLL))
                 return -EINVAL;
 
-        /*
-         * Twilight zone - it's possible that someone issued an opcode that
-         * has a file attached, then got -EAGAIN on submission, and changed
-         * the sqe before we retried it from async context. Avoid dropping
-         * a file reference for this malicious case, and flag the error.
-         */
-        if (req->rw.ki_filp) {
-                err = -EBADF;
-                io_fput(req);
-        }
         io_cqring_add_event(ctx, user_data, err, 0);
-        io_free_req(req);
+        io_put_req(req);
         return 0;
 }
 
 static int io_prep_fsync(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
         struct io_ring_ctx *ctx = req->ctx;
-        unsigned flags;
-        int fd;
 
-        /* Prep already done */
-        if (req->rw.ki_filp)
+        if (!req->file)
+                return -EBADF;
+        /* Prep already done (EAGAIN retry) */
+        if (req->flags & REQ_F_PREPPED)
                 return 0;
 
         if (unlikely(ctx->flags & IORING_SETUP_IOPOLL))
@@ -1102,20 +1074,7 @@ static int io_prep_fsync(struct io_kiocb *req, const struct io_uring_sqe *sqe)
         if (unlikely(sqe->addr || sqe->ioprio || sqe->buf_index))
                 return -EINVAL;
 
-        fd = READ_ONCE(sqe->fd);
-        flags = READ_ONCE(sqe->flags);
-
-        if (flags & IOSQE_FIXED_FILE) {
-                if (unlikely(!ctx->user_files || fd >= ctx->nr_user_files))
-                        return -EBADF;
-                req->rw.ki_filp = ctx->user_files[fd];
-                req->flags |= REQ_F_FIXED_FILE;
-        } else {
-                req->rw.ki_filp = fget(fd);
-                if (unlikely(!req->rw.ki_filp))
-                        return -EBADF;
-        }
-
+        req->flags |= REQ_F_PREPPED;
         return 0;
 }
 
@@ -1144,9 +1103,8 @@ static int io_fsync(struct io_kiocb *req, const struct io_uring_sqe *sqe,
                                 end > 0 ? end : LLONG_MAX,
                                 fsync_flags & IORING_FSYNC_DATASYNC);
 
-        io_fput(req);
         io_cqring_add_event(req->ctx, sqe->user_data, ret, 0);
-        io_free_req(req);
+        io_put_req(req);
         return 0;
 }
 
@@ -1204,15 +1162,16 @@ static int io_poll_remove(struct io_kiocb *req, const struct io_uring_sqe *sqe)
         spin_unlock_irq(&ctx->completion_lock);
 
         io_cqring_add_event(req->ctx, sqe->user_data, ret, 0);
-        io_free_req(req);
+        io_put_req(req);
         return 0;
 }
 
-static void io_poll_complete(struct io_kiocb *req, __poll_t mask)
+static void io_poll_complete(struct io_ring_ctx *ctx, struct io_kiocb *req,
+                             __poll_t mask)
 {
-        io_cqring_add_event(req->ctx, req->user_data, mangle_poll(mask), 0);
-        io_fput(req);
-        io_free_req(req);
+        req->poll.done = true;
+        io_cqring_fill_event(ctx, req->user_data, mangle_poll(mask), 0);
+        io_commit_cqring(ctx);
 }
 
 static void io_poll_complete_work(struct work_struct *work)
@@ -1240,9 +1199,11 @@ static void io_poll_complete_work(struct work_struct *work)
                 return;
         }
         list_del_init(&req->list);
+        io_poll_complete(ctx, req, mask);
         spin_unlock_irq(&ctx->completion_lock);
 
-        io_poll_complete(req, mask);
+        io_cqring_ev_posted(ctx);
+        io_put_req(req);
 }
 
 static int io_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
@@ -1253,29 +1214,25 @@ static int io_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
         struct io_kiocb *req = container_of(poll, struct io_kiocb, poll);
         struct io_ring_ctx *ctx = req->ctx;
         __poll_t mask = key_to_poll(key);
-
-        poll->woken = true;
+        unsigned long flags;
 
         /* for instances that support it check for an event match first: */
-        if (mask) {
-                unsigned long flags;
+        if (mask && !(mask & poll->events))
+                return 0;
 
-                if (!(mask & poll->events))
-                        return 0;
+        list_del_init(&poll->wait.entry);
 
-                /* try to complete the iocb inline if we can: */
-                if (spin_trylock_irqsave(&ctx->completion_lock, flags)) {
-                        list_del(&req->list);
-                        spin_unlock_irqrestore(&ctx->completion_lock, flags);
+        if (mask && spin_trylock_irqsave(&ctx->completion_lock, flags)) {
+                list_del(&req->list);
+                io_poll_complete(ctx, req, mask);
+                spin_unlock_irqrestore(&ctx->completion_lock, flags);
 
-                        list_del_init(&poll->wait.entry);
-                        io_poll_complete(req, mask);
-                        return 1;
-                }
+                io_cqring_ev_posted(ctx);
+                io_put_req(req);
+        } else {
+                queue_work(ctx->sqo_wq, &req->work);
         }
 
-        list_del_init(&poll->wait.entry);
-        queue_work(ctx->sqo_wq, &req->work);
         return 1;
 }
 
@@ -1305,36 +1262,23 @@ static int io_poll_add(struct io_kiocb *req, const struct io_uring_sqe *sqe)
         struct io_poll_iocb *poll = &req->poll;
         struct io_ring_ctx *ctx = req->ctx;
         struct io_poll_table ipt;
-        unsigned flags;
+        bool cancel = false;
         __poll_t mask;
         u16 events;
-        int fd;
 
         if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
                 return -EINVAL;
         if (sqe->addr || sqe->ioprio || sqe->off || sqe->len || sqe->buf_index)
                 return -EINVAL;
+        if (!poll->file)
+                return -EBADF;
 
         INIT_WORK(&req->work, io_poll_complete_work);
         events = READ_ONCE(sqe->poll_events);
         poll->events = demangle_poll(events) | EPOLLERR | EPOLLHUP;
 
-        flags = READ_ONCE(sqe->flags);
-        fd = READ_ONCE(sqe->fd);
-
-        if (flags & IOSQE_FIXED_FILE) {
-                if (unlikely(!ctx->user_files || fd >= ctx->nr_user_files))
-                        return -EBADF;
-                poll->file = ctx->user_files[fd];
-                req->flags |= REQ_F_FIXED_FILE;
-        } else {
-                poll->file = fget(fd);
-        }
-        if (unlikely(!poll->file))
-                return -EBADF;
-
         poll->head = NULL;
-        poll->woken = false;
+        poll->done = false;
         poll->canceled = false;
 
         ipt.pt._qproc = io_poll_queue_proc;
@@ -1346,56 +1290,44 @@ static int io_poll_add(struct io_kiocb *req, const struct io_uring_sqe *sqe)
         INIT_LIST_HEAD(&poll->wait.entry);
         init_waitqueue_func_entry(&poll->wait, io_poll_wake);
 
-        /* one for removal from waitqueue, one for this function */
-        refcount_set(&req->refs, 2);
-
         mask = vfs_poll(poll->file, &ipt.pt) & poll->events;
-        if (unlikely(!poll->head)) {
-                /* we did not manage to set up a waitqueue, done */
-                goto out;
-        }
 
         spin_lock_irq(&ctx->completion_lock);
-        spin_lock(&poll->head->lock);
-        if (poll->woken) {
-                /* wake_up context handles the rest */
-                mask = 0;
+        if (likely(poll->head)) {
+                spin_lock(&poll->head->lock);
+                if (unlikely(list_empty(&poll->wait.entry))) {
+                        if (ipt.error)
+                                cancel = true;
+                        ipt.error = 0;
+                        mask = 0;
+                }
+                if (mask || ipt.error)
+                        list_del_init(&poll->wait.entry);
+                else if (cancel)
+                        WRITE_ONCE(poll->canceled, true);
+                else if (!poll->done) /* actually waiting for an event */
+                        list_add_tail(&req->list, &ctx->cancel_list);
+                spin_unlock(&poll->head->lock);
+        }
+        if (mask) { /* no async, we'd stolen it */
+                req->error = mangle_poll(mask);
                 ipt.error = 0;
-        } else if (mask || ipt.error) {
-                /* if we get an error or a mask we are done */
-                WARN_ON_ONCE(list_empty(&poll->wait.entry));
-                list_del_init(&poll->wait.entry);
-        } else {
-                /* actually waiting for an event */
-                list_add_tail(&req->list, &ctx->cancel_list);
+                io_poll_complete(ctx, req, mask);
         }
-        spin_unlock(&poll->head->lock);
         spin_unlock_irq(&ctx->completion_lock);
 
-out:
-        if (unlikely(ipt.error)) {
-                if (!(flags & IOSQE_FIXED_FILE))
-                        fput(poll->file);
-                /*
-                 * Drop one of our refs to this req, __io_submit_sqe() will
-                 * drop the other one since we're returning an error.
-                 */
-                io_free_req(req);
-                return ipt.error;
+        if (mask) {
+                io_cqring_ev_posted(ctx);
+                io_put_req(req);
         }
-
-        if (mask)
-                io_poll_complete(req, mask);
-        io_free_req(req);
-        return 0;
+        return ipt.error;
 }
 
 static int __io_submit_sqe(struct io_ring_ctx *ctx, struct io_kiocb *req,
                            const struct sqe_submit *s, bool force_nonblock,
                            struct io_submit_state *state)
 {
-        ssize_t ret;
-        int opcode;
+        int ret, opcode;
 
         if (unlikely(s->index >= ctx->sq_entries))
                 return -EINVAL;
@@ -1524,10 +1456,13 @@ restart:
                                         break;
                                 cond_resched();
                         } while (1);
+
+                        /* drop submission reference */
+                        io_put_req(req);
                 }
                 if (ret) {
                         io_cqring_add_event(ctx, sqe->user_data, ret, 0);
-                        io_free_req(req);
+                        io_put_req(req);
                 }
 
                 /* async context always use a copy of the sqe */
@@ -1614,11 +1549,55 @@ static bool io_add_to_prev_work(struct async_list *list, struct io_kiocb *req)
         return ret;
 }
 
+static bool io_op_needs_file(const struct io_uring_sqe *sqe)
+{
+        int op = READ_ONCE(sqe->opcode);
+
+        switch (op) {
+        case IORING_OP_NOP:
+        case IORING_OP_POLL_REMOVE:
+                return false;
+        default:
+                return true;
+        }
+}
+
+static int io_req_set_file(struct io_ring_ctx *ctx, const struct sqe_submit *s,
+                           struct io_submit_state *state, struct io_kiocb *req)
+{
+        unsigned flags;
+        int fd;
+
+        flags = READ_ONCE(s->sqe->flags);
+        fd = READ_ONCE(s->sqe->fd);
+
+        if (!io_op_needs_file(s->sqe)) {
+                req->file = NULL;
+                return 0;
+        }
+
+        if (flags & IOSQE_FIXED_FILE) {
+                if (unlikely(!ctx->user_files ||
+                    (unsigned) fd >= ctx->nr_user_files))
+                        return -EBADF;
+                req->file = ctx->user_files[fd];
+                req->flags |= REQ_F_FIXED_FILE;
+        } else {
+                if (s->needs_fixed_file)
+                        return -EBADF;
+                req->file = io_file_get(state, fd);
+                if (unlikely(!req->file))
+                        return -EBADF;
+        }
+
+        return 0;
+}
+
 static int io_submit_sqe(struct io_ring_ctx *ctx, struct sqe_submit *s,
                          struct io_submit_state *state)
 {
         struct io_kiocb *req;
-        ssize_t ret;
+        int ret;
 
         /* enforce forwards compatibility on users */
         if (unlikely(s->sqe->flags & ~IOSQE_FIXED_FILE))
@@ -1628,7 +1607,9 @@ static int io_submit_sqe(struct io_ring_ctx *ctx, struct sqe_submit *s,
         if (unlikely(!req))
                 return -EAGAIN;
 
-        req->rw.ki_filp = NULL;
+        ret = io_req_set_file(ctx, s, state, req);
+        if (unlikely(ret))
+                goto out;
 
         ret = __io_submit_sqe(ctx, req, s, true, state);
         if (ret == -EAGAIN) {
@@ -1649,11 +1630,23 @@ static int io_submit_sqe(struct io_ring_ctx *ctx, struct sqe_submit *s,
                                 INIT_WORK(&req->work, io_sq_wq_submit_work);
                                 queue_work(ctx->sqo_wq, &req->work);
                         }
-                        ret = 0;
+
+                        /*
+                         * Queued up for async execution, worker will release
+                         * submit reference when the iocb is actually
+                         * submitted.
+                         */
+                        return 0;
                 }
         }
+
+out:
+        /* drop submission reference */
+        io_put_req(req);
+
+        /* and drop final reference, if we failed */
         if (ret)
-                io_free_req(req);
+                io_put_req(req);
 
         return ret;
 }
diff --git a/fs/iomap.c b/fs/iomap.c
index 97cb9d486a7d..abdd18e404f8 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -1589,12 +1589,14 @@ static void iomap_dio_bio_end_io(struct bio *bio)
         if (should_dirty) {
                 bio_check_pages_dirty(bio);
         } else {
-                struct bio_vec *bvec;
-                int i;
-                struct bvec_iter_all iter_all;
+                if (!bio_flagged(bio, BIO_NO_PAGE_REF)) {
+                        struct bvec_iter_all iter_all;
+                        struct bio_vec *bvec;
+                        int i;
 
-                bio_for_each_segment_all(bvec, bio, i, iter_all)
-                        put_page(bvec->bv_page);
+                        bio_for_each_segment_all(bvec, bio, i, iter_all)
+                                put_page(bvec->bv_page);
+                }
                 bio_put(bio);
         }
 }
diff --git a/fs/lockd/host.c b/fs/lockd/host.c
index 93fb7cf0b92b..f0b5c987d6ae 100644
--- a/fs/lockd/host.c
+++ b/fs/lockd/host.c
@@ -290,12 +290,11 @@ void nlmclnt_release_host(struct nlm_host *host)
 
         WARN_ON_ONCE(host->h_server);
 
-        if (refcount_dec_and_test(&host->h_count)) {
+        if (refcount_dec_and_mutex_lock(&host->h_count, &nlm_host_mutex)) {
                 WARN_ON_ONCE(!list_empty(&host->h_lockowners));
                 WARN_ON_ONCE(!list_empty(&host->h_granted));
                 WARN_ON_ONCE(!list_empty(&host->h_reclaim));
 
-                mutex_lock(&nlm_host_mutex);
                 nlm_destroy_host_locked(host);
                 mutex_unlock(&nlm_host_mutex);
         }
diff --git a/fs/locks.c b/fs/locks.c
index eaa1cfaf73b0..71d0c6c2aac5 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1160,6 +1160,11 @@ static int posix_lock_inode(struct inode *inode, struct file_lock *request,
                          */
                         error = -EDEADLK;
                         spin_lock(&blocked_lock_lock);
+                        /*
+                         * Ensure that we don't find any locks blocked on this
+                         * request during deadlock detection.
+                         */
+                        __locks_wake_up_blocks(request);
                         if (likely(!posix_locks_deadlock(request, fl))) {
                                 error = FILE_LOCK_DEFERRED;
                                 __locks_insert_block(fl, request,
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index fb1cf1a4bda2..90d71fda65ce 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -453,7 +453,7 @@ void nfs_init_timeout_values(struct rpc_timeout *to, int proto,
         case XPRT_TRANSPORT_RDMA:
                 if (retrans == NFS_UNSPEC_RETRANS)
                         to->to_retries = NFS_DEF_TCP_RETRANS;
-                if (timeo == NFS_UNSPEC_TIMEO || to->to_retries == 0)
+                if (timeo == NFS_UNSPEC_TIMEO || to->to_initval == 0)
                         to->to_initval = NFS_DEF_TCP_TIMEO * HZ / 10;
                 if (to->to_initval > NFS_MAX_TCP_TIMEOUT)
                         to->to_initval = NFS_MAX_TCP_TIMEOUT;
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index f9264e1922a2..6673d4ff5a2a 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -1289,6 +1289,7 @@ static void ff_layout_io_track_ds_error(struct pnfs_layout_segment *lseg,
 static int ff_layout_read_done_cb(struct rpc_task *task,
                                 struct nfs_pgio_header *hdr)
 {
+        int new_idx = hdr->pgio_mirror_idx;
         int err;
 
         trace_nfs4_pnfs_read(hdr, task->tk_status);
@@ -1307,7 +1308,7 @@ static int ff_layout_read_done_cb(struct rpc_task *task,
         case -NFS4ERR_RESET_TO_PNFS:
                 if (ff_layout_choose_best_ds_for_read(hdr->lseg,
                                         hdr->pgio_mirror_idx + 1,
-                                        &hdr->pgio_mirror_idx))
+                                        &new_idx))
                         goto out_layouterror;
                 set_bit(NFS_IOHDR_RESEND_PNFS, &hdr->flags);
                 return task->tk_status;
@@ -1320,7 +1321,9 @@ static int ff_layout_read_done_cb(struct rpc_task *task,
 
         return 0;
 out_layouterror:
+        ff_layout_read_record_layoutstats_done(task, hdr);
         ff_layout_send_layouterror(hdr->lseg);
+        hdr->pgio_mirror_idx = new_idx;
 out_eagain:
         rpc_restart_call_prepare(task);
         return -EAGAIN;
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 4dbb0ee23432..741ff8c9c6ed 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2933,7 +2933,8 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata,
         }
 
 out:
-        nfs4_sequence_free_slot(&opendata->o_res.seq_res);
+        if (!opendata->cancelled)
+                nfs4_sequence_free_slot(&opendata->o_res.seq_res);
         return ret;
 }
 
@@ -6301,7 +6302,6 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl,
         p->arg.seqid = seqid;
         p->res.seqid = seqid;
         p->lsp = lsp;
-        refcount_inc(&lsp->ls_count);
         /* Ensure we don't close file until we're done freeing locks! */
         p->ctx = get_nfs_open_context(ctx);
         p->l_ctx = nfs_get_lock_context(ctx);
@@ -6526,7 +6526,6 @@ static struct nfs4_lockdata *nfs4_alloc_lockdata(struct file_lock *fl,
         p->res.lock_seqid = p->arg.lock_seqid;
         p->lsp = lsp;
         p->server = server;
-        refcount_inc(&lsp->ls_count);
         p->ctx = get_nfs_open_context(ctx);
         locks_init_lock(&p->fl);
         locks_copy_lock(&p->fl, fl);
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 8247bd1634cb..7066cd7c7aff 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -1889,7 +1889,7 @@ lookup_again:
             atomic_read(&lo->plh_outstanding) != 0) {
                 spin_unlock(&ino->i_lock);
                 lseg = ERR_PTR(wait_var_event_killable(&lo->plh_outstanding,
-                                        atomic_read(&lo->plh_outstanding)));
+                                        !atomic_read(&lo->plh_outstanding)));
                 if (IS_ERR(lseg) || !list_empty(&lo->plh_segs))
                         goto out_put_layout_hdr;
                 pnfs_put_layout_hdr(lo);
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index 56992b32c6bb..a90bb19dcfa2 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -208,6 +208,7 @@ static int copy_fid_to_user(struct fanotify_event *event, char __user *buf)
 {
         struct fanotify_event_info_fid info = { };
         struct file_handle handle = { };
+        unsigned char bounce[FANOTIFY_INLINE_FH_LEN], *fh;
         size_t fh_len = event->fh_len;
         size_t len = fanotify_event_info_len(event);
 
@@ -233,7 +234,16 @@ static int copy_fid_to_user(struct fanotify_event *event, char __user *buf)
 
         buf += sizeof(handle);
         len -= sizeof(handle);
-        if (copy_to_user(buf, fanotify_event_fh(event), fh_len))
+        /*
+         * For an inline fh, copy through stack to exclude the copy from
+         * usercopy hardening protections.
+         */
+        fh = fanotify_event_fh(event);
+        if (fh_len <= FANOTIFY_INLINE_FH_LEN) {
+                memcpy(bounce, fh, fh_len);
+                fh = bounce;
+        }
+        if (copy_to_user(buf, fh, fh_len))
                 return -EFAULT;
 
         /* Pad with 0's */
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index e2901fbb9f76..7b53598c8804 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -519,8 +519,10 @@ static int inotify_update_existing_watch(struct fsnotify_group *group,
         fsn_mark = fsnotify_find_mark(&inode->i_fsnotify_marks, group);
         if (!fsn_mark)
                 return -ENOENT;
-        else if (create)
-                return -EEXIST;
+        else if (create) {
+                ret = -EEXIST;
+                goto out;
+        }
 
         i_mark = container_of(fsn_mark, struct inotify_inode_mark, fsn_mark);
 
@@ -548,6 +550,7 @@ static int inotify_update_existing_watch(struct fsnotify_group *group,
         /* return the wd */
         ret = i_mark->wd;
 
+out:
         /* match the get from fsnotify_find_mark() */
         fsnotify_put_mark(fsn_mark);
 
diff --git a/fs/proc/base.c b/fs/proc/base.c
index f5ebdd87afb2..ddef482f1334 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -3074,6 +3074,15 @@ static const struct file_operations proc_tgid_base_operations = {
         .llseek         = generic_file_llseek,
 };
 
+struct pid *tgid_pidfd_to_pid(const struct file *file)
+{
+        if (!d_is_dir(file->f_path.dentry) ||
+            (file->f_op != &proc_tgid_base_operations))
+                return ERR_PTR(-EBADF);
+
+        return proc_pid(file_inode(file));
+}
+
 static struct dentry *proc_tgid_base_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags)
 {
         return proc_pident_lookup(dir, dentry,
diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
index bbcc185062bb..d29d869abec1 100644
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -54,6 +54,28 @@ static LIST_HEAD(kclist_head);
 static DECLARE_RWSEM(kclist_lock);
 static int kcore_need_update = 1;
 
+/*
+ * Returns > 0 for RAM pages, 0 for non-RAM pages, < 0 on error
+ * Same as oldmem_pfn_is_ram in vmcore
+ */
+static int (*mem_pfn_is_ram)(unsigned long pfn);
+
+int __init register_mem_pfn_is_ram(int (*fn)(unsigned long pfn))
+{
+        if (mem_pfn_is_ram)
+                return -EBUSY;
+        mem_pfn_is_ram = fn;
+        return 0;
+}
+
+static int pfn_is_ram(unsigned long pfn)
+{
+        if (mem_pfn_is_ram)
+                return mem_pfn_is_ram(pfn);
+        else
+                return 1;
+}
+
 /* This doesn't grab kclist_lock, so it should only be used at init time. */
 void __init kclist_add(struct kcore_list *new, void *addr, size_t size,
                        int type)
@@ -465,6 +487,11 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
                                 goto out;
                         }
                         m = NULL;       /* skip the list anchor */
+                } else if (!pfn_is_ram(__pa(start) >> PAGE_SHIFT)) {
+                        if (clear_user(buffer, tsz)) {
+                                ret = -EFAULT;
+                                goto out;
+                        }
                 } else if (m->type == KCORE_VMALLOC) {
                         vread(buf, (char *)start, tsz);
                         /* we have to zero-fill user buffer even if no read */
diff --git a/fs/sysfs/mount.c b/fs/sysfs/mount.c
index 4cb21b558a85..1b56686ab178 100644
--- a/fs/sysfs/mount.c
+++ b/fs/sysfs/mount.c
@@ -71,9 +71,11 @@ static int sysfs_init_fs_context(struct fs_context *fc)
         kfc->magic = SYSFS_MAGIC;
         fc->fs_private = kfc;
         fc->ops = &sysfs_fs_context_ops;
-        if (fc->user_ns)
-                put_user_ns(fc->user_ns);
-        fc->user_ns = get_user_ns(netns->user_ns);
+        if (netns) {
+                if (fc->user_ns)
+                        put_user_ns(fc->user_ns);
+                fc->user_ns = get_user_ns(netns->user_ns);
+        }
         fc->global = true;
         return 0;
 }
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index ae796e10f68b..e7276932e433 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1242,8 +1242,10 @@ set_size:
                 truncate_setsize(inode, newsize);
                 down_write(&iinfo->i_data_sem);
                 udf_clear_extent_cache(inode);
-                udf_truncate_extents(inode);
+                err = udf_truncate_extents(inode);
                 up_write(&iinfo->i_data_sem);
+                if (err)
+                        return err;
         }
 update_time:
         inode->i_mtime = inode->i_ctime = current_time(inode);
diff --git a/fs/udf/truncate.c b/fs/udf/truncate.c
index b647f0bd150c..63a47f1e1d52 100644
--- a/fs/udf/truncate.c
+++ b/fs/udf/truncate.c
@@ -199,7 +199,7 @@ static void udf_update_alloc_ext_desc(struct inode *inode,
  * for making file shorter. For making file longer, udf_extend_file() has to
  * be used.
  */
-void udf_truncate_extents(struct inode *inode)
+int udf_truncate_extents(struct inode *inode)
 {
         struct extent_position epos;
         struct kernel_lb_addr eloc, neloc = {};
@@ -224,7 +224,7 @@ void udf_truncate_extents(struct inode *inode)
         if (etype == -1) {
                 /* We should extend the file? */
                 WARN_ON(byte_offset);
-                return;
+                return 0;
         }
         epos.offset -= adsize;
         extent_trunc(inode, &epos, &eloc, etype, elen, byte_offset);
@@ -260,6 +260,9 @@ void udf_truncate_extents(struct inode *inode)
                         epos.block = eloc;
                         epos.bh = udf_tread(sb,
                                         udf_get_lb_pblock(sb, &eloc, 0));
+                        /* Error reading indirect block? */
+                        if (!epos.bh)
+                                return -EIO;
                         if (elen)
                                 indirect_ext_len =
                                         (elen + sb->s_blocksize - 1) >>
@@ -283,4 +286,5 @@ void udf_truncate_extents(struct inode *inode)
         iinfo->i_lenExtents = inode->i_size;
 
         brelse(epos.bh);
+        return 0;
 }
diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
index ee246769dee4..d89ef71887fc 100644
--- a/fs/udf/udfdecl.h
+++ b/fs/udf/udfdecl.h
@@ -235,7 +235,7 @@ extern struct inode *udf_new_inode(struct inode *, umode_t);
 /* truncate.c */
 extern void udf_truncate_tail_extent(struct inode *);
 extern void udf_discard_prealloc(struct inode *);
-extern void udf_truncate_extents(struct inode *);
+extern int udf_truncate_extents(struct inode *);
 
 /* balloc.c */
 extern void udf_free_blocks(struct super_block *, struct inode *,
diff --git a/fs/xfs/libxfs/xfs_dir2_leaf.c b/fs/xfs/libxfs/xfs_dir2_leaf.c
index 9a3767818c50..9c2a0a13ed61 100644
--- a/fs/xfs/libxfs/xfs_dir2_leaf.c
+++ b/fs/xfs/libxfs/xfs_dir2_leaf.c
@@ -563,43 +563,40 @@ xfs_dir3_leaf_find_entry(
  */
 int                                             /* error */
 xfs_dir2_leaf_addname(
-        xfs_da_args_t           *args)          /* operation arguments */
+        struct xfs_da_args      *args)          /* operation arguments */
 {
+        struct xfs_dir3_icleaf_hdr leafhdr;
+        struct xfs_trans        *tp = args->trans;
         __be16                  *bestsp;        /* freespace table in leaf */
-        int                     compact;        /* need to compact leaves */
-        xfs_dir2_data_hdr_t     *hdr;           /* data block header */
+        __be16                  *tagp;          /* end of data entry */
         struct xfs_buf          *dbp;           /* data block buffer */
-        xfs_dir2_data_entry_t   *dep;           /* data block entry */
-        xfs_inode_t             *dp;            /* incore directory inode */
-        xfs_dir2_data_unused_t  *dup;           /* data unused entry */
+        struct xfs_buf          *lbp;           /* leaf's buffer */
+        struct xfs_dir2_leaf    *leaf;          /* leaf structure */
+        struct xfs_inode        *dp = args->dp; /* incore directory inode */
+        struct xfs_dir2_data_hdr *hdr;          /* data block header */
+        struct xfs_dir2_data_entry *dep;        /* data block entry */
+        struct xfs_dir2_leaf_entry *lep;        /* leaf entry table pointer */
+        struct xfs_dir2_leaf_entry *ents;
+        struct xfs_dir2_data_unused *dup;       /* data unused entry */
+        struct xfs_dir2_leaf_tail *ltp;         /* leaf tail pointer */
+        struct xfs_dir2_data_free *bf;          /* bestfree table */
+        int                     compact;        /* need to compact leaves */
         int                     error;          /* error return value */
         int                     grown;          /* allocated new data block */
-        int                     highstale;      /* index of next stale leaf */
+        int                     highstale = 0;  /* index of next stale leaf */
         int                     i;              /* temporary, index */
         int                     index;          /* leaf table position */
-        struct xfs_buf          *lbp;           /* leaf's buffer */
-        xfs_dir2_leaf_t         *leaf;          /* leaf structure */
         int                     length;         /* length of new entry */
-        xfs_dir2_leaf_entry_t   *lep;           /* leaf entry table pointer */
         int                     lfloglow;       /* low leaf logging index */
         int                     lfloghigh;      /* high leaf logging index */
-        int                     lowstale;       /* index of prev stale leaf */
-        xfs_dir2_leaf_tail_t    *ltp;           /* leaf tail pointer */
+        int                     lowstale = 0;   /* index of prev stale leaf */
         int                     needbytes;      /* leaf block bytes needed */
         int                     needlog;        /* need to log data header */
         int                     needscan;       /* need to rescan data free */
-        __be16                  *tagp;          /* end of data entry */
-        xfs_trans_t             *tp;            /* transaction pointer */
         xfs_dir2_db_t           use_block;      /* data block number */
-        struct xfs_dir2_data_free *bf;          /* bestfree table */
-        struct xfs_dir2_leaf_entry *ents;
-        struct xfs_dir3_icleaf_hdr leafhdr;
 
         trace_xfs_dir2_leaf_addname(args);
 
-        dp = args->dp;
-        tp = args->trans;
-
         error = xfs_dir3_leaf_read(tp, dp, args->geo->leafblk, -1, &lbp);
         if (error)
                 return error;
diff --git a/fs/xfs/libxfs/xfs_dir2_node.c b/fs/xfs/libxfs/xfs_dir2_node.c
index 3b03703c5c3d..16731d2d684b 100644
--- a/fs/xfs/libxfs/xfs_dir2_node.c
+++ b/fs/xfs/libxfs/xfs_dir2_node.c
@@ -426,24 +426,22 @@ xfs_dir2_leaf_to_node(
 static int                                      /* error */
 xfs_dir2_leafn_add(
         struct xfs_buf          *bp,            /* leaf buffer */
-        xfs_da_args_t           *args,          /* operation arguments */
+        struct xfs_da_args      *args,          /* operation arguments */
         int                     index)          /* insertion pt for new entry */
 {
+        struct xfs_dir3_icleaf_hdr leafhdr;
+        struct xfs_inode        *dp = args->dp;
+        struct xfs_dir2_leaf    *leaf = bp->b_addr;
+        struct xfs_dir2_leaf_entry *lep;
+        struct xfs_dir2_leaf_entry *ents;
         int                     compact;        /* compacting stale leaves */
-        xfs_inode_t             *dp;            /* incore directory inode */
-        int                     highstale;      /* next stale entry */
-        xfs_dir2_leaf_t         *leaf;          /* leaf structure */
-        xfs_dir2_leaf_entry_t   *lep;           /* leaf entry */
+        int                     highstale = 0;  /* next stale entry */
         int                     lfloghigh;      /* high leaf entry logging */
         int                     lfloglow;       /* low leaf entry logging */
-        int                     lowstale;       /* previous stale entry */
-        struct xfs_dir3_icleaf_hdr leafhdr;
-        struct xfs_dir2_leaf_entry *ents;
+        int                     lowstale = 0;   /* previous stale entry */
 
         trace_xfs_dir2_leafn_add(args, index);
 
-        dp = args->dp;
-        leaf = bp->b_addr;
         dp->d_ops->leaf_hdr_from_disk(&leafhdr, leaf);
         ents = dp->d_ops->leaf_ents_p(leaf);
 
diff --git a/include/asm-generic/Kbuild b/include/asm-generic/Kbuild
new file mode 100644
index 000000000000..6f4536d70b8e
--- /dev/null
+++ b/include/asm-generic/Kbuild
@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0
+#
+# asm headers that all architectures except um should have
+# (This file is not included when SRCARCH=um since UML borrows several
+# asm headers from the host architecutre.)
diff --git a/include/clocksource/arm_arch_timer.h b/include/clocksource/arm_arch_timer.h
index 349e5957c949..702967d996bb 100644
--- a/include/clocksource/arm_arch_timer.h
+++ b/include/clocksource/arm_arch_timer.h
@@ -74,6 +74,7 @@ enum arch_timer_spi_nr {
 struct arch_timer_kvm_info {
         struct timecounter timecounter;
         int virtual_irq;
+        int physical_irq;
 };
 
 struct arch_timer_mem_frame {
diff --git a/include/drm/drm_fb_helper.h b/include/drm/drm_fb_helper.h
index bb9acea61369..286d58efed5d 100644
--- a/include/drm/drm_fb_helper.h
+++ b/include/drm/drm_fb_helper.h
@@ -36,6 +36,7 @@ struct drm_fb_helper;
 #include <drm/drm_crtc.h>
 #include <drm/drm_device.h>
 #include <linux/kgdb.h>
+#include <linux/vgaarb.h>
 
 enum mode_set_atomic {
         LEAVE_ATOMIC_MODE_SET,
@@ -642,11 +643,18 @@ drm_fb_helper_remove_conflicting_pci_framebuffers(struct pci_dev *pdev,
                                                   int resource_id,
                                                   const char *name)
 {
+        int ret = 0;
+
+        /*
+         * WARNING: Apparently we must kick fbdev drivers before vgacon,
+         * otherwise the vga fbdev driver falls over.
+         */
 #if IS_REACHABLE(CONFIG_FB)
-        return remove_conflicting_pci_framebuffers(pdev, resource_id, name);
-#else
-        return 0;
+        ret = remove_conflicting_pci_framebuffers(pdev, resource_id, name);
 #endif
+        if (ret == 0)
+                ret = vga_remove_vgacon(pdev);
+        return ret;
 }
 
 #endif
diff --git a/include/kvm/arm_arch_timer.h b/include/kvm/arm_arch_timer.h
index 33771352dcd6..05a18dd265b5 100644
--- a/include/kvm/arm_arch_timer.h
+++ b/include/kvm/arm_arch_timer.h
@@ -22,7 +22,22 @@
 #include <linux/clocksource.h>
 #include <linux/hrtimer.h>
 
+enum kvm_arch_timers {
+        TIMER_PTIMER,
+        TIMER_VTIMER,
+        NR_KVM_TIMERS
+};
+
+enum kvm_arch_timer_regs {
+        TIMER_REG_CNT,
+        TIMER_REG_CVAL,
+        TIMER_REG_TVAL,
+        TIMER_REG_CTL,
+};
+
 struct arch_timer_context {
+        struct kvm_vcpu                 *vcpu;
+
         /* Registers: control register, timer value */
         u32                             cnt_ctl;
         u64                             cnt_cval;
@@ -30,30 +45,36 @@ struct arch_timer_context {
         /* Timer IRQ */
         struct kvm_irq_level            irq;
 
+        /* Virtual offset */
+        u64                             cntvoff;
+
+        /* Emulated Timer (may be unused) */
+        struct hrtimer                  hrtimer;
+
         /*
-         * We have multiple paths which can save/restore the timer state
-         * onto the hardware, so we need some way of keeping track of
-         * where the latest state is.
-         *
-         * loaded == true:  State is loaded on the hardware registers.
-         * loaded == false: State is stored in memory.
+         * We have multiple paths which can save/restore the timer state onto
+         * the hardware, so we need some way of keeping track of where the
+         * latest state is.
          */
-        bool                    loaded;
+        bool                            loaded;
 
-        /* Virtual offset */
-        u64                     cntvoff;
+        /* Duplicated state from arch_timer.c for convenience */
+        u32                             host_timer_irq;
+        u32                             host_timer_irq_flags;
+};
+
+struct timer_map {
+        struct arch_timer_context *direct_vtimer;
+        struct arch_timer_context *direct_ptimer;
+        struct arch_timer_context *emul_ptimer;
 };
 
 struct arch_timer_cpu {
-        struct arch_timer_context       vtimer;
-        struct arch_timer_context       ptimer;
+        struct arch_timer_context timers[NR_KVM_TIMERS];
 
         /* Background timer used when the guest is not running */
         struct hrtimer                  bg_timer;
 
-        /* Physical timer emulation */
-        struct hrtimer                  phys_timer;
-
         /* Is the timer enabled */
         bool                    enabled;
 };
@@ -76,9 +97,6 @@ int kvm_arm_timer_has_attr(struct kvm_vcpu *vcpu, struct kvm_device_attr *attr);
 
 bool kvm_timer_is_pending(struct kvm_vcpu *vcpu);
 
-void kvm_timer_schedule(struct kvm_vcpu *vcpu);
-void kvm_timer_unschedule(struct kvm_vcpu *vcpu);
-
 u64 kvm_phys_timer_read(void);
 
 void kvm_timer_vcpu_load(struct kvm_vcpu *vcpu);
@@ -88,7 +106,19 @@ void kvm_timer_init_vhe(void);
 
 bool kvm_arch_timer_get_input_level(int vintid);
 
-#define vcpu_vtimer(v)  (&(v)->arch.timer_cpu.vtimer)
-#define vcpu_ptimer(v)  (&(v)->arch.timer_cpu.ptimer)
+#define vcpu_timer(v)   (&(v)->arch.timer_cpu)
+#define vcpu_get_timer(v,t)     (&vcpu_timer(v)->timers[(t)])
+#define vcpu_vtimer(v)  (&(v)->arch.timer_cpu.timers[TIMER_VTIMER])
+#define vcpu_ptimer(v)  (&(v)->arch.timer_cpu.timers[TIMER_PTIMER])
+
+#define arch_timer_ctx_index(ctx)       ((ctx) - vcpu_timer((ctx)->vcpu)->timers)
+
+u64 kvm_arm_timer_read_sysreg(struct kvm_vcpu *vcpu,
+                              enum kvm_arch_timers tmr,
+                              enum kvm_arch_timer_regs treg);
+void kvm_arm_timer_write_sysreg(struct kvm_vcpu *vcpu,
+                                enum kvm_arch_timers tmr,
+                                enum kvm_arch_timer_regs treg,
+                                u64 val);
 
 #endif
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 6ac47f5ea514..d5dcebd7aad3 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -400,12 +400,17 @@ extern bool acpi_osi_is_win8(void);
 
 #ifdef CONFIG_ACPI_NUMA
 int acpi_map_pxm_to_online_node(int pxm);
+int acpi_map_pxm_to_node(int pxm);
 int acpi_get_node(acpi_handle handle);
 #else
 static inline int acpi_map_pxm_to_online_node(int pxm)
 {
         return 0;
 }
+static inline int acpi_map_pxm_to_node(int pxm)
+{
+        return 0;
+}
 static inline int acpi_get_node(acpi_handle handle)
 {
         return 0;
diff --git a/include/linux/amba/bus.h b/include/linux/amba/bus.h
index d143c13bed26..f99b74a6e4ca 100644
--- a/include/linux/amba/bus.h
+++ b/include/linux/amba/bus.h
@@ -25,6 +25,43 @@
 #define AMBA_CID        0xb105f00d
 #define CORESIGHT_CID   0xb105900d
 
+/*
+ * CoreSight Architecture specification updates the ID specification
+ * for components on the AMBA bus. (ARM IHI 0029E)
+ *
+ * Bits 15:12 of the CID are the device class.
+ *
+ * Class 0xF remains for PrimeCell and legacy components. (AMBA_CID above)
+ * Class 0x9 defines the component as CoreSight (CORESIGHT_CID above)
+ * Class 0x0, 0x1, 0xB, 0xE define components that do not have driver support
+ * at present.
+ * Class 0x2-0x8,0xA and 0xD-0xD are presently reserved.
+ *
+ * Remaining CID bits stay as 0xb105-00d
+ */
+
+/**
+ * Class 0x9 components use additional values to form a Unique Component
+ * Identifier (UCI), where peripheral ID values are identical for different
+ * components. Passed to the amba bus code from the component driver via
+ * the amba_id->data pointer.
+ * @devarch     : coresight devarch register value
+ * @devarch_mask: mask bits used for matching. 0 indicates UCI not used.
+ * @devtype     : coresight device type value
+ * @data        : additional driver data. As we have usurped the original
+ *              pointer some devices may still need additional data
+ */
+struct amba_cs_uci_id {
+        unsigned int devarch;
+        unsigned int devarch_mask;
+        unsigned int devtype;
+        void *data;
+};
+
+/* define offsets for registers used by UCI */
+#define UCI_REG_DEVTYPE_OFFSET  0xFCC
+#define UCI_REG_DEVARCH_OFFSET  0xFBC
+
 struct clk;
 
 struct amba_device {
@@ -32,6 +69,8 @@ struct amba_device {
         struct resource         res;
         struct clk              *pclk;
         unsigned int            periphid;
+        unsigned int            cid;
+        struct amba_cs_uci_id   uci;
         unsigned int            irq[AMBA_NR_IRQS];
         char                    *driver_override;
 };
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index b0c814bcc7e3..cb2aa7ecafff 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -57,7 +57,6 @@ struct blk_mq_hw_ctx {
         unsigned int            queue_num;
 
         atomic_t                nr_active;
-        unsigned int            nr_expired;
 
         struct hlist_node       cpuhp_dead;
         struct kobject          kobj;
@@ -300,8 +299,6 @@ void blk_mq_end_request(struct request *rq, blk_status_t error);
 void __blk_mq_end_request(struct request *rq, blk_status_t error);
 
 void blk_mq_requeue_request(struct request *rq, bool kick_requeue_list);
-void blk_mq_add_to_requeue_list(struct request *rq, bool at_head,
-                                bool kick_requeue_list);
 void blk_mq_kick_requeue_list(struct request_queue *q);
 void blk_mq_delay_kick_requeue_list(struct request_queue *q, unsigned long msecs);
 bool blk_mq_complete_request(struct request *rq);
diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
index d66bf5f32610..791fee35df88 100644
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -215,6 +215,7 @@ struct bio {
 /*
  * bio flags
  */
+#define BIO_NO_PAGE_REF 0       /* don't put release vec pages */
 #define BIO_SEG_VALID   1       /* bi_phys_segments valid */
 #define BIO_CLONED      2       /* doesn't own data */
 #define BIO_BOUNCED     3       /* bio is a bounce bio */
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 0de92b29f589..5c58a3b2bf00 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -50,6 +50,9 @@ struct blk_stat_callback;
 /* Must be consistent with blk_mq_poll_stats_bkt() */
 #define BLK_MQ_POLL_STATS_BKTS 16
 
+/* Doing classic polling */
+#define BLK_MQ_POLL_CLASSIC -1
+
 /*
  * Maximum number of blkcg policies allowed to be registered concurrently.
  * Defined here to simplify include dependency.
diff --git a/include/linux/ceph/libceph.h b/include/linux/ceph/libceph.h
index a420c07904bc..337d5049ff93 100644
--- a/include/linux/ceph/libceph.h
+++ b/include/linux/ceph/libceph.h
@@ -294,6 +294,8 @@ extern void ceph_destroy_client(struct ceph_client *client);
 extern int __ceph_open_session(struct ceph_client *client,
                                unsigned long started);
 extern int ceph_open_session(struct ceph_client *client);
+int ceph_wait_for_latest_osdmap(struct ceph_client *client,
+                                unsigned long timeout);
 
 /* pagevec.c */
 extern void ceph_release_page_vector(struct page **pages, int num_pages);
diff --git a/include/linux/f2fs_fs.h b/include/linux/f2fs_fs.h
index d7711048ef93..f5740423b002 100644
--- a/include/linux/f2fs_fs.h
+++ b/include/linux/f2fs_fs.h
@@ -116,6 +116,7 @@ struct f2fs_super_block {
 /*
  * For checkpoint
  */
+#define CP_DISABLED_QUICK_FLAG          0x00002000
 #define CP_DISABLED_FLAG                0x00001000
 #define CP_QUOTA_NEED_FSCK_FLAG         0x00000800
 #define CP_LARGE_NAT_BITMAP_FLAG        0x00000400
@@ -186,7 +187,7 @@ struct f2fs_orphan_block {
 struct f2fs_extent {
         __le32 fofs;            /* start file offset of the extent */
         __le32 blk;             /* start block address of the extent */
-        __le32 len;             /* lengh of the extent */
+        __le32 len;             /* length of the extent */
 } __packed;
 
 #define F2FS_NAME_LEN           255
@@ -284,7 +285,7 @@ enum {
 
 struct node_footer {
         __le32 nid;             /* node id */
-        __le32 ino;             /* inode nunmber */
+        __le32 ino;             /* inode number */
         __le32 flag;            /* include cold/fsync/dentry marks and offset */
         __le64 cp_ver;          /* checkpoint version */
         __le32 next_blkaddr;    /* next node page block address */
@@ -489,12 +490,12 @@ typedef __le32	f2fs_hash_t;
 
 /*
  * space utilization of regular dentry and inline dentry (w/o extra reservation)
- *              regular dentry                  inline dentry
- * bitmap       1 * 27 = 27                     1 * 23 = 23
- * reserved     1 * 3 = 3                       1 * 7 = 7
- * dentry       11 * 214 = 2354                 11 * 182 = 2002
- * filename     8 * 214 = 1712                  8 * 182 = 1456
- * total        4096                            3488
+ *              regular dentry          inline dentry (def)     inline dentry (min)
+ * bitmap       1 * 27 = 27             1 * 23 = 23             1 * 1 = 1
+ * reserved     1 * 3 = 3               1 * 7 = 7               1 * 1 = 1
+ * dentry       11 * 214 = 2354         11 * 182 = 2002         11 * 2 = 22
+ * filename     8 * 214 = 1712          8 * 182 = 1456          8 * 2 = 16
+ * total        4096                    3488                    40
  *
  * Note: there are more reserved space in inline dentry than in regular
  * dentry, when converting inline dentry we should handle this carefully.
@@ -506,12 +507,13 @@ typedef __le32	f2fs_hash_t;
 #define SIZE_OF_RESERVED        (PAGE_SIZE - ((SIZE_OF_DIR_ENTRY + \
                                 F2FS_SLOT_LEN) * \
                                 NR_DENTRY_IN_BLOCK + SIZE_OF_DENTRY_BITMAP))
+#define MIN_INLINE_DENTRY_SIZE          40      /* just include '.' and '..' entries */
 
 /* One directory entry slot representing F2FS_SLOT_LEN-sized file name */
 struct f2fs_dir_entry {
         __le32 hash_code;       /* hash code of file name */
         __le32 ino;             /* inode number */
-        __le16 name_len;        /* lengh of file name */
+        __le16 name_len;        /* length of file name */
         __u8 file_type;         /* file type */
 } __packed;
 
diff --git a/include/linux/irq.h b/include/linux/irq.h
index d6160d479b14..7ae8de5ad0f2 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -195,7 +195,7 @@ struct irq_data {
  * IRQD_LEVEL                   - Interrupt is level triggered
  * IRQD_WAKEUP_STATE            - Interrupt is configured for wakeup
  *                                from suspend
- * IRDQ_MOVE_PCNTXT             - Interrupt can be moved in process
+ * IRQD_MOVE_PCNTXT             - Interrupt can be moved in process
  *                                context
  * IRQD_IRQ_DISABLED            - Disabled state of the interrupt
  * IRQD_IRQ_MASKED              - Masked state of the interrupt
diff --git a/include/linux/irqchip/arm-gic.h b/include/linux/irqchip/arm-gic.h
index 626179077bb0..0f049b384ccd 100644
--- a/include/linux/irqchip/arm-gic.h
+++ b/include/linux/irqchip/arm-gic.h
@@ -158,8 +158,7 @@ int gic_of_init_child(struct device *dev, struct gic_chip_data **gic, int irq);
  * Legacy platforms not converted to DT yet must use this to init
  * their GIC
  */
-void gic_init(unsigned int nr, int start,
-              void __iomem *dist , void __iomem *cpu);
+void gic_init(void __iomem *dist , void __iomem *cpu);
 
 int gicv2m_init(struct fwnode_handle *parent_handle,
                 struct irq_domain *parent);
diff --git a/include/linux/kcore.h b/include/linux/kcore.h
index 8c3f8c14eeaa..c843f4a9c512 100644
--- a/include/linux/kcore.h
+++ b/include/linux/kcore.h
@@ -44,6 +44,8 @@ void kclist_add_remap(struct kcore_list *m, void *addr, void *vaddr, size_t sz)
         m->vaddr = (unsigned long)vaddr;
         kclist_add(m, addr, sz, KCORE_REMAP);
 }
+
+extern int __init register_mem_pfn_is_ram(int (*fn)(unsigned long pfn));
 #else
 static inline
 void kclist_add(struct kcore_list *new, void *addr, size_t size, int type)
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index c38cc5eb7e73..9d55c63db09b 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -48,6 +48,27 @@
  */
 #define KVM_MEMSLOT_INVALID     (1UL << 16)
 
+/*
+ * Bit 63 of the memslot generation number is an "update in-progress flag",
+ * e.g. is temporarily set for the duration of install_new_memslots().
+ * This flag effectively creates a unique generation number that is used to
+ * mark cached memslot data, e.g. MMIO accesses, as potentially being stale,
+ * i.e. may (or may not) have come from the previous memslots generation.
+ *
+ * This is necessary because the actual memslots update is not atomic with
+ * respect to the generation number update.  Updating the generation number
+ * first would allow a vCPU to cache a spte from the old memslots using the
+ * new generation number, and updating the generation number after switching
+ * to the new memslots would allow cache hits using the old generation number
+ * to reference the defunct memslots.
+ *
+ * This mechanism is used to prevent getting hits in KVM's caches while a
+ * memslot update is in-progress, and to prevent cache hits *after* updating
+ * the actual generation number against accesses that were inserted into the
+ * cache *before* the memslots were updated.
+ */
+#define KVM_MEMSLOT_GEN_UPDATE_IN_PROGRESS      BIT_ULL(63)
+
 /* Two fragments for cross MMIO pages. */
 #define KVM_MAX_MMIO_FRAGMENTS  2
 
@@ -634,7 +655,7 @@ void kvm_arch_free_memslot(struct kvm *kvm, struct kvm_memory_slot *free,
                            struct kvm_memory_slot *dont);
 int kvm_arch_create_memslot(struct kvm *kvm, struct kvm_memory_slot *slot,
                             unsigned long npages);
-void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots);
+void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen);
 int kvm_arch_prepare_memory_region(struct kvm *kvm,
                                 struct kvm_memory_slot *memslot,
                                 const struct kvm_userspace_memory_region *mem,
@@ -1182,6 +1203,7 @@ extern bool kvm_rebooting;
 
 extern unsigned int halt_poll_ns;
 extern unsigned int halt_poll_ns_grow;
+extern unsigned int halt_poll_ns_grow_start;
 extern unsigned int halt_poll_ns_shrink;
 
 struct kvm_device {
diff --git a/include/linux/libnvdimm.h b/include/linux/libnvdimm.h
index 43348303cb4b..feb342d026f2 100644
--- a/include/linux/libnvdimm.h
+++ b/include/linux/libnvdimm.h
@@ -130,6 +130,7 @@ struct nd_region_desc {
         void *provider_data;
         int num_lanes;
         int numa_node;
+        int target_node;
         unsigned long flags;
         struct device_node *of_node;
 };
diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h
index b26ea9077384..0343c81d4c5f 100644
--- a/include/linux/mlx5/qp.h
+++ b/include/linux/mlx5/qp.h
@@ -557,7 +557,8 @@ static inline struct mlx5_core_mkey *__mlx5_mr_lookup(struct mlx5_core_dev *dev,
 
 int mlx5_core_create_dct(struct mlx5_core_dev *dev,
                          struct mlx5_core_dct *qp,
-                         u32 *in, int inlen);
+                         u32 *in, int inlen,
+                         u32 *out, int outlen);
 int mlx5_core_create_qp(struct mlx5_core_dev *dev,
                         struct mlx5_core_qp *qp,
                         u32 *in,
diff --git a/include/linux/ntb.h b/include/linux/ntb.h
index 181d16601dd9..56a92e3ae3ae 100644
--- a/include/linux/ntb.h
+++ b/include/linux/ntb.h
@@ -296,7 +296,8 @@ struct ntb_dev_ops {
         int (*db_clear_mask)(struct ntb_dev *ntb, u64 db_bits);
 
         int (*peer_db_addr)(struct ntb_dev *ntb,
-                            phys_addr_t *db_addr, resource_size_t *db_size);
+                            phys_addr_t *db_addr, resource_size_t *db_size,
+                                u64 *db_data, int db_bit);
         u64 (*peer_db_read)(struct ntb_dev *ntb);
         int (*peer_db_set)(struct ntb_dev *ntb, u64 db_bits);
         int (*peer_db_clear)(struct ntb_dev *ntb, u64 db_bits);
@@ -1078,6 +1079,8 @@ static inline int ntb_db_clear_mask(struct ntb_dev *ntb, u64 db_bits)
  * @ntb:        NTB device context.
  * @db_addr:    OUT - The address of the peer doorbell register.
  * @db_size:    OUT - The number of bytes to write the peer doorbell register.
+ * @db_data:    OUT - The data of peer doorbell register
+ * @db_bit:             door bell bit number
  *
  * Return the address of the peer doorbell register.  This may be used, for
  * example, by drivers that offload memory copy operations to a dma engine.
@@ -1091,12 +1094,13 @@ static inline int ntb_db_clear_mask(struct ntb_dev *ntb, u64 db_bits)
  */
 static inline int ntb_peer_db_addr(struct ntb_dev *ntb,
                                    phys_addr_t *db_addr,
-                                   resource_size_t *db_size)
+                                   resource_size_t *db_size,
+                                   u64 *db_data, int db_bit)
 {
         if (!ntb->ops->peer_db_addr)
                 return -EINVAL;
 
-        return ntb->ops->peer_db_addr(ntb, db_addr, db_size);
+        return ntb->ops->peer_db_addr(ntb, db_addr, db_size, db_data, db_bit);
 }
 
 /**
diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
index b477a70cc2e4..bcf909d0de5f 100644
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -239,6 +239,7 @@ pgoff_t page_cache_prev_miss(struct address_space *mapping,
 #define FGP_WRITE               0x00000008
 #define FGP_NOFS                0x00000010
 #define FGP_NOWAIT              0x00000020
+#define FGP_FOR_MMAP            0x00000040
 
 struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset,
                 int fgp_flags, gfp_t cache_gfp_mask);
diff --git a/include/linux/parport.h b/include/linux/parport.h
index f41f1d041e2c..397607a0c0eb 100644
--- a/include/linux/parport.h
+++ b/include/linux/parport.h
@@ -460,7 +460,6 @@ extern size_t parport_ieee1284_epp_read_addr (struct parport *,
                                               void *, size_t, int);
 
 /* IEEE1284.3 functions */
-#define daisy_dev_name "Device ID probe"
 extern int parport_daisy_init (struct parport *port);
 extern void parport_daisy_fini (struct parport *port);
 extern struct pardevice *parport_open (int devnum, const char *name);
@@ -469,18 +468,6 @@ extern ssize_t parport_device_id (int devnum, char *buffer, size_t len);
 extern void parport_daisy_deselect_all (struct parport *port);
 extern int parport_daisy_select (struct parport *port, int daisy, int mode);
 
-#ifdef CONFIG_PARPORT_1284
-extern int daisy_drv_init(void);
-extern void daisy_drv_exit(void);
-#else
-static inline int daisy_drv_init(void)
-{
-        return 0;
-}
-
-static inline void daisy_drv_exit(void) {}
-#endif
-
 /* Lowlevel drivers _can_ call this support function to handle irqs.  */
 static inline void parport_generic_irq(struct parport *port)
 {
diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
index d0e1f1522a78..52a283ba0465 100644
--- a/include/linux/proc_fs.h
+++ b/include/linux/proc_fs.h
@@ -73,6 +73,7 @@ struct proc_dir_entry *proc_create_net_single_write(const char *name, umode_t mo
                                                     int (*show)(struct seq_file *, void *),
                                                     proc_write_t write,
                                                     void *data);
+extern struct pid *tgid_pidfd_to_pid(const struct file *file);
 
 #else /* CONFIG_PROC_FS */
 
@@ -114,6 +115,11 @@ static inline int remove_proc_subtree(const char *name, struct proc_dir_entry *p
 #define proc_create_net(name, mode, parent, state_size, ops) ({NULL;})
 #define proc_create_net_single(name, mode, parent, show, data) ({NULL;})
 
+static inline struct pid *tgid_pidfd_to_pid(const struct file *file)
+{
+        return ERR_PTR(-EBADF);
+}
+
 #endif /* CONFIG_PROC_FS */
 
 struct net;
diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
index f1429675f252..1a40277b512c 100644
--- a/include/linux/ring_buffer.h
+++ b/include/linux/ring_buffer.h
@@ -128,7 +128,7 @@ ring_buffer_consume(struct ring_buffer *buffer, int cpu, u64 *ts,
                     unsigned long *lost_events);
 
 struct ring_buffer_iter *
-ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu);
+ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu, gfp_t flags);
 void ring_buffer_read_prepare_sync(void);
 void ring_buffer_read_start(struct ring_buffer_iter *iter);
 void ring_buffer_read_finish(struct ring_buffer_iter *iter);
diff --git a/include/linux/sbitmap.h b/include/linux/sbitmap.h
index 14d558146aea..20f3e3f029b9 100644
--- a/include/linux/sbitmap.h
+++ b/include/linux/sbitmap.h
@@ -330,7 +330,7 @@ static inline void sbitmap_clear_bit(struct sbitmap *sb, unsigned int bitnr)
 /*
  * This one is special, since it doesn't actually clear the bit, rather it
  * sets the corresponding bit in the ->cleared mask instead. Paired with
- * the caller doing sbitmap_batch_clear() if a given index is full, which
+ * the caller doing sbitmap_deferred_clear() if a given index is full, which
  * will clear the previously freed entries in the corresponding ->word.
  */
 static inline void sbitmap_deferred_clear_bit(struct sbitmap *sb, unsigned int bitnr)
diff --git a/include/linux/switchtec.h b/include/linux/switchtec.h
index eee0412bdf4b..52a079b3a9a6 100644
--- a/include/linux/switchtec.h
+++ b/include/linux/switchtec.h
@@ -248,9 +248,13 @@ struct ntb_ctrl_regs {
                 u32 win_size;
                 u64 xlate_addr;
         } bar_entry[6];
-        u32 reserved2[216];
-        u32 req_id_table[256];
-        u32 reserved3[512];
+        struct {
+                u32 win_size;
+                u32 reserved[3];
+        } bar_ext_entry[6];
+        u32 reserved2[192];
+        u32 req_id_table[512];
+        u32 reserved3[256];
         u64 lut_entry[512];
 } __packed;
 
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index c2962953bf11..e446806a561f 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -985,6 +985,9 @@ asmlinkage long sys_statx(int dfd, const char __user *path, unsigned flags,
                           unsigned mask, struct statx __user *buffer);
 asmlinkage long sys_rseq(struct rseq __user *rseq, uint32_t rseq_len,
                          int flags, uint32_t sig);
+asmlinkage long sys_pidfd_send_signal(int pidfd, int sig,
+                                       siginfo_t __user *info,
+                                       unsigned int flags);
 
 /*
  * Architecture-specific system calls
diff --git a/include/linux/uio.h b/include/linux/uio.h
index 87477e1640f9..f184af1999a8 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -23,14 +23,23 @@ struct kvec {
 };
 
 enum iter_type {
-        ITER_IOVEC = 0,
-        ITER_KVEC = 2,
-        ITER_BVEC = 4,
-        ITER_PIPE = 8,
-        ITER_DISCARD = 16,
+        /* set if ITER_BVEC doesn't hold a bv_page ref */
+        ITER_BVEC_FLAG_NO_REF = 2,
+
+        /* iter types */
+        ITER_IOVEC = 4,
+        ITER_KVEC = 8,
+        ITER_BVEC = 16,
+        ITER_PIPE = 32,
+        ITER_DISCARD = 64,
 };
 
 struct iov_iter {
+        /*
+         * Bit 0 is the read/write bit, set if we're writing.
+         * Bit 1 is the BVEC_FLAG_NO_REF bit, set if type is a bvec and
+         * the caller isn't expecting to drop a page reference when done.
+         */
         unsigned int type;
         size_t iov_offset;
         size_t count;
@@ -84,6 +93,11 @@ static inline unsigned char iov_iter_rw(const struct iov_iter *i)
         return i->type & (READ | WRITE);
 }
 
+static inline bool iov_iter_bvec_no_ref(const struct iov_iter *i)
+{
+        return (i->type & ITER_BVEC_FLAG_NO_REF) != 0;
+}
+
 /*
  * Total number of bytes covered by an iovec.
  *
diff --git a/include/linux/vgaarb.h b/include/linux/vgaarb.h
index ee162e3e879b..553b34c8b5f7 100644
--- a/include/linux/vgaarb.h
+++ b/include/linux/vgaarb.h
@@ -125,9 +125,11 @@ extern void vga_put(struct pci_dev *pdev, unsigned int rsrc);
 #ifdef CONFIG_VGA_ARB
 extern struct pci_dev *vga_default_device(void);
 extern void vga_set_default_device(struct pci_dev *pdev);
+extern int vga_remove_vgacon(struct pci_dev *pdev);
 #else
 static inline struct pci_dev *vga_default_device(void) { return NULL; };
 static inline void vga_set_default_device(struct pci_dev *pdev) { };
+static inline int vga_remove_vgacon(struct pci_dev *pdev) { return 0; };
 #endif
 
 /*
diff --git a/include/misc/charlcd.h b/include/misc/charlcd.h
index 23f61850f363..1832402324ce 100644
--- a/include/misc/charlcd.h
+++ b/include/misc/charlcd.h
@@ -35,6 +35,7 @@ struct charlcd_ops {
 };
 
 struct charlcd *charlcd_alloc(unsigned int drvdata_size);
+void charlcd_free(struct charlcd *lcd);
 
 int charlcd_register(struct charlcd *lcd);
 int charlcd_unregister(struct charlcd *lcd);
diff --git a/include/sound/pcm.h b/include/sound/pcm.h
index 465d7d033c4c..18bd8c3ea605 100644
--- a/include/sound/pcm.h
+++ b/include/sound/pcm.h
@@ -750,7 +750,7 @@ static inline snd_pcm_uframes_t snd_pcm_playback_avail(struct snd_pcm_runtime *r
 }
 
 /**
- * snd_pcm_playback_avail - Get the available (readable) space for capture
+ * snd_pcm_capture_avail - Get the available (readable) space for capture
  * @runtime: PCM runtime instance
  *
  * Result is between 0 ... (boundary - 1)
diff --git a/include/trace/events/f2fs.h b/include/trace/events/f2fs.h
index 3ec73f17ee2a..a3916b4dd57e 100644
--- a/include/trace/events/f2fs.h
+++ b/include/trace/events/f2fs.h
@@ -149,6 +149,17 @@ TRACE_DEFINE_ENUM(CP_TRIMMED);
                 { CP_SPEC_LOG_NUM,      "log type is 2" },              \
                 { CP_RECOVER_DIR,       "dir needs recovery" })
 
+#define show_shutdown_mode(type)                                        \
+        __print_symbolic(type,                                          \
+                { F2FS_GOING_DOWN_FULLSYNC,     "full sync" },          \
+                { F2FS_GOING_DOWN_METASYNC,     "meta sync" },          \
+                { F2FS_GOING_DOWN_NOSYNC,       "no sync" },            \
+                { F2FS_GOING_DOWN_METAFLUSH,    "meta flush" },         \
+                { F2FS_GOING_DOWN_NEED_FSCK,    "need fsck" })
+
+struct f2fs_sb_info;
+struct f2fs_io_info;
+struct extent_info;
 struct victim_sel_policy;
 struct f2fs_map_blocks;
 
@@ -533,6 +544,9 @@ TRACE_EVENT(f2fs_map_blocks,
                 __field(block_t,        m_lblk)
                 __field(block_t,        m_pblk)
                 __field(unsigned int,   m_len)
+                __field(unsigned int,   m_flags)
+                __field(int,    m_seg_type)
+                __field(bool,   m_may_create)
                 __field(int,    ret)
         ),
 
@@ -542,15 +556,22 @@ TRACE_EVENT(f2fs_map_blocks,
                 __entry->m_lblk         = map->m_lblk;
                 __entry->m_pblk         = map->m_pblk;
                 __entry->m_len          = map->m_len;
+                __entry->m_flags        = map->m_flags;
+                __entry->m_seg_type     = map->m_seg_type;
+                __entry->m_may_create   = map->m_may_create;
                 __entry->ret            = ret;
         ),
 
         TP_printk("dev = (%d,%d), ino = %lu, file offset = %llu, "
-                "start blkaddr = 0x%llx, len = 0x%llx, err = %d",
+                "start blkaddr = 0x%llx, len = 0x%llx, flags = %u,"
+                "seg_type = %d, may_create = %d, err = %d",
                 show_dev_ino(__entry),
                 (unsigned long long)__entry->m_lblk,
                 (unsigned long long)__entry->m_pblk,
                 (unsigned long long)__entry->m_len,
+                __entry->m_flags,
+                __entry->m_seg_type,
+                __entry->m_may_create,
                 __entry->ret)
 );
 
@@ -1616,6 +1637,30 @@ DEFINE_EVENT(f2fs_sync_dirty_inodes, f2fs_sync_dirty_inodes_exit,
         TP_ARGS(sb, type, count)
 );
 
+TRACE_EVENT(f2fs_shutdown,
+
+        TP_PROTO(struct f2fs_sb_info *sbi, unsigned int mode, int ret),
+
+        TP_ARGS(sbi, mode, ret),
+
+        TP_STRUCT__entry(
+                __field(dev_t,  dev)
+                __field(unsigned int, mode)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                __entry->dev = sbi->sb->s_dev;
+                __entry->mode = mode;
+                __entry->ret = ret;
+        ),
+
+        TP_printk("dev = (%d,%d), mode: %s, ret:%d",
+                show_dev(__entry->dev),
+                show_shutdown_mode(__entry->mode),
+                __entry->ret)
+);
+
 #endif /* _TRACE_F2FS_H */
 
  /* This part must be outside protection */
diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
index 8451f30c6a0f..7e899e635d33 100644
--- a/include/trace/events/sunrpc.h
+++ b/include/trace/events/sunrpc.h
@@ -712,7 +712,8 @@ TRACE_EVENT(xprt_transmit,
 
         TP_fast_assign(
                 __entry->task_id = rqst->rq_task->tk_pid;
-                __entry->client_id = rqst->rq_task->tk_client->cl_clid;
+                __entry->client_id = rqst->rq_task->tk_client ?
+                        rqst->rq_task->tk_client->cl_clid : -1;
                 __entry->xid = be32_to_cpu(rqst->rq_xid);
                 __entry->seqno = rqst->rq_seqno;
                 __entry->status = status;
@@ -742,7 +743,8 @@ TRACE_EVENT(xprt_enq_xmit,
 
         TP_fast_assign(
                 __entry->task_id = task->tk_pid;
-                __entry->client_id = task->tk_client->cl_clid;
+                __entry->client_id = task->tk_client ?
+                        task->tk_client->cl_clid : -1;
                 __entry->xid = be32_to_cpu(task->tk_rqstp->rq_xid);
                 __entry->seqno = task->tk_rqstp->rq_seqno;
                 __entry->stage = stage;
diff --git a/include/uapi/asm-generic/Kbuild.asm b/include/uapi/asm-generic/Kbuild
index 355c4ac2c0b0..ebb180aac74e 100644
--- a/include/uapi/asm-generic/Kbuild.asm
+++ b/include/uapi/asm-generic/Kbuild
@@ -1,6 +1,8 @@
+# SPDX-License-Identifier: GPL-2.0
 #
 # Headers that are mandatory in usr/include/asm/
-#
+# (This file is not included when SRCARCH=um since UML does not support UAPI.)
+
 mandatory-y += auxvec.h
 mandatory-y += bitsperlong.h
 mandatory-y += bpf_perf_event.h
diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h
index bf4624efe5e6..dee7292e1df6 100644
--- a/include/uapi/asm-generic/unistd.h
+++ b/include/uapi/asm-generic/unistd.h
@@ -824,6 +824,8 @@ __SYSCALL(__NR_futex_time64, sys_futex)
 __SYSCALL(__NR_sched_rr_get_interval_time64, sys_sched_rr_get_interval)
 #endif
 
+#define __NR_pidfd_send_signal 424
+__SYSCALL(__NR_pidfd_send_signal, sys_pidfd_send_signal)
 #define __NR_io_uring_setup 425
 __SYSCALL(__NR_io_uring_setup, sys_io_uring_setup)
 #define __NR_io_uring_enter 426
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 1032a16bd186..72d06e302e99 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7189,6 +7189,7 @@ static void perf_event_mmap_output(struct perf_event *event,
         struct perf_output_handle handle;
         struct perf_sample_data sample;
         int size = mmap_event->event_id.header.size;
+        u32 type = mmap_event->event_id.header.type;
         int ret;
 
         if (!perf_event_mmap_match(event, data))
@@ -7232,6 +7233,7 @@ static void perf_event_mmap_output(struct perf_event *event,
         perf_output_end(&handle);
 out:
         mmap_event->event_id.header.size = size;
+        mmap_event->event_id.header.type = type;
 }
 
 static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
diff --git a/kernel/futex.c b/kernel/futex.c
index c3b73b0311bc..9e40cf7be606 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -3436,6 +3436,10 @@ static int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int p
 {
         u32 uval, uninitialized_var(nval), mval;
 
+        /* Futex address must be 32bit aligned */
+        if ((((unsigned long)uaddr) % sizeof(*uaddr)) != 0)
+                return -1;
+
 retry:
         if (get_user(uval, uaddr))
                 return -1;
diff --git a/kernel/irq/devres.c b/kernel/irq/devres.c
index 5d5378ea0afe..f808c6a97dcc 100644
--- a/kernel/irq/devres.c
+++ b/kernel/irq/devres.c
@@ -84,8 +84,6 @@ EXPORT_SYMBOL(devm_request_threaded_irq);
  *      @dev: device to request interrupt for
  *      @irq: Interrupt line to allocate
  *      @handler: Function to be called when the IRQ occurs
- *      @thread_fn: function to be called in a threaded interrupt context. NULL
- *                  for devices which handle everything in @handler
  *      @irqflags: Interrupt type flags
  *      @devname: An ascii name for the claiming device, dev_name(dev) if NULL
  *      @dev_id: A cookie passed back to the handler function
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 9ec34a2a6638..1401afa0d58a 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -196,6 +196,7 @@ int irq_do_set_affinity(struct irq_data *data, const struct cpumask *mask,
         case IRQ_SET_MASK_OK:
         case IRQ_SET_MASK_OK_DONE:
                 cpumask_copy(desc->irq_common_data.affinity, mask);
+                /* fall through */
         case IRQ_SET_MASK_OK_NOCOPY:
                 irq_validate_effective_affinity(data);
                 irq_set_thread_affinity(desc);
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 6b7654b8001f..02ca827b8fac 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -65,6 +65,7 @@ int console_printk[4] = {
         CONSOLE_LOGLEVEL_MIN,           /* minimum_console_loglevel */
         CONSOLE_LOGLEVEL_DEFAULT,       /* default_console_loglevel */
 };
+EXPORT_SYMBOL_GPL(console_printk);
 
 atomic_t ignore_console_lock_warning __read_mostly = ATOMIC_INIT(0);
 EXPORT_SYMBOL(ignore_console_lock_warning);
diff --git a/kernel/resource.c b/kernel/resource.c
index e81b17b53fa5..92190f62ebc5 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -382,7 +382,7 @@ static int __walk_iomem_res_desc(resource_size_t start, resource_size_t end,
                                  int (*func)(struct resource *, void *))
 {
         struct resource res;
-        int ret = -1;
+        int ret = -EINVAL;
 
         while (start < end &&
                !find_next_iomem_res(start, end, flags, desc, first_lvl, &res)) {
@@ -452,6 +452,9 @@ int walk_mem_res(u64 start, u64 end, void *arg,
  * This function calls the @func callback against all memory ranges of type
  * System RAM which are marked as IORESOURCE_SYSTEM_RAM and IORESOUCE_BUSY.
  * It is to be used only for System RAM.
+ *
+ * This will find System RAM ranges that are children of top-level resources
+ * in addition to top-level System RAM resources.
  */
 int walk_system_ram_range(unsigned long start_pfn, unsigned long nr_pages,
                           void *arg, int (*func)(unsigned long, unsigned long, void *))
@@ -460,14 +463,14 @@ int walk_system_ram_range(unsigned long start_pfn, unsigned long nr_pages,
         unsigned long flags;
         struct resource res;
         unsigned long pfn, end_pfn;
-        int ret = -1;
+        int ret = -EINVAL;
 
         start = (u64) start_pfn << PAGE_SHIFT;
         end = ((u64)(start_pfn + nr_pages) << PAGE_SHIFT) - 1;
         flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY;
         while (start < end &&
                !find_next_iomem_res(start, end, flags, IORES_DESC_NONE,
-                                    true, &res)) {
+                                    false, &res)) {
                 pfn = (res.start + PAGE_SIZE - 1) >> PAGE_SHIFT;
                 end_pfn = (res.end + 1) >> PAGE_SHIFT;
                 if (end_pfn > pfn)
@@ -1128,6 +1131,15 @@ struct resource * __request_region(struct resource *parent,
                 conflict = __request_resource(parent, res);
                 if (!conflict)
                         break;
+                /*
+                 * mm/hmm.c reserves physical addresses which then
+                 * become unavailable to other users.  Conflicts are
+                 * not expected.  Warn to aid debugging if encountered.
+                 */
+                if (conflict->desc == IORES_DESC_DEVICE_PRIVATE_MEMORY) {
+                        pr_warn("Unaddressable device %s %pR conflicts with %pR",
+                                conflict->name, conflict, res);
+                }
                 if (conflict != parent) {
                         if (!(conflict->flags & IORESOURCE_BUSY)) {
                                 parent = conflict;
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index ead464a0f2e5..4778c48a7fda 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -6998,7 +6998,7 @@ static int __maybe_unused cpu_period_quota_parse(char *buf,
 {
         char tok[21];   /* U64_MAX */
 
-        if (!sscanf(buf, "%s %llu", tok, periodp))
+        if (sscanf(buf, "%20s %llu", tok, periodp) < 1)
                 return -EINVAL;
 
         *periodp *= NSEC_PER_USEC;
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index 2efe629425be..5c41ea367422 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -48,10 +48,10 @@ struct sugov_cpu {
 
         bool                    iowait_boost_pending;
         unsigned int            iowait_boost;
-        unsigned int            iowait_boost_max;
         u64                     last_update;
 
         unsigned long           bw_dl;
+        unsigned long           min;
         unsigned long           max;
 
         /* The field below is for single-CPU policies only: */
@@ -303,8 +303,7 @@ static bool sugov_iowait_reset(struct sugov_cpu *sg_cpu, u64 time,
         if (delta_ns <= TICK_NSEC)
                 return false;
 
-        sg_cpu->iowait_boost = set_iowait_boost
-                ? sg_cpu->sg_policy->policy->min : 0;
+        sg_cpu->iowait_boost = set_iowait_boost ? sg_cpu->min : 0;
         sg_cpu->iowait_boost_pending = set_iowait_boost;
 
         return true;
@@ -344,14 +343,13 @@ static void sugov_iowait_boost(struct sugov_cpu *sg_cpu, u64 time,
 
         /* Double the boost at each request */
         if (sg_cpu->iowait_boost) {
-                sg_cpu->iowait_boost <<= 1;
-                if (sg_cpu->iowait_boost > sg_cpu->iowait_boost_max)
-                        sg_cpu->iowait_boost = sg_cpu->iowait_boost_max;
+                sg_cpu->iowait_boost =
+                        min_t(unsigned int, sg_cpu->iowait_boost << 1, SCHED_CAPACITY_SCALE);
                 return;
         }
 
         /* First wakeup after IO: start with minimum boost */
-        sg_cpu->iowait_boost = sg_cpu->sg_policy->policy->min;
+        sg_cpu->iowait_boost = sg_cpu->min;
 }
 
 /**
@@ -373,47 +371,38 @@ static void sugov_iowait_boost(struct sugov_cpu *sg_cpu, u64 time,
  * This mechanism is designed to boost high frequently IO waiting tasks, while
  * being more conservative on tasks which does sporadic IO operations.
  */
-static void sugov_iowait_apply(struct sugov_cpu *sg_cpu, u64 time,
-                               unsigned long *util, unsigned long *max)
+static unsigned long sugov_iowait_apply(struct sugov_cpu *sg_cpu, u64 time,
+                                        unsigned long util, unsigned long max)
 {
-        unsigned int boost_util, boost_max;
+        unsigned long boost;
 
         /* No boost currently required */
         if (!sg_cpu->iowait_boost)
-                return;
+                return util;
 
         /* Reset boost if the CPU appears to have been idle enough */
         if (sugov_iowait_reset(sg_cpu, time, false))
-                return;
+                return util;
 
-        /*
-         * An IO waiting task has just woken up:
-         * allow to further double the boost value
-         */
-        if (sg_cpu->iowait_boost_pending) {
-                sg_cpu->iowait_boost_pending = false;
-        } else {
+        if (!sg_cpu->iowait_boost_pending) {
                 /*
-                 * Otherwise: reduce the boost value and disable it when we
-                 * reach the minimum.
+                 * No boost pending; reduce the boost value.
                  */
                 sg_cpu->iowait_boost >>= 1;
-                if (sg_cpu->iowait_boost < sg_cpu->sg_policy->policy->min) {
+                if (sg_cpu->iowait_boost < sg_cpu->min) {
                         sg_cpu->iowait_boost = 0;
-                        return;
+                        return util;
                 }
         }
 
+        sg_cpu->iowait_boost_pending = false;
+
         /*
-         * Apply the current boost value: a CPU is boosted only if its current
-         * utilization is smaller then the current IO boost level.
+         * @util is already in capacity scale; convert iowait_boost
+         * into the same scale so we can compare.
          */
-        boost_util = sg_cpu->iowait_boost;
-        boost_max = sg_cpu->iowait_boost_max;
-        if (*util * boost_max < *max * boost_util) {
-                *util = boost_util;
-                *max = boost_max;
-        }
+        boost = (sg_cpu->iowait_boost * max) >> SCHED_CAPACITY_SHIFT;
+        return max(boost, util);
 }
 
 #ifdef CONFIG_NO_HZ_COMMON
@@ -460,7 +449,7 @@ static void sugov_update_single(struct update_util_data *hook, u64 time,
 
         util = sugov_get_util(sg_cpu);
         max = sg_cpu->max;
-        sugov_iowait_apply(sg_cpu, time, &util, &max);
+        util = sugov_iowait_apply(sg_cpu, time, util, max);
         next_f = get_next_freq(sg_policy, util, max);
         /*
          * Do not reduce the frequency if the CPU has not been idle
@@ -500,7 +489,7 @@ static unsigned int sugov_next_freq_shared(struct sugov_cpu *sg_cpu, u64 time)
 
                 j_util = sugov_get_util(j_sg_cpu);
                 j_max = j_sg_cpu->max;
-                sugov_iowait_apply(j_sg_cpu, time, &j_util, &j_max);
+                j_util = sugov_iowait_apply(j_sg_cpu, time, j_util, j_max);
 
                 if (j_util * max > j_max * util) {
                         util = j_util;
@@ -837,7 +826,9 @@ static int sugov_start(struct cpufreq_policy *policy)
                 memset(sg_cpu, 0, sizeof(*sg_cpu));
                 sg_cpu->cpu                     = cpu;
                 sg_cpu->sg_policy               = sg_policy;
-                sg_cpu->iowait_boost_max        = policy->cpuinfo.max_freq;
+                sg_cpu->min                     =
+                        (SCHED_CAPACITY_SCALE * policy->cpuinfo.min_freq) /
+                        policy->cpuinfo.max_freq;
         }
 
         for_each_cpu(cpu, policy->cpus) {
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index ea74d43924b2..fdab7eb6f351 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -8060,6 +8060,18 @@ check_cpu_capacity(struct rq *rq, struct sched_domain *sd)
 }
 
 /*
+ * Check whether a rq has a misfit task and if it looks like we can actually
+ * help that task: we can migrate the task to a CPU of higher capacity, or
+ * the task's current CPU is heavily pressured.
+ */
+static inline int check_misfit_status(struct rq *rq, struct sched_domain *sd)
+{
+        return rq->misfit_task_load &&
+                (rq->cpu_capacity_orig < rq->rd->max_cpu_capacity ||
+                 check_cpu_capacity(rq, sd));
+}
+
+/*
  * Group imbalance indicates (and tries to solve) the problem where balancing
  * groups is inadequate due to ->cpus_allowed constraints.
  *
@@ -9586,35 +9598,21 @@ static void nohz_balancer_kick(struct rq *rq)
         if (time_before(now, nohz.next_balance))
                 goto out;
 
-        if (rq->nr_running >= 2 || rq->misfit_task_load) {
+        if (rq->nr_running >= 2) {
                 flags = NOHZ_KICK_MASK;
                 goto out;
         }
 
         rcu_read_lock();
-        sds = rcu_dereference(per_cpu(sd_llc_shared, cpu));
-        if (sds) {
-                /*
-                 * If there is an imbalance between LLC domains (IOW we could
-                 * increase the overall cache use), we need some less-loaded LLC
-                 * domain to pull some load. Likewise, we may need to spread
-                 * load within the current LLC domain (e.g. packed SMT cores but
-                 * other CPUs are idle). We can't really know from here how busy
-                 * the others are - so just get a nohz balance going if it looks
-                 * like this LLC domain has tasks we could move.
-                 */
-                nr_busy = atomic_read(&sds->nr_busy_cpus);
-                if (nr_busy > 1) {
-                        flags = NOHZ_KICK_MASK;
-                        goto unlock;
-                }
-
-        }
 
         sd = rcu_dereference(rq->sd);
         if (sd) {
-                if ((rq->cfs.h_nr_running >= 1) &&
-                    check_cpu_capacity(rq, sd)) {
+                /*
+                 * If there's a CFS task and the current CPU has reduced
+                 * capacity; kick the ILB to see if there's a better CPU to run
+                 * on.
+                 */
+                if (rq->cfs.h_nr_running >= 1 && check_cpu_capacity(rq, sd)) {
                         flags = NOHZ_KICK_MASK;
                         goto unlock;
                 }
@@ -9622,6 +9620,11 @@ static void nohz_balancer_kick(struct rq *rq)
 
         sd = rcu_dereference(per_cpu(sd_asym_packing, cpu));
         if (sd) {
+                /*
+                 * When ASYM_PACKING; see if there's a more preferred CPU
+                 * currently idle; in which case, kick the ILB to move tasks
+                 * around.
+                 */
                 for_each_cpu_and(i, sched_domain_span(sd), nohz.idle_cpus_mask) {
                         if (sched_asym_prefer(i, cpu)) {
                                 flags = NOHZ_KICK_MASK;
@@ -9629,6 +9632,45 @@ static void nohz_balancer_kick(struct rq *rq)
                         }
                 }
         }
+
+        sd = rcu_dereference(per_cpu(sd_asym_cpucapacity, cpu));
+        if (sd) {
+                /*
+                 * When ASYM_CPUCAPACITY; see if there's a higher capacity CPU
+                 * to run the misfit task on.
+                 */
+                if (check_misfit_status(rq, sd)) {
+                        flags = NOHZ_KICK_MASK;
+                        goto unlock;
+                }
+
+                /*
+                 * For asymmetric systems, we do not want to nicely balance
+                 * cache use, instead we want to embrace asymmetry and only
+                 * ensure tasks have enough CPU capacity.
+                 *
+                 * Skip the LLC logic because it's not relevant in that case.
+                 */
+                goto unlock;
+        }
+
+        sds = rcu_dereference(per_cpu(sd_llc_shared, cpu));
+        if (sds) {
+                /*
+                 * If there is an imbalance between LLC domains (IOW we could
+                 * increase the overall cache use), we need some less-loaded LLC
+                 * domain to pull some load. Likewise, we may need to spread
+                 * load within the current LLC domain (e.g. packed SMT cores but
+                 * other CPUs are idle). We can't really know from here how busy
+                 * the others are - so just get a nohz balance going if it looks
+                 * like this LLC domain has tasks we could move.
+                 */
+                nr_busy = atomic_read(&sds->nr_busy_cpus);
+                if (nr_busy > 1) {
+                        flags = NOHZ_KICK_MASK;
+                        goto unlock;
+                }
+        }
 unlock:
         rcu_read_unlock();
 out:
diff --git a/kernel/signal.c b/kernel/signal.c
index 5d53183e2705..b7953934aa99 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -19,7 +19,9 @@
 #include <linux/sched/task.h>
 #include <linux/sched/task_stack.h>
 #include <linux/sched/cputime.h>
+#include <linux/file.h>
 #include <linux/fs.h>
+#include <linux/proc_fs.h>
 #include <linux/tty.h>
 #include <linux/binfmts.h>
 #include <linux/coredump.h>
@@ -3487,6 +3489,16 @@ COMPAT_SYSCALL_DEFINE4(rt_sigtimedwait_time32, compat_sigset_t __user *, uthese,
 #endif
 #endif
 
+static inline void prepare_kill_siginfo(int sig, struct kernel_siginfo *info)
+{
+        clear_siginfo(info);
+        info->si_signo = sig;
+        info->si_errno = 0;
+        info->si_code = SI_USER;
+        info->si_pid = task_tgid_vnr(current);
+        info->si_uid = from_kuid_munged(current_user_ns(), current_uid());
+}
+
 /**
  *  sys_kill - send a signal to a process
  *  @pid: the PID of the process
@@ -3496,16 +3508,125 @@ SYSCALL_DEFINE2(kill, pid_t, pid, int, sig)
 {
         struct kernel_siginfo info;
 
-        clear_siginfo(&info);
-        info.si_signo = sig;
-        info.si_errno = 0;
-        info.si_code = SI_USER;
-        info.si_pid = task_tgid_vnr(current);
-        info.si_uid = from_kuid_munged(current_user_ns(), current_uid());
+        prepare_kill_siginfo(sig, &info);
 
         return kill_something_info(sig, &info, pid);
 }
 
+#ifdef CONFIG_PROC_FS
+/*
+ * Verify that the signaler and signalee either are in the same pid namespace
+ * or that the signaler's pid namespace is an ancestor of the signalee's pid
+ * namespace.
+ */
+static bool access_pidfd_pidns(struct pid *pid)
+{
+        struct pid_namespace *active = task_active_pid_ns(current);
+        struct pid_namespace *p = ns_of_pid(pid);
+
+        for (;;) {
+                if (!p)
+                        return false;
+                if (p == active)
+                        break;
+                p = p->parent;
+        }
+
+        return true;
+}
+
+static int copy_siginfo_from_user_any(kernel_siginfo_t *kinfo, siginfo_t *info)
+{
+#ifdef CONFIG_COMPAT
+        /*
+         * Avoid hooking up compat syscalls and instead handle necessary
+         * conversions here. Note, this is a stop-gap measure and should not be
+         * considered a generic solution.
+         */
+        if (in_compat_syscall())
+                return copy_siginfo_from_user32(
+                        kinfo, (struct compat_siginfo __user *)info);
+#endif
+        return copy_siginfo_from_user(kinfo, info);
+}
+
+/**
+ * sys_pidfd_send_signal - send a signal to a process through a task file
+ *                          descriptor
+ * @pidfd:  the file descriptor of the process
+ * @sig:    signal to be sent
+ * @info:   the signal info
+ * @flags:  future flags to be passed
+ *
+ * The syscall currently only signals via PIDTYPE_PID which covers
+ * kill(<positive-pid>, <signal>. It does not signal threads or process
+ * groups.
+ * In order to extend the syscall to threads and process groups the @flags
+ * argument should be used. In essence, the @flags argument will determine
+ * what is signaled and not the file descriptor itself. Put in other words,
+ * grouping is a property of the flags argument not a property of the file
+ * descriptor.
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+SYSCALL_DEFINE4(pidfd_send_signal, int, pidfd, int, sig,
+                siginfo_t __user *, info, unsigned int, flags)
+{
+        int ret;
+        struct fd f;
+        struct pid *pid;
+        kernel_siginfo_t kinfo;
+
+        /* Enforce flags be set to 0 until we add an extension. */
+        if (flags)
+                return -EINVAL;
+
+        f = fdget_raw(pidfd);
+        if (!f.file)
+                return -EBADF;
+
+        /* Is this a pidfd? */
+        pid = tgid_pidfd_to_pid(f.file);
+        if (IS_ERR(pid)) {
+                ret = PTR_ERR(pid);
+                goto err;
+        }
+
+        ret = -EINVAL;
+        if (!access_pidfd_pidns(pid))
+                goto err;
+
+        if (info) {
+                ret = copy_siginfo_from_user_any(&kinfo, info);
+                if (unlikely(ret))
+                        goto err;
+
+                ret = -EINVAL;
+                if (unlikely(sig != kinfo.si_signo))
+                        goto err;
+
+                if ((task_pid(current) != pid) &&
+                    (kinfo.si_code >= 0 || kinfo.si_code == SI_TKILL)) {
+                        /* Only allow sending arbitrary signals to yourself. */
+                        ret = -EPERM;
+                        if (kinfo.si_code != SI_USER)
+                                goto err;
+
+                        /* Turn this into a regular kill signal. */
+                        prepare_kill_siginfo(sig, &kinfo);
+                }
+        } else {
+                prepare_kill_siginfo(sig, &kinfo);
+        }
+
+        ret = kill_pid_info(sig, &kinfo, pid);
+
+err:
+        fdput(f);
+        return ret;
+}
+#endif /* CONFIG_PROC_FS */
+
 static int
 do_send_specific(pid_t tgid, pid_t pid, int sig, struct kernel_siginfo *info)
 {
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index 51d7c6794bf1..d21f4befaea4 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -168,6 +168,7 @@ COND_SYSCALL(syslog);
 /* kernel/sched/core.c */
 
 /* kernel/signal.c */
+COND_SYSCALL(pidfd_send_signal);
 
 /* kernel/sys.c */
 COND_SYSCALL(setregid);
diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c
index dc1b6f1929f9..ac9c03dd6c7d 100644
--- a/kernel/time/jiffies.c
+++ b/kernel/time/jiffies.c
@@ -89,7 +89,7 @@ struct clocksource * __init __weak clocksource_default_clock(void)
         return &clocksource_jiffies;
 }
 
-struct clocksource refined_jiffies;
+static struct clocksource refined_jiffies;
 
 int register_refined_jiffies(long cycles_per_second)
 {
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index fac0ddf8a8e2..e1c6d79fb4cc 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -723,6 +723,7 @@ int blk_trace_ioctl(struct block_device *bdev, unsigned cmd, char __user *arg)
 #endif
         case BLKTRACESTART:
                 start = 1;
+                /* fall through */
         case BLKTRACESTOP:
                 ret = __blk_trace_startstop(q, start);
                 break;
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index fa79323331b2..26c8ca9bd06b 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -1992,7 +1992,7 @@ static void print_bug_type(void)
  * modifying the code. @failed should be one of either:
  * EFAULT - if the problem happens on reading the @ip address
  * EINVAL - if what is read at @ip is not what was expected
- * EPERM - if the problem happens on writting to the @ip address
+ * EPERM - if the problem happens on writing to the @ip address
  */
 void ftrace_bug(int failed, struct dyn_ftrace *rec)
 {
@@ -2391,7 +2391,7 @@ __ftrace_replace_code(struct dyn_ftrace *rec, int enable)
                 return ftrace_modify_call(rec, ftrace_old_addr, ftrace_addr);
         }
 
-        return -1; /* unknow ftrace bug */
+        return -1; /* unknown ftrace bug */
 }
 
 void __weak ftrace_replace_code(int mod_flags)
@@ -3004,7 +3004,7 @@ ftrace_allocate_pages(unsigned long num_to_init)
         int cnt;
 
         if (!num_to_init)
-                return 0;
+                return NULL;
 
         start_pg = pg = kzalloc(sizeof(*pg), GFP_KERNEL);
         if (!pg)
@@ -4755,7 +4755,7 @@ static int
 ftrace_set_addr(struct ftrace_ops *ops, unsigned long ip, int remove,
                 int reset, int enable)
 {
-        return ftrace_set_hash(ops, 0, 0, ip, remove, reset, enable);
+        return ftrace_set_hash(ops, NULL, 0, ip, remove, reset, enable);
 }
 
 /**
@@ -5463,7 +5463,7 @@ void ftrace_create_filter_files(struct ftrace_ops *ops,
 
 /*
  * The name "destroy_filter_files" is really a misnomer. Although
- * in the future, it may actualy delete the files, but this is
+ * in the future, it may actually delete the files, but this is
  * really intended to make sure the ops passed in are disabled
  * and that when this function returns, the caller is free to
  * free the ops.
@@ -5786,7 +5786,7 @@ void ftrace_module_enable(struct module *mod)
         /*
          * If the tracing is enabled, go ahead and enable the record.
          *
-         * The reason not to enable the record immediatelly is the
+         * The reason not to enable the record immediately is the
          * inherent check of ftrace_make_nop/ftrace_make_call for
          * correct previous instructions.  Making first the NOP
          * conversion puts the module to the correct state, thus
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 9a91479bbbfe..41b6f96e5366 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -4191,6 +4191,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume);
  * ring_buffer_read_prepare - Prepare for a non consuming read of the buffer
  * @buffer: The ring buffer to read from
  * @cpu: The cpu buffer to iterate over
+ * @flags: gfp flags to use for memory allocation
  *
  * This performs the initial preparations necessary to iterate
  * through the buffer.  Memory is allocated, buffer recording
@@ -4208,7 +4209,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume);
  * This overall must be paired with ring_buffer_read_finish.
  */
 struct ring_buffer_iter *
-ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu)
+ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu, gfp_t flags)
 {
         struct ring_buffer_per_cpu *cpu_buffer;
         struct ring_buffer_iter *iter;
@@ -4216,7 +4217,7 @@ ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu)
         if (!cpumask_test_cpu(cpu, buffer->cpumask))
                 return NULL;
 
-        iter = kmalloc(sizeof(*iter), GFP_KERNEL);
+        iter = kmalloc(sizeof(*iter), flags);
         if (!iter)
                 return NULL;
 
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 94ffc1c559d5..21153e64bf1c 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -4079,7 +4079,8 @@ __tracing_open(struct inode *inode, struct file *file, bool snapshot)
         if (iter->cpu_file == RING_BUFFER_ALL_CPUS) {
                 for_each_tracing_cpu(cpu) {
                         iter->buffer_iter[cpu] =
-                                ring_buffer_read_prepare(iter->trace_buffer->buffer, cpu);
+                                ring_buffer_read_prepare(iter->trace_buffer->buffer,
+                                                         cpu, GFP_KERNEL);
                 }
                 ring_buffer_read_prepare_sync();
                 for_each_tracing_cpu(cpu) {
@@ -4089,7 +4090,8 @@ __tracing_open(struct inode *inode, struct file *file, bool snapshot)
         } else {
                 cpu = iter->cpu_file;
                 iter->buffer_iter[cpu] =
-                        ring_buffer_read_prepare(iter->trace_buffer->buffer, cpu);
+                        ring_buffer_read_prepare(iter->trace_buffer->buffer,
+                                                 cpu, GFP_KERNEL);
                 ring_buffer_read_prepare_sync();
                 ring_buffer_read_start(iter->buffer_iter[cpu]);
                 tracing_iter_reset(iter, cpu);
diff --git a/kernel/trace/trace_dynevent.c b/kernel/trace/trace_dynevent.c
index dd1f43588d70..fa100ed3b4de 100644
--- a/kernel/trace/trace_dynevent.c
+++ b/kernel/trace/trace_dynevent.c
@@ -74,7 +74,7 @@ int dyn_event_release(int argc, char **argv, struct dyn_event_operations *type)
 static int create_dyn_event(int argc, char **argv)
 {
         struct dyn_event_operations *ops;
-        int ret;
+        int ret = -ENODEV;
 
         if (argv[0][0] == '-' || argv[0][0] == '!')
                 return dyn_event_release(argc, argv, NULL);
diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index ca46339f3009..795aa2038377 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -3713,7 +3713,6 @@ static void track_data_destroy(struct hist_trigger_data *hist_data,
         struct trace_event_file *file = hist_data->event_file;
 
         destroy_hist_field(data->track_data.track_var, 0);
-        destroy_hist_field(data->track_data.var_ref, 0);
 
         if (data->action == ACTION_SNAPSHOT) {
                 struct track_data *track_data;
diff --git a/kernel/trace/trace_kdb.c b/kernel/trace/trace_kdb.c
index d953c163a079..810d78a8d14c 100644
--- a/kernel/trace/trace_kdb.c
+++ b/kernel/trace/trace_kdb.c
@@ -51,14 +51,16 @@ static void ftrace_dump_buf(int skip_lines, long cpu_file)
         if (cpu_file == RING_BUFFER_ALL_CPUS) {
                 for_each_tracing_cpu(cpu) {
                         iter.buffer_iter[cpu] =
-                        ring_buffer_read_prepare(iter.trace_buffer->buffer, cpu);
+                        ring_buffer_read_prepare(iter.trace_buffer->buffer,
+                                                 cpu, GFP_ATOMIC);
                         ring_buffer_read_start(iter.buffer_iter[cpu]);
                         tracing_iter_reset(&iter, cpu);
                 }
         } else {
                 iter.cpu_file = cpu_file;
                 iter.buffer_iter[cpu_file] =
-                        ring_buffer_read_prepare(iter.trace_buffer->buffer, cpu_file);
+                        ring_buffer_read_prepare(iter.trace_buffer->buffer,
+                                                 cpu_file, GFP_ATOMIC);
                 ring_buffer_read_start(iter.buffer_iter[cpu_file]);
                 tracing_iter_reset(&iter, cpu_file);
         }
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 99592c27465e..5d5129b05df7 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -35,7 +35,7 @@ static struct dyn_event_operations trace_kprobe_ops = {
         .match = trace_kprobe_match,
 };
 
-/**
+/*
  * Kprobe event core functions
  */
 struct trace_kprobe {
@@ -221,7 +221,7 @@ static struct trace_kprobe *alloc_trace_kprobe(const char *group,
 
         tk->rp.maxactive = maxactive;
 
-        if (!event || !is_good_name(event)) {
+        if (!event || !group) {
                 ret = -EINVAL;
                 goto error;
         }
@@ -231,11 +231,6 @@ static struct trace_kprobe *alloc_trace_kprobe(const char *group,
         if (!tk->tp.call.name)
                 goto error;
 
-        if (!group || !is_good_name(group)) {
-                ret = -EINVAL;
-                goto error;
-        }
-
         tk->tp.class.system = kstrdup(group, GFP_KERNEL);
         if (!tk->tp.class.system)
                 goto error;
@@ -624,7 +619,11 @@ static int trace_kprobe_create(int argc, const char *argv[])
         if (event)
                 event++;
 
-        if (is_return && isdigit(argv[0][1])) {
+        if (isdigit(argv[0][1])) {
+                if (!is_return) {
+                        pr_info("Maxactive is not for kprobe");
+                        return -EINVAL;
+                }
                 if (event)
                         len = event - &argv[0][1] - 1;
                 else
@@ -634,8 +633,8 @@ static int trace_kprobe_create(int argc, const char *argv[])
                 memcpy(buf, &argv[0][1], len);
                 buf[len] = '\0';
                 ret = kstrtouint(buf, 0, &maxactive);
-                if (ret) {
-                        pr_info("Failed to parse maxactive.\n");
+                if (ret || !maxactive) {
+                        pr_info("Invalid maxactive number\n");
                         return ret;
                 }
                 /* kretprobes instances are iterated over via a list. The
@@ -694,9 +693,9 @@ static int trace_kprobe_create(int argc, const char *argv[])
         tk = alloc_trace_kprobe(group, event, addr, symbol, offset, maxactive,
                                argc, is_return);
         if (IS_ERR(tk)) {
-                pr_info("Failed to allocate trace_probe.(%d)\n",
-                        (int)PTR_ERR(tk));
                 ret = PTR_ERR(tk);
+                /* This must return -ENOMEM otherwise there is a bug */
+                WARN_ON_ONCE(ret != -ENOMEM);
                 goto out;
         }
 
diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
index 89da34b326e3..8f8411e7835f 100644
--- a/kernel/trace/trace_probe.c
+++ b/kernel/trace/trace_probe.c
@@ -13,7 +13,7 @@
 
 #include "trace_probe.h"
 
-const char *reserved_field_names[] = {
+static const char *reserved_field_names[] = {
         "common_type",
         "common_flags",
         "common_preempt_count",
@@ -159,6 +159,7 @@ int traceprobe_parse_event_name(const char **pevent, const char **pgroup,
                                 char *buf)
 {
         const char *slash, *event = *pevent;
+        int len;
 
         slash = strchr(event, '/');
         if (slash) {
@@ -171,12 +172,25 @@ int traceprobe_parse_event_name(const char **pevent, const char **pgroup,
                         return -E2BIG;
                 }
                 strlcpy(buf, event, slash - event + 1);
+                if (!is_good_name(buf)) {
+                        pr_info("Group name must follow the same rules as C identifiers\n");
+                        return -EINVAL;
+                }
                 *pgroup = buf;
                 *pevent = slash + 1;
+                event = *pevent;
         }
-        if (strlen(event) == 0) {
+        len = strlen(event);
+        if (len == 0) {
                 pr_info("Event name is not specified\n");
                 return -EINVAL;
+        } else if (len > MAX_EVENT_NAME_LEN) {
+                pr_info("Event name is too long\n");
+                return -E2BIG;
+        }
+        if (!is_good_name(event)) {
+                pr_info("Event name must follow the same rules as C identifiers\n");
+                return -EINVAL;
         }
         return 0;
 }
@@ -548,6 +562,8 @@ int traceprobe_parse_probe_arg(struct trace_probe *tp, int i, char *arg,
 
         body = strchr(arg, '=');
         if (body) {
+                if (body - arg > MAX_ARG_NAME_LEN || body == arg)
+                        return -EINVAL;
                 parg->name = kmemdup_nul(arg, body - arg, GFP_KERNEL);
                 body++;
         } else {
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index 8a63f8bc01bc..2177c206de15 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -32,6 +32,7 @@
 #define MAX_TRACE_ARGS          128
 #define MAX_ARGSTR_LEN          63
 #define MAX_ARRAY_LEN           64
+#define MAX_ARG_NAME_LEN        32
 #define MAX_STRING_SIZE         PATH_MAX
 
 /* Reserved field names */
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index 9bde07c06362..be78d99ee6bc 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -273,10 +273,7 @@ alloc_trace_uprobe(const char *group, const char *event, int nargs, bool is_ret)
 {
         struct trace_uprobe *tu;
 
-        if (!event || !is_good_name(event))
-                return ERR_PTR(-EINVAL);
-
-        if (!group || !is_good_name(group))
+        if (!event || !group)
                 return ERR_PTR(-EINVAL);
 
         tu = kzalloc(SIZEOF_TRACE_UPROBE(nargs), GFP_KERNEL);
@@ -524,8 +521,9 @@ static int trace_uprobe_create(int argc, const char **argv)
 
         tu = alloc_trace_uprobe(group, event, argc, is_return);
         if (IS_ERR(tu)) {
-                pr_info("Failed to allocate trace_uprobe.(%d)\n", (int)PTR_ERR(tu));
                 ret = PTR_ERR(tu);
+                /* This must return -ENOMEM otherwise there is a bug */
+                WARN_ON_ONCE(ret != -ENOMEM);
                 goto fail_address_parse;
         }
         tu->offset = offset;
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 8fbfda94a67b..403c9bd90413 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -42,9 +42,9 @@ int __read_mostly watchdog_user_enabled = 1;
 int __read_mostly nmi_watchdog_user_enabled = NMI_WATCHDOG_DEFAULT;
 int __read_mostly soft_watchdog_user_enabled = 1;
 int __read_mostly watchdog_thresh = 10;
-int __read_mostly nmi_watchdog_available;
+static int __read_mostly nmi_watchdog_available;
 
-struct cpumask watchdog_allowed_mask __read_mostly;
+static struct cpumask watchdog_allowed_mask __read_mostly;
 
 struct cpumask watchdog_cpumask __read_mostly;
 unsigned long *watchdog_cpumask_bits = cpumask_bits(&watchdog_cpumask);
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 4026d1871407..ddee541ea97a 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -4266,7 +4266,7 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,
         INIT_LIST_HEAD(&wq->list);
 
         if (alloc_and_link_pwqs(wq) < 0)
-                goto err_free_wq;
+                goto err_unreg_lockdep;
 
         if (wq_online && init_rescuer(wq) < 0)
                 goto err_destroy;
@@ -4292,9 +4292,10 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,
 
         return wq;
 
-err_free_wq:
+err_unreg_lockdep:
         wq_unregister_lockdep(wq);
         wq_free_lockdep(wq);
+err_free_wq:
         free_workqueue_attrs(wq->unbound_attrs);
         kfree(wq);
         return NULL;
diff --git a/lib/Makefile b/lib/Makefile
index 4e066120a0d6..3b08673e8881 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -213,7 +213,7 @@ KCOV_INSTRUMENT_stackdepot.o := n
 libfdt_files = fdt.o fdt_ro.o fdt_wip.o fdt_rw.o fdt_sw.o fdt_strerror.o \
                fdt_empty_tree.o
 $(foreach file, $(libfdt_files), \
-        $(eval CFLAGS_$(file) = -I$(src)/../scripts/dtc/libfdt))
+        $(eval CFLAGS_$(file) = -I $(srctree)/scripts/dtc/libfdt))
 lib-$(CONFIG_LIBFDT) += $(libfdt_files)
 
 obj-$(CONFIG_RBTREE_TEST) += rbtree_test.o
diff --git a/lib/raid6/Makefile b/lib/raid6/Makefile
index 4e90d443d1b0..e723eacf7868 100644
--- a/lib/raid6/Makefile
+++ b/lib/raid6/Makefile
@@ -39,7 +39,7 @@ endif
 ifeq ($(CONFIG_KERNEL_MODE_NEON),y)
 NEON_FLAGS := -ffreestanding
 ifeq ($(ARCH),arm)
-NEON_FLAGS += -mfloat-abi=softfp -mfpu=neon
+NEON_FLAGS += -march=armv7-a -mfloat-abi=softfp -mfpu=neon
 endif
 CFLAGS_recov_neon_inner.o += $(NEON_FLAGS)
 ifeq ($(ARCH),arm64)
diff --git a/mm/filemap.c b/mm/filemap.c
index ec6566ffbd90..d78f577baef2 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1587,6 +1587,9 @@ EXPORT_SYMBOL(find_lock_entry);
  *   @gfp_mask and added to the page cache and the VM's LRU
  *   list. The page is returned locked and with an increased
  *   refcount.
+ * - FGP_FOR_MMAP: Similar to FGP_CREAT, only we want to allow the caller to do
+ *   its own locking dance if the page is already in cache, or unlock the page
+ *   before returning if we had to add the page to pagecache.
  *
  * If FGP_LOCK or FGP_CREAT are specified then the function may sleep even
  * if the GFP flags specified for FGP_CREAT are atomic.
@@ -1641,7 +1644,7 @@ no_page:
                 if (!page)
                         return NULL;
 
-                if (WARN_ON_ONCE(!(fgp_flags & FGP_LOCK)))
+                if (WARN_ON_ONCE(!(fgp_flags & (FGP_LOCK | FGP_FOR_MMAP))))
                         fgp_flags |= FGP_LOCK;
 
                 /* Init accessed so avoid atomic mark_page_accessed later */
@@ -1655,6 +1658,13 @@ no_page:
                         if (err == -EEXIST)
                                 goto repeat;
                 }
+
+                /*
+                 * add_to_page_cache_lru locks the page, and for mmap we expect
+                 * an unlocked page.
+                 */
+                if (page && (fgp_flags & FGP_FOR_MMAP))
+                        unlock_page(page);
         }
 
         return page;
@@ -2379,64 +2389,98 @@ out:
 EXPORT_SYMBOL(generic_file_read_iter);
 
 #ifdef CONFIG_MMU
-/**
- * page_cache_read - adds requested page to the page cache if not already there
- * @file:       file to read
- * @offset:     page index
- * @gfp_mask:   memory allocation flags
- *
- * This adds the requested page to the page cache if it isn't already there,
- * and schedules an I/O to read in its contents from disk.
- *
- * Return: %0 on success, negative error code otherwise.
- */
-static int page_cache_read(struct file *file, pgoff_t offset, gfp_t gfp_mask)
+#define MMAP_LOTSAMISS  (100)
+static struct file *maybe_unlock_mmap_for_io(struct vm_fault *vmf,
+                                             struct file *fpin)
 {
-        struct address_space *mapping = file->f_mapping;
-        struct page *page;
-        int ret;
+        int flags = vmf->flags;
 
-        do {
-                page = __page_cache_alloc(gfp_mask);
-                if (!page)
-                        return -ENOMEM;
+        if (fpin)
+                return fpin;
 
-                ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
-                if (ret == 0)
-                        ret = mapping->a_ops->readpage(file, page);
-                else if (ret == -EEXIST)
-                        ret = 0; /* losing race to add is OK */
+        /*
+         * FAULT_FLAG_RETRY_NOWAIT means we don't want to wait on page locks or
+         * anything, so we only pin the file and drop the mmap_sem if only
+         * FAULT_FLAG_ALLOW_RETRY is set.
+         */
+        if ((flags & (FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_RETRY_NOWAIT)) ==
+            FAULT_FLAG_ALLOW_RETRY) {
+                fpin = get_file(vmf->vma->vm_file);
+                up_read(&vmf->vma->vm_mm->mmap_sem);
+        }
+        return fpin;
+}
 
-                put_page(page);
+/*
+ * lock_page_maybe_drop_mmap - lock the page, possibly dropping the mmap_sem
+ * @vmf - the vm_fault for this fault.
+ * @page - the page to lock.
+ * @fpin - the pointer to the file we may pin (or is already pinned).
+ *
+ * This works similar to lock_page_or_retry in that it can drop the mmap_sem.
+ * It differs in that it actually returns the page locked if it returns 1 and 0
+ * if it couldn't lock the page.  If we did have to drop the mmap_sem then fpin
+ * will point to the pinned file and needs to be fput()'ed at a later point.
+ */
+static int lock_page_maybe_drop_mmap(struct vm_fault *vmf, struct page *page,
+                                     struct file **fpin)
+{
+        if (trylock_page(page))
+                return 1;
 
-        } while (ret == AOP_TRUNCATED_PAGE);
+        /*
+         * NOTE! This will make us return with VM_FAULT_RETRY, but with
+         * the mmap_sem still held. That's how FAULT_FLAG_RETRY_NOWAIT
+         * is supposed to work. We have way too many special cases..
+         */
+        if (vmf->flags & FAULT_FLAG_RETRY_NOWAIT)
+                return 0;
 
-        return ret;
+        *fpin = maybe_unlock_mmap_for_io(vmf, *fpin);
+        if (vmf->flags & FAULT_FLAG_KILLABLE) {
+                if (__lock_page_killable(page)) {
+                        /*
+                         * We didn't have the right flags to drop the mmap_sem,
+                         * but all fault_handlers only check for fatal signals
+                         * if we return VM_FAULT_RETRY, so we need to drop the
+                         * mmap_sem here and return 0 if we don't have a fpin.
+                         */
+                        if (*fpin == NULL)
+                                up_read(&vmf->vma->vm_mm->mmap_sem);
+                        return 0;
+                }
+        } else
+                __lock_page(page);
+        return 1;
 }
 
-#define MMAP_LOTSAMISS  (100)
 
 /*
- * Synchronous readahead happens when we don't even find
- * a page in the page cache at all.
+ * Synchronous readahead happens when we don't even find a page in the page
+ * cache at all.  We don't want to perform IO under the mmap sem, so if we have
+ * to drop the mmap sem we return the file that was pinned in order for us to do
+ * that.  If we didn't pin a file then we return NULL.  The file that is
+ * returned needs to be fput()'ed when we're done with it.
  */
-static void do_sync_mmap_readahead(struct vm_fault *vmf)
+static struct file *do_sync_mmap_readahead(struct vm_fault *vmf)
 {
         struct file *file = vmf->vma->vm_file;
         struct file_ra_state *ra = &file->f_ra;
         struct address_space *mapping = file->f_mapping;
+        struct file *fpin = NULL;
         pgoff_t offset = vmf->pgoff;
 
         /* If we don't want any read-ahead, don't bother */
         if (vmf->vma->vm_flags & VM_RAND_READ)
-                return;
+                return fpin;
         if (!ra->ra_pages)
-                return;
+                return fpin;
 
         if (vmf->vma->vm_flags & VM_SEQ_READ) {
+                fpin = maybe_unlock_mmap_for_io(vmf, fpin);
                 page_cache_sync_readahead(mapping, ra, file, offset,
                                           ra->ra_pages);
-                return;
+                return fpin;
         }
 
         /* Avoid banging the cache line if not needed */
@@ -2448,37 +2492,44 @@ static void do_sync_mmap_readahead(struct vm_fault *vmf)
          * stop bothering with read-ahead. It will only hurt.
          */
         if (ra->mmap_miss > MMAP_LOTSAMISS)
-                return;
+                return fpin;
 
         /*
          * mmap read-around
          */
+        fpin = maybe_unlock_mmap_for_io(vmf, fpin);
         ra->start = max_t(long, 0, offset - ra->ra_pages / 2);
         ra->size = ra->ra_pages;
         ra->async_size = ra->ra_pages / 4;
         ra_submit(ra, mapping, file);
+        return fpin;
 }
 
 /*
  * Asynchronous readahead happens when we find the page and PG_readahead,
- * so we want to possibly extend the readahead further..
+ * so we want to possibly extend the readahead further.  We return the file that
+ * was pinned if we have to drop the mmap_sem in order to do IO.
  */
-static void do_async_mmap_readahead(struct vm_fault *vmf,
-                                    struct page *page)
+static struct file *do_async_mmap_readahead(struct vm_fault *vmf,
+                                            struct page *page)
 {
         struct file *file = vmf->vma->vm_file;
         struct file_ra_state *ra = &file->f_ra;
         struct address_space *mapping = file->f_mapping;
+        struct file *fpin = NULL;
         pgoff_t offset = vmf->pgoff;
 
         /* If we don't want any read-ahead, don't bother */
         if (vmf->vma->vm_flags & VM_RAND_READ)
-                return;
+                return fpin;
         if (ra->mmap_miss > 0)
                 ra->mmap_miss--;
-        if (PageReadahead(page))
+        if (PageReadahead(page)) {
+                fpin = maybe_unlock_mmap_for_io(vmf, fpin);
                 page_cache_async_readahead(mapping, ra, file,
                                            page, offset, ra->ra_pages);
+        }
+        return fpin;
 }
 
 /**
@@ -2510,6 +2561,7 @@ vm_fault_t filemap_fault(struct vm_fault *vmf)
 {
         int error;
         struct file *file = vmf->vma->vm_file;
+        struct file *fpin = NULL;
         struct address_space *mapping = file->f_mapping;
         struct file_ra_state *ra = &file->f_ra;
         struct inode *inode = mapping->host;
@@ -2531,23 +2583,26 @@ vm_fault_t filemap_fault(struct vm_fault *vmf)
                  * We found the page, so try async readahead before
                  * waiting for the lock.
                  */
-                do_async_mmap_readahead(vmf, page);
+                fpin = do_async_mmap_readahead(vmf, page);
         } else if (!page) {
                 /* No page in the page cache at all */
-                do_sync_mmap_readahead(vmf);
                 count_vm_event(PGMAJFAULT);
                 count_memcg_event_mm(vmf->vma->vm_mm, PGMAJFAULT);
                 ret = VM_FAULT_MAJOR;
+                fpin = do_sync_mmap_readahead(vmf);
 retry_find:
-                page = find_get_page(mapping, offset);
-                if (!page)
-                        goto no_cached_page;
+                page = pagecache_get_page(mapping, offset,
+                                          FGP_CREAT|FGP_FOR_MMAP,
+                                          vmf->gfp_mask);
+                if (!page) {
+                        if (fpin)
+                                goto out_retry;
+                        return vmf_error(-ENOMEM);
+                }
         }
 
-        if (!lock_page_or_retry(page, vmf->vma->vm_mm, vmf->flags)) {
-                put_page(page);
-                return ret | VM_FAULT_RETRY;
-        }
+        if (!lock_page_maybe_drop_mmap(vmf, page, &fpin))
+                goto out_retry;
 
         /* Did it get truncated? */
         if (unlikely(page->mapping != mapping)) {
@@ -2565,6 +2620,16 @@ retry_find:
                 goto page_not_uptodate;
 
         /*
+         * We've made it this far and we had to drop our mmap_sem, now is the
+         * time to return to the upper layer and have it re-find the vma and
+         * redo the fault.
+         */
+        if (fpin) {
+                unlock_page(page);
+                goto out_retry;
+        }
+
+        /*
          * Found the page and have a reference on it.
          * We must recheck i_size under page lock.
          */
@@ -2578,28 +2643,6 @@ retry_find:
         vmf->page = page;
         return ret | VM_FAULT_LOCKED;
 
-no_cached_page:
-        /*
-         * We're only likely to ever get here if MADV_RANDOM is in
-         * effect.
-         */
-        error = page_cache_read(file, offset, vmf->gfp_mask);
-
-        /*
-         * The page we want has now been added to the page cache.
-         * In the unlikely event that someone removed it in the
-         * meantime, we'll just come back here and read it again.
-         */
-        if (error >= 0)
-                goto retry_find;
-
-        /*
-         * An error return from page_cache_read can result if the
-         * system is low on memory, or a problem occurs while trying
-         * to schedule I/O.
-         */
-        return vmf_error(error);
-
 page_not_uptodate:
         /*
          * Umm, take care of errors if the page isn't up-to-date.
@@ -2608,12 +2651,15 @@ page_not_uptodate:
          * and we need to check for errors.
          */
         ClearPageError(page);
+        fpin = maybe_unlock_mmap_for_io(vmf, fpin);
         error = mapping->a_ops->readpage(file, page);
         if (!error) {
                 wait_on_page_locked(page);
                 if (!PageUptodate(page))
                         error = -EIO;
         }
+        if (fpin)
+                goto out_retry;
         put_page(page);
 
         if (!error || error == AOP_TRUNCATED_PAGE)
@@ -2622,6 +2668,18 @@ page_not_uptodate:
         /* Things didn't work out. Return zero to tell the mm layer so. */
         shrink_readahead_size_eio(file, ra);
         return VM_FAULT_SIGBUS;
+
+out_retry:
+        /*
+         * We dropped the mmap_sem, we need to return to the fault handler to
+         * re-find the vma and come back and find our hopefully still populated
+         * page.
+         */
+        if (page)
+                put_page(page);
+        if (fpin)
+                fput(fpin);
+        return ret | VM_FAULT_RETRY;
 }
 EXPORT_SYMBOL(filemap_fault);
 
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index cd23c081924d..f767582af4f8 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -101,28 +101,24 @@ u64 max_mem_size = U64_MAX;
 /* add this memory to iomem resource */
 static struct resource *register_memory_resource(u64 start, u64 size)
 {
-        struct resource *res, *conflict;
+        struct resource *res;
+        unsigned long flags =  IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY;
+        char *resource_name = "System RAM";
 
         if (start + size > max_mem_size)
                 return ERR_PTR(-E2BIG);
 
-        res = kzalloc(sizeof(struct resource), GFP_KERNEL);
-        if (!res)
-                return ERR_PTR(-ENOMEM);
-
-        res->name = "System RAM";
-        res->start = start;
-        res->end = start + size - 1;
-        res->flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY;
-        conflict =  request_resource_conflict(&iomem_resource, res);
-        if (conflict) {
-                if (conflict->desc == IORES_DESC_DEVICE_PRIVATE_MEMORY) {
-                        pr_debug("Device unaddressable memory block "
-                                 "memory hotplug at %#010llx !\n",
-                                 (unsigned long long)start);
-                }
-                pr_debug("System RAM resource %pR cannot be added\n", res);
-                kfree(res);
+        /*
+         * Request ownership of the new memory range.  This might be
+         * a child of an existing resource that was present but
+         * not marked as busy.
+         */
+        res = __request_region(&iomem_resource, start, size,
+                               resource_name, flags);
+
+        if (!res) {
+                pr_debug("Unable to reserve System RAM region: %016llx->%016llx\n",
+                                start, start + size);
                 return ERR_PTR(-EEXIST);
         }
         return res;
diff --git a/net/9p/client.c b/net/9p/client.c
index 357214a51f13..b85d51f4b8eb 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -1061,7 +1061,7 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
                 p9_debug(P9_DEBUG_ERROR,
                          "Please specify a msize of at least 4k\n");
                 err = -EINVAL;
-                goto free_client;
+                goto close_trans;
         }
 
         err = p9_client_version(clnt);
diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
index e2fbf3677b9b..29420ebb8f07 100644
--- a/net/9p/trans_xen.c
+++ b/net/9p/trans_xen.c
@@ -513,7 +513,7 @@ static void xen_9pfs_front_changed(struct xenbus_device *dev,
         case XenbusStateClosed:
                 if (dev->state == XenbusStateClosed)
                         break;
-                /* Missed the backend's CLOSING state -- fallthrough */
+                /* fall through - Missed the backend's CLOSING state */
         case XenbusStateClosing:
                 xenbus_frontend_closed(dev);
                 break;
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index 9cab80207ced..79eac465ec65 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -738,7 +738,6 @@ int __ceph_open_session(struct ceph_client *client, unsigned long started)
 }
 EXPORT_SYMBOL(__ceph_open_session);
 
-
 int ceph_open_session(struct ceph_client *client)
 {
         int ret;
@@ -754,6 +753,23 @@ int ceph_open_session(struct ceph_client *client)
 }
 EXPORT_SYMBOL(ceph_open_session);
 
+int ceph_wait_for_latest_osdmap(struct ceph_client *client,
+                                unsigned long timeout)
+{
+        u64 newest_epoch;
+        int ret;
+
+        ret = ceph_monc_get_version(&client->monc, "osdmap", &newest_epoch);
+        if (ret)
+                return ret;
+
+        if (client->osdc.osdmap->epoch >= newest_epoch)
+                return 0;
+
+        ceph_osdc_maybe_request_map(&client->osdc);
+        return ceph_monc_wait_osdmap(&client->monc, newest_epoch, timeout);
+}
+EXPORT_SYMBOL(ceph_wait_for_latest_osdmap);
 
 static int __init init_ceph_lib(void)
 {
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 18deb3d889c4..a53e4fbb6319 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -922,6 +922,15 @@ int ceph_monc_blacklist_add(struct ceph_mon_client *monc,
         mutex_unlock(&monc->mutex);
 
         ret = wait_generic_request(req);
+        if (!ret)
+                /*
+                 * Make sure we have the osdmap that includes the blacklist
+                 * entry.  This is needed to ensure that the OSDs pick up the
+                 * new blacklist before processing any future requests from
+                 * this client.
+                 */
+                ret = ceph_wait_for_latest_osdmap(monc->client, 0);
+
 out:
         put_generic_request(req);
         return ret;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 4216fe33204a..187d10443a15 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1730,7 +1730,12 @@ call_allocate(struct rpc_task *task)
         req->rq_callsize = RPC_CALLHDRSIZE + (auth->au_cslack << 1) +
                            proc->p_arglen;
         req->rq_callsize <<= 2;
-        req->rq_rcvsize = RPC_REPHDRSIZE + auth->au_rslack + proc->p_replen;
+        /*
+         * Note: the reply buffer must at minimum allocate enough space
+         * for the 'struct accepted_reply' from RFC5531.
+         */
+        req->rq_rcvsize = RPC_REPHDRSIZE + auth->au_rslack + \
+                        max_t(size_t, proc->p_replen, 2);
         req->rq_rcvsize <<= 2;
 
         status = xprt->ops->buf_alloc(task);
@@ -2306,6 +2311,15 @@ out_exit:
         rpc_exit(task, status);
 }
 
+static bool
+rpc_check_connected(const struct rpc_rqst *req)
+{
+        /* No allocated request or transport? return true */
+        if (!req || !req->rq_xprt)
+                return true;
+        return xprt_connected(req->rq_xprt);
+}
+
 static void
 rpc_check_timeout(struct rpc_task *task)
 {
@@ -2317,10 +2331,11 @@ rpc_check_timeout(struct rpc_task *task)
         dprintk("RPC: %5u call_timeout (major)\n", task->tk_pid);
         task->tk_timeouts++;
 
-        if (RPC_IS_SOFTCONN(task)) {
+        if (RPC_IS_SOFTCONN(task) && !rpc_check_connected(task->tk_rqstp)) {
                 rpc_exit(task, -ETIMEDOUT);
                 return;
         }
+
         if (RPC_IS_SOFT(task)) {
                 if (clnt->cl_chatty) {
                         printk(KERN_NOTICE "%s: server %s not responding, timed out\n",
@@ -2387,9 +2402,6 @@ call_decode(struct rpc_task *task)
         WARN_ON(memcmp(&req->rq_rcv_buf, &req->rq_private_buf,
                                 sizeof(req->rq_rcv_buf)) != 0);
 
-        if (req->rq_rcv_buf.len < 12)
-                goto out_retry;
-
         xdr_init_decode(&xdr, &req->rq_rcv_buf,
                         req->rq_rcv_buf.head[0].iov_base, req);
         switch (rpc_decode_header(task, &xdr)) {
@@ -2400,7 +2412,6 @@ call_decode(struct rpc_task *task)
                         task->tk_pid, __func__, task->tk_status);
                 return;
         case -EAGAIN:
-out_retry:
                 task->tk_status = 0;
                 /* Note: rpc_decode_header() may have freed the RPC slot */
                 if (task->tk_rqstp == req) {
@@ -2449,7 +2460,7 @@ static noinline int
 rpc_decode_header(struct rpc_task *task, struct xdr_stream *xdr)
 {
         struct rpc_clnt *clnt = task->tk_client;
-        int error = -EACCES;
+        int error;
         __be32 *p;
 
         /* RFC-1014 says that the representation of XDR data must be a
@@ -2458,7 +2469,7 @@ rpc_decode_header(struct rpc_task *task, struct xdr_stream *xdr)
          *   undefined results
          */
         if (task->tk_rqstp->rq_rcv_buf.len & 3)
-                goto out_badlen;
+                goto out_unparsable;
 
         p = xdr_inline_decode(xdr, 3 * sizeof(*p));
         if (!p)
@@ -2492,10 +2503,12 @@ rpc_decode_header(struct rpc_task *task, struct xdr_stream *xdr)
                 error = -EOPNOTSUPP;
                 goto out_err;
         case rpc_garbage_args:
+        case rpc_system_err:
                 trace_rpc__garbage_args(task);
+                error = -EIO;
                 break;
         default:
-                trace_rpc__unparsable(task);
+                goto out_unparsable;
         }
 
 out_garbage:
@@ -2509,11 +2522,6 @@ out_err:
         rpc_exit(task, error);
         return error;
 
-out_badlen:
-        trace_rpc__unparsable(task);
-        error = -EIO;
-        goto out_err;
-
 out_unparsable:
         trace_rpc__unparsable(task);
         error = -EIO;
@@ -2524,6 +2532,7 @@ out_verifier:
         goto out_garbage;
 
 out_msg_denied:
+        error = -EACCES;
         p = xdr_inline_decode(xdr, sizeof(*p));
         if (!p)
                 goto out_unparsable;
@@ -2535,9 +2544,7 @@ out_msg_denied:
                 error = -EPROTONOSUPPORT;
                 goto out_err;
         default:
-                trace_rpc__unparsable(task);
-                error = -EIO;
-                goto out_err;
+                goto out_unparsable;
         }
 
         p = xdr_inline_decode(xdr, sizeof(*p));
@@ -2572,8 +2579,7 @@ out_msg_denied:
                         task->tk_xprt->servername);
                 break;
         default:
-                trace_rpc__unparsable(task);
-                error = -EIO;
+                goto out_unparsable;
         }
         goto out_err;
 }
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index e096c5a725df..d7117d241460 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -664,7 +664,7 @@ void xprt_disconnect_done(struct rpc_xprt *xprt)
         spin_lock_bh(&xprt->transport_lock);
         xprt_clear_connected(xprt);
         xprt_clear_write_space_locked(xprt);
-        xprt_wake_pending_tasks(xprt, -EAGAIN);
+        xprt_wake_pending_tasks(xprt, -ENOTCONN);
         spin_unlock_bh(&xprt->transport_lock);
 }
 EXPORT_SYMBOL_GPL(xprt_disconnect_done);
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 42f45d33dc56..732d4b57411a 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -453,7 +453,7 @@ xs_read_xdr_buf(struct socket *sock, struct msghdr *msg, int flags,
                         goto out;
                 if (ret != want)
                         goto out;
-        } else
+        } else if (offset < seek_init)
                 offset = seek_init;
         ret = -EMSGSIZE;
 out:
@@ -495,8 +495,8 @@ xs_read_stream_request(struct sock_xprt *transport, struct msghdr *msg,
                 int flags, struct rpc_rqst *req)
 {
         struct xdr_buf *buf = &req->rq_private_buf;
-        size_t want, read;
-        ssize_t ret;
+        size_t want, uninitialized_var(read);
+        ssize_t uninitialized_var(ret);
 
         xs_read_header(transport, buf);
 
diff --git a/scripts/Makefile.asm-generic b/scripts/Makefile.asm-generic
index a62d2823f6cf..82ad63dcd62b 100644
--- a/scripts/Makefile.asm-generic
+++ b/scripts/Makefile.asm-generic
@@ -12,8 +12,19 @@ all:
 src := $(subst /generated,,$(obj))
 -include $(src)/Kbuild
 
+# $(generic)/Kbuild lists mandatory-y. Exclude um since it is a special case.
+ifneq ($(SRCARCH),um)
+include $(generic)/Kbuild
+endif
+
 include scripts/Kbuild.include
 
+redundant := $(filter $(mandatory-y) $(generated-y), $(generic-y))
+redundant += $(foreach f, $(generic-y), $(if $(wildcard $(srctree)/$(src)/$(f)),$(f)))
+redundant := $(sort $(redundant))
+$(if $(redundant),\
+        $(warning redundant generic-y found in $(src)/Kbuild: $(redundant)))
+
 # If arch does not implement mandatory headers, fallback to asm-generic ones.
 mandatory-y := $(filter-out $(generated-y), $(mandatory-y))
 generic-y   += $(foreach f, $(mandatory-y), $(if $(wildcard $(srctree)/$(src)/$(f)),,$(f)))
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index 850b611f4aba..2554a15ecf2b 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -426,13 +426,9 @@ $(modorder-target): $(subdir-ym) FORCE
 # Rule to compile a set of .o files into one .a file (with symbol table)
 #
 ifdef lib-target
-quiet_cmd_link_l_target = AR      $@
-
-# lib target archives do get a symbol table and index
-cmd_link_l_target = rm -f $@; $(AR) rcsTP$(KBUILD_ARFLAGS) $@ $(real-prereqs)
 
 $(lib-target): $(lib-y) FORCE
-        $(call if_changed,link_l_target)
+        $(call if_changed,ar)
 
 targets += $(lib-target)
 
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index c0abd9a779c3..8a1f64f17740 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -233,6 +233,12 @@ $(obj)/%: $(src)/%_shipped
 quiet_cmd_ld = LD      $@
       cmd_ld = $(LD) $(ld_flags) $(real-prereqs) -o $@
 
+# Archive
+# ---------------------------------------------------------------------------
+
+quiet_cmd_ar = AR      $@
+      cmd_ar = rm -f $@; $(AR) rcsTP$(KBUILD_ARFLAGS) $@ $(real-prereqs)
+
 # Objcopy
 # ---------------------------------------------------------------------------
 
diff --git a/scripts/Makefile.modinst b/scripts/Makefile.modinst
index ff5ca9817a85..0dae402661f3 100644
--- a/scripts/Makefile.modinst
+++ b/scripts/Makefile.modinst
@@ -23,7 +23,7 @@ quiet_cmd_modules_install = INSTALL $@
     mkdir -p $(2) ; \
     cp $@ $(2) ; \
     $(mod_strip_cmd) $(2)/$(notdir $@) ; \
-    $(mod_sign_cmd) $(2)/$(notdir $@) $(patsubst %,|| true,$(KBUILD_EXTMOD)) && \
+    $(mod_sign_cmd) $(2)/$(notdir $@) $(patsubst %,|| true,$(KBUILD_EXTMOD)) ; \
     $(mod_compress_cmd) $(2)/$(notdir $@)
 
 # Modules built outside the kernel source tree go into extra by default
diff --git a/scripts/Makefile.modpost b/scripts/Makefile.modpost
index c0b7f526f95e..6b7f354f189a 100644
--- a/scripts/Makefile.modpost
+++ b/scripts/Makefile.modpost
@@ -77,7 +77,6 @@ modpost = scripts/mod/modpost                    \
  $(if $(KBUILD_EXTMOD),-I $(modulesymfile))      \
  $(if $(KBUILD_EXTRA_SYMBOLS), $(patsubst %, -e %,$(KBUILD_EXTRA_SYMBOLS))) \
  $(if $(KBUILD_EXTMOD),-o $(modulesymfile))      \
- $(if $(CONFIG_DEBUG_SECTION_MISMATCH),,-S)      \
  $(if $(CONFIG_SECTION_MISMATCH_WARN_ONLY),,-E)  \
  $(if $(KBUILD_EXTMOD)$(KBUILD_MODPOST_WARN),-w)
 
diff --git a/scripts/adjust_autoksyms.sh b/scripts/adjust_autoksyms.sh
index 6e6d63957da3..84bf6b500815 100755
--- a/scripts/adjust_autoksyms.sh
+++ b/scripts/adjust_autoksyms.sh
@@ -39,14 +39,7 @@ case "$KBUILD_VERBOSE" in
 esac
 
 # We need access to CONFIG_ symbols
-case "${KCONFIG_CONFIG}" in
-*/*)
-        . "${KCONFIG_CONFIG}"
-        ;;
-*)
-        # Force using a file from the current directory
-        . "./${KCONFIG_CONFIG}"
-esac
+. include/config/auto.conf
 
 # Generate a new ksym list file with symbols needed by the current
 # set of modules.
diff --git a/scripts/coccinelle/free/put_device.cocci b/scripts/coccinelle/free/put_device.cocci
new file mode 100644
index 000000000000..7395697e7f19
--- /dev/null
+++ b/scripts/coccinelle/free/put_device.cocci
@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: GPL-2.0
+/// Find missing put_device for every of_find_device_by_node.
+///
+// Confidence: Moderate
+// Copyright: (C) 2018-2019 Wen Yang, ZTE.
+// Comments:
+// Options: --no-includes --include-headers
+
+virtual report
+virtual org
+
+@search exists@
+local idexpression id;
+expression x,e,e1;
+position p1,p2;
+type T,T1,T2,T3;
+@@
+
+id = of_find_device_by_node@p1(x)
+... when != e = id
+if (id == NULL || ...) { ... return ...; }
+... when != put_device(&id->dev)
+    when != platform_device_put(id)
+    when != of_dev_put(id)
+    when != if (id) { ... put_device(&id->dev) ... }
+    when != e1 = (T)id
+    when != e1 = &id->dev
+    when != e1 = get_device(&id->dev)
+    when != e1 = (T1)platform_get_drvdata(id)
+(
+  return
+(    id
+|    (T2)dev_get_drvdata(&id->dev)
+|    (T3)platform_get_drvdata(id)
+);
+| return@p2 ...;
+)
+
+@script:python depends on report@
+p1 << search.p1;
+p2 << search.p2;
+@@
+
+coccilib.report.print_report(p2[0], "ERROR: missing put_device; "
+                              + "call of_find_device_by_node on line "
+                              + p1[0].line
+                              + ", but without a corresponding object release "
+                              + "within this function.")
+
+@script:python depends on org@
+p1 << search.p1;
+p2 << search.p2;
+@@
+
+cocci.print_main("of_find_device_by_node", p1)
+cocci.print_secs("needed put_device", p2)
diff --git a/scripts/kconfig/lxdialog/.gitignore b/scripts/kconfig/lxdialog/.gitignore
deleted file mode 100644
index 90b08ff025a6..000000000000
--- a/scripts/kconfig/lxdialog/.gitignore
+++ /dev/null
@@ -1,4 +0,0 @@
-#
-# Generated files
-#
-lxdialog
diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
index bc7f1fc1f55b..dc0e8c5a1402 100755
--- a/scripts/link-vmlinux.sh
+++ b/scripts/link-vmlinux.sh
@@ -171,14 +171,7 @@ if [ "$1" = "clean" ]; then
 fi
 
 # We need access to CONFIG_ symbols
-case "${KCONFIG_CONFIG}" in
-*/*)
-        . "${KCONFIG_CONFIG}"
-        ;;
-*)
-        # Force using a file from the current directory
-        . "./${KCONFIG_CONFIG}"
-esac
+. include/config/auto.conf
 
 # Update version
 info GEN .version
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 26bf886bd168..0b0d1080b1c5 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -35,7 +35,6 @@ static int vmlinux_section_warnings = 1;
 static int warn_unresolved = 0;
 /* How a symbol is exported */
 static int sec_mismatch_count = 0;
-static int sec_mismatch_verbose = 1;
 static int sec_mismatch_fatal = 0;
 /* ignore missing files */
 static int ignore_missing_files;
@@ -1406,8 +1405,6 @@ static void report_sec_mismatch(const char *modname,
         char *prl_to;
 
         sec_mismatch_count++;
-        if (!sec_mismatch_verbose)
-                return;
 
         get_pretty_name(from_is_func, &from, &from_p);
         get_pretty_name(to_is_func, &to, &to_p);
@@ -1655,9 +1652,7 @@ static void extable_mismatch_handler(const char* modname, struct elf_info *elf,
 
         sec_mismatch_count++;
 
-        if (sec_mismatch_verbose)
-                report_extable_warnings(modname, elf, mismatch, r, sym,
-                                        fromsec, tosec);
+        report_extable_warnings(modname, elf, mismatch, r, sym, fromsec, tosec);
 
         if (match(tosec, mismatch->bad_tosec))
                 fatal("The relocation at %s+0x%lx references\n"
@@ -2433,7 +2428,7 @@ int main(int argc, char **argv)
         struct ext_sym_list *extsym_iter;
         struct ext_sym_list *extsym_start = NULL;
 
-        while ((opt = getopt(argc, argv, "i:I:e:mnsST:o:awE")) != -1) {
+        while ((opt = getopt(argc, argv, "i:I:e:mnsT:o:awE")) != -1) {
                 switch (opt) {
                 case 'i':
                         kernel_read = optarg;
@@ -2465,9 +2460,6 @@ int main(int argc, char **argv)
                 case 's':
                         vmlinux_section_warnings = 0;
                         break;
-                case 'S':
-                        sec_mismatch_verbose = 0;
-                        break;
                 case 'T':
                         files_source = optarg;
                         break;
@@ -2525,18 +2517,9 @@ int main(int argc, char **argv)
         }
         if (dump_write)
                 write_dump(dump_write);
-        if (sec_mismatch_count) {
-                if (!sec_mismatch_verbose) {
-                        warn("modpost: Found %d section mismatch(es).\n"
-                             "To see full details build your kernel with:\n"
-                             "'make CONFIG_DEBUG_SECTION_MISMATCH=y'\n",
-                             sec_mismatch_count);
-                }
-                if (sec_mismatch_fatal) {
-                        fatal("modpost: Section mismatches detected.\n"
-                              "Set CONFIG_SECTION_MISMATCH_WARN_ONLY=y to allow them.\n");
-                }
-        }
+        if (sec_mismatch_count && sec_mismatch_fatal)
+                fatal("modpost: Section mismatches detected.\n"
+                      "Set CONFIG_SECTION_MISMATCH_WARN_ONLY=y to allow them.\n");
         free(buf.p);
 
         return err;
diff --git a/scripts/package/builddeb b/scripts/package/builddeb
index 8ac25d10a6ad..b03dd56a4782 100755
--- a/scripts/package/builddeb
+++ b/scripts/package/builddeb
@@ -12,6 +12,18 @@
 
 set -e
 
+is_enabled() {
+        grep -q "^$1=y" include/config/auto.conf
+}
+
+if_enabled_echo() {
+        if is_enabled "$1"; then
+                echo -n "$2"
+        elif [ $# -ge 3 ]; then
+                echo -n "$3"
+        fi
+}
+
 create_package() {
         local pname="$1" pdir="$2"
 
@@ -62,7 +74,7 @@ parisc|mips|powerpc)
         installed_image_path="boot/vmlinuz-$version"
 esac
 
-BUILD_DEBUG="$(grep -s '^CONFIG_DEBUG_INFO=y' $KCONFIG_CONFIG || true)"
+BUILD_DEBUG=$(if_enabled_echo CONFIG_DEBUG_INFO Yes)
 
 # Setup the directory structure
 rm -rf "$tmpdir" "$kernel_headers_dir" "$libc_headers_dir" "$dbg_dir" $objtree/debian/files
@@ -83,14 +95,14 @@ else
 fi
 cp "$($MAKE -s -f $srctree/Makefile image_name)" "$tmpdir/$installed_image_path"
 
-if grep -q "^CONFIG_OF_EARLY_FLATTREE=y" $KCONFIG_CONFIG ; then
+if is_enabled CONFIG_OF_EARLY_FLATTREE; then
         # Only some architectures with OF support have this target
         if [ -d "${srctree}/arch/$SRCARCH/boot/dts" ]; then
                 $MAKE -f $srctree/Makefile INSTALL_DTBS_PATH="$tmpdir/usr/lib/$packagename" dtbs_install
         fi
 fi
 
-if grep -q '^CONFIG_MODULES=y' $KCONFIG_CONFIG ; then
+if is_enabled CONFIG_MODULES; then
         INSTALL_MOD_PATH="$tmpdir" $MAKE -f $srctree/Makefile modules_install
         rm -f "$tmpdir/lib/modules/$version/build"
         rm -f "$tmpdir/lib/modules/$version/source"
@@ -111,8 +123,7 @@ if grep -q '^CONFIG_MODULES=y' $KCONFIG_CONFIG ; then
                 done
 
                 # resign stripped modules
-                MODULE_SIG_ALL="$(grep -s '^CONFIG_MODULE_SIG_ALL=y' $KCONFIG_CONFIG || true)"
-                if [ -n "$MODULE_SIG_ALL" ]; then
+                if is_enabled CONFIG_MODULE_SIG_ALL; then
                         INSTALL_MOD_PATH="$tmpdir" $MAKE -f $srctree/Makefile modules_sign
                 fi
         fi
@@ -129,11 +140,6 @@ fi
 # make-kpkg sets $INITRD to indicate whether an initramfs is wanted, and
 # so do we; recent versions of dracut and initramfs-tools will obey this.
 debhookdir=${KDEB_HOOKDIR:-/etc/kernel}
-if grep -q '^CONFIG_BLK_DEV_INITRD=y' $KCONFIG_CONFIG; then
-        want_initrd=Yes
-else
-        want_initrd=No
-fi
 for script in postinst postrm preinst prerm ; do
         mkdir -p "$tmpdir$debhookdir/$script.d"
         cat <<EOF > "$tmpdir/DEBIAN/$script"
@@ -145,7 +151,7 @@ set -e
 export DEB_MAINT_PARAMS="\$*"
 
 # Tell initramfs builder whether it's wanted
-export INITRD=$want_initrd
+export INITRD=$(if_enabled_echo CONFIG_BLK_DEV_INITRD Yes No)
 
 test -d $debhookdir/$script.d && run-parts --arg="$version" --arg="/$installed_image_path" $debhookdir/$script.d
 exit 0
@@ -158,11 +164,11 @@ done
 (cd $srctree; find arch/*/include include scripts -type f -o -type l) >> "$objtree/debian/hdrsrcfiles"
 (cd $srctree; find arch/$SRCARCH -name module.lds -o -name Kbuild.platforms -o -name Platform) >> "$objtree/debian/hdrsrcfiles"
 (cd $srctree; find $(find arch/$SRCARCH -name include -o -name scripts -type d) -type f) >> "$objtree/debian/hdrsrcfiles"
-if grep -q '^CONFIG_STACK_VALIDATION=y' $KCONFIG_CONFIG ; then
+if is_enabled CONFIG_STACK_VALIDATION; then
         (cd $objtree; find tools/objtool -type f -executable) >> "$objtree/debian/hdrobjfiles"
 fi
 (cd $objtree; find arch/$SRCARCH/include Module.symvers include scripts -type f) >> "$objtree/debian/hdrobjfiles"
-if grep -q '^CONFIG_GCC_PLUGINS=y' $KCONFIG_CONFIG ; then
+if is_enabled CONFIG_GCC_PLUGINS; then
         (cd $objtree; find scripts/gcc-plugins -name \*.so -o -name gcc-common.h) >> "$objtree/debian/hdrobjfiles"
 fi
 destdir=$kernel_headers_dir/usr/src/linux-headers-$version
diff --git a/scripts/package/buildtar b/scripts/package/buildtar
index cfd2a4a3fe42..2f66c81e4021 100755
--- a/scripts/package/buildtar
+++ b/scripts/package/buildtar
@@ -56,7 +56,7 @@ dirs=boot
 #
 # Try to install modules
 #
-if grep -q '^CONFIG_MODULES=y' "${KCONFIG_CONFIG}"; then
+if grep -q '^CONFIG_MODULES=y' include/config/auto.conf; then
         make ARCH="${ARCH}" -f ${srctree}/Makefile INSTALL_MOD_PATH="${tmpdir}" modules_install
         dirs="$dirs lib"
 fi
diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian
index f030961c5165..8351584cb24e 100755
--- a/scripts/package/mkdebian
+++ b/scripts/package/mkdebian
@@ -7,7 +7,7 @@
 set -e
 
 is_enabled() {
-        grep -q "^CONFIG_$1=y" $KCONFIG_CONFIG
+        grep -q "^$1=y" include/config/auto.conf
 }
 
 if_enabled_echo() {
@@ -31,23 +31,23 @@ set_debarch() {
         x86_64)
                 debarch=amd64 ;;
         sparc*)
-                debarch=sparc$(if_enabled_echo 64BIT 64) ;;
+                debarch=sparc$(if_enabled_echo CONFIG_64BIT 64) ;;
         s390*)
                 debarch=s390x ;;
         ppc*)
-                if is_enabled 64BIT; then
-                        debarch=ppc64$(if_enabled_echo CPU_LITTLE_ENDIAN el)
+                if is_enabled CONFIG_64BIT; then
+                        debarch=ppc64$(if_enabled_echo CONFIG_CPU_LITTLE_ENDIAN el)
                 else
-                        debarch=powerpc$(if_enabled_echo SPE spe)
+                        debarch=powerpc$(if_enabled_echo CONFIG_SPE spe)
                 fi
                 ;;
         parisc*)
                 debarch=hppa ;;
         mips*)
-                if is_enabled CPU_LITTLE_ENDIAN; then
-                        debarch=mips$(if_enabled_echo 64BIT 64)$(if_enabled_echo CPU_MIPSR6 r6)el
-                elif is_enabled CPU_MIPSR6; then
-                        debarch=mips$(if_enabled_echo 64BIT 64)r6
+                if is_enabled CONFIG_CPU_LITTLE_ENDIAN; then
+                        debarch=mips$(if_enabled_echo CONFIG_64BIT 64)$(if_enabled_echo CONFIG_CPU_MIPSR6 r6)el
+                elif is_enabled CONFIG_CPU_MIPSR6; then
+                        debarch=mips$(if_enabled_echo CONFIG_64BIT 64)r6
                 else
                         debarch=mips
                 fi
@@ -55,8 +55,8 @@ set_debarch() {
         aarch64|arm64)
                 debarch=arm64 ;;
         arm*)
-                if is_enabled AEABI; then
-                        debarch=arm$(if_enabled_echo VFP hf el)
+                if is_enabled CONFIG_AEABI; then
+                        debarch=arm$(if_enabled_echo CONFIG_VFP hf el)
                 else
                         debarch=arm
                 fi
@@ -64,10 +64,10 @@ set_debarch() {
         openrisc)
                 debarch=or1k ;;
         sh)
-                if is_enabled CPU_SH3; then
-                        debarch=sh3$(if_enabled_echo CPU_BIG_ENDIAN eb)
-                elif is_enabled CPU_SH4; then
-                        debarch=sh4$(if_enabled_echo CPU_BIG_ENDIAN eb)
+                if is_enabled CONFIG_CPU_SH3; then
+                        debarch=sh3$(if_enabled_echo CONFIG_CPU_BIG_ENDIAN eb)
+                elif is_enabled CONFIG_CPU_SH4; then
+                        debarch=sh4$(if_enabled_echo CONFIG_CPU_BIG_ENDIAN eb)
                 fi
                 ;;
         esac
@@ -132,8 +132,12 @@ else
         echo >&2 "Install lsb-release or set \$KDEB_CHANGELOG_DIST explicitly"
 fi
 
-mkdir -p debian/
+mkdir -p debian/source/
+echo "1.0" > debian/source/format
+
 echo $debarch > debian/arch
+extra_build_depends=", $(if_enabled_echo CONFIG_UNWINDER_ORC libelf-dev)"
+extra_build_depends="$extra_build_depends, $(if_enabled_echo CONFIG_SYSTEM_TRUSTED_KEYRING libssl-dev:native)"
 
 # Generate a simple changelog template
 cat <<EOF > debian/changelog
@@ -170,7 +174,7 @@ Source: $sourcename
 Section: kernel
 Priority: optional
 Maintainer: $maintainer
-Build-Depends: bc, kmod, cpio
+Build-Depends: bc, kmod, cpio, bison, flex | flex:native $extra_build_depends
 Homepage: http://www.kernel.org/
 
 Package: $packagename
@@ -221,5 +225,6 @@ clean:
 
 binary: binary-arch
 EOF
+chmod +x debian/rules
 
 exit 0
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index 6b576e588725..daecdfb15a9c 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -828,9 +828,11 @@ void policydb_destroy(struct policydb *p)
         hashtab_map(p->range_tr, range_tr_destroy, NULL);
         hashtab_destroy(p->range_tr);
 
-        for (i = 0; i < p->p_types.nprim; i++)
-                ebitmap_destroy(&p->type_attr_map_array[i]);
-        kvfree(p->type_attr_map_array);
+        if (p->type_attr_map_array) {
+                for (i = 0; i < p->p_types.nprim; i++)
+                        ebitmap_destroy(&p->type_attr_map_array[i]);
+                kvfree(p->type_attr_map_array);
+        }
 
         ebitmap_destroy(&p->filename_trans_ttypes);
         ebitmap_destroy(&p->policycaps);
@@ -2496,10 +2498,13 @@ int policydb_read(struct policydb *p, void *fp)
         if (!p->type_attr_map_array)
                 goto bad;
 
+        /* just in case ebitmap_init() becomes more than just a memset(0): */
+        for (i = 0; i < p->p_types.nprim; i++)
+                ebitmap_init(&p->type_attr_map_array[i]);
+
         for (i = 0; i < p->p_types.nprim; i++) {
                 struct ebitmap *e = &p->type_attr_map_array[i];
 
-                ebitmap_init(e);
                 if (p->policyvers >= POLICYDB_VERSION_AVTAB) {
                         rc = ebitmap_read(e, fp);
                         if (rc)
diff --git a/sound/drivers/opl3/opl3_voice.h b/sound/drivers/opl3/opl3_voice.h
index 5b02bd49fde4..4e4ecc21760b 100644
--- a/sound/drivers/opl3/opl3_voice.h
+++ b/sound/drivers/opl3/opl3_voice.h
@@ -41,7 +41,7 @@ void snd_opl3_timer_func(struct timer_list *t);
 
 /* Prototypes for opl3_drums.c */
 void snd_opl3_load_drums(struct snd_opl3 *opl3);
-void snd_opl3_drum_switch(struct snd_opl3 *opl3, int note, int on_off, int vel, struct snd_midi_channel *chan);
+void snd_opl3_drum_switch(struct snd_opl3 *opl3, int note, int vel, int on_off, struct snd_midi_channel *chan);
 
 /* Prototypes for opl3_oss.c */
 #if IS_ENABLED(CONFIG_SND_SEQUENCER_OSS)
diff --git a/sound/firewire/motu/motu.c b/sound/firewire/motu/motu.c
index 220e61926ea4..513291ba0ab0 100644
--- a/sound/firewire/motu/motu.c
+++ b/sound/firewire/motu/motu.c
@@ -36,7 +36,7 @@ static void name_card(struct snd_motu *motu)
         fw_csr_iterator_init(&it, motu->unit->directory);
         while (fw_csr_iterator_next(&it, &key, &val)) {
                 switch (key) {
-                case CSR_VERSION:
+                case CSR_MODEL:
                         version = val;
                         break;
                 }
@@ -46,7 +46,7 @@ static void name_card(struct snd_motu *motu)
         strcpy(motu->card->shortname, motu->spec->name);
         strcpy(motu->card->mixername, motu->spec->name);
         snprintf(motu->card->longname, sizeof(motu->card->longname),
-                 "MOTU %s (version:%d), GUID %08x%08x at %s, S%d",
+                 "MOTU %s (version:%06x), GUID %08x%08x at %s, S%d",
                  motu->spec->name, version,
                  fw_dev->config_rom[3], fw_dev->config_rom[4],
                  dev_name(&motu->unit->device), 100 << fw_dev->max_speed);
@@ -237,20 +237,20 @@ static const struct snd_motu_spec motu_audio_express = {
 #define SND_MOTU_DEV_ENTRY(model, data)                 \
 {                                                       \
         .match_flags    = IEEE1394_MATCH_VENDOR_ID |    \
-                          IEEE1394_MATCH_MODEL_ID |     \
-                          IEEE1394_MATCH_SPECIFIER_ID,  \
+                          IEEE1394_MATCH_SPECIFIER_ID | \
+                          IEEE1394_MATCH_VERSION,       \
         .vendor_id      = OUI_MOTU,                     \
-        .model_id       = model,                        \
         .specifier_id   = OUI_MOTU,                     \
+        .version        = model,                        \
         .driver_data    = (kernel_ulong_t)data,         \
 }
 
 static const struct ieee1394_device_id motu_id_table[] = {
-        SND_MOTU_DEV_ENTRY(0x101800, &motu_828mk2),
-        SND_MOTU_DEV_ENTRY(0x107800, &snd_motu_spec_traveler),
-        SND_MOTU_DEV_ENTRY(0x106800, &motu_828mk3),     /* FireWire only. */
-        SND_MOTU_DEV_ENTRY(0x100800, &motu_828mk3),     /* Hybrid. */
-        SND_MOTU_DEV_ENTRY(0x104800, &motu_audio_express),
+        SND_MOTU_DEV_ENTRY(0x000003, &motu_828mk2),
+        SND_MOTU_DEV_ENTRY(0x000009, &snd_motu_spec_traveler),
+        SND_MOTU_DEV_ENTRY(0x000015, &motu_828mk3),     /* FireWire only. */
+        SND_MOTU_DEV_ENTRY(0x000035, &motu_828mk3),     /* Hybrid. */
+        SND_MOTU_DEV_ENTRY(0x000033, &motu_audio_express),
         { }
 };
 MODULE_DEVICE_TABLE(ieee1394, motu_id_table);
diff --git a/sound/hda/hdac_stream.c b/sound/hda/hdac_stream.c
index f5dd288d1a7a..76e9b41fcea2 100644
--- a/sound/hda/hdac_stream.c
+++ b/sound/hda/hdac_stream.c
@@ -95,7 +95,10 @@ void snd_hdac_stream_start(struct hdac_stream *azx_dev, bool fresh_start)
                               1 << azx_dev->index,
                               1 << azx_dev->index);
         /* set stripe control */
-        stripe_ctl = snd_hdac_get_stream_stripe_ctl(bus, azx_dev->substream);
+        if (azx_dev->substream)
+                stripe_ctl = snd_hdac_get_stream_stripe_ctl(bus, azx_dev->substream);
+        else
+                stripe_ctl = 0;
         snd_hdac_stream_updateb(azx_dev, SD_CTL_3B, SD_CTL_STRIPE_MASK,
                                 stripe_ctl);
         /* set DMA start and interrupt mask */
diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c
index aa2a83eb81a9..dc27a480c2d9 100644
--- a/sound/isa/sb/sb8.c
+++ b/sound/isa/sb/sb8.c
@@ -111,6 +111,10 @@ static int snd_sb8_probe(struct device *pdev, unsigned int dev)
 
         /* block the 0x388 port to avoid PnP conflicts */
         acard->fm_res = request_region(0x388, 4, "SoundBlaster FM");
+        if (!acard->fm_res) {
+                err = -EBUSY;
+                goto _err;
+        }
 
         if (port[dev] != SNDRV_AUTO_PORT) {
                 if ((err = snd_sbdsp_create(card, port[dev], irq[dev],
diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c
index ea876b0b02b9..dc0084dc8550 100644
--- a/sound/pci/echoaudio/echoaudio.c
+++ b/sound/pci/echoaudio/echoaudio.c
@@ -1952,6 +1952,11 @@ static int snd_echo_create(struct snd_card *card,
         }
         chip->dsp_registers = (volatile u32 __iomem *)
                 ioremap_nocache(chip->dsp_registers_phys, sz);
+        if (!chip->dsp_registers) {
+                dev_err(chip->card->dev, "ioremap failed\n");
+                snd_echo_free(chip);
+                return -ENOMEM;
+        }
 
         if (request_irq(pci->irq, snd_echo_interrupt, IRQF_SHARED,
                         KBUILD_MODNAME, chip)) {
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 5f2005098a60..ec0b8595eb4d 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -2939,6 +2939,20 @@ static int hda_codec_runtime_resume(struct device *dev)
 #endif /* CONFIG_PM */
 
 #ifdef CONFIG_PM_SLEEP
+static int hda_codec_force_resume(struct device *dev)
+{
+        int ret;
+
+        /* The get/put pair below enforces the runtime resume even if the
+         * device hasn't been used at suspend time.  This trick is needed to
+         * update the jack state change during the sleep.
+         */
+        pm_runtime_get_noresume(dev);
+        ret = pm_runtime_force_resume(dev);
+        pm_runtime_put(dev);
+        return ret;
+}
+
 static int hda_codec_pm_suspend(struct device *dev)
 {
         dev->power.power_state = PMSG_SUSPEND;
@@ -2948,7 +2962,7 @@ static int hda_codec_pm_suspend(struct device *dev)
 static int hda_codec_pm_resume(struct device *dev)
 {
         dev->power.power_state = PMSG_RESUME;
-        return pm_runtime_force_resume(dev);
+        return hda_codec_force_resume(dev);
 }
 
 static int hda_codec_pm_freeze(struct device *dev)
@@ -2960,13 +2974,13 @@ static int hda_codec_pm_freeze(struct device *dev)
 static int hda_codec_pm_thaw(struct device *dev)
 {
         dev->power.power_state = PMSG_THAW;
-        return pm_runtime_force_resume(dev);
+        return hda_codec_force_resume(dev);
 }
 
 static int hda_codec_pm_restore(struct device *dev)
 {
         dev->power.power_state = PMSG_RESTORE;
-        return pm_runtime_force_resume(dev);
+        return hda_codec_force_resume(dev);
 }
 #endif /* CONFIG_PM_SLEEP */
 
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index e5c49003e75f..ece256a3b48f 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -947,7 +947,7 @@ static void __azx_runtime_suspend(struct azx *chip)
         display_power(chip, false);
 }
 
-static void __azx_runtime_resume(struct azx *chip)
+static void __azx_runtime_resume(struct azx *chip, bool from_rt)
 {
         struct hda_intel *hda = container_of(chip, struct hda_intel, chip);
         struct hdac_bus *bus = azx_bus(chip);
@@ -964,7 +964,7 @@ static void __azx_runtime_resume(struct azx *chip)
         azx_init_pci(chip);
         hda_intel_init_chip(chip, true);
 
-        if (status) {
+        if (status && from_rt) {
                 list_for_each_codec(codec, &chip->bus)
                         if (status & (1 << codec->addr))
                                 schedule_delayed_work(&codec->jackpoll_work,
@@ -1016,7 +1016,7 @@ static int azx_resume(struct device *dev)
                         chip->msi = 0;
         if (azx_acquire_irq(chip, 1) < 0)
                 return -EIO;
-        __azx_runtime_resume(chip);
+        __azx_runtime_resume(chip, false);
         snd_power_change_state(card, SNDRV_CTL_POWER_D0);
 
         trace_azx_resume(chip);
@@ -1081,7 +1081,7 @@ static int azx_runtime_resume(struct device *dev)
         chip = card->private_data;
         if (!azx_has_pm_runtime(chip))
                 return 0;
-        __azx_runtime_resume(chip);
+        __azx_runtime_resume(chip, true);
 
         /* disable controller Wake Up event*/
         azx_writew(chip, WAKEEN, azx_readw(chip, WAKEEN) &
@@ -2144,10 +2144,12 @@ static struct snd_pci_quirk power_save_blacklist[] = {
         SND_PCI_QUIRK(0x8086, 0x2057, "Intel NUC5i7RYB", 0),
         /* https://bugzilla.redhat.com/show_bug.cgi?id=1520902 */
         SND_PCI_QUIRK(0x8086, 0x2068, "Intel NUC7i3BNB", 0),
-        /* https://bugzilla.redhat.com/show_bug.cgi?id=1572975 */
-        SND_PCI_QUIRK(0x17aa, 0x36a7, "Lenovo C50 All in one", 0),
         /* https://bugzilla.kernel.org/show_bug.cgi?id=198611 */
         SND_PCI_QUIRK(0x17aa, 0x2227, "Lenovo X1 Carbon 3rd Gen", 0),
+        /* https://bugzilla.redhat.com/show_bug.cgi?id=1689623 */
+        SND_PCI_QUIRK(0x17aa, 0x367b, "Lenovo IdeaCentre B550", 0),
+        /* https://bugzilla.redhat.com/show_bug.cgi?id=1572975 */
+        SND_PCI_QUIRK(0x17aa, 0x36a7, "Lenovo C50 All in one", 0),
         {}
 };
 #endif /* CONFIG_PM */
diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c
index dbd8da5685cb..3d68f9ef7694 100644
--- a/sound/pci/hda/hda_tegra.c
+++ b/sound/pci/hda/hda_tegra.c
@@ -219,7 +219,6 @@ disable_hda:
         return rc;
 }
 
-#ifdef CONFIG_PM_SLEEP
 static void hda_tegra_disable_clocks(struct hda_tegra *data)
 {
         clk_disable_unprepare(data->hda2hdmi_clk);
@@ -230,7 +229,7 @@ static void hda_tegra_disable_clocks(struct hda_tegra *data)
 /*
  * power management
  */
-static int hda_tegra_suspend(struct device *dev)
+static int __maybe_unused hda_tegra_suspend(struct device *dev)
 {
         struct snd_card *card = dev_get_drvdata(dev);
         int rc;
@@ -243,7 +242,7 @@ static int hda_tegra_suspend(struct device *dev)
         return 0;
 }
 
-static int hda_tegra_resume(struct device *dev)
+static int __maybe_unused hda_tegra_resume(struct device *dev)
 {
         struct snd_card *card = dev_get_drvdata(dev);
         int rc;
@@ -255,10 +254,8 @@ static int hda_tegra_resume(struct device *dev)
 
         return 0;
 }
-#endif /* CONFIG_PM_SLEEP */
 
-#ifdef CONFIG_PM
-static int hda_tegra_runtime_suspend(struct device *dev)
+static int __maybe_unused hda_tegra_runtime_suspend(struct device *dev)
 {
         struct snd_card *card = dev_get_drvdata(dev);
         struct azx *chip = card->private_data;
@@ -275,7 +272,7 @@ static int hda_tegra_runtime_suspend(struct device *dev)
         return 0;
 }
 
-static int hda_tegra_runtime_resume(struct device *dev)
+static int __maybe_unused hda_tegra_runtime_resume(struct device *dev)
 {
         struct snd_card *card = dev_get_drvdata(dev);
         struct azx *chip = card->private_data;
@@ -292,7 +289,6 @@ static int hda_tegra_runtime_resume(struct device *dev)
 
         return 0;
 }
-#endif /* CONFIG_PM */
 
 static const struct dev_pm_ops hda_tegra_pm = {
         SET_SYSTEM_SLEEP_PM_OPS(hda_tegra_suspend, hda_tegra_resume)
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index a4ee7656d9ee..fb65ad31e86c 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -936,6 +936,9 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
         SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x103c, 0x8456, "HP Z2 G4 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x103c, 0x8457, "HP Z2 G4 mini", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x103c, 0x8458, "HP Z2 G4 mini premium", CXT_FIXUP_HP_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
         SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO),
         SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 73d7042ff884..8b3ac690efa3 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -57,10 +57,11 @@ MODULE_PARM_DESC(static_hdmi_pcm, "Don't restrict PCM parameters per ELD info");
 #define is_geminilake(codec) (((codec)->core.vendor_id == 0x8086280d) || \
                                 ((codec)->core.vendor_id == 0x80862800))
 #define is_cannonlake(codec) ((codec)->core.vendor_id == 0x8086280c)
+#define is_icelake(codec) ((codec)->core.vendor_id == 0x8086280f)
 #define is_haswell_plus(codec) (is_haswell(codec) || is_broadwell(codec) \
                                 || is_skylake(codec) || is_broxton(codec) \
-                                || is_kabylake(codec)) || is_geminilake(codec) \
-                                || is_cannonlake(codec)
+                                || is_kabylake(codec) || is_geminilake(codec) \
+                                || is_cannonlake(codec) || is_icelake(codec))
 #define is_valleyview(codec) ((codec)->core.vendor_id == 0x80862882)
 #define is_cherryview(codec) ((codec)->core.vendor_id == 0x80862883)
 #define is_valleyview_plus(codec) (is_valleyview(codec) || is_cherryview(codec))
@@ -181,6 +182,8 @@ struct hdmi_spec {
 
         struct hdac_chmap chmap;
         hda_nid_t vendor_nid;
+        const int *port_map;
+        int port_num;
 };
 
 #ifdef CONFIG_SND_HDA_COMPONENT
@@ -2418,12 +2421,11 @@ static void intel_haswell_fixup_connect_list(struct hda_codec *codec,
         snd_hda_override_conn_list(codec, nid, spec->num_cvts, spec->cvt_nids);
 }
 
-#define INTEL_VENDOR_NID 0x08
-#define INTEL_GLK_VENDOR_NID 0x0B
-#define INTEL_GET_VENDOR_VERB 0xf81
-#define INTEL_SET_VENDOR_VERB 0x781
-#define INTEL_EN_DP12                   0x02 /* enable DP 1.2 features */
-#define INTEL_EN_ALL_PIN_CVTS   0x01 /* enable 2nd & 3rd pins and convertors */
+#define INTEL_GET_VENDOR_VERB   0xf81
+#define INTEL_GET_VENDOR_VERB   0xf81
+#define INTEL_SET_VENDOR_VERB   0x781
+#define INTEL_EN_DP12           0x02    /* enable DP 1.2 features */
+#define INTEL_EN_ALL_PIN_CVTS   0x01    /* enable 2nd & 3rd pins and convertors */
 
 static void intel_haswell_enable_all_pins(struct hda_codec *codec,
                                           bool update_tree)
@@ -2503,11 +2505,29 @@ static int intel_base_nid(struct hda_codec *codec)
 
 static int intel_pin2port(void *audio_ptr, int pin_nid)
 {
-        int base_nid = intel_base_nid(audio_ptr);
+        struct hda_codec *codec = audio_ptr;
+        struct hdmi_spec *spec = codec->spec;
+        int base_nid, i;
 
-        if (WARN_ON(pin_nid < base_nid || pin_nid >= base_nid + 3))
-                return -1;
-        return pin_nid - base_nid + 1; /* intel port is 1-based */
+        if (!spec->port_num) {
+                base_nid = intel_base_nid(codec);
+                if (WARN_ON(pin_nid < base_nid || pin_nid >= base_nid + 3))
+                        return -1;
+                return pin_nid - base_nid + 1; /* intel port is 1-based */
+        }
+
+        /*
+         * looking for the pin number in the mapping table and return
+         * the index which indicate the port number
+         */
+        for (i = 0; i < spec->port_num; i++) {
+                if (pin_nid == spec->port_map[i])
+                        return i + 1;
+        }
+
+        /* return -1 if pin number exceeds our expectation */
+        codec_info(codec, "Can't find the HDMI/DP port for pin %d\n", pin_nid);
+        return -1;
 }
 
 static void intel_pin_eld_notify(void *audio_ptr, int port, int pipe)
@@ -2608,7 +2628,8 @@ static int parse_intel_hdmi(struct hda_codec *codec)
 }
 
 /* Intel Haswell and onwards; audio component with eld notifier */
-static int intel_hsw_common_init(struct hda_codec *codec, hda_nid_t vendor_nid)
+static int intel_hsw_common_init(struct hda_codec *codec, hda_nid_t vendor_nid,
+                                 const int *port_map, int port_num)
 {
         struct hdmi_spec *spec;
         int err;
@@ -2620,6 +2641,8 @@ static int intel_hsw_common_init(struct hda_codec *codec, hda_nid_t vendor_nid)
         codec->dp_mst = true;
         spec->dyn_pcm_assign = true;
         spec->vendor_nid = vendor_nid;
+        spec->port_map = port_map;
+        spec->port_num = port_num;
 
         intel_haswell_enable_all_pins(codec, true);
         intel_haswell_fixup_enable_dp12(codec);
@@ -2638,12 +2661,23 @@ static int intel_hsw_common_init(struct hda_codec *codec, hda_nid_t vendor_nid)
 
 static int patch_i915_hsw_hdmi(struct hda_codec *codec)
 {
-        return intel_hsw_common_init(codec, INTEL_VENDOR_NID);
+        return intel_hsw_common_init(codec, 0x08, NULL, 0);
 }
 
 static int patch_i915_glk_hdmi(struct hda_codec *codec)
 {
-        return intel_hsw_common_init(codec, INTEL_GLK_VENDOR_NID);
+        return intel_hsw_common_init(codec, 0x0b, NULL, 0);
+}
+
+static int patch_i915_icl_hdmi(struct hda_codec *codec)
+{
+        /*
+         * pin to port mapping table where the value indicate the pin number and
+         * the index indicate the port number with 1 base.
+         */
+        static const int map[] = {0x4, 0x6, 0x8, 0xa, 0xb};
+
+        return intel_hsw_common_init(codec, 0x02, map, ARRAY_SIZE(map));
 }
 
 /* Intel Baytrail and Braswell; with eld notifier */
@@ -3886,6 +3920,7 @@ HDA_CODEC_ENTRY(0x11069f81, "VX900 HDMI/DP",	patch_via_hdmi),
 HDA_CODEC_ENTRY(0x11069f84, "VX11 HDMI/DP",     patch_generic_hdmi),
 HDA_CODEC_ENTRY(0x11069f85, "VX11 HDMI/DP",     patch_generic_hdmi),
 HDA_CODEC_ENTRY(0x80860054, "IbexPeak HDMI",    patch_i915_cpt_hdmi),
+HDA_CODEC_ENTRY(0x80862800, "Geminilake HDMI",  patch_i915_glk_hdmi),
 HDA_CODEC_ENTRY(0x80862801, "Bearlake HDMI",    patch_generic_hdmi),
 HDA_CODEC_ENTRY(0x80862802, "Cantiga HDMI",     patch_generic_hdmi),
 HDA_CODEC_ENTRY(0x80862803, "Eaglelake HDMI",   patch_generic_hdmi),
@@ -3899,7 +3934,7 @@ HDA_CODEC_ENTRY(0x8086280a, "Broxton HDMI",	patch_i915_hsw_hdmi),
 HDA_CODEC_ENTRY(0x8086280b, "Kabylake HDMI",    patch_i915_hsw_hdmi),
 HDA_CODEC_ENTRY(0x8086280c, "Cannonlake HDMI",  patch_i915_glk_hdmi),
 HDA_CODEC_ENTRY(0x8086280d, "Geminilake HDMI",  patch_i915_glk_hdmi),
-HDA_CODEC_ENTRY(0x80862800, "Geminilake HDMI",  patch_i915_glk_hdmi),
+HDA_CODEC_ENTRY(0x8086280f, "Icelake HDMI",     patch_i915_icl_hdmi),
 HDA_CODEC_ENTRY(0x80862880, "CedarTrail HDMI",  patch_generic_hdmi),
 HDA_CODEC_ENTRY(0x80862882, "Valleyview2 HDMI", patch_i915_byt_hdmi),
 HDA_CODEC_ENTRY(0x80862883, "Braswell HDMI",    patch_i915_byt_hdmi),
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index c8413d44973c..191830d4fa40 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5491,7 +5491,7 @@ static void alc_headset_btn_callback(struct hda_codec *codec,
         jack->jack->button_state = report;
 }
 
-static void alc_fixup_headset_jack(struct hda_codec *codec,
+static void alc295_fixup_chromebook(struct hda_codec *codec,
                                     const struct hda_fixup *fix, int action)
 {
 
@@ -5501,6 +5501,16 @@ static void alc_fixup_headset_jack(struct hda_codec *codec,
                                                     alc_headset_btn_callback);
                 snd_hda_jack_add_kctl(codec, 0x55, "Headset Jack", false,
                                       SND_JACK_HEADSET, alc_headset_btn_keymap);
+                switch (codec->core.vendor_id) {
+                case 0x10ec0295:
+                        alc_update_coef_idx(codec, 0x4a, 0x8000, 1 << 15); /* Reset HP JD */
+                        alc_update_coef_idx(codec, 0x4a, 0x8000, 0 << 15);
+                        break;
+                case 0x10ec0236:
+                        alc_update_coef_idx(codec, 0x1b, 0x8000, 1 << 15); /* Reset HP JD */
+                        alc_update_coef_idx(codec, 0x1b, 0x8000, 0 << 15);
+                        break;
+                }
                 break;
         case HDA_FIXUP_ACT_INIT:
                 switch (codec->core.vendor_id) {
@@ -5670,9 +5680,14 @@ enum {
         ALC294_FIXUP_ASUS_MIC,
         ALC294_FIXUP_ASUS_HEADSET_MIC,
         ALC294_FIXUP_ASUS_SPK,
-        ALC225_FIXUP_HEADSET_JACK,
         ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
         ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE,
+        ALC255_FIXUP_ACER_HEADSET_MIC,
+        ALC295_FIXUP_CHROME_BOOK,
+        ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE,
+        ALC225_FIXUP_WYSE_AUTO_MUTE,
+        ALC225_FIXUP_WYSE_DISABLE_MIC_VREF,
+        ALC286_FIXUP_ACER_AIO_HEADSET_MIC,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -6615,9 +6630,9 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC
         },
-        [ALC225_FIXUP_HEADSET_JACK] = {
+        [ALC295_FIXUP_CHROME_BOOK] = {
                 .type = HDA_FIXUP_FUNC,
-                .v.func = alc_fixup_headset_jack,
+                .v.func = alc295_fixup_chromebook,
         },
         [ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE] = {
                 .type = HDA_FIXUP_PINS,
@@ -6639,6 +6654,48 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC285_FIXUP_LENOVO_HEADPHONE_NOISE
         },
+        [ALC255_FIXUP_ACER_HEADSET_MIC] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x19, 0x03a11130 },
+                        { 0x1a, 0x90a60140 }, /* use as internal mic */
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC255_FIXUP_HEADSET_MODE_NO_HP_MIC
+        },
+        [ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x16, 0x01011020 }, /* Rear Line out */
+                        { 0x19, 0x01a1913c }, /* use as Front headset mic, without its own jack detect */
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC225_FIXUP_WYSE_AUTO_MUTE
+        },
+        [ALC225_FIXUP_WYSE_AUTO_MUTE] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc_fixup_auto_mute_via_amp,
+                .chained = true,
+                .chain_id = ALC225_FIXUP_WYSE_DISABLE_MIC_VREF
+        },
+        [ALC225_FIXUP_WYSE_DISABLE_MIC_VREF] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc_fixup_disable_mic_vref,
+                .chained = true,
+                .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
+        },
+        [ALC286_FIXUP_ACER_AIO_HEADSET_MIC] = {
+                .type = HDA_FIXUP_VERBS,
+                .v.verbs = (const struct hda_verb[]) {
+                        { 0x20, AC_VERB_SET_COEF_INDEX, 0x4f },
+                        { 0x20, AC_VERB_SET_PROC_COEF, 0x5029 },
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -6655,9 +6712,10 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS),
         SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK),
-        SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
-        SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
-        SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
+        SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
+        SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
+        SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC),
         SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
         SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
         SND_PCI_QUIRK(0x1028, 0x05bd, "Dell Latitude E6440", ALC292_FIXUP_DELL_E7X),
@@ -6702,6 +6760,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
         SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
         SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB),
+        SND_PCI_QUIRK(0x1028, 0x08ad, "Dell WYSE AIO", ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x08ae, "Dell WYSE NB", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
         SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
@@ -6764,11 +6824,13 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC),
+        SND_PCI_QUIRK(0x103c, 0x802e, "HP Z240 SFF", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x103c, 0x802f, "HP Z240", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x820d, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
         SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC),
         SND_PCI_QUIRK(0x103c, 0x827e, "HP x360", ALC295_FIXUP_HP_X360),
-        SND_PCI_QUIRK(0x103c, 0x82bf, "HP", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
-        SND_PCI_QUIRK(0x103c, 0x82c0, "HP", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x103c, 0x82bf, "HP G3 mini", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x103c, 0x82c0, "HP G3 mini premium", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
         SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
         SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
@@ -7048,7 +7110,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
         {.id = ALC255_FIXUP_DUMMY_LINEOUT_VERB, .name = "alc255-dummy-lineout"},
         {.id = ALC255_FIXUP_DELL_HEADSET_MIC, .name = "alc255-dell-headset"},
         {.id = ALC295_FIXUP_HP_X360, .name = "alc295-hp-x360"},
-        {.id = ALC225_FIXUP_HEADSET_JACK, .name = "alc-sense-combo"},
+        {.id = ALC295_FIXUP_CHROME_BOOK, .name = "alc-sense-combo"},
         {}
 };
 #define ALC225_STANDARD_PINS \
diff --git a/sound/usb/usx2y/usb_stream.c b/sound/usb/usx2y/usb_stream.c
index b0f8979ff2d2..221adf68bd0c 100644
--- a/sound/usb/usx2y/usb_stream.c
+++ b/sound/usb/usx2y/usb_stream.c
@@ -104,7 +104,12 @@ static int init_urbs(struct usb_stream_kernel *sk, unsigned use_packsize,
 
         for (u = 0; u < USB_STREAM_NURBS; ++u) {
                 sk->inurb[u] = usb_alloc_urb(sk->n_o_ps, GFP_KERNEL);
+                if (!sk->inurb[u])
+                        return -ENOMEM;
+
                 sk->outurb[u] = usb_alloc_urb(sk->n_o_ps, GFP_KERNEL);
+                if (!sk->outurb[u])
+                        return -ENOMEM;
         }
 
         if (init_pipe_urbs(sk, use_packsize, sk->inurb, indata, dev, in_pipe) ||
diff --git a/tools/arch/arm64/include/uapi/asm/unistd.h b/tools/arch/arm64/include/uapi/asm/unistd.h
index dae1584cf017..4703d218663a 100644
--- a/tools/arch/arm64/include/uapi/asm/unistd.h
+++ b/tools/arch/arm64/include/uapi/asm/unistd.h
@@ -17,5 +17,7 @@
 
 #define __ARCH_WANT_RENAMEAT
 #define __ARCH_WANT_NEW_STAT
+#define __ARCH_WANT_SET_GET_RLIMIT
+#define __ARCH_WANT_TIME32_SYSCALLS
 
 #include <asm-generic/unistd.h>
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index 8ef80d65a474..d2be5a06c339 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -401,41 +401,31 @@ static int do_show(int argc, char **argv)
 
 static int do_dump(int argc, char **argv)
 {
-        unsigned int finfo_rec_size, linfo_rec_size, jited_linfo_rec_size;
-        void *func_info = NULL, *linfo = NULL, *jited_linfo = NULL;
-        unsigned int nr_finfo, nr_linfo = 0, nr_jited_linfo = 0;
+        struct bpf_prog_info_linear *info_linear;
         struct bpf_prog_linfo *prog_linfo = NULL;
-        unsigned long *func_ksyms = NULL;
-        struct bpf_prog_info info = {};
-        unsigned int *func_lens = NULL;
+        enum {DUMP_JITED, DUMP_XLATED} mode;
         const char *disasm_opt = NULL;
-        unsigned int nr_func_ksyms;
-        unsigned int nr_func_lens;
+        struct bpf_prog_info *info;
         struct dump_data dd = {};
-        __u32 len = sizeof(info);
+        void *func_info = NULL;
         struct btf *btf = NULL;
-        unsigned int buf_size;
         char *filepath = NULL;
         bool opcodes = false;
         bool visual = false;
         char func_sig[1024];
         unsigned char *buf;
         bool linum = false;
-        __u32 *member_len;
-        __u64 *member_ptr;
+        __u32 member_len;
+        __u64 arrays;
         ssize_t n;
-        int err;
         int fd;
 
         if (is_prefix(*argv, "jited")) {
                 if (disasm_init())
                         return -1;
-
-                member_len = &info.jited_prog_len;
-                member_ptr = &info.jited_prog_insns;
+                mode = DUMP_JITED;
         } else if (is_prefix(*argv, "xlated")) {
-                member_len = &info.xlated_prog_len;
-                member_ptr = &info.xlated_prog_insns;
+                mode = DUMP_XLATED;
         } else {
                 p_err("expected 'xlated' or 'jited', got: %s", *argv);
                 return -1;
@@ -474,175 +464,50 @@ static int do_dump(int argc, char **argv)
                 return -1;
         }
 
-        err = bpf_obj_get_info_by_fd(fd, &info, &len);
-        if (err) {
-                p_err("can't get prog info: %s", strerror(errno));
-                return -1;
-        }
-
-        if (!*member_len) {
-                p_info("no instructions returned");
-                close(fd);
-                return 0;
-        }
+        if (mode == DUMP_JITED)
+                arrays = 1UL << BPF_PROG_INFO_JITED_INSNS;
+        else
+                arrays = 1UL << BPF_PROG_INFO_XLATED_INSNS;
 
-        buf_size = *member_len;
+        arrays |= 1UL << BPF_PROG_INFO_JITED_KSYMS;
+        arrays |= 1UL << BPF_PROG_INFO_JITED_FUNC_LENS;
+        arrays |= 1UL << BPF_PROG_INFO_FUNC_INFO;
+        arrays |= 1UL << BPF_PROG_INFO_LINE_INFO;
+        arrays |= 1UL << BPF_PROG_INFO_JITED_LINE_INFO;
 
-        buf = malloc(buf_size);
-        if (!buf) {
-                p_err("mem alloc failed");
-                close(fd);
+        info_linear = bpf_program__get_prog_info_linear(fd, arrays);
+        close(fd);
+        if (IS_ERR_OR_NULL(info_linear)) {
+                p_err("can't get prog info: %s", strerror(errno));
                 return -1;
         }
 
-        nr_func_ksyms = info.nr_jited_ksyms;
-        if (nr_func_ksyms) {
-                func_ksyms = malloc(nr_func_ksyms * sizeof(__u64));
-                if (!func_ksyms) {
-                        p_err("mem alloc failed");
-                        close(fd);
-                        goto err_free;
-                }
-        }
-
-        nr_func_lens = info.nr_jited_func_lens;
-        if (nr_func_lens) {
-                func_lens = malloc(nr_func_lens * sizeof(__u32));
-                if (!func_lens) {
-                        p_err("mem alloc failed");
-                        close(fd);
+        info = &info_linear->info;
+        if (mode == DUMP_JITED) {
+                if (info->jited_prog_len == 0) {
+                        p_info("no instructions returned");
                         goto err_free;
                 }
-        }
-
-        nr_finfo = info.nr_func_info;
-        finfo_rec_size = info.func_info_rec_size;
-        if (nr_finfo && finfo_rec_size) {
-                func_info = malloc(nr_finfo * finfo_rec_size);
-                if (!func_info) {
-                        p_err("mem alloc failed");
-                        close(fd);
+                buf = (unsigned char *)(info->jited_prog_insns);
+                member_len = info->jited_prog_len;
+        } else {        /* DUMP_XLATED */
+                if (info->xlated_prog_len == 0) {
+                        p_err("error retrieving insn dump: kernel.kptr_restrict set?");
                         goto err_free;
                 }
+                buf = (unsigned char *)info->xlated_prog_insns;
+                member_len = info->xlated_prog_len;
         }
 
-        linfo_rec_size = info.line_info_rec_size;
-        if (info.nr_line_info && linfo_rec_size && info.btf_id) {
-                nr_linfo = info.nr_line_info;
-                linfo = malloc(nr_linfo * linfo_rec_size);
-                if (!linfo) {
-                        p_err("mem alloc failed");
-                        close(fd);
-                        goto err_free;
-                }
-        }
-
-        jited_linfo_rec_size = info.jited_line_info_rec_size;
-        if (info.nr_jited_line_info &&
-            jited_linfo_rec_size &&
-            info.nr_jited_ksyms &&
-            info.nr_jited_func_lens &&
-            info.btf_id) {
-                nr_jited_linfo = info.nr_jited_line_info;
-                jited_linfo = malloc(nr_jited_linfo * jited_linfo_rec_size);
-                if (!jited_linfo) {
-                        p_err("mem alloc failed");
-                        close(fd);
-                        goto err_free;
-                }
-        }
-
-        memset(&info, 0, sizeof(info));
-
-        *member_ptr = ptr_to_u64(buf);
-        *member_len = buf_size;
-        info.jited_ksyms = ptr_to_u64(func_ksyms);
-        info.nr_jited_ksyms = nr_func_ksyms;
-        info.jited_func_lens = ptr_to_u64(func_lens);
-        info.nr_jited_func_lens = nr_func_lens;
-        info.nr_func_info = nr_finfo;
-        info.func_info_rec_size = finfo_rec_size;
-        info.func_info = ptr_to_u64(func_info);
-        info.nr_line_info = nr_linfo;
-        info.line_info_rec_size = linfo_rec_size;
-        info.line_info = ptr_to_u64(linfo);
-        info.nr_jited_line_info = nr_jited_linfo;
-        info.jited_line_info_rec_size = jited_linfo_rec_size;
-        info.jited_line_info = ptr_to_u64(jited_linfo);
-
-        err = bpf_obj_get_info_by_fd(fd, &info, &len);
-        close(fd);
-        if (err) {
-                p_err("can't get prog info: %s", strerror(errno));
-                goto err_free;
-        }
-
-        if (*member_len > buf_size) {
-                p_err("too many instructions returned");
-                goto err_free;
-        }
-
-        if (info.nr_jited_ksyms > nr_func_ksyms) {
-                p_err("too many addresses returned");
-                goto err_free;
-        }
-
-        if (info.nr_jited_func_lens > nr_func_lens) {
-                p_err("too many values returned");
-                goto err_free;
-        }
-
-        if (info.nr_func_info != nr_finfo) {
-                p_err("incorrect nr_func_info %d vs. expected %d",
-                      info.nr_func_info, nr_finfo);
-                goto err_free;
-        }
-
-        if (info.func_info_rec_size != finfo_rec_size) {
-                p_err("incorrect func_info_rec_size %d vs. expected %d",
-                      info.func_info_rec_size, finfo_rec_size);
-                goto err_free;
-        }
-
-        if (linfo && info.nr_line_info != nr_linfo) {
-                p_err("incorrect nr_line_info %u vs. expected %u",
-                      info.nr_line_info, nr_linfo);
-                goto err_free;
-        }
-
-        if (info.line_info_rec_size != linfo_rec_size) {
-                p_err("incorrect line_info_rec_size %u vs. expected %u",
-                      info.line_info_rec_size, linfo_rec_size);
-                goto err_free;
-        }
-
-        if (jited_linfo && info.nr_jited_line_info != nr_jited_linfo) {
-                p_err("incorrect nr_jited_line_info %u vs. expected %u",
-                      info.nr_jited_line_info, nr_jited_linfo);
-                goto err_free;
-        }
-
-        if (info.jited_line_info_rec_size != jited_linfo_rec_size) {
-                p_err("incorrect jited_line_info_rec_size %u vs. expected %u",
-                      info.jited_line_info_rec_size, jited_linfo_rec_size);
-                goto err_free;
-        }
-
-        if ((member_len == &info.jited_prog_len &&
-             info.jited_prog_insns == 0) ||
-            (member_len == &info.xlated_prog_len &&
-             info.xlated_prog_insns == 0)) {
-                p_err("error retrieving insn dump: kernel.kptr_restrict set?");
-                goto err_free;
-        }
-
-        if (info.btf_id && btf__get_from_id(info.btf_id, &btf)) {
+        if (info->btf_id && btf__get_from_id(info->btf_id, &btf)) {
                 p_err("failed to get btf");
                 goto err_free;
         }
 
-        if (nr_linfo) {
-                prog_linfo = bpf_prog_linfo__new(&info);
+        func_info = (void *)info->func_info;
+
+        if (info->nr_line_info) {
+                prog_linfo = bpf_prog_linfo__new(info);
                 if (!prog_linfo)
                         p_info("error in processing bpf_line_info.  continue without it.");
         }
@@ -655,9 +520,9 @@ static int do_dump(int argc, char **argv)
                         goto err_free;
                 }
 
-                n = write(fd, buf, *member_len);
+                n = write(fd, buf, member_len);
                 close(fd);
-                if (n != *member_len) {
+                if (n != member_len) {
                         p_err("error writing output file: %s",
                               n < 0 ? strerror(errno) : "short write");
                         goto err_free;
@@ -665,19 +530,19 @@ static int do_dump(int argc, char **argv)
 
                 if (json_output)
                         jsonw_null(json_wtr);
-        } else if (member_len == &info.jited_prog_len) {
+        } else if (mode == DUMP_JITED) {
                 const char *name = NULL;
 
-                if (info.ifindex) {
-                        name = ifindex_to_bfd_params(info.ifindex,
-                                                     info.netns_dev,
-                                                     info.netns_ino,
+                if (info->ifindex) {
+                        name = ifindex_to_bfd_params(info->ifindex,
+                                                     info->netns_dev,
+                                                     info->netns_ino,
                                                      &disasm_opt);
                         if (!name)
                                 goto err_free;
                 }
 
-                if (info.nr_jited_func_lens && info.jited_func_lens) {
+                if (info->nr_jited_func_lens && info->jited_func_lens) {
                         struct kernel_sym *sym = NULL;
                         struct bpf_func_info *record;
                         char sym_name[SYM_MAX_NAME];
@@ -685,17 +550,16 @@ static int do_dump(int argc, char **argv)
                         __u64 *ksyms = NULL;
                         __u32 *lens;
                         __u32 i;
-
-                        if (info.nr_jited_ksyms) {
+                        if (info->nr_jited_ksyms) {
                                 kernel_syms_load(&dd);
-                                ksyms = (__u64 *) info.jited_ksyms;
+                                ksyms = (__u64 *) info->jited_ksyms;
                         }
 
                         if (json_output)
                                 jsonw_start_array(json_wtr);
 
-                        lens = (__u32 *) info.jited_func_lens;
-                        for (i = 0; i < info.nr_jited_func_lens; i++) {
+                        lens = (__u32 *) info->jited_func_lens;
+                        for (i = 0; i < info->nr_jited_func_lens; i++) {
                                 if (ksyms) {
                                         sym = kernel_syms_search(&dd, ksyms[i]);
                                         if (sym)
@@ -707,7 +571,7 @@ static int do_dump(int argc, char **argv)
                                 }
 
                                 if (func_info) {
-                                        record = func_info + i * finfo_rec_size;
+                                        record = func_info + i * info->func_info_rec_size;
                                         btf_dumper_type_only(btf, record->type_id,
                                                              func_sig,
                                                              sizeof(func_sig));
@@ -744,49 +608,37 @@ static int do_dump(int argc, char **argv)
                         if (json_output)
                                 jsonw_end_array(json_wtr);
                 } else {
-                        disasm_print_insn(buf, *member_len, opcodes, name,
+                        disasm_print_insn(buf, member_len, opcodes, name,
                                           disasm_opt, btf, NULL, 0, 0, false);
                 }
         } else if (visual) {
                 if (json_output)
                         jsonw_null(json_wtr);
                 else
-                        dump_xlated_cfg(buf, *member_len);
+                        dump_xlated_cfg(buf, member_len);
         } else {
                 kernel_syms_load(&dd);
-                dd.nr_jited_ksyms = info.nr_jited_ksyms;
-                dd.jited_ksyms = (__u64 *) info.jited_ksyms;
+                dd.nr_jited_ksyms = info->nr_jited_ksyms;
+                dd.jited_ksyms = (__u64 *) info->jited_ksyms;
                 dd.btf = btf;
                 dd.func_info = func_info;
-                dd.finfo_rec_size = finfo_rec_size;
+                dd.finfo_rec_size = info->func_info_rec_size;
                 dd.prog_linfo = prog_linfo;
 
                 if (json_output)
-                        dump_xlated_json(&dd, buf, *member_len, opcodes,
+                        dump_xlated_json(&dd, buf, member_len, opcodes,
                                          linum);
                 else
-                        dump_xlated_plain(&dd, buf, *member_len, opcodes,
+                        dump_xlated_plain(&dd, buf, member_len, opcodes,
                                           linum);
                 kernel_syms_destroy(&dd);
         }
 
-        free(buf);
-        free(func_ksyms);
-        free(func_lens);
-        free(func_info);
-        free(linfo);
-        free(jited_linfo);
-        bpf_prog_linfo__free(prog_linfo);
+        free(info_linear);
         return 0;
 
 err_free:
-        free(buf);
-        free(func_ksyms);
-        free(func_lens);
-        free(func_info);
-        free(linfo);
-        free(jited_linfo);
-        bpf_prog_linfo__free(prog_linfo);
+        free(info_linear);
         return -1;
 }
 
diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature
index 61e46d54a67c..8d3864b061f3 100644
--- a/tools/build/Makefile.feature
+++ b/tools/build/Makefile.feature
@@ -66,7 +66,8 @@ FEATURE_TESTS_BASIC :=                  \
         sched_getcpu                    \
         sdt                             \
         setns                           \
-        libaio
+        libaio                          \
+        disassembler-four-args
 
 # FEATURE_TESTS_BASIC + FEATURE_TESTS_EXTRA is the complete list
 # of all feature tests
@@ -118,7 +119,8 @@ FEATURE_DISPLAY ?=              \
          lzma                   \
          get_cpuid              \
          bpf                    \
-         libaio
+         libaio                 \
+         disassembler-four-args
 
 # Set FEATURE_CHECK_(C|LD)FLAGS-all for all FEATURE_TESTS features.
 # If in the future we need per-feature checks/flags for features not
diff --git a/tools/build/feature/test-all.c b/tools/build/feature/test-all.c
index e903b86b742f..7853e6d91090 100644
--- a/tools/build/feature/test-all.c
+++ b/tools/build/feature/test-all.c
@@ -178,6 +178,10 @@
 # include "test-reallocarray.c"
 #undef main
 
+#define main main_test_disassembler_four_args
+# include "test-disassembler-four-args.c"
+#undef main
+
 int main(int argc, char *argv[])
 {
         main_test_libpython();
@@ -219,6 +223,7 @@ int main(int argc, char *argv[])
         main_test_setns();
         main_test_libaio();
         main_test_reallocarray();
+        main_test_disassembler_four_args();
 
         return 0;
 }
diff --git a/tools/include/uapi/asm-generic/unistd.h b/tools/include/uapi/asm-generic/unistd.h
index d90127298f12..12cdf611d217 100644
--- a/tools/include/uapi/asm-generic/unistd.h
+++ b/tools/include/uapi/asm-generic/unistd.h
@@ -38,8 +38,10 @@ __SYSCALL(__NR_io_destroy, sys_io_destroy)
 __SC_COMP(__NR_io_submit, sys_io_submit, compat_sys_io_submit)
 #define __NR_io_cancel 3
 __SYSCALL(__NR_io_cancel, sys_io_cancel)
+#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_io_getevents 4
-__SC_COMP(__NR_io_getevents, sys_io_getevents, compat_sys_io_getevents)
+__SC_3264(__NR_io_getevents, sys_io_getevents_time32, sys_io_getevents)
+#endif
 
 /* fs/xattr.c */
 #define __NR_setxattr 5
@@ -179,7 +181,7 @@ __SYSCALL(__NR_fchownat, sys_fchownat)
 #define __NR_fchown 55
 __SYSCALL(__NR_fchown, sys_fchown)
 #define __NR_openat 56
-__SC_COMP(__NR_openat, sys_openat, compat_sys_openat)
+__SYSCALL(__NR_openat, sys_openat)
 #define __NR_close 57
 __SYSCALL(__NR_close, sys_close)
 #define __NR_vhangup 58
@@ -222,10 +224,12 @@ __SC_COMP(__NR_pwritev, sys_pwritev, compat_sys_pwritev)
 __SYSCALL(__NR3264_sendfile, sys_sendfile64)
 
 /* fs/select.c */
+#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_pselect6 72
-__SC_COMP(__NR_pselect6, sys_pselect6, compat_sys_pselect6)
+__SC_COMP_3264(__NR_pselect6, sys_pselect6_time32, sys_pselect6, compat_sys_pselect6_time32)
 #define __NR_ppoll 73
-__SC_COMP(__NR_ppoll, sys_ppoll, compat_sys_ppoll)
+__SC_COMP_3264(__NR_ppoll, sys_ppoll_time32, sys_ppoll, compat_sys_ppoll_time32)
+#endif
 
 /* fs/signalfd.c */
 #define __NR_signalfd4 74
@@ -269,16 +273,20 @@ __SC_COMP(__NR_sync_file_range, sys_sync_file_range, \
 /* fs/timerfd.c */
 #define __NR_timerfd_create 85
 __SYSCALL(__NR_timerfd_create, sys_timerfd_create)
+#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_timerfd_settime 86
-__SC_COMP(__NR_timerfd_settime, sys_timerfd_settime, \
-          compat_sys_timerfd_settime)
+__SC_3264(__NR_timerfd_settime, sys_timerfd_settime32, \
+          sys_timerfd_settime)
 #define __NR_timerfd_gettime 87
-__SC_COMP(__NR_timerfd_gettime, sys_timerfd_gettime, \
-          compat_sys_timerfd_gettime)
+__SC_3264(__NR_timerfd_gettime, sys_timerfd_gettime32, \
+          sys_timerfd_gettime)
+#endif
 
 /* fs/utimes.c */
+#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_utimensat 88
-__SC_COMP(__NR_utimensat, sys_utimensat, compat_sys_utimensat)
+__SC_3264(__NR_utimensat, sys_utimensat_time32, sys_utimensat)
+#endif
 
 /* kernel/acct.c */
 #define __NR_acct 89
@@ -309,8 +317,10 @@ __SYSCALL(__NR_set_tid_address, sys_set_tid_address)
 __SYSCALL(__NR_unshare, sys_unshare)
 
 /* kernel/futex.c */
+#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_futex 98
-__SC_COMP(__NR_futex, sys_futex, compat_sys_futex)
+__SC_3264(__NR_futex, sys_futex_time32, sys_futex)
+#endif
 #define __NR_set_robust_list 99
 __SC_COMP(__NR_set_robust_list, sys_set_robust_list, \
           compat_sys_set_robust_list)
@@ -319,8 +329,10 @@ __SC_COMP(__NR_get_robust_list, sys_get_robust_list, \
           compat_sys_get_robust_list)
 
 /* kernel/hrtimer.c */
+#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_nanosleep 101
-__SC_COMP(__NR_nanosleep, sys_nanosleep, compat_sys_nanosleep)
+__SC_3264(__NR_nanosleep, sys_nanosleep_time32, sys_nanosleep)
+#endif
 
 /* kernel/itimer.c */
 #define __NR_getitimer 102
@@ -341,23 +353,29 @@ __SYSCALL(__NR_delete_module, sys_delete_module)
 /* kernel/posix-timers.c */
 #define __NR_timer_create 107
 __SC_COMP(__NR_timer_create, sys_timer_create, compat_sys_timer_create)
+#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_timer_gettime 108
-__SC_COMP(__NR_timer_gettime, sys_timer_gettime, compat_sys_timer_gettime)
+__SC_3264(__NR_timer_gettime, sys_timer_gettime32, sys_timer_gettime)
+#endif
 #define __NR_timer_getoverrun 109
 __SYSCALL(__NR_timer_getoverrun, sys_timer_getoverrun)
+#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_timer_settime 110
-__SC_COMP(__NR_timer_settime, sys_timer_settime, compat_sys_timer_settime)
+__SC_3264(__NR_timer_settime, sys_timer_settime32, sys_timer_settime)
+#endif
 #define __NR_timer_delete 111
 __SYSCALL(__NR_timer_delete, sys_timer_delete)
+#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_clock_settime 112
-__SC_COMP(__NR_clock_settime, sys_clock_settime, compat_sys_clock_settime)
+__SC_3264(__NR_clock_settime, sys_clock_settime32, sys_clock_settime)
 #define __NR_clock_gettime 113
-__SC_COMP(__NR_clock_gettime, sys_clock_gettime, compat_sys_clock_gettime)
+__SC_3264(__NR_clock_gettime, sys_clock_gettime32, sys_clock_gettime)
 #define __NR_clock_getres 114
-__SC_COMP(__NR_clock_getres, sys_clock_getres, compat_sys_clock_getres)
+__SC_3264(__NR_clock_getres, sys_clock_getres_time32, sys_clock_getres)
 #define __NR_clock_nanosleep 115
-__SC_COMP(__NR_clock_nanosleep, sys_clock_nanosleep, \
-          compat_sys_clock_nanosleep)
+__SC_3264(__NR_clock_nanosleep, sys_clock_nanosleep_time32, \
+          sys_clock_nanosleep)
+#endif
 
 /* kernel/printk.c */
 #define __NR_syslog 116
@@ -388,9 +406,11 @@ __SYSCALL(__NR_sched_yield, sys_sched_yield)
 __SYSCALL(__NR_sched_get_priority_max, sys_sched_get_priority_max)
 #define __NR_sched_get_priority_min 126
 __SYSCALL(__NR_sched_get_priority_min, sys_sched_get_priority_min)
+#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_sched_rr_get_interval 127
-__SC_COMP(__NR_sched_rr_get_interval, sys_sched_rr_get_interval, \
-          compat_sys_sched_rr_get_interval)
+__SC_3264(__NR_sched_rr_get_interval, sys_sched_rr_get_interval_time32, \
+          sys_sched_rr_get_interval)
+#endif
 
 /* kernel/signal.c */
 #define __NR_restart_syscall 128
@@ -411,9 +431,11 @@ __SC_COMP(__NR_rt_sigaction, sys_rt_sigaction, compat_sys_rt_sigaction)
 __SC_COMP(__NR_rt_sigprocmask, sys_rt_sigprocmask, compat_sys_rt_sigprocmask)
 #define __NR_rt_sigpending 136
 __SC_COMP(__NR_rt_sigpending, sys_rt_sigpending, compat_sys_rt_sigpending)
+#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_rt_sigtimedwait 137
-__SC_COMP(__NR_rt_sigtimedwait, sys_rt_sigtimedwait, \
-          compat_sys_rt_sigtimedwait)
+__SC_COMP_3264(__NR_rt_sigtimedwait, sys_rt_sigtimedwait_time32, \
+          sys_rt_sigtimedwait, compat_sys_rt_sigtimedwait_time32)
+#endif
 #define __NR_rt_sigqueueinfo 138
 __SC_COMP(__NR_rt_sigqueueinfo, sys_rt_sigqueueinfo, \
           compat_sys_rt_sigqueueinfo)
@@ -467,10 +489,15 @@ __SYSCALL(__NR_uname, sys_newuname)
 __SYSCALL(__NR_sethostname, sys_sethostname)
 #define __NR_setdomainname 162
 __SYSCALL(__NR_setdomainname, sys_setdomainname)
+
+#ifdef __ARCH_WANT_SET_GET_RLIMIT
+/* getrlimit and setrlimit are superseded with prlimit64 */
 #define __NR_getrlimit 163
 __SC_COMP(__NR_getrlimit, sys_getrlimit, compat_sys_getrlimit)
 #define __NR_setrlimit 164
 __SC_COMP(__NR_setrlimit, sys_setrlimit, compat_sys_setrlimit)
+#endif
+
 #define __NR_getrusage 165
 __SC_COMP(__NR_getrusage, sys_getrusage, compat_sys_getrusage)
 #define __NR_umask 166
@@ -481,12 +508,14 @@ __SYSCALL(__NR_prctl, sys_prctl)
 __SYSCALL(__NR_getcpu, sys_getcpu)
 
 /* kernel/time.c */
+#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_gettimeofday 169
 __SC_COMP(__NR_gettimeofday, sys_gettimeofday, compat_sys_gettimeofday)
 #define __NR_settimeofday 170
 __SC_COMP(__NR_settimeofday, sys_settimeofday, compat_sys_settimeofday)
 #define __NR_adjtimex 171
-__SC_COMP(__NR_adjtimex, sys_adjtimex, compat_sys_adjtimex)
+__SC_3264(__NR_adjtimex, sys_adjtimex_time32, sys_adjtimex)
+#endif
 
 /* kernel/timer.c */
 #define __NR_getpid 172
@@ -511,11 +540,13 @@ __SC_COMP(__NR_sysinfo, sys_sysinfo, compat_sys_sysinfo)
 __SC_COMP(__NR_mq_open, sys_mq_open, compat_sys_mq_open)
 #define __NR_mq_unlink 181
 __SYSCALL(__NR_mq_unlink, sys_mq_unlink)
+#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_mq_timedsend 182
-__SC_COMP(__NR_mq_timedsend, sys_mq_timedsend, compat_sys_mq_timedsend)
+__SC_3264(__NR_mq_timedsend, sys_mq_timedsend_time32, sys_mq_timedsend)
 #define __NR_mq_timedreceive 183
-__SC_COMP(__NR_mq_timedreceive, sys_mq_timedreceive, \
-          compat_sys_mq_timedreceive)
+__SC_3264(__NR_mq_timedreceive, sys_mq_timedreceive_time32, \
+          sys_mq_timedreceive)
+#endif
 #define __NR_mq_notify 184
 __SC_COMP(__NR_mq_notify, sys_mq_notify, compat_sys_mq_notify)
 #define __NR_mq_getsetattr 185
@@ -536,8 +567,10 @@ __SC_COMP(__NR_msgsnd, sys_msgsnd, compat_sys_msgsnd)
 __SYSCALL(__NR_semget, sys_semget)
 #define __NR_semctl 191
 __SC_COMP(__NR_semctl, sys_semctl, compat_sys_semctl)
+#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_semtimedop 192
-__SC_COMP(__NR_semtimedop, sys_semtimedop, compat_sys_semtimedop)
+__SC_COMP(__NR_semtimedop, sys_semtimedop, sys_semtimedop_time32)
+#endif
 #define __NR_semop 193
 __SYSCALL(__NR_semop, sys_semop)
 
@@ -658,8 +691,10 @@ __SC_COMP(__NR_rt_tgsigqueueinfo, sys_rt_tgsigqueueinfo, \
 __SYSCALL(__NR_perf_event_open, sys_perf_event_open)
 #define __NR_accept4 242
 __SYSCALL(__NR_accept4, sys_accept4)
+#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_recvmmsg 243
-__SC_COMP(__NR_recvmmsg, sys_recvmmsg, compat_sys_recvmmsg)
+__SC_COMP_3264(__NR_recvmmsg, sys_recvmmsg_time32, sys_recvmmsg, compat_sys_recvmmsg_time32)
+#endif
 
 /*
  * Architectures may provide up to 16 syscalls of their own
@@ -667,8 +702,10 @@ __SC_COMP(__NR_recvmmsg, sys_recvmmsg, compat_sys_recvmmsg)
  */
 #define __NR_arch_specific_syscall 244
 
+#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_wait4 260
 __SC_COMP(__NR_wait4, sys_wait4, compat_sys_wait4)
+#endif
 #define __NR_prlimit64 261
 __SYSCALL(__NR_prlimit64, sys_prlimit64)
 #define __NR_fanotify_init 262
@@ -678,10 +715,11 @@ __SYSCALL(__NR_fanotify_mark, sys_fanotify_mark)
 #define __NR_name_to_handle_at         264
 __SYSCALL(__NR_name_to_handle_at, sys_name_to_handle_at)
 #define __NR_open_by_handle_at         265
-__SC_COMP(__NR_open_by_handle_at, sys_open_by_handle_at, \
-          compat_sys_open_by_handle_at)
+__SYSCALL(__NR_open_by_handle_at, sys_open_by_handle_at)
+#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_clock_adjtime 266
-__SC_COMP(__NR_clock_adjtime, sys_clock_adjtime, compat_sys_clock_adjtime)
+__SC_3264(__NR_clock_adjtime, sys_clock_adjtime32, sys_clock_adjtime)
+#endif
 #define __NR_syncfs 267
 __SYSCALL(__NR_syncfs, sys_syncfs)
 #define __NR_setns 268
@@ -734,15 +772,60 @@ __SYSCALL(__NR_pkey_alloc,    sys_pkey_alloc)
 __SYSCALL(__NR_pkey_free,     sys_pkey_free)
 #define __NR_statx 291
 __SYSCALL(__NR_statx,     sys_statx)
+#if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_io_pgetevents 292
-__SC_COMP(__NR_io_pgetevents, sys_io_pgetevents, compat_sys_io_pgetevents)
+__SC_COMP_3264(__NR_io_pgetevents, sys_io_pgetevents_time32, sys_io_pgetevents, compat_sys_io_pgetevents)
+#endif
 #define __NR_rseq 293
 __SYSCALL(__NR_rseq, sys_rseq)
 #define __NR_kexec_file_load 294
 __SYSCALL(__NR_kexec_file_load,     sys_kexec_file_load)
+/* 295 through 402 are unassigned to sync up with generic numbers, don't use */
+#if __BITS_PER_LONG == 32
+#define __NR_clock_gettime64 403
+__SYSCALL(__NR_clock_gettime64, sys_clock_gettime)
+#define __NR_clock_settime64 404
+__SYSCALL(__NR_clock_settime64, sys_clock_settime)
+#define __NR_clock_adjtime64 405
+__SYSCALL(__NR_clock_adjtime64, sys_clock_adjtime)
+#define __NR_clock_getres_time64 406
+__SYSCALL(__NR_clock_getres_time64, sys_clock_getres)
+#define __NR_clock_nanosleep_time64 407
+__SYSCALL(__NR_clock_nanosleep_time64, sys_clock_nanosleep)
+#define __NR_timer_gettime64 408
+__SYSCALL(__NR_timer_gettime64, sys_timer_gettime)
+#define __NR_timer_settime64 409
+__SYSCALL(__NR_timer_settime64, sys_timer_settime)
+#define __NR_timerfd_gettime64 410
+__SYSCALL(__NR_timerfd_gettime64, sys_timerfd_gettime)
+#define __NR_timerfd_settime64 411
+__SYSCALL(__NR_timerfd_settime64, sys_timerfd_settime)
+#define __NR_utimensat_time64 412
+__SYSCALL(__NR_utimensat_time64, sys_utimensat)
+#define __NR_pselect6_time64 413
+__SC_COMP(__NR_pselect6_time64, sys_pselect6, compat_sys_pselect6_time64)
+#define __NR_ppoll_time64 414
+__SC_COMP(__NR_ppoll_time64, sys_ppoll, compat_sys_ppoll_time64)
+#define __NR_io_pgetevents_time64 416
+__SYSCALL(__NR_io_pgetevents_time64, sys_io_pgetevents)
+#define __NR_recvmmsg_time64 417
+__SC_COMP(__NR_recvmmsg_time64, sys_recvmmsg, compat_sys_recvmmsg_time64)
+#define __NR_mq_timedsend_time64 418
+__SYSCALL(__NR_mq_timedsend_time64, sys_mq_timedsend)
+#define __NR_mq_timedreceive_time64 419
+__SYSCALL(__NR_mq_timedreceive_time64, sys_mq_timedreceive)
+#define __NR_semtimedop_time64 420
+__SYSCALL(__NR_semtimedop_time64, sys_semtimedop)
+#define __NR_rt_sigtimedwait_time64 421
+__SC_COMP(__NR_rt_sigtimedwait_time64, sys_rt_sigtimedwait, compat_sys_rt_sigtimedwait_time64)
+#define __NR_futex_time64 422
+__SYSCALL(__NR_futex_time64, sys_futex)
+#define __NR_sched_rr_get_interval_time64 423
+__SYSCALL(__NR_sched_rr_get_interval_time64, sys_sched_rr_get_interval)
+#endif
 
 #undef __NR_syscalls
-#define __NR_syscalls 295
+#define __NR_syscalls 424
 
 /*
  * 32 bit systems traditionally used different
diff --git a/tools/include/uapi/linux/in.h b/tools/include/uapi/linux/in.h
index a55cb8b10165..e7ad9d350a28 100644
--- a/tools/include/uapi/linux/in.h
+++ b/tools/include/uapi/linux/in.h
@@ -292,10 +292,11 @@ struct sockaddr_in {
 #define IN_LOOPBACK(a)          ((((long int) (a)) & 0xff000000) == 0x7f000000)
 
 /* Defines for Multicast INADDR */
-#define INADDR_UNSPEC_GROUP     0xe0000000U     /* 224.0.0.0   */
-#define INADDR_ALLHOSTS_GROUP   0xe0000001U     /* 224.0.0.1   */
-#define INADDR_ALLRTRS_GROUP    0xe0000002U     /* 224.0.0.2 */
-#define INADDR_MAX_LOCAL_GROUP  0xe00000ffU     /* 224.0.0.255 */
+#define INADDR_UNSPEC_GROUP             0xe0000000U     /* 224.0.0.0   */
+#define INADDR_ALLHOSTS_GROUP           0xe0000001U     /* 224.0.0.1   */
+#define INADDR_ALLRTRS_GROUP            0xe0000002U     /* 224.0.0.2 */
+#define INADDR_ALLSNOOPERS_GROUP        0xe000006aU     /* 224.0.0.106 */
+#define INADDR_MAX_LOCAL_GROUP          0xe00000ffU     /* 224.0.0.255 */
 #endif
 
 /* <asm/byteorder.h> contains the htonl type stuff.. */
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 5e977d2688da..11c25d9ea431 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -112,6 +112,11 @@ void libbpf_print(enum libbpf_print_level level, const char *format, ...)
 # define LIBBPF_ELF_C_READ_MMAP ELF_C_READ
 #endif
 
+static inline __u64 ptr_to_u64(const void *ptr)
+{
+        return (__u64) (unsigned long) ptr;
+}
+
 struct bpf_capabilities {
         /* v4.14: kernel support for program & map names. */
         __u32 name:1;
@@ -622,7 +627,7 @@ bpf_object__init_maps(struct bpf_object *obj, int flags)
         bool strict = !(flags & MAPS_RELAX_COMPAT);
         int i, map_idx, map_def_sz, nr_maps = 0;
         Elf_Scn *scn;
-        Elf_Data *data;
+        Elf_Data *data = NULL;
         Elf_Data *symbols = obj->efile.symbols;
 
         if (obj->efile.maps_shndx < 0)
@@ -3006,3 +3011,249 @@ bpf_perf_event_read_simple(void *mmap_mem, size_t mmap_size, size_t page_size,
         ring_buffer_write_tail(header, data_tail);
         return ret;
 }
+
+struct bpf_prog_info_array_desc {
+        int     array_offset;   /* e.g. offset of jited_prog_insns */
+        int     count_offset;   /* e.g. offset of jited_prog_len */
+        int     size_offset;    /* > 0: offset of rec size,
+                                 * < 0: fix size of -size_offset
+                                 */
+};
+
+static struct bpf_prog_info_array_desc bpf_prog_info_array_desc[] = {
+        [BPF_PROG_INFO_JITED_INSNS] = {
+                offsetof(struct bpf_prog_info, jited_prog_insns),
+                offsetof(struct bpf_prog_info, jited_prog_len),
+                -1,
+        },
+        [BPF_PROG_INFO_XLATED_INSNS] = {
+                offsetof(struct bpf_prog_info, xlated_prog_insns),
+                offsetof(struct bpf_prog_info, xlated_prog_len),
+                -1,
+        },
+        [BPF_PROG_INFO_MAP_IDS] = {
+                offsetof(struct bpf_prog_info, map_ids),
+                offsetof(struct bpf_prog_info, nr_map_ids),
+                -(int)sizeof(__u32),
+        },
+        [BPF_PROG_INFO_JITED_KSYMS] = {
+                offsetof(struct bpf_prog_info, jited_ksyms),
+                offsetof(struct bpf_prog_info, nr_jited_ksyms),
+                -(int)sizeof(__u64),
+        },
+        [BPF_PROG_INFO_JITED_FUNC_LENS] = {
+                offsetof(struct bpf_prog_info, jited_func_lens),
+                offsetof(struct bpf_prog_info, nr_jited_func_lens),
+                -(int)sizeof(__u32),
+        },
+        [BPF_PROG_INFO_FUNC_INFO] = {
+                offsetof(struct bpf_prog_info, func_info),
+                offsetof(struct bpf_prog_info, nr_func_info),
+                offsetof(struct bpf_prog_info, func_info_rec_size),
+        },
+        [BPF_PROG_INFO_LINE_INFO] = {
+                offsetof(struct bpf_prog_info, line_info),
+                offsetof(struct bpf_prog_info, nr_line_info),
+                offsetof(struct bpf_prog_info, line_info_rec_size),
+        },
+        [BPF_PROG_INFO_JITED_LINE_INFO] = {
+                offsetof(struct bpf_prog_info, jited_line_info),
+                offsetof(struct bpf_prog_info, nr_jited_line_info),
+                offsetof(struct bpf_prog_info, jited_line_info_rec_size),
+        },
+        [BPF_PROG_INFO_PROG_TAGS] = {
+                offsetof(struct bpf_prog_info, prog_tags),
+                offsetof(struct bpf_prog_info, nr_prog_tags),
+                -(int)sizeof(__u8) * BPF_TAG_SIZE,
+        },
+
+};
+
+static __u32 bpf_prog_info_read_offset_u32(struct bpf_prog_info *info, int offset)
+{
+        __u32 *array = (__u32 *)info;
+
+        if (offset >= 0)
+                return array[offset / sizeof(__u32)];
+        return -(int)offset;
+}
+
+static __u64 bpf_prog_info_read_offset_u64(struct bpf_prog_info *info, int offset)
+{
+        __u64 *array = (__u64 *)info;
+
+        if (offset >= 0)
+                return array[offset / sizeof(__u64)];
+        return -(int)offset;
+}
+
+static void bpf_prog_info_set_offset_u32(struct bpf_prog_info *info, int offset,
+                                         __u32 val)
+{
+        __u32 *array = (__u32 *)info;
+
+        if (offset >= 0)
+                array[offset / sizeof(__u32)] = val;
+}
+
+static void bpf_prog_info_set_offset_u64(struct bpf_prog_info *info, int offset,
+                                         __u64 val)
+{
+        __u64 *array = (__u64 *)info;
+
+        if (offset >= 0)
+                array[offset / sizeof(__u64)] = val;
+}
+
+struct bpf_prog_info_linear *
+bpf_program__get_prog_info_linear(int fd, __u64 arrays)
+{
+        struct bpf_prog_info_linear *info_linear;
+        struct bpf_prog_info info = {};
+        __u32 info_len = sizeof(info);
+        __u32 data_len = 0;
+        int i, err;
+        void *ptr;
+
+        if (arrays >> BPF_PROG_INFO_LAST_ARRAY)
+                return ERR_PTR(-EINVAL);
+
+        /* step 1: get array dimensions */
+        err = bpf_obj_get_info_by_fd(fd, &info, &info_len);
+        if (err) {
+                pr_debug("can't get prog info: %s", strerror(errno));
+                return ERR_PTR(-EFAULT);
+        }
+
+        /* step 2: calculate total size of all arrays */
+        for (i = BPF_PROG_INFO_FIRST_ARRAY; i < BPF_PROG_INFO_LAST_ARRAY; ++i) {
+                bool include_array = (arrays & (1UL << i)) > 0;
+                struct bpf_prog_info_array_desc *desc;
+                __u32 count, size;
+
+                desc = bpf_prog_info_array_desc + i;
+
+                /* kernel is too old to support this field */
+                if (info_len < desc->array_offset + sizeof(__u32) ||
+                    info_len < desc->count_offset + sizeof(__u32) ||
+                    (desc->size_offset > 0 && info_len < desc->size_offset))
+                        include_array = false;
+
+                if (!include_array) {
+                        arrays &= ~(1UL << i);  /* clear the bit */
+                        continue;
+                }
+
+                count = bpf_prog_info_read_offset_u32(&info, desc->count_offset);
+                size  = bpf_prog_info_read_offset_u32(&info, desc->size_offset);
+
+                data_len += count * size;
+        }
+
+        /* step 3: allocate continuous memory */
+        data_len = roundup(data_len, sizeof(__u64));
+        info_linear = malloc(sizeof(struct bpf_prog_info_linear) + data_len);
+        if (!info_linear)
+                return ERR_PTR(-ENOMEM);
+
+        /* step 4: fill data to info_linear->info */
+        info_linear->arrays = arrays;
+        memset(&info_linear->info, 0, sizeof(info));
+        ptr = info_linear->data;
+
+        for (i = BPF_PROG_INFO_FIRST_ARRAY; i < BPF_PROG_INFO_LAST_ARRAY; ++i) {
+                struct bpf_prog_info_array_desc *desc;
+                __u32 count, size;
+
+                if ((arrays & (1UL << i)) == 0)
+                        continue;
+
+                desc  = bpf_prog_info_array_desc + i;
+                count = bpf_prog_info_read_offset_u32(&info, desc->count_offset);
+                size  = bpf_prog_info_read_offset_u32(&info, desc->size_offset);
+                bpf_prog_info_set_offset_u32(&info_linear->info,
+                                             desc->count_offset, count);
+                bpf_prog_info_set_offset_u32(&info_linear->info,
+                                             desc->size_offset, size);
+                bpf_prog_info_set_offset_u64(&info_linear->info,
+                                             desc->array_offset,
+                                             ptr_to_u64(ptr));
+                ptr += count * size;
+        }
+
+        /* step 5: call syscall again to get required arrays */
+        err = bpf_obj_get_info_by_fd(fd, &info_linear->info, &info_len);
+        if (err) {
+                pr_debug("can't get prog info: %s", strerror(errno));
+                free(info_linear);
+                return ERR_PTR(-EFAULT);
+        }
+
+        /* step 6: verify the data */
+        for (i = BPF_PROG_INFO_FIRST_ARRAY; i < BPF_PROG_INFO_LAST_ARRAY; ++i) {
+                struct bpf_prog_info_array_desc *desc;
+                __u32 v1, v2;
+
+                if ((arrays & (1UL << i)) == 0)
+                        continue;
+
+                desc = bpf_prog_info_array_desc + i;
+                v1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset);
+                v2 = bpf_prog_info_read_offset_u32(&info_linear->info,
+                                                   desc->count_offset);
+                if (v1 != v2)
+                        pr_warning("%s: mismatch in element count\n", __func__);
+
+                v1 = bpf_prog_info_read_offset_u32(&info, desc->size_offset);
+                v2 = bpf_prog_info_read_offset_u32(&info_linear->info,
+                                                   desc->size_offset);
+                if (v1 != v2)
+                        pr_warning("%s: mismatch in rec size\n", __func__);
+        }
+
+        /* step 7: update info_len and data_len */
+        info_linear->info_len = sizeof(struct bpf_prog_info);
+        info_linear->data_len = data_len;
+
+        return info_linear;
+}
+
+void bpf_program__bpil_addr_to_offs(struct bpf_prog_info_linear *info_linear)
+{
+        int i;
+
+        for (i = BPF_PROG_INFO_FIRST_ARRAY; i < BPF_PROG_INFO_LAST_ARRAY; ++i) {
+                struct bpf_prog_info_array_desc *desc;
+                __u64 addr, offs;
+
+                if ((info_linear->arrays & (1UL << i)) == 0)
+                        continue;
+
+                desc = bpf_prog_info_array_desc + i;
+                addr = bpf_prog_info_read_offset_u64(&info_linear->info,
+                                                     desc->array_offset);
+                offs = addr - ptr_to_u64(info_linear->data);
+                bpf_prog_info_set_offset_u64(&info_linear->info,
+                                             desc->array_offset, offs);
+        }
+}
+
+void bpf_program__bpil_offs_to_addr(struct bpf_prog_info_linear *info_linear)
+{
+        int i;
+
+        for (i = BPF_PROG_INFO_FIRST_ARRAY; i < BPF_PROG_INFO_LAST_ARRAY; ++i) {
+                struct bpf_prog_info_array_desc *desc;
+                __u64 addr, offs;
+
+                if ((info_linear->arrays & (1UL << i)) == 0)
+                        continue;
+
+                desc = bpf_prog_info_array_desc + i;
+                offs = bpf_prog_info_read_offset_u64(&info_linear->info,
+                                                     desc->array_offset);
+                addr = offs + ptr_to_u64(info_linear->data);
+                bpf_prog_info_set_offset_u64(&info_linear->info,
+                                             desc->array_offset, addr);
+        }
+}
diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
index b4652aa1a58a..c70785cc8ef5 100644
--- a/tools/lib/bpf/libbpf.h
+++ b/tools/lib/bpf/libbpf.h
@@ -10,6 +10,7 @@
 #ifndef __LIBBPF_LIBBPF_H
 #define __LIBBPF_LIBBPF_H
 
+#include <stdarg.h>
 #include <stdio.h>
 #include <stdint.h>
 #include <stdbool.h>
@@ -377,6 +378,69 @@ LIBBPF_API bool bpf_probe_map_type(enum bpf_map_type map_type, __u32 ifindex);
 LIBBPF_API bool bpf_probe_helper(enum bpf_func_id id,
                                  enum bpf_prog_type prog_type, __u32 ifindex);
 
+/*
+ * Get bpf_prog_info in continuous memory
+ *
+ * struct bpf_prog_info has multiple arrays. The user has option to choose
+ * arrays to fetch from kernel. The following APIs provide an uniform way to
+ * fetch these data. All arrays in bpf_prog_info are stored in a single
+ * continuous memory region. This makes it easy to store the info in a
+ * file.
+ *
+ * Before writing bpf_prog_info_linear to files, it is necessary to
+ * translate pointers in bpf_prog_info to offsets. Helper functions
+ * bpf_program__bpil_addr_to_offs() and bpf_program__bpil_offs_to_addr()
+ * are introduced to switch between pointers and offsets.
+ *
+ * Examples:
+ *   # To fetch map_ids and prog_tags:
+ *   __u64 arrays = (1UL << BPF_PROG_INFO_MAP_IDS) |
+ *           (1UL << BPF_PROG_INFO_PROG_TAGS);
+ *   struct bpf_prog_info_linear *info_linear =
+ *           bpf_program__get_prog_info_linear(fd, arrays);
+ *
+ *   # To save data in file
+ *   bpf_program__bpil_addr_to_offs(info_linear);
+ *   write(f, info_linear, sizeof(*info_linear) + info_linear->data_len);
+ *
+ *   # To read data from file
+ *   read(f, info_linear, <proper_size>);
+ *   bpf_program__bpil_offs_to_addr(info_linear);
+ */
+enum bpf_prog_info_array {
+        BPF_PROG_INFO_FIRST_ARRAY = 0,
+        BPF_PROG_INFO_JITED_INSNS = 0,
+        BPF_PROG_INFO_XLATED_INSNS,
+        BPF_PROG_INFO_MAP_IDS,
+        BPF_PROG_INFO_JITED_KSYMS,
+        BPF_PROG_INFO_JITED_FUNC_LENS,
+        BPF_PROG_INFO_FUNC_INFO,
+        BPF_PROG_INFO_LINE_INFO,
+        BPF_PROG_INFO_JITED_LINE_INFO,
+        BPF_PROG_INFO_PROG_TAGS,
+        BPF_PROG_INFO_LAST_ARRAY,
+};
+
+struct bpf_prog_info_linear {
+        /* size of struct bpf_prog_info, when the tool is compiled */
+        __u32                   info_len;
+        /* total bytes allocated for data, round up to 8 bytes */
+        __u32                   data_len;
+        /* which arrays are included in data */
+        __u64                   arrays;
+        struct bpf_prog_info    info;
+        __u8                    data[];
+};
+
+LIBBPF_API struct bpf_prog_info_linear *
+bpf_program__get_prog_info_linear(int fd, __u64 arrays);
+
+LIBBPF_API void
+bpf_program__bpil_addr_to_offs(struct bpf_prog_info_linear *info_linear);
+
+LIBBPF_API void
+bpf_program__bpil_offs_to_addr(struct bpf_prog_info_linear *info_linear);
+
 #ifdef __cplusplus
 } /* extern "C" */
 #endif
diff --git a/tools/lib/bpf/libbpf.map b/tools/lib/bpf/libbpf.map
index 778a26702a70..f3ce50500cf2 100644
--- a/tools/lib/bpf/libbpf.map
+++ b/tools/lib/bpf/libbpf.map
@@ -153,4 +153,7 @@ LIBBPF_0.0.2 {
                 xsk_socket__delete;
                 xsk_umem__fd;
                 xsk_socket__fd;
+                bpf_program__get_prog_info_linear;
+                bpf_program__bpil_addr_to_offs;
+                bpf_program__bpil_offs_to_addr;
 } LIBBPF_0.0.1;
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 0414a0d52262..5dde107083c6 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -2184,9 +2184,10 @@ static void cleanup(struct objtool_file *file)
         elf_close(file->elf);
 }
 
+static struct objtool_file file;
+
 int check(const char *_objname, bool orc)
 {
-        struct objtool_file file;
         int ret, warnings = 0;
 
         objname = _objname;
diff --git a/tools/perf/Documentation/Build.txt b/tools/perf/Documentation/Build.txt
index f6fc6507ba55..3766886c4bca 100644
--- a/tools/perf/Documentation/Build.txt
+++ b/tools/perf/Documentation/Build.txt
@@ -47,3 +47,27 @@ Those objects are then used in final linking:
 
 NOTE this description is omitting other libraries involved, only
      focusing on build framework outcomes
+
+3) Build with ASan or UBSan
+==========================
+  $ cd tools/perf
+  $ make DESTDIR=/usr
+  $ make DESTDIR=/usr install
+
+AddressSanitizer (or ASan) is a GCC feature that detects memory corruption bugs
+such as buffer overflows and memory leaks.
+
+  $ cd tools/perf
+  $ make DEBUG=1 EXTRA_CFLAGS='-fno-omit-frame-pointer -fsanitize=address'
+  $ ASAN_OPTIONS=log_path=asan.log ./perf record -a
+
+ASan outputs all detected issues into a log file named 'asan.log.<pid>'.
+
+UndefinedBehaviorSanitizer (or UBSan) is a fast undefined behavior detector
+supported by GCC. UBSan detects undefined behaviors of programs at runtime.
+
+  $ cd tools/perf
+  $ make DEBUG=1 EXTRA_CFLAGS='-fno-omit-frame-pointer -fsanitize=undefined'
+  $ UBSAN_OPTIONS=print_stacktrace=1 ./perf record -a
+
+If UBSan detects any problem at runtime, it outputs a “runtime error:” message.
diff --git a/tools/perf/Documentation/perf-config.txt b/tools/perf/Documentation/perf-config.txt
index 86f3dcc15f83..462b3cde0675 100644
--- a/tools/perf/Documentation/perf-config.txt
+++ b/tools/perf/Documentation/perf-config.txt
@@ -114,7 +114,7 @@ Given a $HOME/.perfconfig like this:
 
         [report]
                 # Defaults
-                sort-order = comm,dso,symbol
+                sort_order = comm,dso,symbol
                 percent-limit = 0
                 queue-size = 0
                 children = true
@@ -584,6 +584,20 @@ llvm.*::
         llvm.opts::
                 Options passed to llc.
 
+samples.*::
+
+        samples.context::
+                Define how many ns worth of time to show
+                around samples in perf report sample context browser.
+
+scripts.*::
+
+        Any option defines a script that is added to the scripts menu
+        in the interactive perf browser and whose output is displayed.
+        The name of the option is the name, the value is a script command line.
+        The script gets the same options passed as a full perf script,
+        in particular -i perfdata file, --cpu, --tid
+
 SEE ALSO
 --------
 linkperf:perf[1]
diff --git a/tools/perf/Documentation/perf-record.txt b/tools/perf/Documentation/perf-record.txt
index 8f0c2be34848..8fe4dffcadd0 100644
--- a/tools/perf/Documentation/perf-record.txt
+++ b/tools/perf/Documentation/perf-record.txt
@@ -495,6 +495,10 @@ overhead. You can still switch them on with:
 
   --switch-output --no-no-buildid  --no-no-buildid-cache
 
+--switch-max-files=N::
+
+When rotating perf.data with --switch-output, only keep N files.
+
 --dry-run::
 Parse options then exit. --dry-run can be used to detect errors in cmdline
 options.
diff --git a/tools/perf/Documentation/perf-report.txt b/tools/perf/Documentation/perf-report.txt
index 1a27bfe05039..f441baa794ce 100644
--- a/tools/perf/Documentation/perf-report.txt
+++ b/tools/perf/Documentation/perf-report.txt
@@ -105,6 +105,8 @@ OPTIONS
         guest machine
         - sample: Number of sample
         - period: Raw number of event count of sample
+        - time: Separate the samples by time stamp with the resolution specified by
+        --time-quantum (default 100ms). Specify with overhead and before it.
 
         By default, comm, dso and symbol keys are used.
         (i.e. --sort comm,dso,symbol)
@@ -459,6 +461,10 @@ include::itrace.txt[]
 --socket-filter::
         Only report the samples on the processor socket that match with this filter
 
+--samples=N::
+        Save N individual samples for each histogram entry to show context in perf
+        report tui browser.
+
 --raw-trace::
         When displaying traceevent output, do not use print fmt or plugins.
 
@@ -477,6 +483,9 @@ include::itrace.txt[]
         Please note that not all mmaps are stored, options affecting which ones
         are include 'perf record --data', for instance.
 
+--ns::
+        Show time stamps in nanoseconds.
+
 --stats::
         Display overall events statistics without any further processing.
         (like the one at the end of the perf report -D command)
@@ -494,6 +503,10 @@ include::itrace.txt[]
         The period/hits keywords set the base the percentage is computed
         on - the samples period or the number of samples (hits).
 
+--time-quantum::
+        Configure time quantum for time sort key. Default 100ms.
+        Accepts s, us, ms, ns units.
+
 include::callchain-overhead-calculation.txt[]
 
 SEE ALSO
diff --git a/tools/perf/Documentation/perf-script.txt b/tools/perf/Documentation/perf-script.txt
index 2e19fd7ffe35..9b0d04dd2a61 100644
--- a/tools/perf/Documentation/perf-script.txt
+++ b/tools/perf/Documentation/perf-script.txt
@@ -380,6 +380,9 @@ include::itrace.txt[]
         Set the maximum number of program blocks to print with brstackasm for
         each sample.
 
+--reltime::
+        Print time stamps relative to trace start.
+
 --per-event-dump::
         Create per event files with a "perf.data.EVENT.dump" name instead of
         printing to stdout, useful, for instance, for generating flamegraphs.
diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt
index 4bc2085e5197..39c05f89104e 100644
--- a/tools/perf/Documentation/perf-stat.txt
+++ b/tools/perf/Documentation/perf-stat.txt
@@ -72,9 +72,8 @@ report::
 --all-cpus::
         system-wide collection from all CPUs (default if no target is specified)
 
--c::
---scale::
-        scale/normalize counter values
+--no-scale::
+        Don't scale/normalize counter values
 
 -d::
 --detailed::
diff --git a/tools/perf/Documentation/tips.txt b/tools/perf/Documentation/tips.txt
index 849599f39c5e..869965d629ce 100644
--- a/tools/perf/Documentation/tips.txt
+++ b/tools/perf/Documentation/tips.txt
@@ -15,6 +15,7 @@ To see callchains in a more compact form: perf report -g folded
 Show individual samples with: perf script
 Limit to show entries above 5% only: perf report --percent-limit 5
 Profiling branch (mis)predictions with: perf record -b / perf report
+To show assembler sample contexts use perf record -b / perf script -F +brstackinsn --xed
 Treat branches as callchains: perf report --branch-history
 To count events in every 1000 msec: perf stat -I 1000
 Print event counts in CSV format with: perf stat -x,
@@ -34,3 +35,9 @@ Show current config key-value pairs: perf config --list
 Show user configuration overrides: perf config --user --list
 To add Node.js USDT(User-Level Statically Defined Tracing): perf buildid-cache --add `which node`
 To report cacheline events from previous recording: perf c2c report
+To browse sample contexts use perf report --sample 10 and select in context menu
+To separate samples by time use perf report --sort time,overhead,sym
+To set sample time separation other than 100ms with --sort time use --time-quantum
+Add -I to perf report to sample register values visible in perf report context.
+To show IPC for sampling periods use perf record -e '{cycles,instructions}:S' and then browse context
+To show context switches in perf report sample context add --switch-events to perf record.
diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
index 0f11d5891301..fe3f97e342fa 100644
--- a/tools/perf/Makefile.config
+++ b/tools/perf/Makefile.config
@@ -227,6 +227,8 @@ FEATURE_CHECK_LDFLAGS-libpython-version := $(PYTHON_EMBED_LDOPTS)
 
 FEATURE_CHECK_LDFLAGS-libaio = -lrt
 
+FEATURE_CHECK_LDFLAGS-disassembler-four-args = -lbfd -lopcodes
+
 CFLAGS += -fno-omit-frame-pointer
 CFLAGS += -ggdb3
 CFLAGS += -funwind-tables
@@ -713,7 +715,7 @@ else
 endif
 
 ifeq ($(feature-libbfd), 1)
-  EXTLIBS += -lbfd
+  EXTLIBS += -lbfd -lopcodes
 else
   # we are on a system that requires -liberty and (maybe) -lz
   # to link against -lbfd; test each case individually here
@@ -724,12 +726,15 @@ else
   $(call feature_check,libbfd-liberty-z)
 
   ifeq ($(feature-libbfd-liberty), 1)
-    EXTLIBS += -lbfd -liberty
+    EXTLIBS += -lbfd -lopcodes -liberty
+    FEATURE_CHECK_LDFLAGS-disassembler-four-args += -liberty -ldl
   else
     ifeq ($(feature-libbfd-liberty-z), 1)
-      EXTLIBS += -lbfd -liberty -lz
+      EXTLIBS += -lbfd -lopcodes -liberty -lz
+      FEATURE_CHECK_LDFLAGS-disassembler-four-args += -liberty -lz -ldl
     endif
   endif
+  $(call feature_check,disassembler-four-args)
 endif
 
 ifdef NO_DEMANGLE
@@ -808,6 +813,10 @@ ifdef HAVE_KVM_STAT_SUPPORT
     CFLAGS += -DHAVE_KVM_STAT_SUPPORT
 endif
 
+ifeq ($(feature-disassembler-four-args), 1)
+    CFLAGS += -DDISASM_FOUR_ARGS_SIGNATURE
+endif
+
 ifeq (${IS_64_BIT}, 1)
   ifndef NO_PERF_READ_VDSO32
     $(call feature_check,compile-32)
diff --git a/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl b/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl
index f0b1709a5ffb..2ae92fddb6d5 100644
--- a/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl
+++ b/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl
@@ -343,6 +343,8 @@
 332     common  statx                   __x64_sys_statx
 333     common  io_pgetevents           __x64_sys_io_pgetevents
 334     common  rseq                    __x64_sys_rseq
+# don't use numbers 387 through 423, add new calls after the last
+# 'common' entry
 
 #
 # x32-specific system call numbers start at 512 to avoid cache impact
@@ -361,7 +363,7 @@
 520     x32     execve                  __x32_compat_sys_execve/ptregs
 521     x32     ptrace                  __x32_compat_sys_ptrace
 522     x32     rt_sigpending           __x32_compat_sys_rt_sigpending
-523     x32     rt_sigtimedwait         __x32_compat_sys_rt_sigtimedwait
+523     x32     rt_sigtimedwait         __x32_compat_sys_rt_sigtimedwait_time64
 524     x32     rt_sigqueueinfo         __x32_compat_sys_rt_sigqueueinfo
 525     x32     sigaltstack             __x32_compat_sys_sigaltstack
 526     x32     timer_create            __x32_compat_sys_timer_create
@@ -375,7 +377,7 @@
 534     x32     preadv                  __x32_compat_sys_preadv64
 535     x32     pwritev                 __x32_compat_sys_pwritev64
 536     x32     rt_tgsigqueueinfo       __x32_compat_sys_rt_tgsigqueueinfo
-537     x32     recvmmsg                __x32_compat_sys_recvmmsg
+537     x32     recvmmsg                __x32_compat_sys_recvmmsg_time64
 538     x32     sendmmsg                __x32_compat_sys_sendmmsg
 539     x32     process_vm_readv        __x32_compat_sys_process_vm_readv
 540     x32     process_vm_writev       __x32_compat_sys_process_vm_writev
diff --git a/tools/perf/arch/x86/util/Build b/tools/perf/arch/x86/util/Build
index 7aab0be5fc5f..47f9c56e744f 100644
--- a/tools/perf/arch/x86/util/Build
+++ b/tools/perf/arch/x86/util/Build
@@ -14,5 +14,6 @@ perf-$(CONFIG_LOCAL_LIBUNWIND)    += unwind-libunwind.o
 perf-$(CONFIG_LIBDW_DWARF_UNWIND) += unwind-libdw.o
 
 perf-$(CONFIG_AUXTRACE) += auxtrace.o
+perf-$(CONFIG_AUXTRACE) += archinsn.o
 perf-$(CONFIG_AUXTRACE) += intel-pt.o
 perf-$(CONFIG_AUXTRACE) += intel-bts.o
diff --git a/tools/perf/arch/x86/util/archinsn.c b/tools/perf/arch/x86/util/archinsn.c
new file mode 100644
index 000000000000..4237bb2e7fa2
--- /dev/null
+++ b/tools/perf/arch/x86/util/archinsn.c
@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: GPL-2.0
+#include "perf.h"
+#include "archinsn.h"
+#include "util/intel-pt-decoder/insn.h"
+#include "machine.h"
+#include "thread.h"
+#include "symbol.h"
+
+void arch_fetch_insn(struct perf_sample *sample,
+                     struct thread *thread,
+                     struct machine *machine)
+{
+        struct insn insn;
+        int len;
+        bool is64bit = false;
+
+        if (!sample->ip)
+                return;
+        len = thread__memcpy(thread, machine, sample->insn, sample->ip, sizeof(sample->insn), &is64bit);
+        if (len <= 0)
+                return;
+        insn_init(&insn, sample->insn, len, is64bit);
+        insn_get_length(&insn);
+        if (insn_complete(&insn) && insn.length <= len)
+                sample->insn_len = insn.length;
+}
diff --git a/tools/perf/bench/epoll-ctl.c b/tools/perf/bench/epoll-ctl.c
index 0c0a6e824934..2af067859966 100644
--- a/tools/perf/bench/epoll-ctl.c
+++ b/tools/perf/bench/epoll-ctl.c
@@ -224,7 +224,7 @@ static int do_threads(struct worker *worker, struct cpu_map *cpu)
         pthread_attr_t thread_attr, *attrp = NULL;
         cpu_set_t cpuset;
         unsigned int i, j;
-        int ret;
+        int ret = 0;
 
         if (!noaffinity)
                 pthread_attr_init(&thread_attr);
diff --git a/tools/perf/bench/epoll-wait.c b/tools/perf/bench/epoll-wait.c
index 5a11534e96a0..fe85448abd45 100644
--- a/tools/perf/bench/epoll-wait.c
+++ b/tools/perf/bench/epoll-wait.c
@@ -293,7 +293,7 @@ static int do_threads(struct worker *worker, struct cpu_map *cpu)
         pthread_attr_t thread_attr, *attrp = NULL;
         cpu_set_t cpuset;
         unsigned int i, j;
-        int ret, events = EPOLLIN;
+        int ret = 0, events = EPOLLIN;
 
         if (oneshot)
                 events |= EPOLLONESHOT;
diff --git a/tools/perf/builtin-list.c b/tools/perf/builtin-list.c
index c9f98d00c0e9..a8394b4f1167 100644
--- a/tools/perf/builtin-list.c
+++ b/tools/perf/builtin-list.c
@@ -119,7 +119,7 @@ int cmd_list(int argc, const char **argv)
                                                 details_flag);
                         print_tracepoint_events(NULL, s, raw_dump);
                         print_sdt_events(NULL, s, raw_dump);
-                        metricgroup__print(true, true, NULL, raw_dump, details_flag);
+                        metricgroup__print(true, true, s, raw_dump, details_flag);
                         free(s);
                 }
         }
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index f3f7f3100336..4e2d953d4bc5 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -62,6 +62,9 @@ struct switch_output {
         unsigned long    time;
         const char      *str;
         bool             set;
+        char             **filenames;
+        int              num_files;
+        int              cur_file;
 };
 
 struct record {
@@ -392,7 +395,7 @@ static int record__process_auxtrace(struct perf_tool *tool,
         size_t padding;
         u8 pad[8] = {0};
 
-        if (!perf_data__is_pipe(data)) {
+        if (!perf_data__is_pipe(data) && !perf_data__is_dir(data)) {
                 off_t file_offset;
                 int fd = perf_data__fd(data);
                 int err;
@@ -837,6 +840,8 @@ static void record__init_features(struct record *rec)
         if (!(rec->opts.use_clockid && rec->opts.clockid_res_ns))
                 perf_header__clear_feat(&session->header, HEADER_CLOCKID);
 
+        perf_header__clear_feat(&session->header, HEADER_DIR_FORMAT);
+
         perf_header__clear_feat(&session->header, HEADER_STAT);
 }
 
@@ -890,6 +895,7 @@ record__switch_output(struct record *rec, bool at_exit)
 {
         struct perf_data *data = &rec->data;
         int fd, err;
+        char *new_filename;
 
         /* Same Size:      "2015122520103046"*/
         char timestamp[] = "InvalidTimestamp";
@@ -910,7 +916,7 @@ record__switch_output(struct record *rec, bool at_exit)
 
         fd = perf_data__switch(data, timestamp,
                                     rec->session->header.data_offset,
-                                    at_exit);
+                                    at_exit, &new_filename);
         if (fd >= 0 && !at_exit) {
                 rec->bytes_written = 0;
                 rec->session->header.data_size = 0;
@@ -920,6 +926,21 @@ record__switch_output(struct record *rec, bool at_exit)
                 fprintf(stderr, "[ perf record: Dump %s.%s ]\n",
                         data->path, timestamp);
 
+        if (rec->switch_output.num_files) {
+                int n = rec->switch_output.cur_file + 1;
+
+                if (n >= rec->switch_output.num_files)
+                        n = 0;
+                rec->switch_output.cur_file = n;
+                if (rec->switch_output.filenames[n]) {
+                        remove(rec->switch_output.filenames[n]);
+                        free(rec->switch_output.filenames[n]);
+                }
+                rec->switch_output.filenames[n] = new_filename;
+        } else {
+                free(new_filename);
+        }
+
         /* Output tracking events */
         if (!at_exit) {
                 record__synthesize(rec, false);
@@ -1093,7 +1114,7 @@ static int record__synthesize(struct record *rec, bool tail)
                 return err;
         }
 
-        err = perf_event__synthesize_bpf_events(tool, process_synthesized_event,
+        err = perf_event__synthesize_bpf_events(session, process_synthesized_event,
                                                 machine, opts);
         if (err < 0)
                 pr_warning("Couldn't synthesize bpf events.\n");
@@ -1116,6 +1137,7 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)
         struct perf_data *data = &rec->data;
         struct perf_session *session;
         bool disabled = false, draining = false;
+        struct perf_evlist *sb_evlist = NULL;
         int fd;
 
         atexit(record__sig_exit);
@@ -1216,6 +1238,14 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)
                 goto out_child;
         }
 
+        if (!opts->no_bpf_event)
+                bpf_event__add_sb_event(&sb_evlist, &session->header.env);
+
+        if (perf_evlist__start_sb_thread(sb_evlist, &rec->opts.target)) {
+                pr_debug("Couldn't start the BPF side band thread:\nBPF programs starting from now on won't be annotatable\n");
+                opts->no_bpf_event = true;
+        }
+
         err = record__synthesize(rec, false);
         if (err < 0)
                 goto out_child;
@@ -1466,6 +1496,9 @@ out_child:
 
 out_delete_session:
         perf_session__delete(session);
+
+        if (!opts->no_bpf_event)
+                perf_evlist__stop_sb_thread(sb_evlist);
         return status;
 }
 
@@ -1870,7 +1903,7 @@ static struct option __record_options[] = {
         OPT_BOOLEAN(0, "tail-synthesize", &record.opts.tail_synthesize,
                     "synthesize non-sample events at the end of output"),
         OPT_BOOLEAN(0, "overwrite", &record.opts.overwrite, "use overwrite mode"),
-        OPT_BOOLEAN(0, "bpf-event", &record.opts.bpf_event, "record bpf events"),
+        OPT_BOOLEAN(0, "no-bpf-event", &record.opts.no_bpf_event, "record bpf events"),
         OPT_BOOLEAN(0, "strict-freq", &record.opts.strict_freq,
                     "Fail if the specified frequency can't be used"),
         OPT_CALLBACK('F', "freq", &record.opts, "freq or 'max'",
@@ -1968,9 +2001,11 @@ static struct option __record_options[] = {
         OPT_BOOLEAN(0, "timestamp-boundary", &record.timestamp_boundary,
                     "Record timestamp boundary (time of first/last samples)"),
         OPT_STRING_OPTARG_SET(0, "switch-output", &record.switch_output.str,
-                          &record.switch_output.set, "signal,size,time",
-                          "Switch output when receive SIGUSR2 or cross size,time threshold",
+                          &record.switch_output.set, "signal or size[BKMG] or time[smhd]",
+                          "Switch output when receiving SIGUSR2 (signal) or cross a size or time threshold",
                           "signal"),
+        OPT_INTEGER(0, "switch-max-files", &record.switch_output.num_files,
+                   "Limit number of switch output generated files"),
         OPT_BOOLEAN(0, "dry-run", &dry_run,
                     "Parse options then exit"),
 #ifdef HAVE_AIO_SUPPORT
@@ -2057,6 +2092,13 @@ int cmd_record(int argc, const char **argv)
                 alarm(rec->switch_output.time);
         }
 
+        if (rec->switch_output.num_files) {
+                rec->switch_output.filenames = calloc(sizeof(char *),
+                                                      rec->switch_output.num_files);
+                if (!rec->switch_output.filenames)
+                        return -EINVAL;
+        }
+
         /*
          * Allow aliases to facilitate the lookup of symbols for address
          * filters. Refer to auxtrace_parse_filters().
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index ee93c18a6685..4054eb1f98ac 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -47,9 +47,11 @@
 #include <errno.h>
 #include <inttypes.h>
 #include <regex.h>
+#include "sane_ctype.h"
 #include <signal.h>
 #include <linux/bitmap.h>
 #include <linux/stringify.h>
+#include <linux/time64.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <unistd.h>
@@ -926,6 +928,43 @@ report_parse_callchain_opt(const struct option *opt, const char *arg, int unset)
         return parse_callchain_report_opt(arg);
 }
 
+static int
+parse_time_quantum(const struct option *opt, const char *arg,
+                   int unset __maybe_unused)
+{
+        unsigned long *time_q = opt->value;
+        char *end;
+
+        *time_q = strtoul(arg, &end, 0);
+        if (end == arg)
+                goto parse_err;
+        if (*time_q == 0) {
+                pr_err("time quantum cannot be 0");
+                return -1;
+        }
+        while (isspace(*end))
+                end++;
+        if (*end == 0)
+                return 0;
+        if (!strcmp(end, "s")) {
+                *time_q *= NSEC_PER_SEC;
+                return 0;
+        }
+        if (!strcmp(end, "ms")) {
+                *time_q *= NSEC_PER_MSEC;
+                return 0;
+        }
+        if (!strcmp(end, "us")) {
+                *time_q *= NSEC_PER_USEC;
+                return 0;
+        }
+        if (!strcmp(end, "ns"))
+                return 0;
+parse_err:
+        pr_err("Cannot parse time quantum `%s'\n", arg);
+        return -1;
+}
+
 int
 report_parse_ignore_callees_opt(const struct option *opt __maybe_unused,
                                 const char *arg, int unset __maybe_unused)
@@ -1044,10 +1083,9 @@ int cmd_report(int argc, const char **argv)
         OPT_BOOLEAN(0, "header-only", &report.header_only,
                     "Show only data header."),
         OPT_STRING('s', "sort", &sort_order, "key[,key2...]",
-                   "sort by key(s): pid, comm, dso, symbol, parent, cpu, srcline, ..."
-                   " Please refer the man page for the complete list."),
+                   sort_help("sort by key(s):")),
         OPT_STRING('F', "fields", &field_order, "key[,keys...]",
-                   "output field(s): overhead, period, sample plus all of sort keys"),
+                   sort_help("output field(s): overhead period sample ")),
         OPT_BOOLEAN(0, "show-cpu-utilization", &symbol_conf.show_cpu_utilization,
                     "Show sample percentage for different cpu modes"),
         OPT_BOOLEAN_FLAG(0, "showcpuutilization", &symbol_conf.show_cpu_utilization,
@@ -1120,6 +1158,8 @@ int cmd_report(int argc, const char **argv)
         OPT_BOOLEAN(0, "demangle-kernel", &symbol_conf.demangle_kernel,
                     "Enable kernel symbol demangling"),
         OPT_BOOLEAN(0, "mem-mode", &report.mem_mode, "mem access profile"),
+        OPT_INTEGER(0, "samples", &symbol_conf.res_sample,
+                    "Number of samples to save per histogram entry for individual browsing"),
         OPT_CALLBACK(0, "percent-limit", &report, "percent",
                      "Don't show entries under that percent", parse_percent_limit),
         OPT_CALLBACK(0, "percentage", NULL, "relative|absolute",
@@ -1147,6 +1187,10 @@ int cmd_report(int argc, const char **argv)
         OPT_CALLBACK(0, "percent-type", &report.annotation_opts, "local-period",
                      "Set percent type local/global-period/hits",
                      annotate_parse_percent_type),
+        OPT_BOOLEAN(0, "ns", &symbol_conf.nanosecs, "Show times in nanosecs"),
+        OPT_CALLBACK(0, "time-quantum", &symbol_conf.time_quantum, "time (ms|us|ns|s)",
+                     "Set time quantum for time sort key (default 100ms)",
+                     parse_time_quantum),
         OPT_END()
         };
         struct perf_data data = {
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index 53f78cf3113f..61cfd8f70989 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -29,10 +29,12 @@
 #include "util/time-utils.h"
 #include "util/path.h"
 #include "print_binary.h"
+#include "archinsn.h"
 #include <linux/bitmap.h>
 #include <linux/kernel.h>
 #include <linux/stringify.h>
 #include <linux/time64.h>
+#include <sys/utsname.h>
 #include "asm/bug.h"
 #include "util/mem-events.h"
 #include "util/dump-insn.h"
@@ -51,6 +53,8 @@
 
 static char const               *script_name;
 static char const               *generate_script_lang;
+static bool                     reltime;
+static u64                      initial_time;
 static bool                     debug_mode;
 static u64                      last_timestamp;
 static u64                      nr_unordered;
@@ -58,11 +62,11 @@ static bool			no_callchain;
 static bool                     latency_format;
 static bool                     system_wide;
 static bool                     print_flags;
-static bool                     nanosecs;
 static const char               *cpu_list;
 static DECLARE_BITMAP(cpu_bitmap, MAX_NR_CPUS);
 static struct perf_stat_config  stat_config;
 static int                      max_blocks;
+static bool                     native_arch;
 
 unsigned int scripting_max_stack = PERF_MAX_STACK_DEPTH;
 
@@ -684,15 +688,21 @@ static int perf_sample__fprintf_start(struct perf_sample *sample,
         }
 
         if (PRINT_FIELD(TIME)) {
-                nsecs = sample->time;
+                u64 t = sample->time;
+                if (reltime) {
+                        if (!initial_time)
+                                initial_time = sample->time;
+                        t = sample->time - initial_time;
+                }
+                nsecs = t;
                 secs = nsecs / NSEC_PER_SEC;
                 nsecs -= secs * NSEC_PER_SEC;
 
-                if (nanosecs)
+                if (symbol_conf.nanosecs)
                         printed += fprintf(fp, "%5lu.%09llu: ", secs, nsecs);
                 else {
                         char sample_time[32];
-                        timestamp__scnprintf_usec(sample->time, sample_time, sizeof(sample_time));
+                        timestamp__scnprintf_usec(t, sample_time, sizeof(sample_time));
                         printed += fprintf(fp, "%12s: ", sample_time);
                 }
         }
@@ -1227,6 +1237,12 @@ static int perf_sample__fprintf_callindent(struct perf_sample *sample,
         return len + dlen;
 }
 
+__weak void arch_fetch_insn(struct perf_sample *sample __maybe_unused,
+                            struct thread *thread __maybe_unused,
+                            struct machine *machine __maybe_unused)
+{
+}
+
 static int perf_sample__fprintf_insn(struct perf_sample *sample,
                                      struct perf_event_attr *attr,
                                      struct thread *thread,
@@ -1234,9 +1250,12 @@ static int perf_sample__fprintf_insn(struct perf_sample *sample,
 {
         int printed = 0;
 
+        if (sample->insn_len == 0 && native_arch)
+                arch_fetch_insn(sample, thread, machine);
+
         if (PRINT_FIELD(INSNLEN))
                 printed += fprintf(fp, " ilen: %d", sample->insn_len);
-        if (PRINT_FIELD(INSN)) {
+        if (PRINT_FIELD(INSN) && sample->insn_len) {
                 int i;
 
                 printed += fprintf(fp, " insn:");
@@ -1922,6 +1941,13 @@ static int cleanup_scripting(void)
         return scripting_ops ? scripting_ops->stop_script() : 0;
 }
 
+static bool filter_cpu(struct perf_sample *sample)
+{
+        if (cpu_list)
+                return !test_bit(sample->cpu, cpu_bitmap);
+        return false;
+}
+
 static int process_sample_event(struct perf_tool *tool,
                                 union perf_event *event,
                                 struct perf_sample *sample,
@@ -1956,7 +1982,7 @@ static int process_sample_event(struct perf_tool *tool,
         if (al.filtered)
                 goto out_put;
 
-        if (cpu_list && !test_bit(sample->cpu, cpu_bitmap))
+        if (filter_cpu(sample))
                 goto out_put;
 
         if (scripting_ops)
@@ -2041,9 +2067,11 @@ static int process_comm_event(struct perf_tool *tool,
                 sample->tid = event->comm.tid;
                 sample->pid = event->comm.pid;
         }
-        perf_sample__fprintf_start(sample, thread, evsel,
+        if (!filter_cpu(sample)) {
+                perf_sample__fprintf_start(sample, thread, evsel,
                                    PERF_RECORD_COMM, stdout);
-        perf_event__fprintf(event, stdout);
+                perf_event__fprintf(event, stdout);
+        }
         ret = 0;
 out:
         thread__put(thread);
@@ -2077,9 +2105,11 @@ static int process_namespaces_event(struct perf_tool *tool,
                 sample->tid = event->namespaces.tid;
                 sample->pid = event->namespaces.pid;
         }
-        perf_sample__fprintf_start(sample, thread, evsel,
-                                   PERF_RECORD_NAMESPACES, stdout);
-        perf_event__fprintf(event, stdout);
+        if (!filter_cpu(sample)) {
+                perf_sample__fprintf_start(sample, thread, evsel,
+                                           PERF_RECORD_NAMESPACES, stdout);
+                perf_event__fprintf(event, stdout);
+        }
         ret = 0;
 out:
         thread__put(thread);
@@ -2111,9 +2141,11 @@ static int process_fork_event(struct perf_tool *tool,
                 sample->tid = event->fork.tid;
                 sample->pid = event->fork.pid;
         }
-        perf_sample__fprintf_start(sample, thread, evsel,
-                                   PERF_RECORD_FORK, stdout);
-        perf_event__fprintf(event, stdout);
+        if (!filter_cpu(sample)) {
+                perf_sample__fprintf_start(sample, thread, evsel,
+                                           PERF_RECORD_FORK, stdout);
+                perf_event__fprintf(event, stdout);
+        }
         thread__put(thread);
 
         return 0;
@@ -2141,9 +2173,11 @@ static int process_exit_event(struct perf_tool *tool,
                 sample->tid = event->fork.tid;
                 sample->pid = event->fork.pid;
         }
-        perf_sample__fprintf_start(sample, thread, evsel,
-                                   PERF_RECORD_EXIT, stdout);
-        perf_event__fprintf(event, stdout);
+        if (!filter_cpu(sample)) {
+                perf_sample__fprintf_start(sample, thread, evsel,
+                                           PERF_RECORD_EXIT, stdout);
+                perf_event__fprintf(event, stdout);
+        }
 
         if (perf_event__process_exit(tool, event, sample, machine) < 0)
                 err = -1;
@@ -2177,9 +2211,11 @@ static int process_mmap_event(struct perf_tool *tool,
                 sample->tid = event->mmap.tid;
                 sample->pid = event->mmap.pid;
         }
-        perf_sample__fprintf_start(sample, thread, evsel,
-                                   PERF_RECORD_MMAP, stdout);
-        perf_event__fprintf(event, stdout);
+        if (!filter_cpu(sample)) {
+                perf_sample__fprintf_start(sample, thread, evsel,
+                                           PERF_RECORD_MMAP, stdout);
+                perf_event__fprintf(event, stdout);
+        }
         thread__put(thread);
         return 0;
 }
@@ -2209,9 +2245,11 @@ static int process_mmap2_event(struct perf_tool *tool,
                 sample->tid = event->mmap2.tid;
                 sample->pid = event->mmap2.pid;
         }
-        perf_sample__fprintf_start(sample, thread, evsel,
-                                   PERF_RECORD_MMAP2, stdout);
-        perf_event__fprintf(event, stdout);
+        if (!filter_cpu(sample)) {
+                perf_sample__fprintf_start(sample, thread, evsel,
+                                           PERF_RECORD_MMAP2, stdout);
+                perf_event__fprintf(event, stdout);
+        }
         thread__put(thread);
         return 0;
 }
@@ -2236,9 +2274,11 @@ static int process_switch_event(struct perf_tool *tool,
                 return -1;
         }
 
-        perf_sample__fprintf_start(sample, thread, evsel,
-                                   PERF_RECORD_SWITCH, stdout);
-        perf_event__fprintf(event, stdout);
+        if (!filter_cpu(sample)) {
+                perf_sample__fprintf_start(sample, thread, evsel,
+                                           PERF_RECORD_SWITCH, stdout);
+                perf_event__fprintf(event, stdout);
+        }
         thread__put(thread);
         return 0;
 }
@@ -2259,9 +2299,11 @@ process_lost_event(struct perf_tool *tool,
         if (thread == NULL)
                 return -1;
 
-        perf_sample__fprintf_start(sample, thread, evsel,
-                                   PERF_RECORD_LOST, stdout);
-        perf_event__fprintf(event, stdout);
+        if (!filter_cpu(sample)) {
+                perf_sample__fprintf_start(sample, thread, evsel,
+                                           PERF_RECORD_LOST, stdout);
+                perf_event__fprintf(event, stdout);
+        }
         thread__put(thread);
         return 0;
 }
@@ -2948,7 +2990,8 @@ static int check_ev_match(char *dir_name, char *scriptname,
  * will list all statically runnable scripts, select one, execute it and
  * show the output in a perf browser.
  */
-int find_scripts(char **scripts_array, char **scripts_path_array)
+int find_scripts(char **scripts_array, char **scripts_path_array, int num,
+                 int pathlen)
 {
         struct dirent *script_dirent, *lang_dirent;
         char scripts_path[MAXPATHLEN], lang_path[MAXPATHLEN];
@@ -2993,7 +3036,10 @@ int find_scripts(char **scripts_array, char **scripts_path_array)
                         /* Skip those real time scripts: xxxtop.p[yl] */
                         if (strstr(script_dirent->d_name, "top."))
                                 continue;
-                        sprintf(scripts_path_array[i], "%s/%s", lang_path,
+                        if (i >= num)
+                                break;
+                        snprintf(scripts_path_array[i], pathlen, "%s/%s",
+                                lang_path,
                                 script_dirent->d_name);
                         temp = strchr(script_dirent->d_name, '.');
                         snprintf(scripts_array[i],
@@ -3232,7 +3278,7 @@ static int parse_insn_trace(const struct option *opt __maybe_unused,
 {
         parse_output_fields(NULL, "+insn,-event,-period", 0);
         itrace_parse_synth_opts(opt, "i0ns", 0);
-        nanosecs = true;
+        symbol_conf.nanosecs = true;
         return 0;
 }
 
@@ -3250,7 +3296,7 @@ static int parse_call_trace(const struct option *opt __maybe_unused,
 {
         parse_output_fields(NULL, "-ip,-addr,-event,-period,+callindent", 0);
         itrace_parse_synth_opts(opt, "cewp", 0);
-        nanosecs = true;
+        symbol_conf.nanosecs = true;
         return 0;
 }
 
@@ -3260,7 +3306,7 @@ static int parse_callret_trace(const struct option *opt __maybe_unused,
 {
         parse_output_fields(NULL, "-ip,-addr,-event,-period,+callindent,+flags", 0);
         itrace_parse_synth_opts(opt, "crewp", 0);
-        nanosecs = true;
+        symbol_conf.nanosecs = true;
         return 0;
 }
 
@@ -3277,6 +3323,7 @@ int cmd_script(int argc, const char **argv)
                 .set = false,
                 .default_no_sample = true,
         };
+        struct utsname uts;
         char *script_path = NULL;
         const char **__argv;
         int i, j, err = 0;
@@ -3374,6 +3421,7 @@ int cmd_script(int argc, const char **argv)
                      "Set the maximum stack depth when parsing the callchain, "
                      "anything beyond the specified depth will be ignored. "
                      "Default: kernel.perf_event_max_stack or " __stringify(PERF_MAX_STACK_DEPTH)),
+        OPT_BOOLEAN(0, "reltime", &reltime, "Show time stamps relative to start"),
         OPT_BOOLEAN('I', "show-info", &show_full_info,
                     "display extended information from perf.data file"),
         OPT_BOOLEAN('\0', "show-kernel-path", &symbol_conf.show_kernel_path,
@@ -3395,7 +3443,7 @@ int cmd_script(int argc, const char **argv)
         OPT_BOOLEAN('f', "force", &symbol_conf.force, "don't complain, do it"),
         OPT_INTEGER(0, "max-blocks", &max_blocks,
                     "Maximum number of code blocks to dump with brstackinsn"),
-        OPT_BOOLEAN(0, "ns", &nanosecs,
+        OPT_BOOLEAN(0, "ns", &symbol_conf.nanosecs,
                     "Use 9 decimal places when displaying time"),
         OPT_CALLBACK_OPTARG(0, "itrace", &itrace_synth_opts, NULL, "opts",
                             "Instruction Tracing options\n" ITRACE_HELP,
@@ -3448,6 +3496,11 @@ int cmd_script(int argc, const char **argv)
                 }
         }
 
+        if (script.time_str && reltime) {
+                fprintf(stderr, "Don't combine --reltime with --time\n");
+                return -1;
+        }
+
         if (itrace_synth_opts.callchain &&
             itrace_synth_opts.callchain_sz > scripting_max_stack)
                 scripting_max_stack = itrace_synth_opts.callchain_sz;
@@ -3615,6 +3668,12 @@ int cmd_script(int argc, const char **argv)
         if (symbol__init(&session->header.env) < 0)
                 goto out_delete;
 
+        uname(&uts);
+        if (!strcmp(uts.machine, session->header.env.arch) ||
+            (!strcmp(uts.machine, "x86_64") &&
+             !strcmp(session->header.env.arch, "i386")))
+                native_arch = true;
+
         script.session = session;
         script__setup_sample_type(&script);
 
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 7b8f09b0b8bf..49ee3c2033ec 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -718,7 +718,8 @@ static struct option stat_options[] = {
                     "system-wide collection from all CPUs"),
         OPT_BOOLEAN('g', "group", &group,
                     "put the counters into a counter group"),
-        OPT_BOOLEAN('c', "scale", &stat_config.scale, "scale/normalize counters"),
+        OPT_BOOLEAN(0, "scale", &stat_config.scale,
+                    "Use --no-scale to disable counter scaling for multiplexing"),
         OPT_INCR('v', "verbose", &verbose,
                     "be more verbose (show counter open errors, etc)"),
         OPT_INTEGER('r', "repeat", &stat_config.run_count,
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 231a90daa958..1999d6533d12 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -1189,30 +1189,26 @@ static int __cmd_top(struct perf_top *top)
         pthread_t thread, thread_process;
         int ret;
 
-        top->session = perf_session__new(NULL, false, NULL);
-        if (top->session == NULL)
-                return -1;
-
         if (!top->annotation_opts.objdump_path) {
                 ret = perf_env__lookup_objdump(&top->session->header.env,
                                                &top->annotation_opts.objdump_path);
                 if (ret)
-                        goto out_delete;
+                        return ret;
         }
 
         ret = callchain_param__setup_sample_type(&callchain_param);
         if (ret)
-                goto out_delete;
+                return ret;
 
         if (perf_session__register_idle_thread(top->session) < 0)
-                goto out_delete;
+                return ret;
 
         if (top->nr_threads_synthesize > 1)
                 perf_set_multithreaded();
 
         init_process_thread(top);
 
-        ret = perf_event__synthesize_bpf_events(&top->tool, perf_event__process,
+        ret = perf_event__synthesize_bpf_events(top->session, perf_event__process,
                                                 &top->session->machines.host,
                                                 &top->record_opts);
         if (ret < 0)
@@ -1227,13 +1223,18 @@ static int __cmd_top(struct perf_top *top)
 
         if (perf_hpp_list.socket) {
                 ret = perf_env__read_cpu_topology_map(&perf_env);
-                if (ret < 0)
-                        goto out_err_cpu_topo;
+                if (ret < 0) {
+                        char errbuf[BUFSIZ];
+                        const char *err = str_error_r(-ret, errbuf, sizeof(errbuf));
+
+                        ui__error("Could not read the CPU topology map: %s\n", err);
+                        return ret;
+                }
         }
 
         ret = perf_top__start_counters(top);
         if (ret)
-                goto out_delete;
+                return ret;
 
         top->session->evlist = top->evlist;
         perf_session__set_id_hdr_size(top->session);
@@ -1252,7 +1253,7 @@ static int __cmd_top(struct perf_top *top)
         ret = -1;
         if (pthread_create(&thread_process, NULL, process_thread, top)) {
                 ui__error("Could not create process thread.\n");
-                goto out_delete;
+                return ret;
         }
 
         if (pthread_create(&thread, NULL, (use_browser > 0 ? display_thread_tui :
@@ -1296,19 +1297,7 @@ out_join:
 out_join_thread:
         pthread_cond_signal(&top->qe.cond);
         pthread_join(thread_process, NULL);
-out_delete:
-        perf_session__delete(top->session);
-        top->session = NULL;
-
         return ret;
-
-out_err_cpu_topo: {
-        char errbuf[BUFSIZ];
-        const char *err = str_error_r(-ret, errbuf, sizeof(errbuf));
-
-        ui__error("Could not read the CPU topology map: %s\n", err);
-        goto out_delete;
-}
 }
 
 static int
@@ -1480,6 +1469,7 @@ int cmd_top(int argc, const char **argv)
                     "Display raw encoding of assembly instructions (default)"),
         OPT_BOOLEAN(0, "demangle-kernel", &symbol_conf.demangle_kernel,
                     "Enable kernel symbol demangling"),
+        OPT_BOOLEAN(0, "no-bpf-event", &top.record_opts.no_bpf_event, "do not record bpf events"),
         OPT_STRING(0, "objdump", &top.annotation_opts.objdump_path, "path",
                     "objdump binary to use for disassembly and annotations"),
         OPT_STRING('M', "disassembler-style", &top.annotation_opts.disassembler_style, "disassembler style",
@@ -1511,6 +1501,7 @@ int cmd_top(int argc, const char **argv)
                         "number of thread to run event synthesize"),
         OPT_END()
         };
+        struct perf_evlist *sb_evlist = NULL;
         const char * const top_usage[] = {
                 "perf top [<options>]",
                 NULL
@@ -1628,8 +1619,9 @@ int cmd_top(int argc, const char **argv)
         annotation_config__init();
 
         symbol_conf.try_vmlinux_path = (symbol_conf.vmlinux_name == NULL);
-        if (symbol__init(NULL) < 0)
-                return -1;
+        status = symbol__init(NULL);
+        if (status < 0)
+                goto out_delete_evlist;
 
         sort__setup_elide(stdout);
 
@@ -1639,10 +1631,28 @@ int cmd_top(int argc, const char **argv)
                 signal(SIGWINCH, winch_sig);
         }
 
+        top.session = perf_session__new(NULL, false, NULL);
+        if (top.session == NULL) {
+                status = -1;
+                goto out_delete_evlist;
+        }
+
+        if (!top.record_opts.no_bpf_event)
+                bpf_event__add_sb_event(&sb_evlist, &perf_env);
+
+        if (perf_evlist__start_sb_thread(sb_evlist, target)) {
+                pr_debug("Couldn't start the BPF side band thread:\nBPF programs starting from now on won't be annotatable\n");
+                opts->no_bpf_event = true;
+        }
+
         status = __cmd_top(&top);
 
+        if (!opts->no_bpf_event)
+                perf_evlist__stop_sb_thread(sb_evlist);
+
 out_delete_evlist:
         perf_evlist__delete(top.evlist);
+        perf_session__delete(top.session);
 
         return status;
 }
diff --git a/tools/perf/builtin.h b/tools/perf/builtin.h
index 05745f3ce912..999fe9170122 100644
--- a/tools/perf/builtin.h
+++ b/tools/perf/builtin.h
@@ -40,5 +40,6 @@ int cmd_mem(int argc, const char **argv);
 int cmd_data(int argc, const char **argv);
 int cmd_ftrace(int argc, const char **argv);
 
-int find_scripts(char **scripts_array, char **scripts_path_array);
+int find_scripts(char **scripts_array, char **scripts_path_array, int num,
+                 int pathlen);
 #endif
diff --git a/tools/perf/perf.c b/tools/perf/perf.c
index a11cb006f968..72df4b6fa36f 100644
--- a/tools/perf/perf.c
+++ b/tools/perf/perf.c
@@ -298,6 +298,7 @@ static int run_builtin(struct cmd_struct *p, int argc, const char **argv)
                 use_pager = 1;
         commit_pager_choice();
 
+        perf_env__init(&perf_env);
         perf_env__set_cmdline(&perf_env, argc, argv);
         status = p->fn(argc, argv);
         perf_config__exit();
diff --git a/tools/perf/perf.h b/tools/perf/perf.h
index b120e547ddc7..c59743def8d3 100644
--- a/tools/perf/perf.h
+++ b/tools/perf/perf.h
@@ -66,7 +66,7 @@ struct record_opts {
         bool         ignore_missing_thread;
         bool         strict_freq;
         bool         sample_id;
-        bool         bpf_event;
+        bool         no_bpf_event;
         unsigned int freq;
         unsigned int mmap_pages;
         unsigned int auxtrace_mmap_pages;
diff --git a/tools/perf/pmu-events/arch/powerpc/power8/other.json b/tools/perf/pmu-events/arch/powerpc/power8/other.json
index 704302c3e67d..9dc2f6b70354 100644
--- a/tools/perf/pmu-events/arch/powerpc/power8/other.json
+++ b/tools/perf/pmu-events/arch/powerpc/power8/other.json
@@ -348,18 +348,6 @@
     "PublicDescription": ""
   },
   {,
-    "EventCode": "0x517082",
-    "EventName": "PM_CO_DISP_FAIL",
-    "BriefDescription": "CO dispatch failed due to all CO machines being busy",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x527084",
-    "EventName": "PM_CO_TM_SC_FOOTPRINT",
-    "BriefDescription": "L2 did a cleanifdirty CO to the L3 (ie created an SC line in the L3)",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x3608a",
     "EventName": "PM_CO_USAGE",
     "BriefDescription": "Continuous 16 cycle(2to1) window where this signals rotates thru sampling each L2 CO machine busy. PMU uses this wave to then do 16 cyc count to sample total number of machs running",
@@ -1578,36 +1566,12 @@
     "PublicDescription": ""
   },
   {,
-    "EventCode": "0x617082",
-    "EventName": "PM_ISIDE_DISP",
-    "BriefDescription": "All i-side dispatch attempts",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x627084",
-    "EventName": "PM_ISIDE_DISP_FAIL",
-    "BriefDescription": "All i-side dispatch attempts that failed due to a addr collision with another machine",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x627086",
-    "EventName": "PM_ISIDE_DISP_FAIL_OTHER",
-    "BriefDescription": "All i-side dispatch attempts that failed due to a reason other than addrs collision",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x4608e",
     "EventName": "PM_ISIDE_L2MEMACC",
     "BriefDescription": "valid when first beat of data comes in for an i-side fetch where data came from mem(or L4)",
     "PublicDescription": ""
   },
   {,
-    "EventCode": "0x44608e",
-    "EventName": "PM_ISIDE_MRU_TOUCH",
-    "BriefDescription": "Iside L2 MRU touch",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x30ac",
     "EventName": "PM_ISU_REF_FX0",
     "BriefDescription": "FX0 ISU reject",
@@ -1734,222 +1698,36 @@
     "PublicDescription": ""
   },
   {,
-    "EventCode": "0x417080",
-    "EventName": "PM_L2_CASTOUT_MOD",
-    "BriefDescription": "L2 Castouts - Modified (M, Mu, Me)",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x417082",
-    "EventName": "PM_L2_CASTOUT_SHR",
-    "BriefDescription": "L2 Castouts - Shared (T, Te, Si, S)",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x27084",
     "EventName": "PM_L2_CHIP_PUMP",
     "BriefDescription": "RC requests that were local on chip pump attempts",
     "PublicDescription": ""
   },
   {,
-    "EventCode": "0x427086",
-    "EventName": "PM_L2_DC_INV",
-    "BriefDescription": "Dcache invalidates from L2",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x44608c",
-    "EventName": "PM_L2_DISP_ALL_L2MISS",
-    "BriefDescription": "All successful Ld/St dispatches for this thread that were an L2miss",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x27086",
     "EventName": "PM_L2_GROUP_PUMP",
     "BriefDescription": "RC requests that were on Node Pump attempts",
     "PublicDescription": ""
   },
   {,
-    "EventCode": "0x626084",
-    "EventName": "PM_L2_GRP_GUESS_CORRECT",
-    "BriefDescription": "L2 guess grp and guess was correct (data intra-6chip AND ^on-chip)",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x626086",
-    "EventName": "PM_L2_GRP_GUESS_WRONG",
-    "BriefDescription": "L2 guess grp and guess was not correct (ie data on-chip OR beyond-6chip)",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x427084",
-    "EventName": "PM_L2_IC_INV",
-    "BriefDescription": "Icache Invalidates from L2",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x436088",
-    "EventName": "PM_L2_INST",
-    "BriefDescription": "All successful I-side dispatches for this thread (excludes i_l2mru_tch reqs)",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x43608a",
-    "EventName": "PM_L2_INST_MISS",
-    "BriefDescription": "All successful i-side dispatches that were an L2miss for this thread (excludes i_l2mru_tch reqs)",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x416080",
-    "EventName": "PM_L2_LD",
-    "BriefDescription": "All successful D-side Load dispatches for this thread",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x437088",
-    "EventName": "PM_L2_LD_DISP",
-    "BriefDescription": "All successful load dispatches",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x43708a",
-    "EventName": "PM_L2_LD_HIT",
-    "BriefDescription": "All successful load dispatches that were L2 hits",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x426084",
-    "EventName": "PM_L2_LD_MISS",
-    "BriefDescription": "All successful D-Side Load dispatches that were an L2miss for this thread",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x616080",
-    "EventName": "PM_L2_LOC_GUESS_CORRECT",
-    "BriefDescription": "L2 guess loc and guess was correct (ie data local)",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x616082",
-    "EventName": "PM_L2_LOC_GUESS_WRONG",
-    "BriefDescription": "L2 guess loc and guess was not correct (ie data not on chip)",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x516080",
-    "EventName": "PM_L2_RCLD_DISP",
-    "BriefDescription": "L2 RC load dispatch attempt",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x516082",
-    "EventName": "PM_L2_RCLD_DISP_FAIL_ADDR",
-    "BriefDescription": "L2 RC load dispatch attempt failed due to address collision with RC/CO/SN/SQ",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x526084",
-    "EventName": "PM_L2_RCLD_DISP_FAIL_OTHER",
-    "BriefDescription": "L2 RC load dispatch attempt failed due to other reasons",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x536088",
-    "EventName": "PM_L2_RCST_DISP",
-    "BriefDescription": "L2 RC store dispatch attempt",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x53608a",
-    "EventName": "PM_L2_RCST_DISP_FAIL_ADDR",
-    "BriefDescription": "L2 RC store dispatch attempt failed due to address collision with RC/CO/SN/SQ",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x54608c",
-    "EventName": "PM_L2_RCST_DISP_FAIL_OTHER",
-    "BriefDescription": "L2 RC store dispatch attempt failed due to other reasons",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x537088",
-    "EventName": "PM_L2_RC_ST_DONE",
-    "BriefDescription": "RC did st to line that was Tx or Sx",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x63708a",
-    "EventName": "PM_L2_RTY_LD",
-    "BriefDescription": "RC retries on PB for any load from core",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x3708a",
     "EventName": "PM_L2_RTY_ST",
     "BriefDescription": "RC retries on PB for any store from core",
     "PublicDescription": ""
   },
   {,
-    "EventCode": "0x54708c",
-    "EventName": "PM_L2_SN_M_RD_DONE",
-    "BriefDescription": "SNP dispatched for a read and was M",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x54708e",
-    "EventName": "PM_L2_SN_M_WR_DONE",
-    "BriefDescription": "SNP dispatched for a write and was M",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x53708a",
-    "EventName": "PM_L2_SN_SX_I_DONE",
-    "BriefDescription": "SNP dispatched and went from Sx or Tx to Ix",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x17080",
     "EventName": "PM_L2_ST",
     "BriefDescription": "All successful D-side store dispatches for this thread",
     "PublicDescription": ""
   },
   {,
-    "EventCode": "0x44708c",
-    "EventName": "PM_L2_ST_DISP",
-    "BriefDescription": "All successful store dispatches",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x44708e",
-    "EventName": "PM_L2_ST_HIT",
-    "BriefDescription": "All successful store dispatches that were L2Hits",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x17082",
     "EventName": "PM_L2_ST_MISS",
     "BriefDescription": "All successful D-side store dispatches for this thread that were L2 Miss",
     "PublicDescription": ""
   },
   {,
-    "EventCode": "0x636088",
-    "EventName": "PM_L2_SYS_GUESS_CORRECT",
-    "BriefDescription": "L2 guess sys and guess was correct (ie data beyond-6chip)",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x63608a",
-    "EventName": "PM_L2_SYS_GUESS_WRONG",
-    "BriefDescription": "L2 guess sys and guess was not correct (ie data ^beyond-6chip)",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x617080",
-    "EventName": "PM_L2_SYS_PUMP",
-    "BriefDescription": "RC requests that were system pump attempts",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x1e05e",
     "EventName": "PM_L2_TM_REQ_ABORT",
     "BriefDescription": "TM abort",
@@ -1962,36 +1740,12 @@
     "PublicDescription": ""
   },
   {,
-    "EventCode": "0x23808a",
-    "EventName": "PM_L3_CINJ",
-    "BriefDescription": "l3 ci of cache inject",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x128084",
-    "EventName": "PM_L3_CI_HIT",
-    "BriefDescription": "L3 Castins Hit (total count",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x128086",
-    "EventName": "PM_L3_CI_MISS",
-    "BriefDescription": "L3 castins miss (total count",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x819082",
     "EventName": "PM_L3_CI_USAGE",
     "BriefDescription": "rotating sample of 16 CI or CO actives",
     "PublicDescription": ""
   },
   {,
-    "EventCode": "0x438088",
-    "EventName": "PM_L3_CO",
-    "BriefDescription": "l3 castout occurring ( does not include casthrough or log writes (cinj/dmaw)",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x83908b",
     "EventName": "PM_L3_CO0_ALLOC",
     "BriefDescription": "lifetime, sample of CO machine 0 valid",
@@ -2010,120 +1764,18 @@
     "PublicDescription": ""
   },
   {,
-    "EventCode": "0x238088",
-    "EventName": "PM_L3_CO_LCO",
-    "BriefDescription": "Total L3 castouts occurred on LCO",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x28084",
     "EventName": "PM_L3_CO_MEM",
     "BriefDescription": "L3 CO to memory OR of port 0 and 1 ( lossy)",
     "PublicDescription": ""
   },
   {,
-    "EventCode": "0xb19082",
-    "EventName": "PM_L3_GRP_GUESS_CORRECT",
-    "BriefDescription": "Initial scope=group and data from same group (near) (pred successful)",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0xb3908a",
-    "EventName": "PM_L3_GRP_GUESS_WRONG_HIGH",
-    "BriefDescription": "Initial scope=group but data from local node. Predition too high",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0xb39088",
-    "EventName": "PM_L3_GRP_GUESS_WRONG_LOW",
-    "BriefDescription": "Initial scope=group but data from outside group (far or rem). Prediction too Low",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x218080",
-    "EventName": "PM_L3_HIT",
-    "BriefDescription": "L3 Hits",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x138088",
-    "EventName": "PM_L3_L2_CO_HIT",
-    "BriefDescription": "L2 castout hits",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x13808a",
-    "EventName": "PM_L3_L2_CO_MISS",
-    "BriefDescription": "L2 castout miss",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x14808c",
-    "EventName": "PM_L3_LAT_CI_HIT",
-    "BriefDescription": "L3 Lateral Castins Hit",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x14808e",
-    "EventName": "PM_L3_LAT_CI_MISS",
-    "BriefDescription": "L3 Lateral Castins Miss",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x228084",
-    "EventName": "PM_L3_LD_HIT",
-    "BriefDescription": "L3 demand LD Hits",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x228086",
-    "EventName": "PM_L3_LD_MISS",
-    "BriefDescription": "L3 demand LD Miss",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x1e052",
     "EventName": "PM_L3_LD_PREF",
     "BriefDescription": "L3 Load Prefetches",
     "PublicDescription": ""
   },
   {,
-    "EventCode": "0xb19080",
-    "EventName": "PM_L3_LOC_GUESS_CORRECT",
-    "BriefDescription": "initial scope=node/chip and data from local node (local) (pred successful)",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0xb29086",
-    "EventName": "PM_L3_LOC_GUESS_WRONG",
-    "BriefDescription": "Initial scope=node but data from out side local node (near or far or rem). Prediction too Low",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x218082",
-    "EventName": "PM_L3_MISS",
-    "BriefDescription": "L3 Misses",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x54808c",
-    "EventName": "PM_L3_P0_CO_L31",
-    "BriefDescription": "l3 CO to L3.1 (lco) port 0",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x538088",
-    "EventName": "PM_L3_P0_CO_MEM",
-    "BriefDescription": "l3 CO to memory port 0",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x929084",
-    "EventName": "PM_L3_P0_CO_RTY",
-    "BriefDescription": "L3 CO received retry port 0",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0xa29084",
     "EventName": "PM_L3_P0_GRP_PUMP",
     "BriefDescription": "L3 pf sent with grp scope port 0",
@@ -2148,120 +1800,6 @@
     "PublicDescription": ""
   },
   {,
-    "EventCode": "0xa19080",
-    "EventName": "PM_L3_P0_NODE_PUMP",
-    "BriefDescription": "L3 pf sent with nodal scope port 0",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x919080",
-    "EventName": "PM_L3_P0_PF_RTY",
-    "BriefDescription": "L3 PF received retry port 0",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x939088",
-    "EventName": "PM_L3_P0_SN_HIT",
-    "BriefDescription": "L3 snoop hit port 0",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x118080",
-    "EventName": "PM_L3_P0_SN_INV",
-    "BriefDescription": "Port0 snooper detects someone doing a store to a line thats Sx",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x94908c",
-    "EventName": "PM_L3_P0_SN_MISS",
-    "BriefDescription": "L3 snoop miss port 0",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0xa39088",
-    "EventName": "PM_L3_P0_SYS_PUMP",
-    "BriefDescription": "L3 pf sent with sys scope port 0",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x54808e",
-    "EventName": "PM_L3_P1_CO_L31",
-    "BriefDescription": "l3 CO to L3.1 (lco) port 1",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x53808a",
-    "EventName": "PM_L3_P1_CO_MEM",
-    "BriefDescription": "l3 CO to memory port 1",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x929086",
-    "EventName": "PM_L3_P1_CO_RTY",
-    "BriefDescription": "L3 CO received retry port 1",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0xa29086",
-    "EventName": "PM_L3_P1_GRP_PUMP",
-    "BriefDescription": "L3 pf sent with grp scope port 1",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x528086",
-    "EventName": "PM_L3_P1_LCO_DATA",
-    "BriefDescription": "lco sent with data port 1",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x518082",
-    "EventName": "PM_L3_P1_LCO_NO_DATA",
-    "BriefDescription": "dataless l3 lco sent port 1",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0xa4908e",
-    "EventName": "PM_L3_P1_LCO_RTY",
-    "BriefDescription": "L3 LCO received retry port 1",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0xa19082",
-    "EventName": "PM_L3_P1_NODE_PUMP",
-    "BriefDescription": "L3 pf sent with nodal scope port 1",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x919082",
-    "EventName": "PM_L3_P1_PF_RTY",
-    "BriefDescription": "L3 PF received retry port 1",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x93908a",
-    "EventName": "PM_L3_P1_SN_HIT",
-    "BriefDescription": "L3 snoop hit port 1",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x118082",
-    "EventName": "PM_L3_P1_SN_INV",
-    "BriefDescription": "Port1 snooper detects someone doing a store to a line thats Sx",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x94908e",
-    "EventName": "PM_L3_P1_SN_MISS",
-    "BriefDescription": "L3 snoop miss port 1",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0xa3908a",
-    "EventName": "PM_L3_P1_SYS_PUMP",
-    "BriefDescription": "L3 pf sent with sys scope port 1",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x84908d",
     "EventName": "PM_L3_PF0_ALLOC",
     "BriefDescription": "lifetime, sample of PF machine 0 valid",
@@ -2274,12 +1812,6 @@
     "PublicDescription": ""
   },
   {,
-    "EventCode": "0x428084",
-    "EventName": "PM_L3_PF_HIT_L3",
-    "BriefDescription": "l3 pf hit in l3",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x18080",
     "EventName": "PM_L3_PF_MISS_L3",
     "BriefDescription": "L3 Prefetch missed in L3",
@@ -2370,42 +1902,12 @@
     "PublicDescription": ""
   },
   {,
-    "EventCode": "0xb29084",
-    "EventName": "PM_L3_SYS_GUESS_CORRECT",
-    "BriefDescription": "Initial scope=system and data from outside group (far or rem)(pred successful)",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0xb4908c",
-    "EventName": "PM_L3_SYS_GUESS_WRONG",
-    "BriefDescription": "Initial scope=system but data from local or near. Predction too high",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x24808e",
-    "EventName": "PM_L3_TRANS_PF",
-    "BriefDescription": "L3 Transient prefetch",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x18081",
     "EventName": "PM_L3_WI0_ALLOC",
     "BriefDescription": "lifetime, sample of Write Inject machine 0 valid",
     "PublicDescription": "0.0"
   },
   {,
-    "EventCode": "0x418080",
-    "EventName": "PM_L3_WI0_BUSY",
-    "BriefDescription": "lifetime, sample of Write Inject machine 0 valid",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x418082",
-    "EventName": "PM_L3_WI_USAGE",
-    "BriefDescription": "rotating sample of 8 WI actives",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0xc080",
     "EventName": "PM_LD_REF_L1_LSU0",
     "BriefDescription": "LS0 L1 D cache load references counted at finish, gated by reject",
@@ -3312,12 +2814,6 @@
     "PublicDescription": ""
   },
   {,
-    "EventCode": "0x328084",
-    "EventName": "PM_NON_TM_RST_SC",
-    "BriefDescription": "non tm snp rst tm sc",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x2001a",
     "EventName": "PM_NTCG_ALL_FIN",
     "BriefDescription": "Cycles after all instructions have finished to group completed",
@@ -3420,24 +2916,6 @@
     "PublicDescription": ""
   },
   {,
-    "EventCode": "0x34808e",
-    "EventName": "PM_RD_CLEARING_SC",
-    "BriefDescription": "rd clearing sc",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x34808c",
-    "EventName": "PM_RD_FORMING_SC",
-    "BriefDescription": "rd forming sc",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x428086",
-    "EventName": "PM_RD_HIT_PF",
-    "BriefDescription": "rd machine hit l3 pf machine",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x20004",
     "EventName": "PM_REAL_SRQ_FULL",
     "BriefDescription": "Out of real srq entries",
@@ -3504,18 +2982,6 @@
     "PublicDescription": "TLBIE snoopSnoop TLBIE"
   },
   {,
-    "EventCode": "0x338088",
-    "EventName": "PM_SNP_TM_HIT_M",
-    "BriefDescription": "snp tm st hit m mu",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x33808a",
-    "EventName": "PM_SNP_TM_HIT_T",
-    "BriefDescription": "snp tm_st_hit t tn te",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x4608c",
     "EventName": "PM_SN_USAGE",
     "BriefDescription": "Continuous 16 cycle(2to1) window where this signals rotates thru sampling each L2 SN machine busy. PMU uses this wave to then do 16 cyc count to sample total number of machs running",
@@ -3534,12 +3000,6 @@
     "PublicDescription": "STCX executed reported at sent to nest42"
   },
   {,
-    "EventCode": "0x717080",
-    "EventName": "PM_ST_CAUSED_FAIL",
-    "BriefDescription": "Non TM St caused any thread to fail",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x3090",
     "EventName": "PM_SWAP_CANCEL",
     "BriefDescription": "SWAP cancel , rtag not available",
@@ -3624,18 +3084,6 @@
     "PublicDescription": ""
   },
   {,
-    "EventCode": "0x318082",
-    "EventName": "PM_TM_CAM_OVERFLOW",
-    "BriefDescription": "l3 tm cam overflow during L2 co of SC",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x74708c",
-    "EventName": "PM_TM_CAP_OVERFLOW",
-    "BriefDescription": "TM Footprint Capactiy Overflow",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x20ba",
     "EventName": "PM_TM_END_ALL",
     "BriefDescription": "Tm any tend",
@@ -3690,48 +3138,6 @@
     "PublicDescription": "Transactional conflict from LSU, whatever gets reported to texas 42"
   },
   {,
-    "EventCode": "0x727086",
-    "EventName": "PM_TM_FAV_CAUSED_FAIL",
-    "BriefDescription": "TM Load (fav) caused another thread to fail",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x717082",
-    "EventName": "PM_TM_LD_CAUSED_FAIL",
-    "BriefDescription": "Non TM Ld caused any thread to fail",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x727084",
-    "EventName": "PM_TM_LD_CONF",
-    "BriefDescription": "TM Load (fav or non-fav) ran into conflict (failed)",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x328086",
-    "EventName": "PM_TM_RST_SC",
-    "BriefDescription": "tm snp rst tm sc",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x318080",
-    "EventName": "PM_TM_SC_CO",
-    "BriefDescription": "l3 castout tm Sc line",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x73708a",
-    "EventName": "PM_TM_ST_CAUSED_FAIL",
-    "BriefDescription": "TM Store (fav or non-fav) caused another thread to fail",
-    "PublicDescription": ""
-  },
-  {,
-    "EventCode": "0x737088",
-    "EventName": "PM_TM_ST_CONF",
-    "BriefDescription": "TM Store (fav or non-fav) ran into conflict (failed)",
-    "PublicDescription": ""
-  },
-  {,
     "EventCode": "0x20bc",
     "EventName": "PM_TM_TBEGIN",
     "BriefDescription": "Tm nested tbegin",
diff --git a/tools/perf/pmu-events/arch/x86/amdfam17h/branch.json b/tools/perf/pmu-events/arch/x86/amdfam17h/branch.json
new file mode 100644
index 000000000000..93ddfd8053ca
--- /dev/null
+++ b/tools/perf/pmu-events/arch/x86/amdfam17h/branch.json
@@ -0,0 +1,12 @@
+[
+  {
+    "EventName": "bp_l1_btb_correct",
+    "EventCode": "0x8a",
+    "BriefDescription": "L1 BTB Correction."
+  },
+  {
+    "EventName": "bp_l2_btb_correct",
+    "EventCode": "0x8b",
+    "BriefDescription": "L2 BTB Correction."
+  }
+]
diff --git a/tools/perf/pmu-events/arch/x86/amdfam17h/cache.json b/tools/perf/pmu-events/arch/x86/amdfam17h/cache.json
new file mode 100644
index 000000000000..fad4af9142cb
--- /dev/null
+++ b/tools/perf/pmu-events/arch/x86/amdfam17h/cache.json
@@ -0,0 +1,287 @@
+[
+  {
+    "EventName": "ic_fw32",
+    "EventCode": "0x80",
+    "BriefDescription": "The number of 32B fetch windows transferred from IC pipe to DE instruction decoder (includes non-cacheable and cacheable fill responses)."
+  },
+  {
+    "EventName": "ic_fw32_miss",
+    "EventCode": "0x81",
+    "BriefDescription": "The number of 32B fetch windows tried to read the L1 IC and missed in the full tag."
+  },
+  {
+    "EventName": "ic_cache_fill_l2",
+    "EventCode": "0x82",
+    "BriefDescription": "The number of 64 byte instruction cache line was fulfilled from the L2 cache."
+  },
+  {
+    "EventName": "ic_cache_fill_sys",
+    "EventCode": "0x83",
+    "BriefDescription": "The number of 64 byte instruction cache line fulfilled from system memory or another cache."
+  },
+  {
+    "EventName": "bp_l1_tlb_miss_l2_hit",
+    "EventCode": "0x84",
+    "BriefDescription": "The number of instruction fetches that miss in the L1 ITLB but hit in the L2 ITLB."
+  },
+  {
+    "EventName": "bp_l1_tlb_miss_l2_miss",
+    "EventCode": "0x85",
+    "BriefDescription": "The number of instruction fetches that miss in both the L1 and L2 TLBs."
+  },
+  {
+    "EventName": "bp_snp_re_sync",
+    "EventCode": "0x86",
+    "BriefDescription": "The number of pipeline restarts caused by invalidating probes that hit on the instruction stream currently being executed. This would happen if the active instruction stream was being modified by another processor in an MP system - typically a highly unlikely event."
+  },
+  {
+    "EventName": "ic_fetch_stall.ic_stall_any",
+    "EventCode": "0x87",
+    "BriefDescription": "IC pipe was stalled during this clock cycle for any reason (nothing valid in pipe ICM1).",
+    "PublicDescription": "Instruction Pipe Stall. IC pipe was stalled during this clock cycle for any reason (nothing valid in pipe ICM1).",
+    "UMask": "0x4"
+  },
+  {
+    "EventName": "ic_fetch_stall.ic_stall_dq_empty",
+    "EventCode": "0x87",
+    "BriefDescription": "IC pipe was stalled during this clock cycle (including IC to OC fetches) due to DQ empty.",
+    "PublicDescription": "Instruction Pipe Stall. IC pipe was stalled during this clock cycle (including IC to OC fetches) due to DQ empty.",
+    "UMask": "0x2"
+  },
+  {
+    "EventName": "ic_fetch_stall.ic_stall_back_pressure",
+    "EventCode": "0x87",
+    "BriefDescription": "IC pipe was stalled during this clock cycle (including IC to OC fetches) due to back-pressure.",
+    "PublicDescription": "Instruction Pipe Stall. IC pipe was stalled during this clock cycle (including IC to OC fetches) due to back-pressure.",
+    "UMask": "0x1"
+  },
+  {
+    "EventName": "ic_cache_inval.l2_invalidating_probe",
+    "EventCode": "0x8c",
+    "BriefDescription": "IC line invalidated due to L2 invalidating probe (external or LS).",
+    "PublicDescription": "The number of instruction cache lines invalidated. A non-SMC event is CMC (cross modifying code), either from the other thread of the core or another core. IC line invalidated due to L2 invalidating probe (external or LS).",
+    "UMask": "0x2"
+  },
+  {
+    "EventName": "ic_cache_inval.fill_invalidated",
+    "EventCode": "0x8c",
+    "BriefDescription": "IC line invalidated due to overwriting fill response.",
+    "PublicDescription": "The number of instruction cache lines invalidated. A non-SMC event is CMC (cross modifying code), either from the other thread of the core or another core. IC line invalidated due to overwriting fill response.",
+    "UMask": "0x1"
+  },
+  {
+    "EventName": "bp_tlb_rel",
+    "EventCode": "0x99",
+    "BriefDescription": "The number of ITLB reload requests."
+  },
+  {
+    "EventName": "l2_request_g1.rd_blk_l",
+    "EventCode": "0x60",
+    "BriefDescription": "Requests to L2 Group1.",
+    "PublicDescription": "Requests to L2 Group1.",
+    "UMask": "0x80"
+  },
+  {
+    "EventName": "l2_request_g1.rd_blk_x",
+    "EventCode": "0x60",
+    "BriefDescription": "Requests to L2 Group1.",
+    "PublicDescription": "Requests to L2 Group1.",
+    "UMask": "0x40"
+  },
+  {
+    "EventName": "l2_request_g1.ls_rd_blk_c_s",
+    "EventCode": "0x60",
+    "BriefDescription": "Requests to L2 Group1.",
+    "PublicDescription": "Requests to L2 Group1.",
+    "UMask": "0x20"
+  },
+  {
+    "EventName": "l2_request_g1.cacheable_ic_read",
+    "EventCode": "0x60",
+    "BriefDescription": "Requests to L2 Group1.",
+    "PublicDescription": "Requests to L2 Group1.",
+    "UMask": "0x10"
+  },
+  {
+    "EventName": "l2_request_g1.change_to_x",
+    "EventCode": "0x60",
+    "BriefDescription": "Requests to L2 Group1.",
+    "PublicDescription": "Requests to L2 Group1.",
+    "UMask": "0x8"
+  },
+  {
+    "EventName": "l2_request_g1.prefetch_l2",
+    "EventCode": "0x60",
+    "BriefDescription": "Requests to L2 Group1.",
+    "PublicDescription": "Requests to L2 Group1.",
+    "UMask": "0x4"
+  },
+  {
+    "EventName": "l2_request_g1.l2_hw_pf",
+    "EventCode": "0x60",
+    "BriefDescription": "Requests to L2 Group1.",
+    "PublicDescription": "Requests to L2 Group1.",
+    "UMask": "0x2"
+  },
+  {
+    "EventName": "l2_request_g1.other_requests",
+    "EventCode": "0x60",
+    "BriefDescription": "Events covered by l2_request_g2.",
+    "PublicDescription": "Requests to L2 Group1. Events covered by l2_request_g2.",
+    "UMask": "0x1"
+  },
+  {
+    "EventName": "l2_request_g2.group1",
+    "EventCode": "0x61",
+    "BriefDescription": "All Group 1 commands not in unit0.",
+    "PublicDescription": "Multi-events in that LS and IF requests can be received simultaneous. All Group 1 commands not in unit0.",
+    "UMask": "0x80"
+  },
+  {
+    "EventName": "l2_request_g2.ls_rd_sized",
+    "EventCode": "0x61",
+    "BriefDescription": "RdSized, RdSized32, RdSized64.",
+    "PublicDescription": "Multi-events in that LS and IF requests can be received simultaneous. RdSized, RdSized32, RdSized64.",
+    "UMask": "0x40"
+  },
+  {
+    "EventName": "l2_request_g2.ls_rd_sized_nc",
+    "EventCode": "0x61",
+    "BriefDescription": "RdSizedNC, RdSized32NC, RdSized64NC.",
+    "PublicDescription": "Multi-events in that LS and IF requests can be received simultaneous. RdSizedNC, RdSized32NC, RdSized64NC.",
+    "UMask": "0x20"
+  },
+  {
+    "EventName": "l2_request_g2.ic_rd_sized",
+    "EventCode": "0x61",
+    "BriefDescription": "Multi-events in that LS and IF requests can be received simultaneous.",
+    "PublicDescription": "Multi-events in that LS and IF requests can be received simultaneous.",
+    "UMask": "0x10"
+  },
+  {
+    "EventName": "l2_request_g2.ic_rd_sized_nc",
+    "EventCode": "0x61",
+    "BriefDescription": "Multi-events in that LS and IF requests can be received simultaneous.",
+    "PublicDescription": "Multi-events in that LS and IF requests can be received simultaneous.",
+    "UMask": "0x8"
+  },
+  {
+    "EventName": "l2_request_g2.smc_inval",
+    "EventCode": "0x61",
+    "BriefDescription": "Multi-events in that LS and IF requests can be received simultaneous.",
+    "PublicDescription": "Multi-events in that LS and IF requests can be received simultaneous.",
+    "UMask": "0x4"
+  },
+  {
+    "EventName": "l2_request_g2.bus_locks_originator",
+    "EventCode": "0x61",
+    "BriefDescription": "Multi-events in that LS and IF requests can be received simultaneous.",
+    "PublicDescription": "Multi-events in that LS and IF requests can be received simultaneous.",
+    "UMask": "0x2"
+  },
+  {
+    "EventName": "l2_request_g2.bus_locks_responses",
+    "EventCode": "0x61",
+    "BriefDescription": "Multi-events in that LS and IF requests can be received simultaneous.",
+    "PublicDescription": "Multi-events in that LS and IF requests can be received simultaneous.",
+    "UMask": "0x1"
+  },
+  {
+    "EventName": "l2_latency.l2_cycles_waiting_on_fills",
+    "EventCode": "0x62",
+    "BriefDescription": "Total cycles spent waiting for L2 fills to complete from L3 or memory, divided by four. Event counts are for both threads. To calculate average latency, the number of fills from both threads must be used.",
+    "PublicDescription": "Total cycles spent waiting for L2 fills to complete from L3 or memory, divided by four. Event counts are for both threads. To calculate average latency, the number of fills from both threads must be used.",
+    "UMask": "0x1"
+  },
+  {
+    "EventName": "l2_wcb_req.wcb_write",
+    "EventCode": "0x63",
+    "PublicDescription": "LS (Load/Store unit) to L2 WCB (Write Combining Buffer) write requests.",
+    "BriefDescription": "LS to L2 WCB write requests.",
+    "UMask": "0x40"
+  },
+  {
+    "EventName": "l2_wcb_req.wcb_close",
+    "EventCode": "0x63",
+    "BriefDescription": "LS to L2 WCB close requests.",
+    "PublicDescription": "LS (Load/Store unit) to L2 WCB (Write Combining Buffer) close requests.",
+    "UMask": "0x20"
+  },
+  {
+    "EventName": "l2_wcb_req.zero_byte_store",
+    "EventCode": "0x63",
+    "BriefDescription": "LS to L2 WCB zero byte store requests.",
+    "PublicDescription": "LS (Load/Store unit) to L2 WCB (Write Combining Buffer) zero byte store requests.",
+    "UMask": "0x4"
+  },
+  {
+    "EventName": "l2_wcb_req.cl_zero",
+    "EventCode": "0x63",
+    "PublicDescription": "LS to L2 WCB cache line zeroing requests.",
+    "BriefDescription": "LS (Load/Store unit) to L2 WCB (Write Combining Buffer) cache line zeroing requests.",
+    "UMask": "0x1"
+  },
+  {
+    "EventName": "l2_cache_req_stat.ls_rd_blk_cs",
+    "EventCode": "0x64",
+    "BriefDescription": "LS ReadBlock C/S Hit.",
+    "PublicDescription": "This event does not count accesses to the L2 cache by the L2 prefetcher, but it does count accesses by the L1 prefetcher. LS ReadBlock C/S Hit.",
+    "UMask": "0x80"
+  },
+  {
+    "EventName": "l2_cache_req_stat.ls_rd_blk_l_hit_x",
+    "EventCode": "0x64",
+    "BriefDescription": "LS Read Block L Hit X.",
+    "PublicDescription": "This event does not count accesses to the L2 cache by the L2 prefetcher, but it does count accesses by the L1 prefetcher. LS Read Block L Hit X.",
+    "UMask": "0x40"
+  },
+  {
+    "EventName": "l2_cache_req_stat.ls_rd_blk_l_hit_s",
+    "EventCode": "0x64",
+    "BriefDescription": "LsRdBlkL Hit Shared.",
+    "PublicDescription": "This event does not count accesses to the L2 cache by the L2 prefetcher, but it does count accesses by the L1 prefetcher. LsRdBlkL Hit Shared.",
+    "UMask": "0x20"
+  },
+  {
+    "EventName": "l2_cache_req_stat.ls_rd_blk_x",
+    "EventCode": "0x64",
+    "BriefDescription": "LsRdBlkX/ChgToX Hit X.  Count RdBlkX finding Shared as a Miss.",
+    "PublicDescription": "This event does not count accesses to the L2 cache by the L2 prefetcher, but it does count accesses by the L1 prefetcher. LsRdBlkX/ChgToX Hit X.  Count RdBlkX finding Shared as a Miss.",
+    "UMask": "0x10"
+  },
+  {
+    "EventName": "l2_cache_req_stat.ls_rd_blk_c",
+    "EventCode": "0x64",
+    "BriefDescription": "LS Read Block C S L X Change to X Miss.",
+    "PublicDescription": "This event does not count accesses to the L2 cache by the L2 prefetcher, but it does count accesses by the L1 prefetcher. LS Read Block C S L X Change to X Miss.",
+    "UMask": "0x8"
+  },
+  {
+    "EventName": "l2_cache_req_stat.ic_fill_hit_x",
+    "EventCode": "0x64",
+    "BriefDescription": "IC Fill Hit Exclusive Stale.",
+    "PublicDescription": "This event does not count accesses to the L2 cache by the L2 prefetcher, but it does count accesses by the L1 prefetcher. IC Fill Hit Exclusive Stale.",
+    "UMask": "0x4"
+  },
+  {
+    "EventName": "l2_cache_req_stat.ic_fill_hit_s",
+    "EventCode": "0x64",
+    "BriefDescription": "IC Fill Hit Shared.",
+    "PublicDescription": "This event does not count accesses to the L2 cache by the L2 prefetcher, but it does count accesses by the L1 prefetcher. IC Fill Hit Shared.",
+    "UMask": "0x2"
+  },
+  {
+    "EventName": "l2_cache_req_stat.ic_fill_miss",
+    "EventCode": "0x64",
+    "BriefDescription": "IC Fill Miss.",
+    "PublicDescription": "This event does not count accesses to the L2 cache by the L2 prefetcher, but it does count accesses by the L1 prefetcher. IC Fill Miss.",
+    "UMask": "0x1"
+  },
+  {
+    "EventName": "l2_fill_pending.l2_fill_busy",
+    "EventCode": "0x6d",
+    "BriefDescription": "Total cycles spent with one or more fill requests in flight from L2.",
+    "PublicDescription": "Total cycles spent with one or more fill requests in flight from L2.",
+    "UMask": "0x1"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/x86/amdfam17h/core.json b/tools/perf/pmu-events/arch/x86/amdfam17h/core.json
new file mode 100644
index 000000000000..7b285b0a7f35
--- /dev/null
+++ b/tools/perf/pmu-events/arch/x86/amdfam17h/core.json
@@ -0,0 +1,134 @@
+[
+  {
+    "EventName": "ex_ret_instr",
+    "EventCode": "0xc0",
+    "BriefDescription": "Retired Instructions."
+  },
+  {
+    "EventName": "ex_ret_cops",
+    "EventCode": "0xc1",
+    "BriefDescription": "Retired Uops.",
+    "PublicDescription": "The number of uOps retired. This includes all processor activity (instructions, exceptions, interrupts, microcode assists, etc.). The number of events logged per cycle can vary from 0 to 4."
+  },
+  {
+    "EventName": "ex_ret_brn",
+    "EventCode": "0xc2",
+    "BriefDescription": "[Retired Branch Instructions.",
+    "PublicDescription": "The number of branch instructions retired. This includes all types of architectural control flow changes, including exceptions and interrupts."
+  },
+  {
+    "EventName": "ex_ret_brn_misp",
+    "EventCode": "0xc3",
+    "BriefDescription": "Retired Branch Instructions Mispredicted.",
+    "PublicDescription": "The number of branch instructions retired, of any type, that were not correctly predicted. This includes those for which prediction is not attempted (far control transfers, exceptions and interrupts)."
+  },
+  {
+    "EventName": "ex_ret_brn_tkn",
+    "EventCode": "0xc4",
+    "BriefDescription": "Retired Taken Branch Instructions.",
+    "PublicDescription": "The number of taken branches that were retired. This includes all types of architectural control flow changes, including exceptions and interrupts."
+  },
+  {
+    "EventName": "ex_ret_brn_tkn_misp",
+    "EventCode": "0xc5",
+    "BriefDescription": "Retired Taken Branch Instructions Mispredicted.",
+    "PublicDescription": "The number of retired taken branch instructions that were mispredicted."
+  },
+  {
+    "EventName": "ex_ret_brn_far",
+    "EventCode": "0xc6",
+    "BriefDescription": "Retired Far Control Transfers.",
+    "PublicDescription": "The number of far control transfers retired including far call/jump/return, IRET, SYSCALL and SYSRET, plus exceptions and interrupts. Far control transfers are not subject to branch prediction."
+  },
+  {
+    "EventName": "ex_ret_brn_resync",
+    "EventCode": "0xc7",
+    "BriefDescription": "Retired Branch Resyncs.",
+    "PublicDescription": "The number of resync branches. These reflect pipeline restarts due to certain microcode assists and events such as writes to the active instruction stream, among other things. Each occurrence reflects a restart penalty similar to a branch mispredict. This is relatively rare."
+  },
+  {
+    "EventName": "ex_ret_near_ret",
+    "EventCode": "0xc8",
+    "BriefDescription": "Retired Near Returns.",
+    "PublicDescription": "The number of near return instructions (RET or RET Iw) retired."
+  },
+  {
+    "EventName": "ex_ret_near_ret_mispred",
+    "EventCode": "0xc9",
+    "BriefDescription": "Retired Near Returns Mispredicted.",
+    "PublicDescription": "The number of near returns retired that were not correctly predicted by the return address predictor. Each such mispredict incurs the same penalty as a mispredicted conditional branch instruction."
+  },
+  {
+    "EventName": "ex_ret_brn_ind_misp",
+    "EventCode": "0xca",
+    "BriefDescription": "Retired Indirect Branch Instructions Mispredicted.",
+    "PublicDescription": "Retired Indirect Branch Instructions Mispredicted."
+  },
+  {
+    "EventName": "ex_ret_mmx_fp_instr.sse_instr",
+    "EventCode": "0xcb",
+    "BriefDescription": "SSE instructions (SSE, SSE2, SSE3, SSSE3, SSE4A, SSE41, SSE42, AVX).",
+    "PublicDescription": "The number of MMX, SSE or x87 instructions retired. The UnitMask allows the selection of the individual classes of instructions as given in the table. Each increment represents one complete instruction. Since this event includes non-numeric instructions it is not suitable for measuring MFLOPS. SSE instructions (SSE, SSE2, SSE3, SSSE3, SSE4A, SSE41, SSE42, AVX).",
+    "UMask": "0x4"
+  },
+  {
+    "EventName": "ex_ret_mmx_fp_instr.mmx_instr",
+    "EventCode": "0xcb",
+    "BriefDescription": "MMX instructions.",
+    "PublicDescription": "The number of MMX, SSE or x87 instructions retired. The UnitMask allows the selection of the individual classes of instructions as given in the table. Each increment represents one complete instruction. Since this event includes non-numeric instructions it is not suitable for measuring MFLOPS. MMX instructions.",
+    "UMask": "0x2"
+  },
+  {
+    "EventName": "ex_ret_mmx_fp_instr.x87_instr",
+    "EventCode": "0xcb",
+    "BriefDescription": "x87 instructions.",
+    "PublicDescription": "The number of MMX, SSE or x87 instructions retired. The UnitMask allows the selection of the individual classes of instructions as given in the table. Each increment represents one complete instruction. Since this event includes non-numeric instructions it is not suitable for measuring MFLOPS. x87 instructions.",
+    "UMask": "0x1"
+  },
+  {
+    "EventName": "ex_ret_cond",
+    "EventCode": "0xd1",
+    "BriefDescription": "Retired Conditional Branch Instructions."
+  },
+  {
+    "EventName": "ex_ret_cond_misp",
+    "EventCode": "0xd2",
+    "BriefDescription": "Retired Conditional Branch Instructions Mispredicted."
+  },
+  {
+    "EventName": "ex_div_busy",
+    "EventCode": "0xd3",
+    "BriefDescription": "Div Cycles Busy count."
+  },
+  {
+    "EventName": "ex_div_count",
+    "EventCode": "0xd4",
+    "BriefDescription": "Div Op Count."
+  },
+  {
+    "EventName": "ex_tagged_ibs_ops.ibs_count_rollover",
+    "EventCode": "0x1cf",
+    "BriefDescription": "Number of times an op could not be tagged by IBS because of a previous tagged op that has not retired.",
+    "PublicDescription": "Tagged IBS Ops. Number of times an op could not be tagged by IBS because of a previous tagged op that has not retired.",
+    "UMask": "0x4"
+  },
+  {
+    "EventName": "ex_tagged_ibs_ops.ibs_tagged_ops_ret",
+    "EventCode": "0x1cf",
+    "BriefDescription": "Number of Ops tagged by IBS that retired.",
+    "PublicDescription": "Tagged IBS Ops. Number of Ops tagged by IBS that retired.",
+    "UMask": "0x2"
+  },
+  {
+    "EventName": "ex_tagged_ibs_ops.ibs_tagged_ops",
+    "EventCode": "0x1cf",
+    "BriefDescription": "Number of Ops tagged by IBS.",
+    "PublicDescription": "Tagged IBS Ops. Number of Ops tagged by IBS.",
+    "UMask": "0x1"
+  },
+  {
+    "EventName": "ex_ret_fus_brnch_inst",
+    "EventCode": "0x1d0",
+    "BriefDescription": "The number of fused retired branch instructions retired per cycle. The number of events logged per cycle can vary from 0 to 3."
+  }
+]
diff --git a/tools/perf/pmu-events/arch/x86/amdfam17h/floating-point.json b/tools/perf/pmu-events/arch/x86/amdfam17h/floating-point.json
new file mode 100644
index 000000000000..ea4711983d1d
--- /dev/null
+++ b/tools/perf/pmu-events/arch/x86/amdfam17h/floating-point.json
@@ -0,0 +1,168 @@
+[
+  {
+    "EventName": "fpu_pipe_assignment.dual",
+    "EventCode": "0x00",
+    "BriefDescription": "Total number multi-pipe uOps.",
+    "PublicDescription": "The number of operations (uOps) and dual-pipe uOps dispatched to each of the 4 FPU execution pipelines. This event reflects how busy the FPU pipelines are and may be used for workload characterization. This includes all operations performed by x87, MMX, and SSE instructions, including moves. Each increment represents a one- cycle dispatch event. This event is a speculative event. Since this event includes non-numeric operations it is not suitable for measuring MFLOPS. Total number multi-pipe uOps assigned to Pipe 3.",
+    "UMask": "0xf0"
+  },
+  {
+    "EventName": "fpu_pipe_assignment.total",
+    "EventCode": "0x00",
+    "BriefDescription": "Total number uOps.",
+    "PublicDescription": "The number of operations (uOps) and dual-pipe uOps dispatched to each of the 4 FPU execution pipelines. This event reflects how busy the FPU pipelines are and may be used for workload characterization. This includes all operations performed by x87, MMX, and SSE instructions, including moves. Each increment represents a one- cycle dispatch event. This event is a speculative event. Since this event includes non-numeric operations it is not suitable for measuring MFLOPS. Total number uOps assigned to Pipe 3.",
+    "UMask": "0xf"
+  },
+  {
+    "EventName": "fp_sched_empty",
+    "EventCode": "0x01",
+    "BriefDescription": "This is a speculative event. The number of cycles in which the FPU scheduler is empty. Note that some Ops like FP loads bypass the scheduler."
+  },
+  {
+    "EventName": "fp_retx87_fp_ops.all",
+    "EventCode": "0x02",
+    "BriefDescription": "All Ops.",
+    "PublicDescription": "The number of x87 floating-point Ops that have retired. The number of events logged per cycle can vary from 0 to 8.",
+    "UMask": "0x7"
+  },
+  {
+    "EventName": "fp_retx87_fp_ops.div_sqr_r_ops",
+    "EventCode": "0x02",
+    "BriefDescription": "Divide and square root Ops.",
+    "PublicDescription": "The number of x87 floating-point Ops that have retired. The number of events logged per cycle can vary from 0 to 8. Divide and square root Ops.",
+    "UMask": "0x4"
+  },
+  {
+    "EventName": "fp_retx87_fp_ops.mul_ops",
+    "EventCode": "0x02",
+    "BriefDescription": "Multiply Ops.",
+    "PublicDescription": "The number of x87 floating-point Ops that have retired. The number of events logged per cycle can vary from 0 to 8. Multiply Ops.",
+    "UMask": "0x2"
+  },
+  {
+    "EventName": "fp_retx87_fp_ops.add_sub_ops",
+    "EventCode": "0x02",
+    "BriefDescription": "Add/subtract Ops.",
+    "PublicDescription": "The number of x87 floating-point Ops that have retired. The number of events logged per cycle can vary from 0 to 8. Add/subtract Ops.",
+    "UMask": "0x1"
+  },
+  {
+    "EventName": "fp_ret_sse_avx_ops.all",
+    "EventCode": "0x03",
+    "BriefDescription": "All FLOPS.",
+    "PublicDescription": "This is a retire-based event. The number of retired SSE/AVX FLOPS. The number of events logged per cycle can vary from 0 to 64. This event can count above 15.",
+    "UMask": "0xff"
+  },
+  {
+    "EventName": "fp_ret_sse_avx_ops.dp_mult_add_flops",
+    "EventCode": "0x03",
+    "BriefDescription": "Double precision multiply-add FLOPS. Multiply-add counts as 2 FLOPS.",
+    "PublicDescription": "This is a retire-based event. The number of retired SSE/AVX FLOPS. The number of events logged per cycle can vary from 0 to 64. This event can count above 15. Double precision multiply-add FLOPS. Multiply-add counts as 2 FLOPS.",
+    "UMask": "0x80"
+  },
+  {
+    "EventName": "fp_ret_sse_avx_ops.dp_div_flops",
+    "EventCode": "0x03",
+    "BriefDescription": "Double precision divide/square root FLOPS.",
+    "PublicDescription": "This is a retire-based event. The number of retired SSE/AVX FLOPS. The number of events logged per cycle can vary from 0 to 64. This event can count above 15. Double precision divide/square root FLOPS.",
+    "UMask": "0x40"
+  },
+  {
+    "EventName": "fp_ret_sse_avx_ops.dp_mult_flops",
+    "EventCode": "0x03",
+    "BriefDescription": "Double precision multiply FLOPS.",
+    "PublicDescription": "This is a retire-based event. The number of retired SSE/AVX FLOPS. The number of events logged per cycle can vary from 0 to 64. This event can count above 15. Double precision multiply FLOPS.",
+    "UMask": "0x20"
+  },
+  {
+    "EventName": "fp_ret_sse_avx_ops.dp_add_sub_flops",
+    "EventCode": "0x03",
+    "BriefDescription": "Double precision add/subtract FLOPS.",
+    "PublicDescription": "This is a retire-based event. The number of retired SSE/AVX FLOPS. The number of events logged per cycle can vary from 0 to 64. This event can count above 15. Double precision add/subtract FLOPS.",
+    "UMask": "0x10"
+  },
+  {
+    "EventName": "fp_ret_sse_avx_ops.sp_mult_add_flops",
+    "EventCode": "0x03",
+    "BriefDescription": "Single precision multiply-add FLOPS. Multiply-add counts as 2 FLOPS.",
+    "PublicDescription": "This is a retire-based event. The number of retired SSE/AVX FLOPS. The number of events logged per cycle can vary from 0 to 64. This event can count above 15. Single precision multiply-add FLOPS. Multiply-add counts as 2 FLOPS.",
+    "UMask": "0x8"
+  },
+  {
+    "EventName": "fp_ret_sse_avx_ops.sp_div_flops",
+    "EventCode": "0x03",
+    "BriefDescription": "Single-precision divide/square root FLOPS.",
+    "PublicDescription": "This is a retire-based event. The number of retired SSE/AVX FLOPS. The number of events logged per cycle can vary from 0 to 64. This event can count above 15. Single-precision divide/square root FLOPS.",
+    "UMask": "0x4"
+  },
+  {
+    "EventName": "fp_ret_sse_avx_ops.sp_mult_flops",
+    "EventCode": "0x03",
+    "BriefDescription": "Single-precision multiply FLOPS.",
+    "PublicDescription": "This is a retire-based event. The number of retired SSE/AVX FLOPS. The number of events logged per cycle can vary from 0 to 64. This event can count above 15. Single-precision multiply FLOPS.",
+    "UMask": "0x2"
+  },
+  {
+    "EventName": "fp_ret_sse_avx_ops.sp_add_sub_flops",
+    "EventCode": "0x03",
+    "BriefDescription": "Single-precision add/subtract FLOPS.",
+    "PublicDescription": "This is a retire-based event. The number of retired SSE/AVX FLOPS. The number of events logged per cycle can vary from 0 to 64. This event can count above 15. Single-precision add/subtract FLOPS.",
+    "UMask": "0x1"
+  },
+  {
+    "EventName": "fp_num_mov_elim_scal_op.optimized",
+    "EventCode": "0x04",
+    "BriefDescription": "Number of Scalar Ops optimized.",
+    "PublicDescription": "This is a dispatch based speculative event, and is useful for measuring the effectiveness of the Move elimination and Scalar code optimization schemes. Number of Scalar Ops optimized.",
+    "UMask": "0x8"
+  },
+  {
+    "EventName": "fp_num_mov_elim_scal_op.opt_potential",
+    "EventCode": "0x04",
+    "BriefDescription": "Number of Ops that are candidates for optimization (have Z-bit either set or pass).",
+    "PublicDescription": "This is a dispatch based speculative event, and is useful for measuring the effectiveness of the Move elimination and Scalar code optimization schemes. Number of Ops that are candidates for optimization (have Z-bit either set or pass).",
+    "UMask": "0x4"
+  },
+  {
+    "EventName": "fp_num_mov_elim_scal_op.sse_mov_ops_elim",
+    "EventCode": "0x04",
+    "BriefDescription": "Number of SSE Move Ops eliminated.",
+    "PublicDescription": "This is a dispatch based speculative event, and is useful for measuring the effectiveness of the Move elimination and Scalar code optimization schemes. Number of SSE Move Ops eliminated.",
+    "UMask": "0x2"
+  },
+  {
+    "EventName": "fp_num_mov_elim_scal_op.sse_mov_ops",
+    "EventCode": "0x04",
+    "BriefDescription": "Number of SSE Move Ops.",
+    "PublicDescription": "This is a dispatch based speculative event, and is useful for measuring the effectiveness of the Move elimination and Scalar code optimization schemes. Number of SSE Move Ops.",
+    "UMask": "0x1"
+  },
+  {
+    "EventName": "fp_retired_ser_ops.x87_ctrl_ret",
+    "EventCode": "0x05",
+    "BriefDescription": "x87 control word mispredict traps due to mispredictions in RC or PC, or changes in mask bits.",
+    "PublicDescription": "The number of serializing Ops retired. x87 control word mispredict traps due to mispredictions in RC or PC, or changes in mask bits.",
+    "UMask": "0x8"
+  },
+  {
+    "EventName": "fp_retired_ser_ops.x87_bot_ret",
+    "EventCode": "0x05",
+    "BriefDescription": "x87 bottom-executing uOps retired.",
+    "PublicDescription": "The number of serializing Ops retired. x87 bottom-executing uOps retired.",
+    "UMask": "0x4"
+  },
+  {
+    "EventName": "fp_retired_ser_ops.sse_ctrl_ret",
+    "EventCode": "0x05",
+    "BriefDescription": "SSE control word mispredict traps due to mispredictions in RC, FTZ or DAZ, or changes in mask bits.",
+    "PublicDescription": "The number of serializing Ops retired. SSE control word mispredict traps due to mispredictions in RC, FTZ or DAZ, or changes in mask bits.",
+    "UMask": "0x2"
+  },
+  {
+    "EventName": "fp_retired_ser_ops.sse_bot_ret",
+    "EventCode": "0x05",
+    "BriefDescription": "SSE bottom-executing uOps retired.",
+    "PublicDescription": "The number of serializing Ops retired. SSE bottom-executing uOps retired.",
+    "UMask": "0x1"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/x86/amdfam17h/memory.json b/tools/perf/pmu-events/arch/x86/amdfam17h/memory.json
new file mode 100644
index 000000000000..fa2d60d4def0
--- /dev/null
+++ b/tools/perf/pmu-events/arch/x86/amdfam17h/memory.json
@@ -0,0 +1,162 @@
+[
+  {
+    "EventName": "ls_locks.bus_lock",
+    "EventCode": "0x25",
+    "BriefDescription": "Bus lock when a locked operations crosses a cache boundary or is done on an uncacheable memory type.",
+    "PublicDescription": "Bus lock when a locked operations crosses a cache boundary or is done on an uncacheable memory type.",
+    "UMask": "0x1"
+  },
+  {
+    "EventName": "ls_dispatch.ld_st_dispatch",
+    "EventCode": "0x29",
+    "BriefDescription": "Load-op-Stores.",
+    "PublicDescription": "Counts the number of operations dispatched to the LS unit. Unit Masks ADDed. Load-op-Stores.",
+    "UMask": "0x4"
+  },
+  {
+    "EventName": "ls_dispatch.store_dispatch",
+    "EventCode": "0x29",
+    "BriefDescription": "Counts the number of operations dispatched to the LS unit. Unit Masks ADDed.",
+    "PublicDescription": "Counts the number of operations dispatched to the LS unit. Unit Masks ADDed.",
+    "UMask": "0x2"
+  },
+  {
+    "EventName": "ls_dispatch.ld_dispatch",
+    "EventCode": "0x29",
+    "BriefDescription": "Counts the number of operations dispatched to the LS unit. Unit Masks ADDed.",
+    "PublicDescription": "Counts the number of operations dispatched to the LS unit. Unit Masks ADDed.",
+    "UMask": "0x1"
+  },
+  {
+    "EventName": "ls_stlf",
+    "EventCode": "0x35",
+    "BriefDescription": "Number of STLF hits."
+  },
+  {
+    "EventName": "ls_dc_accesses",
+    "EventCode": "0x40",
+    "BriefDescription": "The number of accesses to the data cache for load and store references. This may include certain microcode scratchpad accesses, although these are generally rare. Each increment represents an eight-byte access, although the instruction may only be accessing a portion of that. This event is a speculative event."
+  },
+  {
+    "EventName": "ls_l1_d_tlb_miss.all",
+    "EventCode": "0x45",
+    "BriefDescription": "L1 DTLB Miss or Reload off all sizes.",
+    "PublicDescription": "L1 DTLB Miss or Reload off all sizes.",
+    "UMask": "0xff"
+  },
+  {
+    "EventName": "ls_l1_d_tlb_miss.tlb_reload_1g_l2_miss",
+    "EventCode": "0x45",
+    "BriefDescription": "L1 DTLB Miss of a page of 1G size.",
+    "PublicDescription": "L1 DTLB Miss of a page of 1G size.",
+    "UMask": "0x80"
+  },
+  {
+    "EventName": "ls_l1_d_tlb_miss.tlb_reload_2m_l2_miss",
+    "EventCode": "0x45",
+    "BriefDescription": "L1 DTLB Miss of a page of 2M size.",
+    "PublicDescription": "L1 DTLB Miss of a page of 2M size.",
+    "UMask": "0x40"
+  },
+  {
+    "EventName": "ls_l1_d_tlb_miss.tlb_reload_32k_l2_miss",
+    "EventCode": "0x45",
+    "BriefDescription": "L1 DTLB Miss of a page of 32K size.",
+    "PublicDescription": "L1 DTLB Miss of a page of 32K size.",
+    "UMask": "0x20"
+  },
+  {
+    "EventName": "ls_l1_d_tlb_miss.tlb_reload_4k_l2_miss",
+    "EventCode": "0x45",
+    "BriefDescription": "L1 DTLB Miss of a page of 4K size.",
+    "PublicDescription": "L1 DTLB Miss of a page of 4K size.",
+    "UMask": "0x10"
+  },
+  {
+    "EventName": "ls_l1_d_tlb_miss.tlb_reload_1g_l2_hit",
+    "EventCode": "0x45",
+    "BriefDescription": "L1 DTLB Reload of a page of 1G size.",
+    "PublicDescription": "L1 DTLB Reload of a page of 1G size.",
+    "UMask": "0x8"
+  },
+  {
+    "EventName": "ls_l1_d_tlb_miss.tlb_reload_2m_l2_hit",
+    "EventCode": "0x45",
+    "BriefDescription": "L1 DTLB Reload of a page of 2M size.",
+    "PublicDescription": "L1 DTLB Reload of a page of 2M size.",
+    "UMask": "0x4"
+  },
+  {
+    "EventName": "ls_l1_d_tlb_miss.tlb_reload_32k_l2_hit",
+    "EventCode": "0x45",
+    "BriefDescription": "L1 DTLB Reload of a page of 32K size.",
+    "PublicDescription": "L1 DTLB Reload of a page of 32K size.",
+    "UMask": "0x2"
+  },
+  {
+    "EventName": "ls_l1_d_tlb_miss.tlb_reload_4k_l2_hit",
+    "EventCode": "0x45",
+    "BriefDescription": "L1 DTLB Reload of a page of 4K size.",
+    "PublicDescription": "L1 DTLB Reload of a page of 4K size.",
+    "UMask": "0x1"
+  },
+  {
+    "EventName": "ls_tablewalker.perf_mon_tablewalk_alloc_iside",
+    "EventCode": "0x46",
+    "BriefDescription": "Tablewalker allocation.",
+    "PublicDescription": "Tablewalker allocation.",
+    "UMask": "0xc"
+  },
+  {
+    "EventName": "ls_tablewalker.perf_mon_tablewalk_alloc_dside",
+    "EventCode": "0x46",
+    "BriefDescription": "Tablewalker allocation.",
+    "PublicDescription": "Tablewalker allocation.",
+    "UMask": "0x3"
+  },
+  {
+    "EventName": "ls_misal_accesses",
+    "EventCode": "0x47",
+    "BriefDescription": "Misaligned loads."
+  },
+  {
+    "EventName": "ls_pref_instr_disp.prefetch_nta",
+    "EventCode": "0x4b",
+    "BriefDescription": "Software Prefetch Instructions (PREFETCHNTA instruction) Dispatched.",
+    "PublicDescription": "Software Prefetch Instructions (PREFETCHNTA instruction) Dispatched.",
+    "UMask": "0x4"
+  },
+  {
+    "EventName": "ls_pref_instr_disp.store_prefetch_w",
+    "EventCode": "0x4b",
+    "BriefDescription": "Software Prefetch Instructions (3DNow PREFETCHW instruction) Dispatched.",
+    "PublicDescription": "Software Prefetch Instructions (3DNow PREFETCHW instruction) Dispatched.",
+    "UMask": "0x2"
+  },
+  {
+    "EventName": "ls_pref_instr_disp.load_prefetch_w",
+    "EventCode": "0x4b",
+    "BriefDescription": "Prefetch, Prefetch_T0_T1_T2.",
+    "PublicDescription": "Software Prefetch Instructions Dispatched. Prefetch, Prefetch_T0_T1_T2.",
+    "UMask": "0x1"
+  },
+  {
+    "EventName": "ls_inef_sw_pref.mab_mch_cnt",
+    "EventCode": "0x52",
+    "BriefDescription": "The number of software prefetches that did not fetch data outside of the processor core.",
+    "PublicDescription": "The number of software prefetches that did not fetch data outside of the processor core.",
+    "UMask": "0x2"
+  },
+  {
+    "EventName": "ls_inef_sw_pref.data_pipe_sw_pf_dc_hit",
+    "EventCode": "0x52",
+    "BriefDescription": "The number of software prefetches that did not fetch data outside of the processor core.",
+    "PublicDescription": "The number of software prefetches that did not fetch data outside of the processor core.",
+    "UMask": "0x1"
+  },
+  {
+    "EventName": "ls_not_halted_cyc",
+    "EventCode": "0x76",
+    "BriefDescription": "Cycles not in Halt."
+  }
+]
diff --git a/tools/perf/pmu-events/arch/x86/amdfam17h/other.json b/tools/perf/pmu-events/arch/x86/amdfam17h/other.json
new file mode 100644
index 000000000000..b26a00d05a2e
--- /dev/null
+++ b/tools/perf/pmu-events/arch/x86/amdfam17h/other.json
@@ -0,0 +1,65 @@
+[
+  {
+    "EventName": "ic_oc_mode_switch.oc_ic_mode_switch",
+    "EventCode": "0x28a",
+    "BriefDescription": "OC to IC mode switch.",
+    "PublicDescription": "OC Mode Switch. OC to IC mode switch.",
+    "UMask": "0x2"
+  },
+  {
+    "EventName": "ic_oc_mode_switch.ic_oc_mode_switch",
+    "EventCode": "0x28a",
+    "BriefDescription": "IC to OC mode switch.",
+    "PublicDescription": "OC Mode Switch. IC to OC mode switch.",
+    "UMask": "0x1"
+  },
+  {
+    "EventName": "de_dis_dispatch_token_stalls0.retire_token_stall",
+    "EventCode": "0xaf",
+    "BriefDescription": "RETIRE Tokens unavailable.",
+    "PublicDescription": "Cycles where a dispatch group is valid but does not get dispatched due to a token stall. RETIRE Tokens unavailable.",
+    "UMask": "0x40"
+  },
+  {
+    "EventName": "de_dis_dispatch_token_stalls0.agsq_token_stall",
+    "EventCode": "0xaf",
+    "BriefDescription": "AGSQ Tokens unavailable.",
+    "PublicDescription": "Cycles where a dispatch group is valid but does not get dispatched due to a token stall. AGSQ Tokens unavailable.",
+    "UMask": "0x20"
+  },
+  {
+    "EventName": "de_dis_dispatch_token_stalls0.alu_token_stall",
+    "EventCode": "0xaf",
+    "BriefDescription": "ALU tokens total unavailable.",
+    "PublicDescription": "Cycles where a dispatch group is valid but does not get dispatched due to a token stall. ALU tokens total unavailable.",
+    "UMask": "0x10"
+  },
+  {
+    "EventName": "de_dis_dispatch_token_stalls0.alsq3_0_token_stall",
+    "EventCode": "0xaf",
+    "BriefDescription": "Cycles where a dispatch group is valid but does not get dispatched due to a token stall.",
+    "PublicDescription": "Cycles where a dispatch group is valid but does not get dispatched due to a token stall.",
+    "UMask": "0x8"
+  },
+  {
+    "EventName": "de_dis_dispatch_token_stalls0.alsq3_token_stall",
+    "EventCode": "0xaf",
+    "BriefDescription": "ALSQ 3 Tokens unavailable.",
+    "PublicDescription": "Cycles where a dispatch group is valid but does not get dispatched due to a token stall. ALSQ 3 Tokens unavailable.",
+    "UMask": "0x4"
+  },
+  {
+    "EventName": "de_dis_dispatch_token_stalls0.alsq2_token_stall",
+    "EventCode": "0xaf",
+    "BriefDescription": "ALSQ 2 Tokens unavailable.",
+    "PublicDescription": "Cycles where a dispatch group is valid but does not get dispatched due to a token stall. ALSQ 2 Tokens unavailable.",
+    "UMask": "0x2"
+  },
+  {
+    "EventName": "de_dis_dispatch_token_stalls0.alsq1_token_stall",
+    "EventCode": "0xaf",
+    "BriefDescription": "ALSQ 1 Tokens unavailable.",
+    "PublicDescription": "Cycles where a dispatch group is valid but does not get dispatched due to a token stall. ALSQ 1 Tokens unavailable.",
+    "UMask": "0x1"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/x86/mapfile.csv b/tools/perf/pmu-events/arch/x86/mapfile.csv
index e05c2c8458fc..d6984a3017e0 100644
--- a/tools/perf/pmu-events/arch/x86/mapfile.csv
+++ b/tools/perf/pmu-events/arch/x86/mapfile.csv
@@ -33,3 +33,4 @@ GenuineIntel-6-25,v2,westmereep-sp,core
 GenuineIntel-6-2F,v2,westmereex,core
 GenuineIntel-6-55-[01234],v1,skylakex,core
 GenuineIntel-6-55-[56789ABCDEF],v1,cascadelakex,core
+AuthenticAMD-23-[[:xdigit:]]+,v1,amdfam17h,core
diff --git a/tools/perf/scripts/python/export-to-postgresql.py b/tools/perf/scripts/python/export-to-postgresql.py
index 390a351d15ea..c3eae1d77d36 100644
--- a/tools/perf/scripts/python/export-to-postgresql.py
+++ b/tools/perf/scripts/python/export-to-postgresql.py
@@ -10,6 +10,8 @@
 # FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
 # more details.
 
+from __future__ import print_function
+
 import os
 import sys
 import struct
@@ -199,6 +201,18 @@ import datetime
 
 from PySide.QtSql import *
 
+if sys.version_info < (3, 0):
+        def toserverstr(str):
+                return str
+        def toclientstr(str):
+                return str
+else:
+        # Assume UTF-8 server_encoding and client_encoding
+        def toserverstr(str):
+                return bytes(str, "UTF_8")
+        def toclientstr(str):
+                return bytes(str, "UTF_8")
+
 # Need to access PostgreSQL C library directly to use COPY FROM STDIN
 from ctypes import *
 libpq = CDLL("libpq.so.5")
@@ -234,12 +248,17 @@ perf_db_export_mode = True
 perf_db_export_calls = False
 perf_db_export_callchains = False
 
+def printerr(*args, **kw_args):
+        print(*args, file=sys.stderr, **kw_args)
+
+def printdate(*args, **kw_args):
+        print(datetime.datetime.today(), *args, sep=' ', **kw_args)
 
 def usage():
-        print >> sys.stderr, "Usage is: export-to-postgresql.py <database name> [<columns>] [<calls>] [<callchains>]"
-        print >> sys.stderr, "where:    columns         'all' or 'branches'"
-        print >> sys.stderr, "          calls           'calls' => create calls and call_paths table"
-        print >> sys.stderr, "          callchains      'callchains' => create call_paths table"
+        printerr("Usage is: export-to-postgresql.py <database name> [<columns>] [<calls>] [<callchains>]")
+        printerr("where:        columns         'all' or 'branches'")
+        printerr("              calls           'calls' => create calls and call_paths table")
+        printerr("              callchains      'callchains' => create call_paths table")
         raise Exception("Too few arguments")
 
 if (len(sys.argv) < 2):
@@ -273,7 +292,7 @@ def do_query(q, s):
                 return
         raise Exception("Query failed: " + q.lastError().text())
 
-print datetime.datetime.today(), "Creating database..."
+printdate("Creating database...")
 
 db = QSqlDatabase.addDatabase('QPSQL')
 query = QSqlQuery(db)
@@ -506,12 +525,12 @@ do_query(query, 'CREATE VIEW samples_view AS '
         ' FROM samples')
 
 
-file_header = struct.pack("!11sii", "PGCOPY\n\377\r\n\0", 0, 0)
-file_trailer = "\377\377"
+file_header = struct.pack("!11sii", b"PGCOPY\n\377\r\n\0", 0, 0)
+file_trailer = b"\377\377"
 
 def open_output_file(file_name):
         path_name = output_dir_name + "/" + file_name
-        file = open(path_name, "w+")
+        file = open(path_name, "wb+")
         file.write(file_header)
         return file
 
@@ -526,13 +545,13 @@ def copy_output_file_direct(file, table_name):
 
 # Use COPY FROM STDIN because security may prevent postgres from accessing the files directly
 def copy_output_file(file, table_name):
-        conn = PQconnectdb("dbname = " + dbname)
+        conn = PQconnectdb(toclientstr("dbname = " + dbname))
         if (PQstatus(conn)):
                 raise Exception("COPY FROM STDIN PQconnectdb failed")
         file.write(file_trailer)
         file.seek(0)
         sql = "COPY " + table_name + " FROM STDIN (FORMAT 'binary')"
-        res = PQexec(conn, sql)
+        res = PQexec(conn, toclientstr(sql))
         if (PQresultStatus(res) != 4):
                 raise Exception("COPY FROM STDIN PQexec failed")
         data = file.read(65536)
@@ -566,7 +585,7 @@ if perf_db_export_calls:
         call_file               = open_output_file("call_table.bin")
 
 def trace_begin():
-        print datetime.datetime.today(), "Writing to intermediate files..."
+        printdate("Writing to intermediate files...")
         # id == 0 means unknown.  It is easier to create records for them than replace the zeroes with NULLs
         evsel_table(0, "unknown")
         machine_table(0, 0, "unknown")
@@ -582,7 +601,7 @@ def trace_begin():
 unhandled_count = 0
 
 def trace_end():
-        print datetime.datetime.today(), "Copying to database..."
+        printdate("Copying to database...")
         copy_output_file(evsel_file,            "selected_events")
         copy_output_file(machine_file,          "machines")
         copy_output_file(thread_file,           "threads")
@@ -597,7 +616,7 @@ def trace_end():
         if perf_db_export_calls:
                 copy_output_file(call_file,             "calls")
 
-        print datetime.datetime.today(), "Removing intermediate files..."
+        printdate("Removing intermediate files...")
         remove_output_file(evsel_file)
         remove_output_file(machine_file)
         remove_output_file(thread_file)
@@ -612,7 +631,7 @@ def trace_end():
         if perf_db_export_calls:
                 remove_output_file(call_file)
         os.rmdir(output_dir_name)
-        print datetime.datetime.today(), "Adding primary keys"
+        printdate("Adding primary keys")
         do_query(query, 'ALTER TABLE selected_events ADD PRIMARY KEY (id)')
         do_query(query, 'ALTER TABLE machines        ADD PRIMARY KEY (id)')
         do_query(query, 'ALTER TABLE threads         ADD PRIMARY KEY (id)')
@@ -627,7 +646,7 @@ def trace_end():
         if perf_db_export_calls:
                 do_query(query, 'ALTER TABLE calls           ADD PRIMARY KEY (id)')
 
-        print datetime.datetime.today(), "Adding foreign keys"
+        printdate("Adding foreign keys")
         do_query(query, 'ALTER TABLE threads '
                                         'ADD CONSTRAINT machinefk  FOREIGN KEY (machine_id)   REFERENCES machines   (id),'
                                         'ADD CONSTRAINT processfk  FOREIGN KEY (process_id)   REFERENCES threads    (id)')
@@ -663,8 +682,8 @@ def trace_end():
                 do_query(query, 'CREATE INDEX pid_idx ON calls (parent_id)')
 
         if (unhandled_count):
-                print datetime.datetime.today(), "Warning: ", unhandled_count, " unhandled events"
-        print datetime.datetime.today(), "Done"
+                printdate("Warning: ", unhandled_count, " unhandled events")
+        printdate("Done")
 
 def trace_unhandled(event_name, context, event_fields_dict):
         global unhandled_count
@@ -674,12 +693,14 @@ def sched__sched_switch(*x):
         pass
 
 def evsel_table(evsel_id, evsel_name, *x):
+        evsel_name = toserverstr(evsel_name)
         n = len(evsel_name)
         fmt = "!hiqi" + str(n) + "s"
         value = struct.pack(fmt, 2, 8, evsel_id, n, evsel_name)
         evsel_file.write(value)
 
 def machine_table(machine_id, pid, root_dir, *x):
+        root_dir = toserverstr(root_dir)
         n = len(root_dir)
         fmt = "!hiqiii" + str(n) + "s"
         value = struct.pack(fmt, 3, 8, machine_id, 4, pid, n, root_dir)
@@ -690,6 +711,7 @@ def thread_table(thread_id, machine_id, process_id, pid, tid, *x):
         thread_file.write(value)
 
 def comm_table(comm_id, comm_str, *x):
+        comm_str = toserverstr(comm_str)
         n = len(comm_str)
         fmt = "!hiqi" + str(n) + "s"
         value = struct.pack(fmt, 2, 8, comm_id, n, comm_str)
@@ -701,6 +723,9 @@ def comm_thread_table(comm_thread_id, comm_id, thread_id, *x):
         comm_thread_file.write(value)
 
 def dso_table(dso_id, machine_id, short_name, long_name, build_id, *x):
+        short_name = toserverstr(short_name)
+        long_name = toserverstr(long_name)
+        build_id = toserverstr(build_id)
         n1 = len(short_name)
         n2 = len(long_name)
         n3 = len(build_id)
@@ -709,12 +734,14 @@ def dso_table(dso_id, machine_id, short_name, long_name, build_id, *x):
         dso_file.write(value)
 
 def symbol_table(symbol_id, dso_id, sym_start, sym_end, binding, symbol_name, *x):
+        symbol_name = toserverstr(symbol_name)
         n = len(symbol_name)
         fmt = "!hiqiqiqiqiii" + str(n) + "s"
         value = struct.pack(fmt, 6, 8, symbol_id, 8, dso_id, 8, sym_start, 8, sym_end, 4, binding, n, symbol_name)
         symbol_file.write(value)
 
 def branch_type_table(branch_type, name, *x):
+        name = toserverstr(name)
         n = len(name)
         fmt = "!hiii" + str(n) + "s"
         value = struct.pack(fmt, 2, 4, branch_type, n, name)
diff --git a/tools/perf/scripts/python/export-to-sqlite.py b/tools/perf/scripts/python/export-to-sqlite.py
index eb63e6c7107f..3b71902a5a21 100644
--- a/tools/perf/scripts/python/export-to-sqlite.py
+++ b/tools/perf/scripts/python/export-to-sqlite.py
@@ -10,6 +10,8 @@
 # FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
 # more details.
 
+from __future__ import print_function
+
 import os
 import sys
 import struct
@@ -60,11 +62,17 @@ perf_db_export_mode = True
 perf_db_export_calls = False
 perf_db_export_callchains = False
 
+def printerr(*args, **keyword_args):
+        print(*args, file=sys.stderr, **keyword_args)
+
+def printdate(*args, **kw_args):
+        print(datetime.datetime.today(), *args, sep=' ', **kw_args)
+
 def usage():
-        print >> sys.stderr, "Usage is: export-to-sqlite.py <database name> [<columns>] [<calls>] [<callchains>]"
-        print >> sys.stderr, "where:    columns         'all' or 'branches'"
-        print >> sys.stderr, "          calls           'calls' => create calls and call_paths table"
-        print >> sys.stderr, "          callchains      'callchains' => create call_paths table"
+        printerr("Usage is: export-to-sqlite.py <database name> [<columns>] [<calls>] [<callchains>]");
+        printerr("where:        columns         'all' or 'branches'");
+        printerr("              calls           'calls' => create calls and call_paths table");
+        printerr("              callchains      'callchains' => create call_paths table");
         raise Exception("Too few arguments")
 
 if (len(sys.argv) < 2):
@@ -100,7 +108,7 @@ def do_query_(q):
                 return
         raise Exception("Query failed: " + q.lastError().text())
 
-print datetime.datetime.today(), "Creating database..."
+printdate("Creating database ...")
 
 db_exists = False
 try:
@@ -378,7 +386,7 @@ if perf_db_export_calls:
         call_query.prepare("INSERT INTO calls VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)")
 
 def trace_begin():
-        print datetime.datetime.today(), "Writing records..."
+        printdate("Writing records...")
         do_query(query, 'BEGIN TRANSACTION')
         # id == 0 means unknown.  It is easier to create records for them than replace the zeroes with NULLs
         evsel_table(0, "unknown")
@@ -397,14 +405,14 @@ unhandled_count = 0
 def trace_end():
         do_query(query, 'END TRANSACTION')
 
-        print datetime.datetime.today(), "Adding indexes"
+        printdate("Adding indexes")
         if perf_db_export_calls:
                 do_query(query, 'CREATE INDEX pcpid_idx ON calls (parent_call_path_id)')
                 do_query(query, 'CREATE INDEX pid_idx ON calls (parent_id)')
 
         if (unhandled_count):
-                print datetime.datetime.today(), "Warning: ", unhandled_count, " unhandled events"
-        print datetime.datetime.today(), "Done"
+                printdate("Warning: ", unhandled_count, " unhandled events")
+        printdate("Done")
 
 def trace_unhandled(event_name, context, event_fields_dict):
         global unhandled_count
diff --git a/tools/perf/scripts/python/exported-sql-viewer.py b/tools/perf/scripts/python/exported-sql-viewer.py
index afec9479ca7f..e38518cdcbc3 100755
--- a/tools/perf/scripts/python/exported-sql-viewer.py
+++ b/tools/perf/scripts/python/exported-sql-viewer.py
@@ -88,11 +88,20 @@
 #                                                                              7fab593ea956 48 89 15 3b 13 22 00                            movq  %rdx, 0x22133b(%rip)
 # 8107675243232  2    ls       22011  22011  hardware interrupt     No         7fab593ea956 _dl_start+0x26 (ld-2.19.so) -> ffffffff86a012e0 page_fault ([kernel])
 
+from __future__ import print_function
+
 import sys
 import weakref
 import threading
 import string
-import cPickle
+try:
+        # Python2
+        import cPickle as pickle
+        # size of pickled integer big enough for record size
+        glb_nsz = 8
+except ImportError:
+        import pickle
+        glb_nsz = 16
 import re
 import os
 from PySide.QtCore import *
@@ -102,6 +111,15 @@ from decimal import *
 from ctypes import *
 from multiprocessing import Process, Array, Value, Event
 
+# xrange is range in Python3
+try:
+        xrange
+except NameError:
+        xrange = range
+
+def printerr(*args, **keyword_args):
+        print(*args, file=sys.stderr, **keyword_args)
+
 # Data formatting helpers
 
 def tohex(ip):
@@ -1004,10 +1022,6 @@ class ChildDataItemFinder():
 
 glb_chunk_sz = 10000
 
-# size of pickled integer big enough for record size
-
-glb_nsz = 8
-
 # Background process for SQL data fetcher
 
 class SQLFetcherProcess():
@@ -1066,7 +1080,7 @@ class SQLFetcherProcess():
                                 return True
                         if space >= glb_nsz:
                                 # Use 0 (or space < glb_nsz) to mean there is no more at the top of the buffer
-                                nd = cPickle.dumps(0, cPickle.HIGHEST_PROTOCOL)
+                                nd = pickle.dumps(0, pickle.HIGHEST_PROTOCOL)
                                 self.buffer[self.local_head : self.local_head + len(nd)] = nd
                         self.local_head = 0
                 if self.local_tail - self.local_head > sz:
@@ -1084,9 +1098,9 @@ class SQLFetcherProcess():
                         self.wait_event.wait()
 
         def AddToBuffer(self, obj):
-                d = cPickle.dumps(obj, cPickle.HIGHEST_PROTOCOL)
+                d = pickle.dumps(obj, pickle.HIGHEST_PROTOCOL)
                 n = len(d)
-                nd = cPickle.dumps(n, cPickle.HIGHEST_PROTOCOL)
+                nd = pickle.dumps(n, pickle.HIGHEST_PROTOCOL)
                 sz = n + glb_nsz
                 self.WaitForSpace(sz)
                 pos = self.local_head
@@ -1198,12 +1212,12 @@ class SQLFetcher(QObject):
                 pos = self.local_tail
                 if len(self.buffer) - pos < glb_nsz:
                         pos = 0
-                n = cPickle.loads(self.buffer[pos : pos + glb_nsz])
+                n = pickle.loads(self.buffer[pos : pos + glb_nsz])
                 if n == 0:
                         pos = 0
-                        n = cPickle.loads(self.buffer[0 : glb_nsz])
+                        n = pickle.loads(self.buffer[0 : glb_nsz])
                 pos += glb_nsz
-                obj = cPickle.loads(self.buffer[pos : pos + n])
+                obj = pickle.loads(self.buffer[pos : pos + n])
                 self.local_tail = pos + n
                 return obj
 
@@ -2973,7 +2987,7 @@ class DBRef():
 
 def Main():
         if (len(sys.argv) < 2):
-                print >> sys.stderr, "Usage is: exported-sql-viewer.py {<database name> | --help-only}"
+                printerr("Usage is: exported-sql-viewer.py {<database name> | --help-only}");
                 raise Exception("Too few arguments")
 
         dbname = sys.argv[1]
@@ -2986,8 +3000,8 @@ def Main():
 
         is_sqlite3 = False
         try:
-                f = open(dbname)
-                if f.read(15) == "SQLite format 3":
+                f = open(dbname, "rb")
+                if f.read(15) == b'SQLite format 3':
                         is_sqlite3 = True
                 f.close()
         except:
diff --git a/tools/perf/tests/attr/test-record-C0 b/tools/perf/tests/attr/test-record-C0
index cb0a3138fa54..93818054ae20 100644
--- a/tools/perf/tests/attr/test-record-C0
+++ b/tools/perf/tests/attr/test-record-C0
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = -C 0 kill >/dev/null 2>&1
+args    = --no-bpf-event -C 0 kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/attr/test-record-basic b/tools/perf/tests/attr/test-record-basic
index 85a23cf35ba1..b0ca42a5ecc9 100644
--- a/tools/perf/tests/attr/test-record-basic
+++ b/tools/perf/tests/attr/test-record-basic
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = kill >/dev/null 2>&1
+args    = --no-bpf-event kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/attr/test-record-branch-any b/tools/perf/tests/attr/test-record-branch-any
index 81f839e2fad0..1a99b3ce6b89 100644
--- a/tools/perf/tests/attr/test-record-branch-any
+++ b/tools/perf/tests/attr/test-record-branch-any
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = -b kill >/dev/null 2>&1
+args    = --no-bpf-event -b kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/attr/test-record-branch-filter-any b/tools/perf/tests/attr/test-record-branch-filter-any
index 357421f4dfce..709768b508c6 100644
--- a/tools/perf/tests/attr/test-record-branch-filter-any
+++ b/tools/perf/tests/attr/test-record-branch-filter-any
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = -j any kill >/dev/null 2>&1
+args    = --no-bpf-event -j any kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/attr/test-record-branch-filter-any_call b/tools/perf/tests/attr/test-record-branch-filter-any_call
index dbc55f2ab845..f943221f7825 100644
--- a/tools/perf/tests/attr/test-record-branch-filter-any_call
+++ b/tools/perf/tests/attr/test-record-branch-filter-any_call
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = -j any_call kill >/dev/null 2>&1
+args    = --no-bpf-event -j any_call kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/attr/test-record-branch-filter-any_ret b/tools/perf/tests/attr/test-record-branch-filter-any_ret
index a0824ff8e131..fd4f5b4154a9 100644
--- a/tools/perf/tests/attr/test-record-branch-filter-any_ret
+++ b/tools/perf/tests/attr/test-record-branch-filter-any_ret
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = -j any_ret kill >/dev/null 2>&1
+args    = --no-bpf-event -j any_ret kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/attr/test-record-branch-filter-hv b/tools/perf/tests/attr/test-record-branch-filter-hv
index f34d6f120181..4e52d685ebe1 100644
--- a/tools/perf/tests/attr/test-record-branch-filter-hv
+++ b/tools/perf/tests/attr/test-record-branch-filter-hv
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = -j hv kill >/dev/null 2>&1
+args    = --no-bpf-event -j hv kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/attr/test-record-branch-filter-ind_call b/tools/perf/tests/attr/test-record-branch-filter-ind_call
index b86a35232248..e08c6ab3796e 100644
--- a/tools/perf/tests/attr/test-record-branch-filter-ind_call
+++ b/tools/perf/tests/attr/test-record-branch-filter-ind_call
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = -j ind_call kill >/dev/null 2>&1
+args    = --no-bpf-event -j ind_call kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/attr/test-record-branch-filter-k b/tools/perf/tests/attr/test-record-branch-filter-k
index d3fbc5e1858a..b4b98f84fc2f 100644
--- a/tools/perf/tests/attr/test-record-branch-filter-k
+++ b/tools/perf/tests/attr/test-record-branch-filter-k
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = -j k kill >/dev/null 2>&1
+args    = --no-bpf-event -j k kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/attr/test-record-branch-filter-u b/tools/perf/tests/attr/test-record-branch-filter-u
index a318f0dda173..fb9610edbb0d 100644
--- a/tools/perf/tests/attr/test-record-branch-filter-u
+++ b/tools/perf/tests/attr/test-record-branch-filter-u
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = -j u kill >/dev/null 2>&1
+args    = --no-bpf-event -j u kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/attr/test-record-count b/tools/perf/tests/attr/test-record-count
index 34f6cc577263..5e9b9019d786 100644
--- a/tools/perf/tests/attr/test-record-count
+++ b/tools/perf/tests/attr/test-record-count
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = -c 123 kill >/dev/null 2>&1
+args    = --no-bpf-event -c 123 kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/attr/test-record-data b/tools/perf/tests/attr/test-record-data
index a9cf2233b0ce..a99bb13149c2 100644
--- a/tools/perf/tests/attr/test-record-data
+++ b/tools/perf/tests/attr/test-record-data
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = -d kill >/dev/null 2>&1
+args    = --no-bpf-event -d kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/attr/test-record-freq b/tools/perf/tests/attr/test-record-freq
index bf4cb459f0d5..89e29f6b2ae0 100644
--- a/tools/perf/tests/attr/test-record-freq
+++ b/tools/perf/tests/attr/test-record-freq
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = -F 100 kill >/dev/null 2>&1
+args    = --no-bpf-event -F 100 kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/attr/test-record-graph-default b/tools/perf/tests/attr/test-record-graph-default
index 0b216e69760c..5d8234d50845 100644
--- a/tools/perf/tests/attr/test-record-graph-default
+++ b/tools/perf/tests/attr/test-record-graph-default
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = -g kill >/dev/null 2>&1
+args    = --no-bpf-event -g kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/attr/test-record-graph-dwarf b/tools/perf/tests/attr/test-record-graph-dwarf
index da2fa73bd0a2..ae92061d611d 100644
--- a/tools/perf/tests/attr/test-record-graph-dwarf
+++ b/tools/perf/tests/attr/test-record-graph-dwarf
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = --call-graph dwarf -- kill >/dev/null 2>&1
+args    = --no-bpf-event --call-graph dwarf -- kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/attr/test-record-graph-fp b/tools/perf/tests/attr/test-record-graph-fp
index 625d190bb798..5630521c0b0f 100644
--- a/tools/perf/tests/attr/test-record-graph-fp
+++ b/tools/perf/tests/attr/test-record-graph-fp
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = --call-graph fp kill >/dev/null 2>&1
+args    = --no-bpf-event --call-graph fp kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/attr/test-record-group b/tools/perf/tests/attr/test-record-group
index 618ba1c17474..14ee60fd3f41 100644
--- a/tools/perf/tests/attr/test-record-group
+++ b/tools/perf/tests/attr/test-record-group
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = --group -e cycles,instructions kill >/dev/null 2>&1
+args    = --no-bpf-event --group -e cycles,instructions kill >/dev/null 2>&1
 ret     = 1
 
 [event-1:base-record]
diff --git a/tools/perf/tests/attr/test-record-group-sampling b/tools/perf/tests/attr/test-record-group-sampling
index f0729c454f16..300b9f7e6d69 100644
--- a/tools/perf/tests/attr/test-record-group-sampling
+++ b/tools/perf/tests/attr/test-record-group-sampling
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = -e '{cycles,cache-misses}:S' kill >/dev/null 2>&1
+args    = --no-bpf-event -e '{cycles,cache-misses}:S' kill >/dev/null 2>&1
 ret     = 1
 
 [event-1:base-record]
diff --git a/tools/perf/tests/attr/test-record-group1 b/tools/perf/tests/attr/test-record-group1
index 48e8bd12fe46..3ffe246e0228 100644
--- a/tools/perf/tests/attr/test-record-group1
+++ b/tools/perf/tests/attr/test-record-group1
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = -e '{cycles,instructions}' kill >/dev/null 2>&1
+args    = --no-bpf-event -e '{cycles,instructions}' kill >/dev/null 2>&1
 ret     = 1
 
 [event-1:base-record]
diff --git a/tools/perf/tests/attr/test-record-no-buffering b/tools/perf/tests/attr/test-record-no-buffering
index aa3956d8fe20..583dcbb078ba 100644
--- a/tools/perf/tests/attr/test-record-no-buffering
+++ b/tools/perf/tests/attr/test-record-no-buffering
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = --no-buffering kill >/dev/null 2>&1
+args    = --no-bpf-event --no-buffering kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/attr/test-record-no-inherit b/tools/perf/tests/attr/test-record-no-inherit
index 560943decb87..15d1dc162e1c 100644
--- a/tools/perf/tests/attr/test-record-no-inherit
+++ b/tools/perf/tests/attr/test-record-no-inherit
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = -i kill >/dev/null 2>&1
+args    = --no-bpf-event -i kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/attr/test-record-no-samples b/tools/perf/tests/attr/test-record-no-samples
index 8eb73ab639e0..596fbd6d5a2c 100644
--- a/tools/perf/tests/attr/test-record-no-samples
+++ b/tools/perf/tests/attr/test-record-no-samples
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = -n kill >/dev/null 2>&1
+args    = --no-bpf-event -n kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/attr/test-record-period b/tools/perf/tests/attr/test-record-period
index 69bc748f0f27..119101154c5e 100644
--- a/tools/perf/tests/attr/test-record-period
+++ b/tools/perf/tests/attr/test-record-period
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = -c 100 -P kill >/dev/null 2>&1
+args    = --no-bpf-event -c 100 -P kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/attr/test-record-raw b/tools/perf/tests/attr/test-record-raw
index a188a614a44c..13a5f7860c78 100644
--- a/tools/perf/tests/attr/test-record-raw
+++ b/tools/perf/tests/attr/test-record-raw
@@ -1,6 +1,6 @@
 [config]
 command = record
-args    = -R kill >/dev/null 2>&1
+args    = --no-bpf-event -R kill >/dev/null 2>&1
 ret     = 1
 
 [event:base-record]
diff --git a/tools/perf/tests/backward-ring-buffer.c b/tools/perf/tests/backward-ring-buffer.c
index 6d598cc071ae..1a9c3becf5ff 100644
--- a/tools/perf/tests/backward-ring-buffer.c
+++ b/tools/perf/tests/backward-ring-buffer.c
@@ -18,7 +18,7 @@ static void testcase(void)
         int i;
 
         for (i = 0; i < NR_ITERS; i++) {
-                char proc_name[10];
+                char proc_name[15];
 
                 snprintf(proc_name, sizeof(proc_name), "p:%d\n", i);
                 prctl(PR_SET_NAME, proc_name);
diff --git a/tools/perf/tests/evsel-tp-sched.c b/tools/perf/tests/evsel-tp-sched.c
index ea7acf403727..71f60c0f9faa 100644
--- a/tools/perf/tests/evsel-tp-sched.c
+++ b/tools/perf/tests/evsel-tp-sched.c
@@ -85,5 +85,6 @@ int test__perf_evsel__tp_sched_test(struct test *test __maybe_unused, int subtes
         if (perf_evsel__test_field(evsel, "target_cpu", 4, true))
                 ret = -1;
 
+        perf_evsel__delete(evsel);
         return ret;
 }
diff --git a/tools/perf/tests/expr.c b/tools/perf/tests/expr.c
index 01f0706995a9..9acc1e80b936 100644
--- a/tools/perf/tests/expr.c
+++ b/tools/perf/tests/expr.c
@@ -19,7 +19,7 @@ int test__expr(struct test *t __maybe_unused, int subtest __maybe_unused)
         const char *p;
         const char **other;
         double val;
-        int ret;
+        int i, ret;
         struct parse_ctx ctx;
         int num_other;
 
@@ -56,6 +56,9 @@ int test__expr(struct test *t __maybe_unused, int subtest __maybe_unused)
         TEST_ASSERT_VAL("find other", !strcmp(other[1], "BAZ"));
         TEST_ASSERT_VAL("find other", !strcmp(other[2], "BOZO"));
         TEST_ASSERT_VAL("find other", other[3] == NULL);
+
+        for (i = 0; i < num_other; i++)
+                free((void *)other[i]);
         free((void *)other);
 
         return 0;
diff --git a/tools/perf/tests/openat-syscall-all-cpus.c b/tools/perf/tests/openat-syscall-all-cpus.c
index c531e6deb104..493ecb611540 100644
--- a/tools/perf/tests/openat-syscall-all-cpus.c
+++ b/tools/perf/tests/openat-syscall-all-cpus.c
@@ -45,7 +45,7 @@ int test__openat_syscall_event_on_all_cpus(struct test *test __maybe_unused, int
         if (IS_ERR(evsel)) {
                 tracing_path__strerror_open_tp(errno, errbuf, sizeof(errbuf), "syscalls", "sys_enter_openat");
                 pr_debug("%s\n", errbuf);
-                goto out_thread_map_delete;
+                goto out_cpu_map_delete;
         }
 
         if (perf_evsel__open(evsel, cpus, threads) < 0) {
@@ -119,6 +119,8 @@ out_close_fd:
         perf_evsel__close_fd(evsel);
 out_evsel_delete:
         perf_evsel__delete(evsel);
+out_cpu_map_delete:
+        cpu_map__put(cpus);
 out_thread_map_delete:
         thread_map__put(threads);
         return err;
diff --git a/tools/perf/ui/browser.c b/tools/perf/ui/browser.c
index 4f75561424ed..4ad37d8c7d6a 100644
--- a/tools/perf/ui/browser.c
+++ b/tools/perf/ui/browser.c
@@ -611,14 +611,16 @@ void ui_browser__argv_seek(struct ui_browser *browser, off_t offset, int whence)
                 browser->top = browser->entries;
                 break;
         case SEEK_CUR:
-                browser->top = browser->top + browser->top_idx + offset;
+                browser->top = (char **)browser->top + offset;
                 break;
         case SEEK_END:
-                browser->top = browser->top + browser->nr_entries - 1 + offset;
+                browser->top = (char **)browser->entries + browser->nr_entries - 1 + offset;
                 break;
         default:
                 return;
         }
+        assert((char **)browser->top < (char **)browser->entries + browser->nr_entries);
+        assert((char **)browser->top >= (char **)browser->entries);
 }
 
 unsigned int ui_browser__argv_refresh(struct ui_browser *browser)
@@ -630,7 +632,9 @@ unsigned int ui_browser__argv_refresh(struct ui_browser *browser)
                 browser->top = browser->entries;
 
         pos = (char **)browser->top;
-        while (idx < browser->nr_entries) {
+        while (idx < browser->nr_entries &&
+               row < (unsigned)SLtt_Screen_Rows - 1) {
+                assert(pos < (char **)browser->entries + browser->nr_entries);
                 if (!browser->filter || !browser->filter(browser, *pos)) {
                         ui_browser__gotorc(browser, row, 0);
                         browser->write(browser, pos, row);
diff --git a/tools/perf/ui/browsers/Build b/tools/perf/ui/browsers/Build
index 8fee56b46502..fdf86f7981ca 100644
--- a/tools/perf/ui/browsers/Build
+++ b/tools/perf/ui/browsers/Build
@@ -3,6 +3,7 @@ perf-y += hists.o
 perf-y += map.o
 perf-y += scripts.o
 perf-y += header.o
+perf-y += res_sample.o
 
 CFLAGS_annotate.o += -DENABLE_SLFUTURE_CONST
 CFLAGS_hists.o    += -DENABLE_SLFUTURE_CONST
diff --git a/tools/perf/ui/browsers/annotate.c b/tools/perf/ui/browsers/annotate.c
index 35bdfd8b1e71..98d934a36d86 100644
--- a/tools/perf/ui/browsers/annotate.c
+++ b/tools/perf/ui/browsers/annotate.c
@@ -750,7 +750,7 @@ static int annotate_browser__run(struct annotate_browser *browser,
                         continue;
                 case 'r':
                         {
-                                script_browse(NULL);
+                                script_browse(NULL, NULL);
                                 continue;
                         }
                 case 'k':
diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
index aef800d97ea1..3421ecbdd3f0 100644
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -7,6 +7,7 @@
 #include <string.h>
 #include <linux/rbtree.h>
 #include <sys/ttydefaults.h>
+#include <linux/time64.h>
 
 #include "../../util/callchain.h"
 #include "../../util/evsel.h"
@@ -30,6 +31,7 @@
 #include "srcline.h"
 #include "string2.h"
 #include "units.h"
+#include "time-utils.h"
 
 #include "sane_ctype.h"
 
@@ -1224,6 +1226,8 @@ void hist_browser__init_hpp(void)
                                 hist_browser__hpp_color_overhead_guest_us;
         perf_hpp__format[PERF_HPP__OVERHEAD_ACC].color =
                                 hist_browser__hpp_color_overhead_acc;
+
+        res_sample_init();
 }
 
 static int hist_browser__show_entry(struct hist_browser *browser,
@@ -2338,9 +2342,12 @@ close_file_and_continue:
 }
 
 struct popup_action {
+        unsigned long           time;
         struct thread           *thread;
         struct map_symbol       ms;
         int                     socket;
+        struct perf_evsel       *evsel;
+        enum rstype             rstype;
 
         int (*fn)(struct hist_browser *browser, struct popup_action *act);
 };
@@ -2527,46 +2534,137 @@ static int
 do_run_script(struct hist_browser *browser __maybe_unused,
               struct popup_action *act)
 {
-        char script_opt[64];
-        memset(script_opt, 0, sizeof(script_opt));
+        char *script_opt;
+        int len;
+        int n = 0;
 
+        len = 100;
+        if (act->thread)
+                len += strlen(thread__comm_str(act->thread));
+        else if (act->ms.sym)
+                len += strlen(act->ms.sym->name);
+        script_opt = malloc(len);
+        if (!script_opt)
+                return -1;
+
+        script_opt[0] = 0;
         if (act->thread) {
-                scnprintf(script_opt, sizeof(script_opt), " -c %s ",
+                n = scnprintf(script_opt, len, " -c %s ",
                           thread__comm_str(act->thread));
         } else if (act->ms.sym) {
-                scnprintf(script_opt, sizeof(script_opt), " -S %s ",
+                n = scnprintf(script_opt, len, " -S %s ",
                           act->ms.sym->name);
         }
 
-        script_browse(script_opt);
+        if (act->time) {
+                char start[32], end[32];
+                unsigned long starttime = act->time;
+                unsigned long endtime = act->time + symbol_conf.time_quantum;
+
+                if (starttime == endtime) { /* Display 1ms as fallback */
+                        starttime -= 1*NSEC_PER_MSEC;
+                        endtime += 1*NSEC_PER_MSEC;
+                }
+                timestamp__scnprintf_usec(starttime, start, sizeof start);
+                timestamp__scnprintf_usec(endtime, end, sizeof end);
+                n += snprintf(script_opt + n, len - n, " --time %s,%s", start, end);
+        }
+
+        script_browse(script_opt, act->evsel);
+        free(script_opt);
         return 0;
 }
 
 static int
-add_script_opt(struct hist_browser *browser __maybe_unused,
+do_res_sample_script(struct hist_browser *browser __maybe_unused,
+                     struct popup_action *act)
+{
+        struct hist_entry *he;
+
+        he = hist_browser__selected_entry(browser);
+        res_sample_browse(he->res_samples, he->num_res, act->evsel, act->rstype);
+        return 0;
+}
+
+static int
+add_script_opt_2(struct hist_browser *browser __maybe_unused,
                struct popup_action *act, char **optstr,
-               struct thread *thread, struct symbol *sym)
+               struct thread *thread, struct symbol *sym,
+               struct perf_evsel *evsel, const char *tstr)
 {
+
         if (thread) {
-                if (asprintf(optstr, "Run scripts for samples of thread [%s]",
-                             thread__comm_str(thread)) < 0)
+                if (asprintf(optstr, "Run scripts for samples of thread [%s]%s",
+                             thread__comm_str(thread), tstr) < 0)
                         return 0;
         } else if (sym) {
-                if (asprintf(optstr, "Run scripts for samples of symbol [%s]",
-                             sym->name) < 0)
+                if (asprintf(optstr, "Run scripts for samples of symbol [%s]%s",
+                             sym->name, tstr) < 0)
                         return 0;
         } else {
-                if (asprintf(optstr, "Run scripts for all samples") < 0)
+                if (asprintf(optstr, "Run scripts for all samples%s", tstr) < 0)
                         return 0;
         }
 
         act->thread = thread;
         act->ms.sym = sym;
+        act->evsel = evsel;
         act->fn = do_run_script;
         return 1;
 }
 
 static int
+add_script_opt(struct hist_browser *browser,
+               struct popup_action *act, char **optstr,
+               struct thread *thread, struct symbol *sym,
+               struct perf_evsel *evsel)
+{
+        int n, j;
+        struct hist_entry *he;
+
+        n = add_script_opt_2(browser, act, optstr, thread, sym, evsel, "");
+
+        he = hist_browser__selected_entry(browser);
+        if (sort_order && strstr(sort_order, "time")) {
+                char tstr[128];
+
+                optstr++;
+                act++;
+                j = sprintf(tstr, " in ");
+                j += timestamp__scnprintf_usec(he->time, tstr + j,
+                                               sizeof tstr - j);
+                j += sprintf(tstr + j, "-");
+                timestamp__scnprintf_usec(he->time + symbol_conf.time_quantum,
+                                          tstr + j, sizeof tstr - j);
+                n += add_script_opt_2(browser, act, optstr, thread, sym,
+                                          evsel, tstr);
+                act->time = he->time;
+        }
+        return n;
+}
+
+static int
+add_res_sample_opt(struct hist_browser *browser __maybe_unused,
+                   struct popup_action *act, char **optstr,
+                   struct res_sample *res_sample,
+                   struct perf_evsel *evsel,
+                   enum rstype type)
+{
+        if (!res_sample)
+                return 0;
+
+        if (asprintf(optstr, "Show context for individual samples %s",
+                type == A_ASM ? "with assembler" :
+                type == A_SOURCE ? "with source" : "") < 0)
+                return 0;
+
+        act->fn = do_res_sample_script;
+        act->evsel = evsel;
+        act->rstype = type;
+        return 1;
+}
+
+static int
 do_switch_data(struct hist_browser *browser __maybe_unused,
                struct popup_action *act __maybe_unused)
 {
@@ -3031,7 +3129,7 @@ skip_annotation:
                                 nr_options += add_script_opt(browser,
                                                              &actions[nr_options],
                                                              &options[nr_options],
-                                                             thread, NULL);
+                                                             thread, NULL, evsel);
                         }
                         /*
                          * Note that browser->selection != NULL
@@ -3046,11 +3144,24 @@ skip_annotation:
                                 nr_options += add_script_opt(browser,
                                                              &actions[nr_options],
                                                              &options[nr_options],
-                                                             NULL, browser->selection->sym);
+                                                             NULL, browser->selection->sym,
+                                                             evsel);
                         }
                 }
                 nr_options += add_script_opt(browser, &actions[nr_options],
-                                             &options[nr_options], NULL, NULL);
+                                             &options[nr_options], NULL, NULL, evsel);
+                nr_options += add_res_sample_opt(browser, &actions[nr_options],
+                                                 &options[nr_options],
+                                 hist_browser__selected_entry(browser)->res_samples,
+                                 evsel, A_NORMAL);
+                nr_options += add_res_sample_opt(browser, &actions[nr_options],
+                                                 &options[nr_options],
+                                 hist_browser__selected_entry(browser)->res_samples,
+                                 evsel, A_ASM);
+                nr_options += add_res_sample_opt(browser, &actions[nr_options],
+                                                 &options[nr_options],
+                                 hist_browser__selected_entry(browser)->res_samples,
+                                 evsel, A_SOURCE);
                 nr_options += add_switch_opt(browser, &actions[nr_options],
                                              &options[nr_options]);
 skip_scripting:
diff --git a/tools/perf/ui/browsers/res_sample.c b/tools/perf/ui/browsers/res_sample.c
new file mode 100644
index 000000000000..c0dd73176d42
--- /dev/null
+++ b/tools/perf/ui/browsers/res_sample.c
@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Display a menu with individual samples to browse with perf script */
+#include "util.h"
+#include "hist.h"
+#include "evsel.h"
+#include "hists.h"
+#include "sort.h"
+#include "config.h"
+#include "time-utils.h"
+#include <linux/time64.h>
+
+static u64 context_len = 10 * NSEC_PER_MSEC;
+
+static int res_sample_config(const char *var, const char *value, void *data __maybe_unused)
+{
+        if (!strcmp(var, "samples.context"))
+                return perf_config_u64(&context_len, var, value);
+        return 0;
+}
+
+void res_sample_init(void)
+{
+        perf_config(res_sample_config, NULL);
+}
+
+int res_sample_browse(struct res_sample *res_samples, int num_res,
+                      struct perf_evsel *evsel, enum rstype rstype)
+{
+        char **names;
+        int i, n;
+        int choice;
+        char *cmd;
+        char pbuf[256], tidbuf[32], cpubuf[32];
+        const char *perf = perf_exe(pbuf, sizeof pbuf);
+        char trange[128], tsample[64];
+        struct res_sample *r;
+        char extra_format[256];
+
+        names = calloc(num_res, sizeof(char *));
+        if (!names)
+                return -1;
+        for (i = 0; i < num_res; i++) {
+                char tbuf[64];
+
+                timestamp__scnprintf_nsec(res_samples[i].time, tbuf, sizeof tbuf);
+                if (asprintf(&names[i], "%s: CPU %d tid %d", tbuf,
+                             res_samples[i].cpu, res_samples[i].tid) < 0) {
+                        while (--i >= 0)
+                                free(names[i]);
+                        free(names);
+                        return -1;
+                }
+        }
+        choice = ui__popup_menu(num_res, names);
+        for (i = 0; i < num_res; i++)
+                free(names[i]);
+        free(names);
+
+        if (choice < 0 || choice >= num_res)
+                return -1;
+        r = &res_samples[choice];
+
+        n = timestamp__scnprintf_nsec(r->time - context_len, trange, sizeof trange);
+        trange[n++] = ',';
+        timestamp__scnprintf_nsec(r->time + context_len, trange + n, sizeof trange - n);
+
+        timestamp__scnprintf_nsec(r->time, tsample, sizeof tsample);
+
+        attr_to_script(extra_format, &evsel->attr);
+
+        if (asprintf(&cmd, "%s script %s%s --time %s %s%s %s%s --ns %s %s %s %s %s | less +/%s",
+                     perf,
+                     input_name ? "-i " : "",
+                     input_name ? input_name : "",
+                     trange,
+                     r->cpu >= 0 ? "--cpu " : "",
+                     r->cpu >= 0 ? (sprintf(cpubuf, "%d", r->cpu), cpubuf) : "",
+                     r->tid ? "--tid " : "",
+                     r->tid ? (sprintf(tidbuf, "%d", r->tid), tidbuf) : "",
+                     extra_format,
+                     rstype == A_ASM ? "-F +insn --xed" :
+                     rstype == A_SOURCE ? "-F +srcline,+srccode" : "",
+                     symbol_conf.inline_name ? "--inline" : "",
+                     "--show-lost-events ",
+                     r->tid ? "--show-switch-events --show-task-events " : "",
+                     tsample) < 0)
+                return -1;
+        run_script(cmd);
+        free(cmd);
+        return 0;
+}
diff --git a/tools/perf/ui/browsers/scripts.c b/tools/perf/ui/browsers/scripts.c
index 90a32ac69e76..27cf3ab88d13 100644
--- a/tools/perf/ui/browsers/scripts.c
+++ b/tools/perf/ui/browsers/scripts.c
@@ -1,34 +1,12 @@
 // SPDX-License-Identifier: GPL-2.0
-#include <elf.h>
-#include <inttypes.h>
-#include <sys/ttydefaults.h>
-#include <string.h>
 #include "../../util/sort.h"
 #include "../../util/util.h"
 #include "../../util/hist.h"
 #include "../../util/debug.h"
 #include "../../util/symbol.h"
 #include "../browser.h"
-#include "../helpline.h"
 #include "../libslang.h"
-
-/* 2048 lines should be enough for a script output */
-#define MAX_LINES               2048
-
-/* 160 bytes for one output line */
-#define AVERAGE_LINE_LEN        160
-
-struct script_line {
-        struct list_head node;
-        char line[AVERAGE_LINE_LEN];
-};
-
-struct perf_script_browser {
-        struct ui_browser b;
-        struct list_head entries;
-        const char *script_name;
-        int nr_lines;
-};
+#include "config.h"
 
 #define SCRIPT_NAMELEN  128
 #define SCRIPT_MAX_NO   64
@@ -40,149 +18,169 @@ struct perf_script_browser {
  */
 #define SCRIPT_FULLPATH_LEN     256
 
+struct script_config {
+        const char **names;
+        char **paths;
+        int index;
+        const char *perf;
+        char extra_format[256];
+};
+
+void attr_to_script(char *extra_format, struct perf_event_attr *attr)
+{
+        extra_format[0] = 0;
+        if (attr->read_format & PERF_FORMAT_GROUP)
+                strcat(extra_format, " -F +metric");
+        if (attr->sample_type & PERF_SAMPLE_BRANCH_STACK)
+                strcat(extra_format, " -F +brstackinsn --xed");
+        if (attr->sample_type & PERF_SAMPLE_REGS_INTR)
+                strcat(extra_format, " -F +iregs");
+        if (attr->sample_type & PERF_SAMPLE_REGS_USER)
+                strcat(extra_format, " -F +uregs");
+        if (attr->sample_type & PERF_SAMPLE_PHYS_ADDR)
+                strcat(extra_format, " -F +phys_addr");
+}
+
+static int add_script_option(const char *name, const char *opt,
+                             struct script_config *c)
+{
+        c->names[c->index] = name;
+        if (asprintf(&c->paths[c->index],
+                     "%s script %s -F +metric %s %s",
+                     c->perf, opt, symbol_conf.inline_name ? " --inline" : "",
+                     c->extra_format) < 0)
+                return -1;
+        c->index++;
+        return 0;
+}
+
+static int scripts_config(const char *var, const char *value, void *data)
+{
+        struct script_config *c = data;
+
+        if (!strstarts(var, "scripts."))
+                return -1;
+        if (c->index >= SCRIPT_MAX_NO)
+                return -1;
+        c->names[c->index] = strdup(var + 7);
+        if (!c->names[c->index])
+                return -1;
+        if (asprintf(&c->paths[c->index], "%s %s", value,
+                     c->extra_format) < 0)
+                return -1;
+        c->index++;
+        return 0;
+}
+
 /*
  * When success, will copy the full path of the selected script
  * into  the buffer pointed by script_name, and return 0.
  * Return -1 on failure.
  */
-static int list_scripts(char *script_name)
+static int list_scripts(char *script_name, bool *custom,
+                        struct perf_evsel *evsel)
 {
-        char *buf, *names[SCRIPT_MAX_NO], *paths[SCRIPT_MAX_NO];
-        int i, num, choice, ret = -1;
+        char *buf, *paths[SCRIPT_MAX_NO], *names[SCRIPT_MAX_NO];
+        int i, num, choice;
+        int ret = 0;
+        int max_std, custom_perf;
+        char pbuf[256];
+        const char *perf = perf_exe(pbuf, sizeof pbuf);
+        struct script_config scriptc = {
+                .names = (const char **)names,
+                .paths = paths,
+                .perf = perf
+        };
+
+        script_name[0] = 0;
 
         /* Preset the script name to SCRIPT_NAMELEN */
         buf = malloc(SCRIPT_MAX_NO * (SCRIPT_NAMELEN + SCRIPT_FULLPATH_LEN));
         if (!buf)
-                return ret;
+                return -1;
 
-        for (i = 0; i < SCRIPT_MAX_NO; i++) {
-                names[i] = buf + i * (SCRIPT_NAMELEN + SCRIPT_FULLPATH_LEN);
+        if (evsel)
+                attr_to_script(scriptc.extra_format, &evsel->attr);
+        add_script_option("Show individual samples", "", &scriptc);
+        add_script_option("Show individual samples with assembler", "-F +insn --xed",
+                          &scriptc);
+        add_script_option("Show individual samples with source", "-F +srcline,+srccode",
+                          &scriptc);
+        perf_config(scripts_config, &scriptc);
+        custom_perf = scriptc.index;
+        add_script_option("Show samples with custom perf script arguments", "", &scriptc);
+        i = scriptc.index;
+        max_std = i;
+
+        for (; i < SCRIPT_MAX_NO; i++) {
+                names[i] = buf + (i - max_std) * (SCRIPT_NAMELEN + SCRIPT_FULLPATH_LEN);
                 paths[i] = names[i] + SCRIPT_NAMELEN;
         }
 
-        num = find_scripts(names, paths);
-        if (num > 0) {
-                choice = ui__popup_menu(num, names);
-                if (choice < num && choice >= 0) {
-                        strcpy(script_name, paths[choice]);
-                        ret = 0;
-                }
+        num = find_scripts(names + max_std, paths + max_std, SCRIPT_MAX_NO - max_std,
+                        SCRIPT_FULLPATH_LEN);
+        if (num < 0)
+                num = 0;
+        choice = ui__popup_menu(num + max_std, (char * const *)names);
+        if (choice < 0) {
+                ret = -1;
+                goto out;
         }
+        if (choice == custom_perf) {
+                char script_args[50];
+                int key = ui_browser__input_window("perf script command",
+                                "Enter perf script command line (without perf script prefix)",
+                                script_args, "", 0);
+                if (key != K_ENTER)
+                        return -1;
+                sprintf(script_name, "%s script %s", perf, script_args);
+        } else if (choice < num + max_std) {
+                strcpy(script_name, paths[choice]);
+        }
+        *custom = choice >= max_std;
 
+out:
         free(buf);
+        for (i = 0; i < max_std; i++)
+                free(paths[i]);
         return ret;
 }
 
-static void script_browser__write(struct ui_browser *browser,
-                                   void *entry, int row)
+void run_script(char *cmd)
 {
-        struct script_line *sline = list_entry(entry, struct script_line, node);
-        bool current_entry = ui_browser__is_current_entry(browser, row);
-
-        ui_browser__set_color(browser, current_entry ? HE_COLORSET_SELECTED :
-                                                       HE_COLORSET_NORMAL);
-
-        ui_browser__write_nstring(browser, sline->line, browser->width);
+        pr_debug("Running %s\n", cmd);
+        SLang_reset_tty();
+        if (system(cmd) < 0)
+                pr_warning("Cannot run %s\n", cmd);
+        /*
+         * SLang doesn't seem to reset the whole terminal, so be more
+         * forceful to get back to the original state.
+         */
+        printf("\033[c\033[H\033[J");
+        fflush(stdout);
+        SLang_init_tty(0, 0, 0);
+        SLsmg_refresh();
 }
 
-static int script_browser__run(struct perf_script_browser *browser)
+int script_browse(const char *script_opt, struct perf_evsel *evsel)
 {
-        int key;
+        char *cmd, script_name[SCRIPT_FULLPATH_LEN];
+        bool custom = false;
 
-        if (ui_browser__show(&browser->b, browser->script_name,
-                             "Press ESC to exit") < 0)
+        memset(script_name, 0, SCRIPT_FULLPATH_LEN);
+        if (list_scripts(script_name, &custom, evsel))
                 return -1;
 
-        while (1) {
-                key = ui_browser__run(&browser->b, 0);
-
-                /* We can add some special key handling here if needed */
-                break;
-        }
-
-        ui_browser__hide(&browser->b);
-        return key;
-}
-
-
-int script_browse(const char *script_opt)
-{
-        char cmd[SCRIPT_FULLPATH_LEN*2], script_name[SCRIPT_FULLPATH_LEN];
-        char *line = NULL;
-        size_t len = 0;
-        ssize_t retlen;
-        int ret = -1, nr_entries = 0;
-        FILE *fp;
-        void *buf;
-        struct script_line *sline;
-
-        struct perf_script_browser script = {
-                .b = {
-                        .refresh    = ui_browser__list_head_refresh,
-                        .seek       = ui_browser__list_head_seek,
-                        .write      = script_browser__write,
-                },
-                .script_name = script_name,
-        };
-
-        INIT_LIST_HEAD(&script.entries);
-
-        /* Save each line of the output in one struct script_line object. */
-        buf = zalloc((sizeof(*sline)) * MAX_LINES);
-        if (!buf)
+        if (asprintf(&cmd, "%s%s %s %s%s 2>&1 | less",
+                        custom ? "perf script -s " : "",
+                        script_name,
+                        script_opt ? script_opt : "",
+                        input_name ? "-i " : "",
+                        input_name ? input_name : "") < 0)
                 return -1;
-        sline = buf;
-
-        memset(script_name, 0, SCRIPT_FULLPATH_LEN);
-        if (list_scripts(script_name))
-                goto exit;
-
-        sprintf(cmd, "perf script -s %s ", script_name);
 
-        if (script_opt)
-                strcat(cmd, script_opt);
+        run_script(cmd);
+        free(cmd);
 
-        if (input_name) {
-                strcat(cmd, " -i ");
-                strcat(cmd, input_name);
-        }
-
-        strcat(cmd, " 2>&1");
-
-        fp = popen(cmd, "r");
-        if (!fp)
-                goto exit;
-
-        while ((retlen = getline(&line, &len, fp)) != -1) {
-                strncpy(sline->line, line, AVERAGE_LINE_LEN);
-
-                /* If one output line is very large, just cut it short */
-                if (retlen >= AVERAGE_LINE_LEN) {
-                        sline->line[AVERAGE_LINE_LEN - 1] = '\0';
-                        sline->line[AVERAGE_LINE_LEN - 2] = '\n';
-                }
-                list_add_tail(&sline->node, &script.entries);
-
-                if (script.b.width < retlen)
-                        script.b.width = retlen;
-
-                if (nr_entries++ >= MAX_LINES - 1)
-                        break;
-                sline++;
-        }
-
-        if (script.b.width > AVERAGE_LINE_LEN)
-                script.b.width = AVERAGE_LINE_LEN;
-
-        free(line);
-        pclose(fp);
-
-        script.nr_lines = nr_entries;
-        script.b.nr_entries = nr_entries;
-        script.b.entries = &script.entries;
-
-        ret = script_browser__run(&script);
-exit:
-        free(buf);
-        return ret;
+        return 0;
 }
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index 5f6dbbf5d749..c8b01176c9e1 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -10,6 +10,10 @@
 #include <errno.h>
 #include <inttypes.h>
 #include <libgen.h>
+#include <bpf/bpf.h>
+#include <bpf/btf.h>
+#include <bpf/libbpf.h>
+#include <linux/btf.h>
 #include "util.h"
 #include "ui/ui.h"
 #include "sort.h"
@@ -24,6 +28,7 @@
 #include "annotate.h"
 #include "evsel.h"
 #include "evlist.h"
+#include "bpf-event.h"
 #include "block-range.h"
 #include "string2.h"
 #include "arch/common.h"
@@ -31,6 +36,7 @@
 #include <pthread.h>
 #include <linux/bitops.h>
 #include <linux/kernel.h>
+#include <bpf/libbpf.h>
 
 /* FIXME: For the HE_COLORSET */
 #include "ui/browser.h"
@@ -1615,6 +1621,9 @@ int symbol__strerror_disassemble(struct symbol *sym __maybe_unused, struct map *
                           "  --vmlinux vmlinux\n", build_id_msg ?: "");
         }
                 break;
+        case SYMBOL_ANNOTATE_ERRNO__NO_LIBOPCODES_FOR_BPF:
+                scnprintf(buf, buflen, "Please link with binutils's libopcode to enable BPF annotation");
+                break;
         default:
                 scnprintf(buf, buflen, "Internal error: Invalid %d error code\n", errnum);
                 break;
@@ -1674,6 +1683,156 @@ fallback:
         return 0;
 }
 
+#if defined(HAVE_LIBBFD_SUPPORT) && defined(HAVE_LIBBPF_SUPPORT)
+#define PACKAGE "perf"
+#include <bfd.h>
+#include <dis-asm.h>
+
+static int symbol__disassemble_bpf(struct symbol *sym,
+                                   struct annotate_args *args)
+{
+        struct annotation *notes = symbol__annotation(sym);
+        struct annotation_options *opts = args->options;
+        struct bpf_prog_info_linear *info_linear;
+        struct bpf_prog_linfo *prog_linfo = NULL;
+        struct bpf_prog_info_node *info_node;
+        int len = sym->end - sym->start;
+        disassembler_ftype disassemble;
+        struct map *map = args->ms.map;
+        struct disassemble_info info;
+        struct dso *dso = map->dso;
+        int pc = 0, count, sub_id;
+        struct btf *btf = NULL;
+        char tpath[PATH_MAX];
+        size_t buf_size;
+        int nr_skip = 0;
+        int ret = -1;
+        char *buf;
+        bfd *bfdf;
+        FILE *s;
+
+        if (dso->binary_type != DSO_BINARY_TYPE__BPF_PROG_INFO)
+                return -1;
+
+        pr_debug("%s: handling sym %s addr %lx len %lx\n", __func__,
+                 sym->name, sym->start, sym->end - sym->start);
+
+        memset(tpath, 0, sizeof(tpath));
+        perf_exe(tpath, sizeof(tpath));
+
+        bfdf = bfd_openr(tpath, NULL);
+        assert(bfdf);
+        assert(bfd_check_format(bfdf, bfd_object));
+
+        s = open_memstream(&buf, &buf_size);
+        if (!s)
+                goto out;
+        init_disassemble_info(&info, s,
+                              (fprintf_ftype) fprintf);
+
+        info.arch = bfd_get_arch(bfdf);
+        info.mach = bfd_get_mach(bfdf);
+
+        info_node = perf_env__find_bpf_prog_info(dso->bpf_prog.env,
+                                                 dso->bpf_prog.id);
+        if (!info_node)
+                goto out;
+        info_linear = info_node->info_linear;
+        sub_id = dso->bpf_prog.sub_id;
+
+        info.buffer = (void *)(info_linear->info.jited_prog_insns);
+        info.buffer_length = info_linear->info.jited_prog_len;
+
+        if (info_linear->info.nr_line_info)
+                prog_linfo = bpf_prog_linfo__new(&info_linear->info);
+
+        if (info_linear->info.btf_id) {
+                struct btf_node *node;
+
+                node = perf_env__find_btf(dso->bpf_prog.env,
+                                          info_linear->info.btf_id);
+                if (node)
+                        btf = btf__new((__u8 *)(node->data),
+                                       node->data_size);
+        }
+
+        disassemble_init_for_target(&info);
+
+#ifdef DISASM_FOUR_ARGS_SIGNATURE
+        disassemble = disassembler(info.arch,
+                                   bfd_big_endian(bfdf),
+                                   info.mach,
+                                   bfdf);
+#else
+        disassemble = disassembler(bfdf);
+#endif
+        assert(disassemble);
+
+        fflush(s);
+        do {
+                const struct bpf_line_info *linfo = NULL;
+                struct disasm_line *dl;
+                size_t prev_buf_size;
+                const char *srcline;
+                u64 addr;
+
+                addr = pc + ((u64 *)(info_linear->info.jited_ksyms))[sub_id];
+                count = disassemble(pc, &info);
+
+                if (prog_linfo)
+                        linfo = bpf_prog_linfo__lfind_addr_func(prog_linfo,
+                                                                addr, sub_id,
+                                                                nr_skip);
+
+                if (linfo && btf) {
+                        srcline = btf__name_by_offset(btf, linfo->line_off);
+                        nr_skip++;
+                } else
+                        srcline = NULL;
+
+                fprintf(s, "\n");
+                prev_buf_size = buf_size;
+                fflush(s);
+
+                if (!opts->hide_src_code && srcline) {
+                        args->offset = -1;
+                        args->line = strdup(srcline);
+                        args->line_nr = 0;
+                        args->ms.sym  = sym;
+                        dl = disasm_line__new(args);
+                        if (dl) {
+                                annotation_line__add(&dl->al,
+                                                     &notes->src->source);
+                        }
+                }
+
+                args->offset = pc;
+                args->line = buf + prev_buf_size;
+                args->line_nr = 0;
+                args->ms.sym  = sym;
+                dl = disasm_line__new(args);
+                if (dl)
+                        annotation_line__add(&dl->al, &notes->src->source);
+
+                pc += count;
+        } while (count > 0 && pc < len);
+
+        ret = 0;
+out:
+        free(prog_linfo);
+        free(btf);
+        fclose(s);
+        bfd_close(bfdf);
+        return ret;
+}
+#else // defined(HAVE_LIBBFD_SUPPORT) && defined(HAVE_LIBBPF_SUPPORT)
+static int symbol__disassemble_bpf(struct symbol *sym __maybe_unused,
+                                   struct annotate_args *args __maybe_unused)
+{
+        return SYMBOL_ANNOTATE_ERRNO__NO_LIBOPCODES_FOR_BPF;
+}
+#endif // defined(HAVE_LIBBFD_SUPPORT) && defined(HAVE_LIBBPF_SUPPORT)
+
 static int symbol__disassemble(struct symbol *sym, struct annotate_args *args)
 {
         struct annotation_options *opts = args->options;
@@ -1701,7 +1860,9 @@ static int symbol__disassemble(struct symbol *sym, struct annotate_args *args)
         pr_debug("annotating [%p] %30s : [%p] %30s\n",
                  dso, dso->long_name, sym, sym->name);
 
-        if (dso__is_kcore(dso)) {
+        if (dso->binary_type == DSO_BINARY_TYPE__BPF_PROG_INFO) {
+                return symbol__disassemble_bpf(sym, args);
+        } else if (dso__is_kcore(dso)) {
                 kce.kcore_filename = symfs_filename;
                 kce.addr = map__rip_2objdump(map, sym->start);
                 kce.offs = sym->start;
diff --git a/tools/perf/util/annotate.h b/tools/perf/util/annotate.h
index df34fe483164..5bc0cf655d37 100644
--- a/tools/perf/util/annotate.h
+++ b/tools/perf/util/annotate.h
@@ -369,6 +369,7 @@ enum symbol_disassemble_errno {
         __SYMBOL_ANNOTATE_ERRNO__START          = -10000,
 
         SYMBOL_ANNOTATE_ERRNO__NO_VMLINUX       = __SYMBOL_ANNOTATE_ERRNO__START,
+        SYMBOL_ANNOTATE_ERRNO__NO_LIBOPCODES_FOR_BPF,
 
         __SYMBOL_ANNOTATE_ERRNO__END,
 };
diff --git a/tools/perf/util/archinsn.h b/tools/perf/util/archinsn.h
new file mode 100644
index 000000000000..448cbb6b8d7e
--- /dev/null
+++ b/tools/perf/util/archinsn.h
@@ -0,0 +1,12 @@
+#ifndef INSN_H
+#define INSN_H 1
+
+struct perf_sample;
+struct machine;
+struct thread;
+
+void arch_fetch_insn(struct perf_sample *sample,
+                     struct thread *thread,
+                     struct machine *machine);
+
+#endif
diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
index 028c8ec1f62a..2a4a0da35632 100644
--- a/tools/perf/util/bpf-event.c
+++ b/tools/perf/util/bpf-event.c
@@ -3,11 +3,17 @@
 #include <stdlib.h>
 #include <bpf/bpf.h>
 #include <bpf/btf.h>
+#include <bpf/libbpf.h>
 #include <linux/btf.h>
+#include <linux/err.h>
 #include "bpf-event.h"
 #include "debug.h"
 #include "symbol.h"
 #include "machine.h"
+#include "env.h"
+#include "session.h"
+#include "map.h"
+#include "evlist.h"
 
 #define ptr_to_u64(ptr)    ((__u64)(unsigned long)(ptr))
 
@@ -21,15 +27,122 @@ static int snprintf_hex(char *buf, size_t size, unsigned char *data, size_t len)
         return ret;
 }
 
+static int machine__process_bpf_event_load(struct machine *machine,
+                                           union perf_event *event,
+                                           struct perf_sample *sample __maybe_unused)
+{
+        struct bpf_prog_info_linear *info_linear;
+        struct bpf_prog_info_node *info_node;
+        struct perf_env *env = machine->env;
+        int id = event->bpf_event.id;
+        unsigned int i;
+
+        /* perf-record, no need to handle bpf-event */
+        if (env == NULL)
+                return 0;
+
+        info_node = perf_env__find_bpf_prog_info(env, id);
+        if (!info_node)
+                return 0;
+        info_linear = info_node->info_linear;
+
+        for (i = 0; i < info_linear->info.nr_jited_ksyms; i++) {
+                u64 *addrs = (u64 *)(uintptr_t)(info_linear->info.jited_ksyms);
+                u64 addr = addrs[i];
+                struct map *map;
+
+                map = map_groups__find(&machine->kmaps, addr);
+
+                if (map) {
+                        map->dso->binary_type = DSO_BINARY_TYPE__BPF_PROG_INFO;
+                        map->dso->bpf_prog.id = id;
+                        map->dso->bpf_prog.sub_id = i;
+                        map->dso->bpf_prog.env = env;
+                }
+        }
+        return 0;
+}
+
 int machine__process_bpf_event(struct machine *machine __maybe_unused,
                                union perf_event *event,
                                struct perf_sample *sample __maybe_unused)
 {
         if (dump_trace)
                 perf_event__fprintf_bpf_event(event, stdout);
+
+        switch (event->bpf_event.type) {
+        case PERF_BPF_EVENT_PROG_LOAD:
+                return machine__process_bpf_event_load(machine, event, sample);
+
+        case PERF_BPF_EVENT_PROG_UNLOAD:
+                /*
+                 * Do not free bpf_prog_info and btf of the program here,
+                 * as annotation still need them. They will be freed at
+                 * the end of the session.
+                 */
+                break;
+        default:
+                pr_debug("unexpected bpf_event type of %d\n",
+                         event->bpf_event.type);
+                break;
+        }
         return 0;
 }
 
+static int perf_env__fetch_btf(struct perf_env *env,
+                               u32 btf_id,
+                               struct btf *btf)
+{
+        struct btf_node *node;
+        u32 data_size;
+        const void *data;
+
+        data = btf__get_raw_data(btf, &data_size);
+
+        node = malloc(data_size + sizeof(struct btf_node));
+        if (!node)
+                return -1;
+
+        node->id = btf_id;
+        node->data_size = data_size;
+        memcpy(node->data, data, data_size);
+
+        perf_env__insert_btf(env, node);
+        return 0;
+}
+
+static int synthesize_bpf_prog_name(char *buf, int size,
+                                    struct bpf_prog_info *info,
+                                    struct btf *btf,
+                                    u32 sub_id)
+{
+        u8 (*prog_tags)[BPF_TAG_SIZE] = (void *)(uintptr_t)(info->prog_tags);
+        void *func_infos = (void *)(uintptr_t)(info->func_info);
+        u32 sub_prog_cnt = info->nr_jited_ksyms;
+        const struct bpf_func_info *finfo;
+        const char *short_name = NULL;
+        const struct btf_type *t;
+        int name_len;
+
+        name_len = snprintf(buf, size, "bpf_prog_");
+        name_len += snprintf_hex(buf + name_len, size - name_len,
+                                 prog_tags[sub_id], BPF_TAG_SIZE);
+        if (btf) {
+                finfo = func_infos + sub_id * info->func_info_rec_size;
+                t = btf__type_by_id(btf, finfo->type_id);
+                short_name = btf__name_by_offset(btf, t->name_off);
+        } else if (sub_id == 0 && sub_prog_cnt == 1) {
+                /* no subprog */
+                if (info->name[0])
+                        short_name = info->name;
+        } else
+                short_name = "F";
+        if (short_name)
+                name_len += snprintf(buf + name_len, size - name_len,
+                                     "_%s", short_name);
+        return name_len;
+}
+
 /*
  * Synthesize PERF_RECORD_KSYMBOL and PERF_RECORD_BPF_EVENT for one bpf
  * program. One PERF_RECORD_BPF_EVENT is generated for the program. And
@@ -40,7 +153,7 @@ int machine__process_bpf_event(struct machine *machine __maybe_unused,
  *   -1 for failures;
  *   -2 for lack of kernel support.
  */
-static int perf_event__synthesize_one_bpf_prog(struct perf_tool *tool,
+static int perf_event__synthesize_one_bpf_prog(struct perf_session *session,
                                                perf_event__handler_t process,
                                                struct machine *machine,
                                                int fd,
@@ -49,102 +162,71 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_tool *tool,
 {
         struct ksymbol_event *ksymbol_event = &event->ksymbol_event;
         struct bpf_event *bpf_event = &event->bpf_event;
-        u32 sub_prog_cnt, i, func_info_rec_size = 0;
-        u8 (*prog_tags)[BPF_TAG_SIZE] = NULL;
-        struct bpf_prog_info info = { .type = 0, };
-        u32 info_len = sizeof(info);
-        void *func_infos = NULL;
-        u64 *prog_addrs = NULL;
+        struct bpf_prog_info_linear *info_linear;
+        struct perf_tool *tool = session->tool;
+        struct bpf_prog_info_node *info_node;
+        struct bpf_prog_info *info;
         struct btf *btf = NULL;
-        u32 *prog_lens = NULL;
-        bool has_btf = false;
-        char errbuf[512];
+        struct perf_env *env;
+        u32 sub_prog_cnt, i;
         int err = 0;
+        u64 arrays;
+
+        /*
+         * for perf-record and perf-report use header.env;
+         * otherwise, use global perf_env.
+         */
+        env = session->data ? &session->header.env : &perf_env;
 
-        /* Call bpf_obj_get_info_by_fd() to get sizes of arrays */
-        err = bpf_obj_get_info_by_fd(fd, &info, &info_len);
+        arrays = 1UL << BPF_PROG_INFO_JITED_KSYMS;
+        arrays |= 1UL << BPF_PROG_INFO_JITED_FUNC_LENS;
+        arrays |= 1UL << BPF_PROG_INFO_FUNC_INFO;
+        arrays |= 1UL << BPF_PROG_INFO_PROG_TAGS;
+        arrays |= 1UL << BPF_PROG_INFO_JITED_INSNS;
+        arrays |= 1UL << BPF_PROG_INFO_LINE_INFO;
+        arrays |= 1UL << BPF_PROG_INFO_JITED_LINE_INFO;
 
-        if (err) {
-                pr_debug("%s: failed to get BPF program info: %s, aborting\n",
-                         __func__, str_error_r(errno, errbuf, sizeof(errbuf)));
+        info_linear = bpf_program__get_prog_info_linear(fd, arrays);
+        if (IS_ERR_OR_NULL(info_linear)) {
+                info_linear = NULL;
+                pr_debug("%s: failed to get BPF program info. aborting\n", __func__);
                 return -1;
         }
-        if (info_len < offsetof(struct bpf_prog_info, prog_tags)) {
+
+        if (info_linear->info_len < offsetof(struct bpf_prog_info, prog_tags)) {
                 pr_debug("%s: the kernel is too old, aborting\n", __func__);
                 return -2;
         }
 
+        info = &info_linear->info;
+
         /* number of ksyms, func_lengths, and tags should match */
-        sub_prog_cnt = info.nr_jited_ksyms;
-        if (sub_prog_cnt != info.nr_prog_tags ||
-            sub_prog_cnt != info.nr_jited_func_lens)
+        sub_prog_cnt = info->nr_jited_ksyms;
+        if (sub_prog_cnt != info->nr_prog_tags ||
+            sub_prog_cnt != info->nr_jited_func_lens)
                 return -1;
 
         /* check BTF func info support */
-        if (info.btf_id && info.nr_func_info && info.func_info_rec_size) {
+        if (info->btf_id && info->nr_func_info && info->func_info_rec_size) {
                 /* btf func info number should be same as sub_prog_cnt */
-                if (sub_prog_cnt != info.nr_func_info) {
+                if (sub_prog_cnt != info->nr_func_info) {
                         pr_debug("%s: mismatch in BPF sub program count and BTF function info count, aborting\n", __func__);
-                        return -1;
-                }
-                if (btf__get_from_id(info.btf_id, &btf)) {
-                        pr_debug("%s: failed to get BTF of id %u, aborting\n", __func__, info.btf_id);
-                        return -1;
+                        err = -1;
+                        goto out;
                 }
-                func_info_rec_size = info.func_info_rec_size;
-                func_infos = calloc(sub_prog_cnt, func_info_rec_size);
-                if (!func_infos) {
-                        pr_debug("%s: failed to allocate memory for func_infos, aborting\n", __func__);
-                        return -1;
+                if (btf__get_from_id(info->btf_id, &btf)) {
+                        pr_debug("%s: failed to get BTF of id %u, aborting\n", __func__, info->btf_id);
+                        err = -1;
+                        btf = NULL;
+                        goto out;
                 }
-                has_btf = true;
-        }
-
-        /*
-         * We need address, length, and tag for each sub program.
-         * Allocate memory and call bpf_obj_get_info_by_fd() again
-         */
-        prog_addrs = calloc(sub_prog_cnt, sizeof(u64));
-        if (!prog_addrs) {
-                pr_debug("%s: failed to allocate memory for prog_addrs, aborting\n", __func__);
-                goto out;
-        }
-        prog_lens = calloc(sub_prog_cnt, sizeof(u32));
-        if (!prog_lens) {
-                pr_debug("%s: failed to allocate memory for prog_lens, aborting\n", __func__);
-                goto out;
-        }
-        prog_tags = calloc(sub_prog_cnt, BPF_TAG_SIZE);
-        if (!prog_tags) {
-                pr_debug("%s: failed to allocate memory for prog_tags, aborting\n", __func__);
-                goto out;
-        }
-
-        memset(&info, 0, sizeof(info));
-        info.nr_jited_ksyms = sub_prog_cnt;
-        info.nr_jited_func_lens = sub_prog_cnt;
-        info.nr_prog_tags = sub_prog_cnt;
-        info.jited_ksyms = ptr_to_u64(prog_addrs);
-        info.jited_func_lens = ptr_to_u64(prog_lens);
-        info.prog_tags = ptr_to_u64(prog_tags);
-        info_len = sizeof(info);
-        if (has_btf) {
-                info.nr_func_info = sub_prog_cnt;
-                info.func_info_rec_size = func_info_rec_size;
-                info.func_info = ptr_to_u64(func_infos);
-        }
-
-        err = bpf_obj_get_info_by_fd(fd, &info, &info_len);
-        if (err) {
-                pr_debug("%s: failed to get BPF program info, aborting\n", __func__);
-                goto out;
+                perf_env__fetch_btf(env, info->btf_id, btf);
         }
 
         /* Synthesize PERF_RECORD_KSYMBOL */
         for (i = 0; i < sub_prog_cnt; i++) {
-                const struct bpf_func_info *finfo;
-                const char *short_name = NULL;
-                const struct btf_type *t;
+                __u32 *prog_lens = (__u32 *)(uintptr_t)(info->jited_func_lens);
+                __u64 *prog_addrs = (__u64 *)(uintptr_t)(info->jited_ksyms);
                 int name_len;
 
                 *ksymbol_event = (struct ksymbol_event){
@@ -157,26 +239,9 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_tool *tool,
                         .ksym_type = PERF_RECORD_KSYMBOL_TYPE_BPF,
                         .flags = 0,
                 };
-                name_len = snprintf(ksymbol_event->name, KSYM_NAME_LEN,
-                                    "bpf_prog_");
-                name_len += snprintf_hex(ksymbol_event->name + name_len,
-                                         KSYM_NAME_LEN - name_len,
-                                         prog_tags[i], BPF_TAG_SIZE);
-                if (has_btf) {
-                        finfo = func_infos + i * info.func_info_rec_size;
-                        t = btf__type_by_id(btf, finfo->type_id);
-                        short_name = btf__name_by_offset(btf, t->name_off);
-                } else if (i == 0 && sub_prog_cnt == 1) {
-                        /* no subprog */
-                        if (info.name[0])
-                                short_name = info.name;
-                } else
-                        short_name = "F";
-                if (short_name)
-                        name_len += snprintf(ksymbol_event->name + name_len,
-                                             KSYM_NAME_LEN - name_len,
-                                             "_%s", short_name);
 
+                name_len = synthesize_bpf_prog_name(ksymbol_event->name,
+                                                    KSYM_NAME_LEN, info, btf, i);
                 ksymbol_event->header.size += PERF_ALIGN(name_len + 1,
                                                          sizeof(u64));
 
@@ -186,8 +251,8 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_tool *tool,
                                                      machine, process);
         }
 
-        /* Synthesize PERF_RECORD_BPF_EVENT */
-        if (opts->bpf_event) {
+        if (!opts->no_bpf_event) {
+                /* Synthesize PERF_RECORD_BPF_EVENT */
                 *bpf_event = (struct bpf_event){
                         .header = {
                                 .type = PERF_RECORD_BPF_EVENT,
@@ -195,25 +260,38 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_tool *tool,
                         },
                         .type = PERF_BPF_EVENT_PROG_LOAD,
                         .flags = 0,
-                        .id = info.id,
+                        .id = info->id,
                 };
-                memcpy(bpf_event->tag, prog_tags[i], BPF_TAG_SIZE);
+                memcpy(bpf_event->tag, info->tag, BPF_TAG_SIZE);
                 memset((void *)event + event->header.size, 0, machine->id_hdr_size);
                 event->header.size += machine->id_hdr_size;
+
+                /* save bpf_prog_info to env */
+                info_node = malloc(sizeof(struct bpf_prog_info_node));
+                if (!info_node) {
+                        err = -1;
+                        goto out;
+                }
+
+                info_node->info_linear = info_linear;
+                perf_env__insert_bpf_prog_info(env, info_node);
+                info_linear = NULL;
+
+                /*
+                 * process after saving bpf_prog_info to env, so that
+                 * required information is ready for look up
+                 */
                 err = perf_tool__process_synth_event(tool, event,
                                                      machine, process);
         }
 
 out:
-        free(prog_tags);
-        free(prog_lens);
-        free(prog_addrs);
-        free(func_infos);
+        free(info_linear);
         free(btf);
         return err ? -1 : 0;
 }
 
-int perf_event__synthesize_bpf_events(struct perf_tool *tool,
+int perf_event__synthesize_bpf_events(struct perf_session *session,
                                       perf_event__handler_t process,
                                       struct machine *machine,
                                       struct record_opts *opts)
@@ -247,7 +325,7 @@ int perf_event__synthesize_bpf_events(struct perf_tool *tool,
                         continue;
                 }
 
-                err = perf_event__synthesize_one_bpf_prog(tool, process,
+                err = perf_event__synthesize_one_bpf_prog(session, process,
                                                           machine, fd,
                                                           event, opts);
                 close(fd);
@@ -261,3 +339,142 @@ int perf_event__synthesize_bpf_events(struct perf_tool *tool,
         free(event);
         return err;
 }
+
+static void perf_env__add_bpf_info(struct perf_env *env, u32 id)
+{
+        struct bpf_prog_info_linear *info_linear;
+        struct bpf_prog_info_node *info_node;
+        struct btf *btf = NULL;
+        u64 arrays;
+        u32 btf_id;
+        int fd;
+
+        fd = bpf_prog_get_fd_by_id(id);
+        if (fd < 0)
+                return;
+
+        arrays = 1UL << BPF_PROG_INFO_JITED_KSYMS;
+        arrays |= 1UL << BPF_PROG_INFO_JITED_FUNC_LENS;
+        arrays |= 1UL << BPF_PROG_INFO_FUNC_INFO;
+        arrays |= 1UL << BPF_PROG_INFO_PROG_TAGS;
+        arrays |= 1UL << BPF_PROG_INFO_JITED_INSNS;
+        arrays |= 1UL << BPF_PROG_INFO_LINE_INFO;
+        arrays |= 1UL << BPF_PROG_INFO_JITED_LINE_INFO;
+
+        info_linear = bpf_program__get_prog_info_linear(fd, arrays);
+        if (IS_ERR_OR_NULL(info_linear)) {
+                pr_debug("%s: failed to get BPF program info. aborting\n", __func__);
+                goto out;
+        }
+
+        btf_id = info_linear->info.btf_id;
+
+        info_node = malloc(sizeof(struct bpf_prog_info_node));
+        if (info_node) {
+                info_node->info_linear = info_linear;
+                perf_env__insert_bpf_prog_info(env, info_node);
+        } else
+                free(info_linear);
+
+        if (btf_id == 0)
+                goto out;
+
+        if (btf__get_from_id(btf_id, &btf)) {
+                pr_debug("%s: failed to get BTF of id %u, aborting\n",
+                         __func__, btf_id);
+                goto out;
+        }
+        perf_env__fetch_btf(env, btf_id, btf);
+
+out:
+        free(btf);
+        close(fd);
+}
+
+static int bpf_event__sb_cb(union perf_event *event, void *data)
+{
+        struct perf_env *env = data;
+
+        if (event->header.type != PERF_RECORD_BPF_EVENT)
+                return -1;
+
+        switch (event->bpf_event.type) {
+        case PERF_BPF_EVENT_PROG_LOAD:
+                perf_env__add_bpf_info(env, event->bpf_event.id);
+
+        case PERF_BPF_EVENT_PROG_UNLOAD:
+                /*
+                 * Do not free bpf_prog_info and btf of the program here,
+                 * as annotation still need them. They will be freed at
+                 * the end of the session.
+                 */
+                break;
+        default:
+                pr_debug("unexpected bpf_event type of %d\n",
+                         event->bpf_event.type);
+                break;
+        }
+
+        return 0;
+}
+
+int bpf_event__add_sb_event(struct perf_evlist **evlist,
+                            struct perf_env *env)
+{
+        struct perf_event_attr attr = {
+                .type             = PERF_TYPE_SOFTWARE,
+                .config           = PERF_COUNT_SW_DUMMY,
+                .sample_id_all    = 1,
+                .watermark        = 1,
+                .bpf_event        = 1,
+                .size      = sizeof(attr), /* to capture ABI version */
+        };
+
+        /*
+         * Older gcc versions don't support designated initializers, like above,
+         * for unnamed union members, such as the following:
+         */
+        attr.wakeup_watermark = 1;
+
+        return perf_evlist__add_sb_event(evlist, &attr, bpf_event__sb_cb, env);
+}
+
+void bpf_event__print_bpf_prog_info(struct bpf_prog_info *info,
+                                    struct perf_env *env,
+                                    FILE *fp)
+{
+        __u32 *prog_lens = (__u32 *)(uintptr_t)(info->jited_func_lens);
+        __u64 *prog_addrs = (__u64 *)(uintptr_t)(info->jited_ksyms);
+        char name[KSYM_NAME_LEN];
+        struct btf *btf = NULL;
+        u32 sub_prog_cnt, i;
+
+        sub_prog_cnt = info->nr_jited_ksyms;
+        if (sub_prog_cnt != info->nr_prog_tags ||
+            sub_prog_cnt != info->nr_jited_func_lens)
+                return;
+
+        if (info->btf_id) {
+                struct btf_node *node;
+
+                node = perf_env__find_btf(env, info->btf_id);
+                if (node)
+                        btf = btf__new((__u8 *)(node->data),
+                                       node->data_size);
+        }
+
+        if (sub_prog_cnt == 1) {
+                synthesize_bpf_prog_name(name, KSYM_NAME_LEN, info, btf, 0);
+                fprintf(fp, "# bpf_prog_info %u: %s addr 0x%llx size %u\n",
+                        info->id, name, prog_addrs[0], prog_lens[0]);
+                return;
+        }
+
+        fprintf(fp, "# bpf_prog_info %u:\n", info->id);
+        for (i = 0; i < sub_prog_cnt; i++) {
+                synthesize_bpf_prog_name(name, KSYM_NAME_LEN, info, btf, i);
+
+                fprintf(fp, "# \tsub_prog %u: %s addr 0x%llx size %u\n",
+                        i, name, prog_addrs[i], prog_lens[i]);
+        }
+}
diff --git a/tools/perf/util/bpf-event.h b/tools/perf/util/bpf-event.h
index 7890067e1a37..04c33b3bfe28 100644
--- a/tools/perf/util/bpf-event.h
+++ b/tools/perf/util/bpf-event.h
@@ -3,22 +3,45 @@
 #define __PERF_BPF_EVENT_H
 
 #include <linux/compiler.h>
+#include <linux/rbtree.h>
+#include <pthread.h>
+#include <api/fd/array.h>
 #include "event.h"
+#include <stdio.h>
 
 struct machine;
 union perf_event;
+struct perf_env;
 struct perf_sample;
-struct perf_tool;
 struct record_opts;
+struct evlist;
+struct target;
+
+struct bpf_prog_info_node {
+        struct bpf_prog_info_linear     *info_linear;
+        struct rb_node                  rb_node;
+};
+
+struct btf_node {
+        struct rb_node  rb_node;
+        u32             id;
+        u32             data_size;
+        char            data[];
+};
 
 #ifdef HAVE_LIBBPF_SUPPORT
 int machine__process_bpf_event(struct machine *machine, union perf_event *event,
                                struct perf_sample *sample);
 
-int perf_event__synthesize_bpf_events(struct perf_tool *tool,
+int perf_event__synthesize_bpf_events(struct perf_session *session,
                                       perf_event__handler_t process,
                                       struct machine *machine,
                                       struct record_opts *opts);
+int bpf_event__add_sb_event(struct perf_evlist **evlist,
+                                 struct perf_env *env);
+void bpf_event__print_bpf_prog_info(struct bpf_prog_info *info,
+                                    struct perf_env *env,
+                                    FILE *fp);
 #else
 static inline int machine__process_bpf_event(struct machine *machine __maybe_unused,
                                              union perf_event *event __maybe_unused,
@@ -27,12 +50,25 @@ static inline int machine__process_bpf_event(struct machine *machine __maybe_unu
         return 0;
 }
 
-static inline int perf_event__synthesize_bpf_events(struct perf_tool *tool __maybe_unused,
+static inline int perf_event__synthesize_bpf_events(struct perf_session *session __maybe_unused,
                                                     perf_event__handler_t process __maybe_unused,
                                                     struct machine *machine __maybe_unused,
                                                     struct record_opts *opts __maybe_unused)
 {
         return 0;
 }
+
+static inline int bpf_event__add_sb_event(struct perf_evlist **evlist __maybe_unused,
+                                          struct perf_env *env __maybe_unused)
+{
+        return 0;
+}
+
+static inline void bpf_event__print_bpf_prog_info(struct bpf_prog_info *info __maybe_unused,
+                                                  struct perf_env *env __maybe_unused,
+                                                  FILE *fp __maybe_unused)
+{
+
+}
 #endif // HAVE_LIBBPF_SUPPORT
 #endif
diff --git a/tools/perf/util/build-id.c b/tools/perf/util/build-id.c
index bff0d17920ed..0c5517a8d0b7 100644
--- a/tools/perf/util/build-id.c
+++ b/tools/perf/util/build-id.c
@@ -185,6 +185,7 @@ char *build_id_cache__linkname(const char *sbuild_id, char *bf, size_t size)
         return bf;
 }
 
+/* The caller is responsible to free the returned buffer. */
 char *build_id_cache__origname(const char *sbuild_id)
 {
         char *linkname;
diff --git a/tools/perf/util/config.c b/tools/perf/util/config.c
index fa092511c52b..7e3c1b60120c 100644
--- a/tools/perf/util/config.c
+++ b/tools/perf/util/config.c
@@ -633,11 +633,10 @@ static int collect_config(const char *var, const char *value,
         }
 
         ret = set_value(item, value);
-        return ret;
 
 out_free:
         free(key);
-        return -1;
+        return ret;
 }
 
 int perf_config_set__collect(struct perf_config_set *set, const char *file_name,
diff --git a/tools/perf/util/data.c b/tools/perf/util/data.c
index e098e189f93e..6a64f713710d 100644
--- a/tools/perf/util/data.c
+++ b/tools/perf/util/data.c
@@ -14,6 +14,7 @@
 #include "data.h"
 #include "util.h"
 #include "debug.h"
+#include "header.h"
 
 static void close_dir(struct perf_data_file *files, int nr)
 {
@@ -34,12 +35,16 @@ int perf_data__create_dir(struct perf_data *data, int nr)
         struct perf_data_file *files = NULL;
         int i, ret = -1;
 
+        if (WARN_ON(!data->is_dir))
+                return -EINVAL;
+
         files = zalloc(nr * sizeof(*files));
         if (!files)
                 return -ENOMEM;
 
-        data->dir.files = files;
-        data->dir.nr    = nr;
+        data->dir.version = PERF_DIR_VERSION;
+        data->dir.files   = files;
+        data->dir.nr      = nr;
 
         for (i = 0; i < nr; i++) {
                 struct perf_data_file *file = &files[i];
@@ -69,6 +74,13 @@ int perf_data__open_dir(struct perf_data *data)
         DIR *dir;
         int nr = 0;
 
+        if (WARN_ON(!data->is_dir))
+                return -EINVAL;
+
+        /* The version is provided by DIR_FORMAT feature. */
+        if (WARN_ON(data->dir.version != PERF_DIR_VERSION))
+                return -1;
+
         dir = opendir(data->path);
         if (!dir)
                 return -EINVAL;
@@ -118,6 +130,26 @@ out_err:
         return ret;
 }
 
+int perf_data__update_dir(struct perf_data *data)
+{
+        int i;
+
+        if (WARN_ON(!data->is_dir))
+                return -EINVAL;
+
+        for (i = 0; i < data->dir.nr; i++) {
+                struct perf_data_file *file = &data->dir.files[i];
+                struct stat st;
+
+                if (fstat(file->fd, &st))
+                        return -1;
+
+                file->size = st.st_size;
+        }
+
+        return 0;
+}
+
 static bool check_pipe(struct perf_data *data)
 {
         struct stat st;
@@ -173,6 +205,16 @@ static int check_backup(struct perf_data *data)
         return 0;
 }
 
+static bool is_dir(struct perf_data *data)
+{
+        struct stat st;
+
+        if (stat(data->path, &st))
+                return false;
+
+        return (st.st_mode & S_IFMT) == S_IFDIR;
+}
+
 static int open_file_read(struct perf_data *data)
 {
         struct stat st;
@@ -254,6 +296,30 @@ static int open_file_dup(struct perf_data *data)
         return open_file(data);
 }
 
+static int open_dir(struct perf_data *data)
+{
+        int ret;
+
+        /*
+         * So far we open only the header, so we can read the data version and
+         * layout.
+         */
+        if (asprintf(&data->file.path, "%s/header", data->path) < 0)
+                return -1;
+
+        if (perf_data__is_write(data) &&
+            mkdir(data->path, S_IRWXU) < 0)
+                return -1;
+
+        ret = open_file(data);
+
+        /* Cleanup whatever we managed to create so far. */
+        if (ret && perf_data__is_write(data))
+                rm_rf_perf_data(data->path);
+
+        return ret;
+}
+
 int perf_data__open(struct perf_data *data)
 {
         if (check_pipe(data))
@@ -265,11 +331,18 @@ int perf_data__open(struct perf_data *data)
         if (check_backup(data))
                 return -1;
 
-        return open_file_dup(data);
+        if (perf_data__is_read(data))
+                data->is_dir = is_dir(data);
+
+        return perf_data__is_dir(data) ?
+               open_dir(data) : open_file_dup(data);
 }
 
 void perf_data__close(struct perf_data *data)
 {
+        if (perf_data__is_dir(data))
+                perf_data__close_dir(data);
+
         zfree(&data->file.path);
         close(data->file.fd);
 }
@@ -288,9 +361,9 @@ ssize_t perf_data__write(struct perf_data *data,
 
 int perf_data__switch(struct perf_data *data,
                            const char *postfix,
-                           size_t pos, bool at_exit)
+                           size_t pos, bool at_exit,
+                           char **new_filepath)
 {
-        char *new_filepath;
         int ret;
 
         if (check_pipe(data))
@@ -298,15 +371,15 @@ int perf_data__switch(struct perf_data *data,
         if (perf_data__is_read(data))
                 return -EINVAL;
 
-        if (asprintf(&new_filepath, "%s.%s", data->path, postfix) < 0)
+        if (asprintf(new_filepath, "%s.%s", data->path, postfix) < 0)
                 return -ENOMEM;
 
         /*
          * Only fire a warning, don't return error, continue fill
          * original file.
          */
-        if (rename(data->path, new_filepath))
-                pr_warning("Failed to rename %s to %s\n", data->path, new_filepath);
+        if (rename(data->path, *new_filepath))
+                pr_warning("Failed to rename %s to %s\n", data->path, *new_filepath);
 
         if (!at_exit) {
                 close(data->file.fd);
@@ -323,6 +396,22 @@ int perf_data__switch(struct perf_data *data,
         }
         ret = data->file.fd;
 out:
-        free(new_filepath);
         return ret;
 }
+
+unsigned long perf_data__size(struct perf_data *data)
+{
+        u64 size = data->file.size;
+        int i;
+
+        if (!data->is_dir)
+                return size;
+
+        for (i = 0; i < data->dir.nr; i++) {
+                struct perf_data_file *file = &data->dir.files[i];
+
+                size += file->size;
+        }
+
+        return size;
+}
diff --git a/tools/perf/util/data.h b/tools/perf/util/data.h
index 14b47be2bd69..259868a39019 100644
--- a/tools/perf/util/data.h
+++ b/tools/perf/util/data.h
@@ -19,10 +19,12 @@ struct perf_data {
         const char              *path;
         struct perf_data_file    file;
         bool                     is_pipe;
+        bool                     is_dir;
         bool                     force;
         enum perf_data_mode      mode;
 
         struct {
+                u64                      version;
                 struct perf_data_file   *files;
                 int                      nr;
         } dir;
@@ -43,14 +45,14 @@ static inline int perf_data__is_pipe(struct perf_data *data)
         return data->is_pipe;
 }
 
-static inline int perf_data__fd(struct perf_data *data)
+static inline bool perf_data__is_dir(struct perf_data *data)
 {
-        return data->file.fd;
+        return data->is_dir;
 }
 
-static inline unsigned long perf_data__size(struct perf_data *data)
+static inline int perf_data__fd(struct perf_data *data)
 {
-        return data->file.size;
+        return data->file.fd;
 }
 
 int perf_data__open(struct perf_data *data);
@@ -68,9 +70,11 @@ ssize_t perf_data_file__write(struct perf_data_file *file,
  */
 int perf_data__switch(struct perf_data *data,
                            const char *postfix,
-                           size_t pos, bool at_exit);
+                           size_t pos, bool at_exit, char **new_filepath);
 
 int perf_data__create_dir(struct perf_data *data, int nr);
 int perf_data__open_dir(struct perf_data *data);
 void perf_data__close_dir(struct perf_data *data);
+int perf_data__update_dir(struct perf_data *data);
+unsigned long perf_data__size(struct perf_data *data);
 #endif /* __PERF_DATA_H */
diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c
index ba58ba603b69..e059976d9d93 100644
--- a/tools/perf/util/dso.c
+++ b/tools/perf/util/dso.c
@@ -184,6 +184,7 @@ int dso__read_binary_type_filename(const struct dso *dso,
         case DSO_BINARY_TYPE__KALLSYMS:
         case DSO_BINARY_TYPE__GUEST_KALLSYMS:
         case DSO_BINARY_TYPE__JAVA_JIT:
+        case DSO_BINARY_TYPE__BPF_PROG_INFO:
         case DSO_BINARY_TYPE__NOT_FOUND:
                 ret = -1;
                 break;
@@ -1141,28 +1142,34 @@ void dso__set_short_name(struct dso *dso, const char *name, bool name_allocated)
 
 static void dso__set_basename(struct dso *dso)
 {
-       /*
-        * basename() may modify path buffer, so we must pass
-        * a copy.
-        */
-       char *base, *lname = strdup(dso->long_name);
+        char *base, *lname;
+        int tid;
 
-       if (!lname)
-               return;
-
-       /*
-        * basename() may return a pointer to internal
-        * storage which is reused in subsequent calls
-        * so copy the result.
-        */
-       base = strdup(basename(lname));
+        if (sscanf(dso->long_name, "/tmp/perf-%d.map", &tid) == 1) {
+                if (asprintf(&base, "[JIT] tid %d", tid) < 0)
+                        return;
+        } else {
+              /*
+               * basename() may modify path buffer, so we must pass
+               * a copy.
+               */
+                lname = strdup(dso->long_name);
+                if (!lname)
+                        return;
 
-       free(lname);
+                /*
+                 * basename() may return a pointer to internal
+                 * storage which is reused in subsequent calls
+                 * so copy the result.
+                 */
+                base = strdup(basename(lname));
 
-       if (!base)
-               return;
+                free(lname);
 
-       dso__set_short_name(dso, base, true);
+                if (!base)
+                        return;
+        }
+        dso__set_short_name(dso, base, true);
 }
 
 int dso__name_len(const struct dso *dso)
diff --git a/tools/perf/util/dso.h b/tools/perf/util/dso.h
index bb417c54c25a..6e3f63781e51 100644
--- a/tools/perf/util/dso.h
+++ b/tools/perf/util/dso.h
@@ -14,6 +14,7 @@
 
 struct machine;
 struct map;
+struct perf_env;
 
 enum dso_binary_type {
         DSO_BINARY_TYPE__KALLSYMS = 0,
@@ -35,6 +36,7 @@ enum dso_binary_type {
         DSO_BINARY_TYPE__KCORE,
         DSO_BINARY_TYPE__GUEST_KCORE,
         DSO_BINARY_TYPE__OPENEMBEDDED_DEBUGINFO,
+        DSO_BINARY_TYPE__BPF_PROG_INFO,
         DSO_BINARY_TYPE__NOT_FOUND,
 };
 
@@ -189,6 +191,12 @@ struct dso {
                 u64              debug_frame_offset;
                 u64              eh_frame_hdr_offset;
         } data;
+        /* bpf prog information */
+        struct {
+                u32             id;
+                u32             sub_id;
+                struct perf_env *env;
+        } bpf_prog;
 
         union { /* Tool specific area */
                 void     *priv;
diff --git a/tools/perf/util/env.c b/tools/perf/util/env.c
index 4c23779e271a..c6351b557bb0 100644
--- a/tools/perf/util/env.c
+++ b/tools/perf/util/env.c
@@ -3,15 +3,163 @@
 #include "env.h"
 #include "sane_ctype.h"
 #include "util.h"
+#include "bpf-event.h"
 #include <errno.h>
 #include <sys/utsname.h>
+#include <bpf/libbpf.h>
 
 struct perf_env perf_env;
 
+void perf_env__insert_bpf_prog_info(struct perf_env *env,
+                                    struct bpf_prog_info_node *info_node)
+{
+        __u32 prog_id = info_node->info_linear->info.id;
+        struct bpf_prog_info_node *node;
+        struct rb_node *parent = NULL;
+        struct rb_node **p;
+
+        down_write(&env->bpf_progs.lock);
+        p = &env->bpf_progs.infos.rb_node;
+
+        while (*p != NULL) {
+                parent = *p;
+                node = rb_entry(parent, struct bpf_prog_info_node, rb_node);
+                if (prog_id < node->info_linear->info.id) {
+                        p = &(*p)->rb_left;
+                } else if (prog_id > node->info_linear->info.id) {
+                        p = &(*p)->rb_right;
+                } else {
+                        pr_debug("duplicated bpf prog info %u\n", prog_id);
+                        goto out;
+                }
+        }
+
+        rb_link_node(&info_node->rb_node, parent, p);
+        rb_insert_color(&info_node->rb_node, &env->bpf_progs.infos);
+        env->bpf_progs.infos_cnt++;
+out:
+        up_write(&env->bpf_progs.lock);
+}
+
+struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env,
+                                                        __u32 prog_id)
+{
+        struct bpf_prog_info_node *node = NULL;
+        struct rb_node *n;
+
+        down_read(&env->bpf_progs.lock);
+        n = env->bpf_progs.infos.rb_node;
+
+        while (n) {
+                node = rb_entry(n, struct bpf_prog_info_node, rb_node);
+                if (prog_id < node->info_linear->info.id)
+                        n = n->rb_left;
+                else if (prog_id > node->info_linear->info.id)
+                        n = n->rb_right;
+                else
+                        break;
+        }
+
+        up_read(&env->bpf_progs.lock);
+        return node;
+}
+
+void perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node)
+{
+        struct rb_node *parent = NULL;
+        __u32 btf_id = btf_node->id;
+        struct btf_node *node;
+        struct rb_node **p;
+
+        down_write(&env->bpf_progs.lock);
+        p = &env->bpf_progs.btfs.rb_node;
+
+        while (*p != NULL) {
+                parent = *p;
+                node = rb_entry(parent, struct btf_node, rb_node);
+                if (btf_id < node->id) {
+                        p = &(*p)->rb_left;
+                } else if (btf_id > node->id) {
+                        p = &(*p)->rb_right;
+                } else {
+                        pr_debug("duplicated btf %u\n", btf_id);
+                        goto out;
+                }
+        }
+
+        rb_link_node(&btf_node->rb_node, parent, p);
+        rb_insert_color(&btf_node->rb_node, &env->bpf_progs.btfs);
+        env->bpf_progs.btfs_cnt++;
+out:
+        up_write(&env->bpf_progs.lock);
+}
+
+struct btf_node *perf_env__find_btf(struct perf_env *env, __u32 btf_id)
+{
+        struct btf_node *node = NULL;
+        struct rb_node *n;
+
+        down_read(&env->bpf_progs.lock);
+        n = env->bpf_progs.btfs.rb_node;
+
+        while (n) {
+                node = rb_entry(n, struct btf_node, rb_node);
+                if (btf_id < node->id)
+                        n = n->rb_left;
+                else if (btf_id > node->id)
+                        n = n->rb_right;
+                else
+                        break;
+        }
+
+        up_read(&env->bpf_progs.lock);
+        return node;
+}
+
+/* purge data in bpf_progs.infos tree */
+static void perf_env__purge_bpf(struct perf_env *env)
+{
+        struct rb_root *root;
+        struct rb_node *next;
+
+        down_write(&env->bpf_progs.lock);
+
+        root = &env->bpf_progs.infos;
+        next = rb_first(root);
+
+        while (next) {
+                struct bpf_prog_info_node *node;
+
+                node = rb_entry(next, struct bpf_prog_info_node, rb_node);
+                next = rb_next(&node->rb_node);
+                rb_erase(&node->rb_node, root);
+                free(node);
+        }
+
+        env->bpf_progs.infos_cnt = 0;
+
+        root = &env->bpf_progs.btfs;
+        next = rb_first(root);
+
+        while (next) {
+                struct btf_node *node;
+
+                node = rb_entry(next, struct btf_node, rb_node);
+                next = rb_next(&node->rb_node);
+                rb_erase(&node->rb_node, root);
+                free(node);
+        }
+
+        env->bpf_progs.btfs_cnt = 0;
+
+        up_write(&env->bpf_progs.lock);
+}
+
 void perf_env__exit(struct perf_env *env)
 {
         int i;
 
+        perf_env__purge_bpf(env);
         zfree(&env->hostname);
         zfree(&env->os_release);
         zfree(&env->version);
@@ -38,6 +186,13 @@ void perf_env__exit(struct perf_env *env)
         zfree(&env->memory_nodes);
 }
 
+void perf_env__init(struct perf_env *env)
+{
+        env->bpf_progs.infos = RB_ROOT;
+        env->bpf_progs.btfs = RB_ROOT;
+        init_rwsem(&env->bpf_progs.lock);
+}
+
 int perf_env__set_cmdline(struct perf_env *env, int argc, const char *argv[])
 {
         int i;
diff --git a/tools/perf/util/env.h b/tools/perf/util/env.h
index d01b8355f4ca..4f8e2b485c01 100644
--- a/tools/perf/util/env.h
+++ b/tools/perf/util/env.h
@@ -3,7 +3,9 @@
 #define __PERF_ENV_H
 
 #include <linux/types.h>
+#include <linux/rbtree.h>
 #include "cpumap.h"
+#include "rwsem.h"
 
 struct cpu_topology_map {
         int     socket_id;
@@ -64,8 +66,23 @@ struct perf_env {
         struct memory_node      *memory_nodes;
         unsigned long long       memory_bsize;
         u64                     clockid_res_ns;
+
+        /*
+         * bpf_info_lock protects bpf rbtrees. This is needed because the
+         * trees are accessed by different threads in perf-top
+         */
+        struct {
+                struct rw_semaphore     lock;
+                struct rb_root          infos;
+                u32                     infos_cnt;
+                struct rb_root          btfs;
+                u32                     btfs_cnt;
+        } bpf_progs;
 };
 
+struct bpf_prog_info_node;
+struct btf_node;
+
 extern struct perf_env perf_env;
 
 void perf_env__exit(struct perf_env *env);
@@ -80,4 +97,11 @@ const char *perf_env__arch(struct perf_env *env);
 const char *perf_env__raw_arch(struct perf_env *env);
 int perf_env__nr_cpus_avail(struct perf_env *env);
 
+void perf_env__init(struct perf_env *env);
+void perf_env__insert_bpf_prog_info(struct perf_env *env,
+                                    struct bpf_prog_info_node *info_node);
+struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env,
+                                                        __u32 prog_id);
+void perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node);
+struct btf_node *perf_env__find_btf(struct perf_env *env, __u32 btf_id);
 #endif /* __PERF_ENV_H */
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index ed20f4379956..ec78e93085de 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -19,6 +19,7 @@
 #include "debug.h"
 #include "units.h"
 #include "asm/bug.h"
+#include "bpf-event.h"
 #include <signal.h>
 #include <unistd.h>
 
@@ -1856,3 +1857,121 @@ struct perf_evsel *perf_evlist__reset_weak_group(struct perf_evlist *evsel_list,
         }
         return leader;
 }
+
+int perf_evlist__add_sb_event(struct perf_evlist **evlist,
+                              struct perf_event_attr *attr,
+                              perf_evsel__sb_cb_t cb,
+                              void *data)
+{
+        struct perf_evsel *evsel;
+        bool new_evlist = (*evlist) == NULL;
+
+        if (*evlist == NULL)
+                *evlist = perf_evlist__new();
+        if (*evlist == NULL)
+                return -1;
+
+        if (!attr->sample_id_all) {
+                pr_warning("enabling sample_id_all for all side band events\n");
+                attr->sample_id_all = 1;
+        }
+
+        evsel = perf_evsel__new_idx(attr, (*evlist)->nr_entries);
+        if (!evsel)
+                goto out_err;
+
+        evsel->side_band.cb = cb;
+        evsel->side_band.data = data;
+        perf_evlist__add(*evlist, evsel);
+        return 0;
+
+out_err:
+        if (new_evlist) {
+                perf_evlist__delete(*evlist);
+                *evlist = NULL;
+        }
+        return -1;
+}
+
+static void *perf_evlist__poll_thread(void *arg)
+{
+        struct perf_evlist *evlist = arg;
+        bool draining = false;
+        int i;
+
+        while (draining || !(evlist->thread.done)) {
+                if (draining)
+                        draining = false;
+                else if (evlist->thread.done)
+                        draining = true;
+
+                if (!draining)
+                        perf_evlist__poll(evlist, 1000);
+
+                for (i = 0; i < evlist->nr_mmaps; i++) {
+                        struct perf_mmap *map = &evlist->mmap[i];
+                        union perf_event *event;
+
+                        if (perf_mmap__read_init(map))
+                                continue;
+                        while ((event = perf_mmap__read_event(map)) != NULL) {
+                                struct perf_evsel *evsel = perf_evlist__event2evsel(evlist, event);
+
+                                if (evsel && evsel->side_band.cb)
+                                        evsel->side_band.cb(event, evsel->side_band.data);
+                                else
+                                        pr_warning("cannot locate proper evsel for the side band event\n");
+
+                                perf_mmap__consume(map);
+                        }
+                        perf_mmap__read_done(map);
+                }
+        }
+        return NULL;
+}
+
+int perf_evlist__start_sb_thread(struct perf_evlist *evlist,
+                                 struct target *target)
+{
+        struct perf_evsel *counter;
+
+        if (!evlist)
+                return 0;
+
+        if (perf_evlist__create_maps(evlist, target))
+                goto out_delete_evlist;
+
+        evlist__for_each_entry(evlist, counter) {
+                if (perf_evsel__open(counter, evlist->cpus,
+                                     evlist->threads) < 0)
+                        goto out_delete_evlist;
+        }
+
+        if (perf_evlist__mmap(evlist, UINT_MAX))
+                goto out_delete_evlist;
+
+        evlist__for_each_entry(evlist, counter) {
+                if (perf_evsel__enable(counter))
+                        goto out_delete_evlist;
+        }
+
+        evlist->thread.done = 0;
+        if (pthread_create(&evlist->thread.th, NULL, perf_evlist__poll_thread, evlist))
+                goto out_delete_evlist;
+
+        return 0;
+
+out_delete_evlist:
+        perf_evlist__delete(evlist);
+        evlist = NULL;
+        return -1;
+}
+
+void perf_evlist__stop_sb_thread(struct perf_evlist *evlist)
+{
+        if (!evlist)
+                return;
+        evlist->thread.done = 1;
+        pthread_join(evlist->thread.th, NULL);
+        perf_evlist__delete(evlist);
+}
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index 744906dd4887..dcb68f34d2cd 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -54,6 +54,10 @@ struct perf_evlist {
                                        struct perf_sample *sample);
         u64             first_sample_time;
         u64             last_sample_time;
+        struct {
+                pthread_t               th;
+                volatile int            done;
+        } thread;
 };
 
 struct perf_evsel_str_handler {
@@ -87,6 +91,14 @@ int __perf_evlist__add_default_attrs(struct perf_evlist *evlist,
 
 int perf_evlist__add_dummy(struct perf_evlist *evlist);
 
+int perf_evlist__add_sb_event(struct perf_evlist **evlist,
+                              struct perf_event_attr *attr,
+                              perf_evsel__sb_cb_t cb,
+                              void *data);
+int perf_evlist__start_sb_thread(struct perf_evlist *evlist,
+                                 struct target *target);
+void perf_evlist__stop_sb_thread(struct perf_evlist *evlist);
+
 int perf_evlist__add_newtp(struct perf_evlist *evlist,
                            const char *sys, const char *name, void *handler);
 
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index 3bbf73e979c0..7835e05f0c0a 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -1036,7 +1036,7 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts,
         attr->mmap2 = track && !perf_missing_features.mmap2;
         attr->comm  = track;
         attr->ksymbol = track && !perf_missing_features.ksymbol;
-        attr->bpf_event = track && opts->bpf_event &&
+        attr->bpf_event = track && !opts->no_bpf_event &&
                 !perf_missing_features.bpf_event;
 
         if (opts->record_namespaces)
@@ -1292,6 +1292,7 @@ void perf_evsel__exit(struct perf_evsel *evsel)
 {
         assert(list_empty(&evsel->node));
         assert(evsel->evlist == NULL);
+        perf_evsel__free_counts(evsel);
         perf_evsel__free_fd(evsel);
         perf_evsel__free_id(evsel);
         perf_evsel__free_config_terms(evsel);
@@ -1342,10 +1343,9 @@ void perf_counts_values__scale(struct perf_counts_values *count,
                         count->val = 0;
                 } else if (count->run < count->ena) {
                         scaled = 1;
-                        count->val = (u64)((double) count->val * count->ena / count->run + 0.5);
+                        count->val = (u64)((double) count->val * count->ena / count->run);
                 }
-        } else
-                count->ena = count->run = 0;
+        }
 
         if (pscaled)
                 *pscaled = scaled;
diff --git a/tools/perf/util/evsel.h b/tools/perf/util/evsel.h
index cc578e02e08f..0f2c6c93d721 100644
--- a/tools/perf/util/evsel.h
+++ b/tools/perf/util/evsel.h
@@ -73,6 +73,8 @@ struct perf_evsel_config_term {
 
 struct perf_stat_evsel;
 
+typedef int (perf_evsel__sb_cb_t)(union perf_event *event, void *data);
+
 /** struct perf_evsel - event selector
  *
  * @evlist - evlist this evsel is in, if it is in one.
@@ -151,6 +153,10 @@ struct perf_evsel {
         bool                    collect_stat;
         bool                    weak_group;
         const char              *pmu_name;
+        struct {
+                perf_evsel__sb_cb_t     *cb;
+                void                    *data;
+        } side_band;
 };
 
 union u64_swap {
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 01b324c275b9..b9e693825873 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -18,6 +18,7 @@
 #include <sys/utsname.h>
 #include <linux/time64.h>
 #include <dirent.h>
+#include <bpf/libbpf.h>
 
 #include "evlist.h"
 #include "evsel.h"
@@ -40,6 +41,7 @@
 #include "time-utils.h"
 #include "units.h"
 #include "cputopo.h"
+#include "bpf-event.h"
 
 #include "sane_ctype.h"
 
@@ -861,6 +863,104 @@ static int write_clockid(struct feat_fd *ff,
                         sizeof(ff->ph->env.clockid_res_ns));
 }
 
+static int write_dir_format(struct feat_fd *ff,
+                            struct perf_evlist *evlist __maybe_unused)
+{
+        struct perf_session *session;
+        struct perf_data *data;
+
+        session = container_of(ff->ph, struct perf_session, header);
+        data = session->data;
+
+        if (WARN_ON(!perf_data__is_dir(data)))
+                return -1;
+
+        return do_write(ff, &data->dir.version, sizeof(data->dir.version));
+}
+
+#ifdef HAVE_LIBBPF_SUPPORT
+static int write_bpf_prog_info(struct feat_fd *ff,
+                               struct perf_evlist *evlist __maybe_unused)
+{
+        struct perf_env *env = &ff->ph->env;
+        struct rb_root *root;
+        struct rb_node *next;
+        int ret;
+
+        down_read(&env->bpf_progs.lock);
+
+        ret = do_write(ff, &env->bpf_progs.infos_cnt,
+                       sizeof(env->bpf_progs.infos_cnt));
+        if (ret < 0)
+                goto out;
+
+        root = &env->bpf_progs.infos;
+        next = rb_first(root);
+        while (next) {
+                struct bpf_prog_info_node *node;
+                size_t len;
+
+                node = rb_entry(next, struct bpf_prog_info_node, rb_node);
+                next = rb_next(&node->rb_node);
+                len = sizeof(struct bpf_prog_info_linear) +
+                        node->info_linear->data_len;
+
+                /* before writing to file, translate address to offset */
+                bpf_program__bpil_addr_to_offs(node->info_linear);
+                ret = do_write(ff, node->info_linear, len);
+                /*
+                 * translate back to address even when do_write() fails,
+                 * so that this function never changes the data.
+                 */
+                bpf_program__bpil_offs_to_addr(node->info_linear);
+                if (ret < 0)
+                        goto out;
+        }
+out:
+        up_read(&env->bpf_progs.lock);
+        return ret;
+}
+#else // HAVE_LIBBPF_SUPPORT
+static int write_bpf_prog_info(struct feat_fd *ff __maybe_unused,
+                               struct perf_evlist *evlist __maybe_unused)
+{
+        return 0;
+}
+#endif // HAVE_LIBBPF_SUPPORT
+
+static int write_bpf_btf(struct feat_fd *ff,
+                         struct perf_evlist *evlist __maybe_unused)
+{
+        struct perf_env *env = &ff->ph->env;
+        struct rb_root *root;
+        struct rb_node *next;
+        int ret;
+
+        down_read(&env->bpf_progs.lock);
+
+        ret = do_write(ff, &env->bpf_progs.btfs_cnt,
+                       sizeof(env->bpf_progs.btfs_cnt));
+
+        if (ret < 0)
+                goto out;
+
+        root = &env->bpf_progs.btfs;
+        next = rb_first(root);
+        while (next) {
+                struct btf_node *node;
+
+                node = rb_entry(next, struct btf_node, rb_node);
+                next = rb_next(&node->rb_node);
+                ret = do_write(ff, &node->id,
+                               sizeof(u32) * 2 + node->data_size);
+                if (ret < 0)
+                        goto out;
+        }
+out:
+        up_read(&env->bpf_progs.lock);
+        return ret;
+}
+
 static int cpu_cache_level__sort(const void *a, const void *b)
 {
         struct cpu_cache_level *cache_a = (struct cpu_cache_level *)a;
@@ -1341,6 +1441,63 @@ static void print_clockid(struct feat_fd *ff, FILE *fp)
                 ff->ph->env.clockid_res_ns * 1000);
 }
 
+static void print_dir_format(struct feat_fd *ff, FILE *fp)
+{
+        struct perf_session *session;
+        struct perf_data *data;
+
+        session = container_of(ff->ph, struct perf_session, header);
+        data = session->data;
+
+        fprintf(fp, "# directory data version : %"PRIu64"\n", data->dir.version);
+}
+
+static void print_bpf_prog_info(struct feat_fd *ff, FILE *fp)
+{
+        struct perf_env *env = &ff->ph->env;
+        struct rb_root *root;
+        struct rb_node *next;
+
+        down_read(&env->bpf_progs.lock);
+
+        root = &env->bpf_progs.infos;
+        next = rb_first(root);
+
+        while (next) {
+                struct bpf_prog_info_node *node;
+
+                node = rb_entry(next, struct bpf_prog_info_node, rb_node);
+                next = rb_next(&node->rb_node);
+
+                bpf_event__print_bpf_prog_info(&node->info_linear->info,
+                                               env, fp);
+        }
+
+        up_read(&env->bpf_progs.lock);
+}
+
+static void print_bpf_btf(struct feat_fd *ff, FILE *fp)
+{
+        struct perf_env *env = &ff->ph->env;
+        struct rb_root *root;
+        struct rb_node *next;
+
+        down_read(&env->bpf_progs.lock);
+
+        root = &env->bpf_progs.btfs;
+        next = rb_first(root);
+
+        while (next) {
+                struct btf_node *node;
+
+                node = rb_entry(next, struct btf_node, rb_node);
+                next = rb_next(&node->rb_node);
+                fprintf(fp, "# btf info of id %u\n", node->id);
+        }
+
+        up_read(&env->bpf_progs.lock);
+}
+
 static void free_event_desc(struct perf_evsel *events)
 {
         struct perf_evsel *evsel;
@@ -2373,6 +2530,139 @@ static int process_clockid(struct feat_fd *ff,
         return 0;
 }
 
+static int process_dir_format(struct feat_fd *ff,
+                              void *_data __maybe_unused)
+{
+        struct perf_session *session;
+        struct perf_data *data;
+
+        session = container_of(ff->ph, struct perf_session, header);
+        data = session->data;
+
+        if (WARN_ON(!perf_data__is_dir(data)))
+                return -1;
+
+        return do_read_u64(ff, &data->dir.version);
+}
+
+#ifdef HAVE_LIBBPF_SUPPORT
+static int process_bpf_prog_info(struct feat_fd *ff, void *data __maybe_unused)
+{
+        struct bpf_prog_info_linear *info_linear;
+        struct bpf_prog_info_node *info_node;
+        struct perf_env *env = &ff->ph->env;
+        u32 count, i;
+        int err = -1;
+
+        if (ff->ph->needs_swap) {
+                pr_warning("interpreting bpf_prog_info from systems with endianity is not yet supported\n");
+                return 0;
+        }
+
+        if (do_read_u32(ff, &count))
+                return -1;
+
+        down_write(&env->bpf_progs.lock);
+
+        for (i = 0; i < count; ++i) {
+                u32 info_len, data_len;
+
+                info_linear = NULL;
+                info_node = NULL;
+                if (do_read_u32(ff, &info_len))
+                        goto out;
+                if (do_read_u32(ff, &data_len))
+                        goto out;
+
+                if (info_len > sizeof(struct bpf_prog_info)) {
+                        pr_warning("detected invalid bpf_prog_info\n");
+                        goto out;
+                }
+
+                info_linear = malloc(sizeof(struct bpf_prog_info_linear) +
+                                     data_len);
+                if (!info_linear)
+                        goto out;
+                info_linear->info_len = sizeof(struct bpf_prog_info);
+                info_linear->data_len = data_len;
+                if (do_read_u64(ff, (u64 *)(&info_linear->arrays)))
+                        goto out;
+                if (__do_read(ff, &info_linear->info, info_len))
+                        goto out;
+                if (info_len < sizeof(struct bpf_prog_info))
+                        memset(((void *)(&info_linear->info)) + info_len, 0,
+                               sizeof(struct bpf_prog_info) - info_len);
+
+                if (__do_read(ff, info_linear->data, data_len))
+                        goto out;
+
+                info_node = malloc(sizeof(struct bpf_prog_info_node));
+                if (!info_node)
+                        goto out;
+
+                /* after reading from file, translate offset to address */
+                bpf_program__bpil_offs_to_addr(info_linear);
+                info_node->info_linear = info_linear;
+                perf_env__insert_bpf_prog_info(env, info_node);
+        }
+
+        return 0;
+out:
+        free(info_linear);
+        free(info_node);
+        up_write(&env->bpf_progs.lock);
+        return err;
+}
+#else // HAVE_LIBBPF_SUPPORT
+static int process_bpf_prog_info(struct feat_fd *ff __maybe_unused, void *data __maybe_unused)
+{
+        return 0;
+}
+#endif // HAVE_LIBBPF_SUPPORT
+
+static int process_bpf_btf(struct feat_fd *ff, void *data __maybe_unused)
+{
+        struct perf_env *env = &ff->ph->env;
+        u32 count, i;
+
+        if (ff->ph->needs_swap) {
+                pr_warning("interpreting btf from systems with endianity is not yet supported\n");
+                return 0;
+        }
+
+        if (do_read_u32(ff, &count))
+                return -1;
+
+        down_write(&env->bpf_progs.lock);
+
+        for (i = 0; i < count; ++i) {
+                struct btf_node *node;
+                u32 id, data_size;
+
+                if (do_read_u32(ff, &id))
+                        return -1;
+                if (do_read_u32(ff, &data_size))
+                        return -1;
+
+                node = malloc(sizeof(struct btf_node) + data_size);
+                if (!node)
+                        return -1;
+
+                node->id = id;
+                node->data_size = data_size;
+
+                if (__do_read(ff, node->data, data_size)) {
+                        free(node);
+                        return -1;
+                }
+
+                perf_env__insert_btf(env, node);
+        }
+
+        up_write(&env->bpf_progs.lock);
+        return 0;
+}
+
 struct feature_ops {
         int (*write)(struct feat_fd *ff, struct perf_evlist *evlist);
         void (*print)(struct feat_fd *ff, FILE *fp);
@@ -2432,7 +2722,10 @@ static const struct feature_ops feat_ops[HEADER_LAST_FEATURE] = {
         FEAT_OPN(CACHE,         cache,          true),
         FEAT_OPR(SAMPLE_TIME,   sample_time,    false),
         FEAT_OPR(MEM_TOPOLOGY,  mem_topology,   true),
-        FEAT_OPR(CLOCKID,       clockid,        false)
+        FEAT_OPR(CLOCKID,       clockid,        false),
+        FEAT_OPN(DIR_FORMAT,    dir_format,     false),
+        FEAT_OPR(BPF_PROG_INFO, bpf_prog_info,  false),
+        FEAT_OPR(BPF_BTF,       bpf_btf,        false),
 };
 
 struct header_print_data {
diff --git a/tools/perf/util/header.h b/tools/perf/util/header.h
index 0d553ddca0a3..386da49e1bfa 100644
--- a/tools/perf/util/header.h
+++ b/tools/perf/util/header.h
@@ -39,6 +39,9 @@ enum {
         HEADER_SAMPLE_TIME,
         HEADER_MEM_TOPOLOGY,
         HEADER_CLOCKID,
+        HEADER_DIR_FORMAT,
+        HEADER_BPF_PROG_INFO,
+        HEADER_BPF_BTF,
         HEADER_LAST_FEATURE,
         HEADER_FEAT_BITS        = 256,
 };
@@ -48,6 +51,10 @@ enum perf_header_version {
         PERF_HEADER_VERSION_2,
 };
 
+enum perf_dir_version {
+        PERF_DIR_VERSION        = 1,
+};
+
 struct perf_file_section {
         u64 offset;
         u64 size;
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index f9eb95bf3938..7ace7a10054d 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -19,6 +19,7 @@
 #include <math.h>
 #include <inttypes.h>
 #include <sys/param.h>
+#include <linux/time64.h>
 
 static bool hists__filter_entry_by_dso(struct hists *hists,
                                        struct hist_entry *he);
@@ -192,6 +193,7 @@ void hists__calc_col_len(struct hists *hists, struct hist_entry *h)
         hists__new_col_len(hists, HISTC_MEM_LVL, 21 + 3);
         hists__new_col_len(hists, HISTC_LOCAL_WEIGHT, 12);
         hists__new_col_len(hists, HISTC_GLOBAL_WEIGHT, 12);
+        hists__new_col_len(hists, HISTC_TIME, 12);
 
         if (h->srcline) {
                 len = MAX(strlen(h->srcline), strlen(sort_srcline.se_header));
@@ -246,6 +248,14 @@ static void he_stat__add_cpumode_period(struct he_stat *he_stat,
         }
 }
 
+static long hist_time(unsigned long htime)
+{
+        unsigned long time_quantum = symbol_conf.time_quantum;
+        if (time_quantum)
+                return (htime / time_quantum) * time_quantum;
+        return htime;
+}
+
 static void he_stat__add_period(struct he_stat *he_stat, u64 period,
                                 u64 weight)
 {
@@ -426,6 +436,13 @@ static int hist_entry__init(struct hist_entry *he,
                         goto err_rawdata;
         }
 
+        if (symbol_conf.res_sample) {
+                he->res_samples = calloc(sizeof(struct res_sample),
+                                        symbol_conf.res_sample);
+                if (!he->res_samples)
+                        goto err_srcline;
+        }
+
         INIT_LIST_HEAD(&he->pairs.node);
         thread__get(he->thread);
         he->hroot_in  = RB_ROOT_CACHED;
@@ -436,6 +453,9 @@ static int hist_entry__init(struct hist_entry *he,
 
         return 0;
 
+err_srcline:
+        free(he->srcline);
+
 err_rawdata:
         free(he->raw_data);
 
@@ -593,6 +613,32 @@ out:
         return he;
 }
 
+static unsigned random_max(unsigned high)
+{
+        unsigned thresh = -high % high;
+        for (;;) {
+                unsigned r = random();
+                if (r >= thresh)
+                        return r % high;
+        }
+}
+
+static void hists__res_sample(struct hist_entry *he, struct perf_sample *sample)
+{
+        struct res_sample *r;
+        int j;
+
+        if (he->num_res < symbol_conf.res_sample) {
+                j = he->num_res++;
+        } else {
+                j = random_max(symbol_conf.res_sample);
+        }
+        r = &he->res_samples[j];
+        r->time = sample->time;
+        r->cpu = sample->cpu;
+        r->tid = sample->tid;
+}
+
 static struct hist_entry*
 __hists__add_entry(struct hists *hists,
                    struct addr_location *al,
@@ -635,10 +681,13 @@ __hists__add_entry(struct hists *hists,
                 .raw_data = sample->raw_data,
                 .raw_size = sample->raw_size,
                 .ops = ops,
+                .time = hist_time(sample->time),
         }, *he = hists__findnew_entry(hists, &entry, al, sample_self);
 
         if (!hists->has_callchains && he && he->callchain_size != 0)
                 hists->has_callchains = true;
+        if (he && symbol_conf.res_sample)
+                hists__res_sample(he, sample);
         return he;
 }
 
@@ -1062,8 +1111,10 @@ int hist_entry_iter__add(struct hist_entry_iter *iter, struct addr_location *al,
 
         err = sample__resolve_callchain(iter->sample, &callchain_cursor, &iter->parent,
                                         iter->evsel, al, max_stack_depth);
-        if (err)
+        if (err) {
+                map__put(alm);
                 return err;
+        }
 
         err = iter->ops->prepare_entry(iter, al);
         if (err)
@@ -1162,6 +1213,7 @@ void hist_entry__delete(struct hist_entry *he)
                 mem_info__zput(he->mem_info);
         }
 
+        zfree(&he->res_samples);
         zfree(&he->stat_acc);
         free_srcline(he->srcline);
         if (he->srcfile && he->srcfile[0])
diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
index 4af27fbab24f..76ff6c6d03b8 100644
--- a/tools/perf/util/hist.h
+++ b/tools/perf/util/hist.h
@@ -31,6 +31,7 @@ enum hist_filter {
 
 enum hist_column {
         HISTC_SYMBOL,
+        HISTC_TIME,
         HISTC_DSO,
         HISTC_THREAD,
         HISTC_COMM,
@@ -432,9 +433,18 @@ struct hist_browser_timer {
 };
 
 struct annotation_options;
+struct res_sample;
+
+enum rstype {
+        A_NORMAL,
+        A_ASM,
+        A_SOURCE
+};
 
 #ifdef HAVE_SLANG_SUPPORT
 #include "../ui/keysyms.h"
+void attr_to_script(char *buf, struct perf_event_attr *attr);
+
 int map_symbol__tui_annotate(struct map_symbol *ms, struct perf_evsel *evsel,
                              struct hist_browser_timer *hbt,
                              struct annotation_options *annotation_opts);
@@ -449,7 +459,13 @@ int perf_evlist__tui_browse_hists(struct perf_evlist *evlist, const char *help,
                                   struct perf_env *env,
                                   bool warn_lost_event,
                                   struct annotation_options *annotation_options);
-int script_browse(const char *script_opt);
+
+int script_browse(const char *script_opt, struct perf_evsel *evsel);
+
+void run_script(char *cmd);
+int res_sample_browse(struct res_sample *res_samples, int num_res,
+                      struct perf_evsel *evsel, enum rstype rstype);
+void res_sample_init(void);
 #else
 static inline
 int perf_evlist__tui_browse_hists(struct perf_evlist *evlist __maybe_unused,
@@ -478,11 +494,22 @@ static inline int hist_entry__tui_annotate(struct hist_entry *he __maybe_unused,
         return 0;
 }
 
-static inline int script_browse(const char *script_opt __maybe_unused)
+static inline int script_browse(const char *script_opt __maybe_unused,
+                                struct perf_evsel *evsel __maybe_unused)
 {
         return 0;
 }
 
+static inline int res_sample_browse(struct res_sample *res_samples __maybe_unused,
+                                    int num_res __maybe_unused,
+                                    struct perf_evsel *evsel __maybe_unused,
+                                    enum rstype rstype __maybe_unused)
+{
+        return 0;
+}
+
+static inline void res_sample_init(void) {}
+
 #define K_LEFT  -1000
 #define K_RIGHT -2000
 #define K_SWITCH_INPUT_DATA -3000
diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c
index fbeb0c6efaa6..e32628cd20a7 100644
--- a/tools/perf/util/map.c
+++ b/tools/perf/util/map.c
@@ -577,10 +577,25 @@ static void __maps__purge(struct maps *maps)
         }
 }
 
+static void __maps__purge_names(struct maps *maps)
+{
+        struct rb_root *root = &maps->names;
+        struct rb_node *next = rb_first(root);
+
+        while (next) {
+                struct map *pos = rb_entry(next, struct map, rb_node_name);
+
+                next = rb_next(&pos->rb_node_name);
+                rb_erase_init(&pos->rb_node_name, root);
+                map__put(pos);
+        }
+}
+
 static void maps__exit(struct maps *maps)
 {
         down_write(&maps->lock);
         __maps__purge(maps);
+        __maps__purge_names(maps);
         up_write(&maps->lock);
 }
 
@@ -917,6 +932,9 @@ static void __maps__remove(struct maps *maps, struct map *map)
 {
         rb_erase_init(&map->rb_node, &maps->entries);
         map__put(map);
+
+        rb_erase_init(&map->rb_node_name, &maps->names);
+        map__put(map);
 }
 
 void maps__remove(struct maps *maps, struct map *map)
diff --git a/tools/perf/util/ordered-events.c b/tools/perf/util/ordered-events.c
index ea523d3b248f..989fed6f43b5 100644
--- a/tools/perf/util/ordered-events.c
+++ b/tools/perf/util/ordered-events.c
@@ -270,6 +270,8 @@ static int __ordered_events__flush(struct ordered_events *oe, enum oe_flush how,
                 "FINAL",
                 "ROUND",
                 "HALF ",
+                "TOP  ",
+                "TIME ",
         };
         int err;
         bool show_progress = false;
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index 4dcc01b2532c..5ef4939408f2 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -2271,6 +2271,7 @@ static bool is_event_supported(u8 type, unsigned config)
                 perf_evsel__delete(evsel);
         }
 
+        thread_map__put(tmap);
         return ret;
 }
 
@@ -2341,6 +2342,7 @@ void print_sdt_events(const char *subsys_glob, const char *event_glob,
                                 printf("  %-50s [%s]\n", buf, "SDT event");
                                 free(buf);
                         }
+                        free(path);
                 } else
                         printf("  %-50s [%s]\n", nd->s, "SDT event");
                 if (nd2) {
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index a1b8d9649ca7..198e09ff611e 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -160,8 +160,10 @@ static struct map *kernel_get_module_map(const char *module)
         if (module && strchr(module, '/'))
                 return dso__new_map(module);
 
-        if (!module)
-                module = "kernel";
+        if (!module) {
+                pos = machine__kernel_map(host_machine);
+                return map__get(pos);
+        }
 
         for (pos = maps__first(maps); pos; pos = map__next(pos)) {
                 /* short_name is "[module]" */
diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index db643f3c2b95..b17f1c9bc965 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -132,6 +132,7 @@ struct perf_session *perf_session__new(struct perf_data *data,
         ordered_events__init(&session->ordered_events,
                              ordered_events__deliver_event, NULL);
 
+        perf_env__init(&session->header.env);
         if (data) {
                 if (perf_data__open(data))
                         goto out_delete;
@@ -152,6 +153,10 @@ struct perf_session *perf_session__new(struct perf_data *data,
                         }
 
                         perf_evlist__init_trace_event_sample_raw(session->evlist);
+
+                        /* Open the directory data. */
+                        if (data->is_dir && perf_data__open_dir(data))
+                                goto out_delete;
                 }
         } else  {
                 session->machines.host.env = &perf_env;
@@ -1843,10 +1848,17 @@ fetch_mmaped_event(struct perf_session *session,
 #define NUM_MMAPS 128
 #endif
 
+struct reader;
+
+typedef s64 (*reader_cb_t)(struct perf_session *session,
+                           union perf_event *event,
+                           u64 file_offset);
+
 struct reader {
-        int     fd;
-        u64     data_size;
-        u64     data_offset;
+        int              fd;
+        u64              data_size;
+        u64              data_offset;
+        reader_cb_t      process;
 };
 
 static int
@@ -1917,7 +1929,7 @@ more:
         size = event->header.size;
 
         if (size < sizeof(struct perf_event_header) ||
-            (skip = perf_session__process_event(session, event, file_pos)) < 0) {
+            (skip = rd->process(session, event, file_pos)) < 0) {
                 pr_err("%#" PRIx64 " [%#x]: failed to process type: %d\n",
                        file_offset + head, event->header.size,
                        event->header.type);
@@ -1943,12 +1955,20 @@ out:
         return err;
 }
 
+static s64 process_simple(struct perf_session *session,
+                          union perf_event *event,
+                          u64 file_offset)
+{
+        return perf_session__process_event(session, event, file_offset);
+}
+
 static int __perf_session__process_events(struct perf_session *session)
 {
         struct reader rd = {
                 .fd             = perf_data__fd(session->data),
                 .data_size      = session->header.data_size,
                 .data_offset    = session->header.data_offset,
+                .process        = process_simple,
         };
         struct ordered_events *oe = &session->ordered_events;
         struct perf_tool *tool = session->tool;
diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c
index d2299e912e59..5d2518e89fc4 100644
--- a/tools/perf/util/sort.c
+++ b/tools/perf/util/sort.c
@@ -3,6 +3,7 @@
 #include <inttypes.h>
 #include <regex.h>
 #include <linux/mman.h>
+#include <linux/time64.h>
 #include "sort.h"
 #include "hist.h"
 #include "comm.h"
@@ -12,9 +13,11 @@
 #include "evsel.h"
 #include "evlist.h"
 #include "strlist.h"
+#include "strbuf.h"
 #include <traceevent/event-parse.h>
 #include "mem-events.h"
 #include "annotate.h"
+#include "time-utils.h"
 #include <linux/kernel.h>
 
 regex_t         parent_regex;
@@ -654,6 +657,42 @@ struct sort_entry sort_socket = {
         .se_width_idx   = HISTC_SOCKET,
 };
 
+/* --sort time */
+
+static int64_t
+sort__time_cmp(struct hist_entry *left, struct hist_entry *right)
+{
+        return right->time - left->time;
+}
+
+static int hist_entry__time_snprintf(struct hist_entry *he, char *bf,
+                                    size_t size, unsigned int width)
+{
+        unsigned long secs;
+        unsigned long long nsecs;
+        char he_time[32];
+
+        nsecs = he->time;
+        secs = nsecs / NSEC_PER_SEC;
+        nsecs -= secs * NSEC_PER_SEC;
+
+        if (symbol_conf.nanosecs)
+                snprintf(he_time, sizeof he_time, "%5lu.%09llu: ",
+                         secs, nsecs);
+        else
+                timestamp__scnprintf_usec(he->time, he_time,
+                                          sizeof(he_time));
+
+        return repsep_snprintf(bf, size, "%-.*s", width, he_time);
+}
+
+struct sort_entry sort_time = {
+        .se_header      = "Time",
+        .se_cmp         = sort__time_cmp,
+        .se_snprintf    = hist_entry__time_snprintf,
+        .se_width_idx   = HISTC_TIME,
+};
+
 /* --sort trace */
 
 static char *get_trace_output(struct hist_entry *he)
@@ -1634,6 +1673,7 @@ static struct sort_dimension common_sort_dimensions[] = {
         DIM(SORT_DSO_SIZE, "dso_size", sort_dso_size),
         DIM(SORT_CGROUP_ID, "cgroup_id", sort_cgroup_id),
         DIM(SORT_SYM_IPC_NULL, "ipc_null", sort_sym_ipc_null),
+        DIM(SORT_TIME, "time", sort_time),
 };
 
 #undef DIM
@@ -3068,3 +3108,54 @@ void reset_output_field(void)
         reset_dimensions();
         perf_hpp__reset_output_field(&perf_hpp_list);
 }
+
+#define INDENT (3*8 + 1)
+
+static void add_key(struct strbuf *sb, const char *str, int *llen)
+{
+        if (*llen >= 75) {
+                strbuf_addstr(sb, "\n\t\t\t ");
+                *llen = INDENT;
+        }
+        strbuf_addf(sb, " %s", str);
+        *llen += strlen(str) + 1;
+}
+
+static void add_sort_string(struct strbuf *sb, struct sort_dimension *s, int n,
+                            int *llen)
+{
+        int i;
+
+        for (i = 0; i < n; i++)
+                add_key(sb, s[i].name, llen);
+}
+
+static void add_hpp_sort_string(struct strbuf *sb, struct hpp_dimension *s, int n,
+                                int *llen)
+{
+        int i;
+
+        for (i = 0; i < n; i++)
+                add_key(sb, s[i].name, llen);
+}
+
+const char *sort_help(const char *prefix)
+{
+        struct strbuf sb;
+        char *s;
+        int len = strlen(prefix) + INDENT;
+
+        strbuf_init(&sb, 300);
+        strbuf_addstr(&sb, prefix);
+        add_hpp_sort_string(&sb, hpp_sort_dimensions,
+                            ARRAY_SIZE(hpp_sort_dimensions), &len);
+        add_sort_string(&sb, common_sort_dimensions,
+                            ARRAY_SIZE(common_sort_dimensions), &len);
+        add_sort_string(&sb, bstack_sort_dimensions,
+                            ARRAY_SIZE(bstack_sort_dimensions), &len);
+        add_sort_string(&sb, memory_sort_dimensions,
+                            ARRAY_SIZE(memory_sort_dimensions), &len);
+        s = strbuf_detach(&sb, NULL);
+        strbuf_release(&sb);
+        return s;
+}
diff --git a/tools/perf/util/sort.h b/tools/perf/util/sort.h
index 2fbee0b1011c..ce376a73f964 100644
--- a/tools/perf/util/sort.h
+++ b/tools/perf/util/sort.h
@@ -47,6 +47,12 @@ extern struct sort_entry sort_srcline;
 extern enum sort_type sort__first_dimension;
 extern const char default_mem_sort_order[];
 
+struct res_sample {
+        u64 time;
+        int cpu;
+        int tid;
+};
+
 struct he_stat {
         u64                     period;
         u64                     period_sys;
@@ -135,10 +141,13 @@ struct hist_entry {
         char                    *srcfile;
         struct symbol           *parent;
         struct branch_info      *branch_info;
+        long                    time;
         struct hists            *hists;
         struct mem_info         *mem_info;
         void                    *raw_data;
         u32                     raw_size;
+        int                     num_res;
+        struct res_sample       *res_samples;
         void                    *trace_output;
         struct perf_hpp_list    *hpp_list;
         struct hist_entry       *parent_he;
@@ -231,6 +240,7 @@ enum sort_type {
         SORT_DSO_SIZE,
         SORT_CGROUP_ID,
         SORT_SYM_IPC_NULL,
+        SORT_TIME,
 
         /* branch stack specific sort keys */
         __SORT_BRANCH_STACK,
@@ -286,6 +296,8 @@ void reset_output_field(void);
 void sort__setup_elide(FILE *fp);
 void perf_hpp__set_elide(int idx, bool elide);
 
+const char *sort_help(const char *prefix);
+
 int report_parse_ignore_callees_opt(const struct option *opt, const char *arg, int unset);
 
 bool is_strict_order(const char *order);
diff --git a/tools/perf/util/stat.c b/tools/perf/util/stat.c
index 4d40515307b8..2856cc9d5a31 100644
--- a/tools/perf/util/stat.c
+++ b/tools/perf/util/stat.c
@@ -291,10 +291,8 @@ process_counter_values(struct perf_stat_config *config, struct perf_evsel *evsel
                 break;
         case AGGR_GLOBAL:
                 aggr->val += count->val;
-                if (config->scale) {
-                        aggr->ena += count->ena;
-                        aggr->run += count->run;
-                }
+                aggr->ena += count->ena;
+                aggr->run += count->run;
         case AGGR_UNSET:
         default:
                 break;
@@ -442,10 +440,8 @@ int create_perf_stat_counter(struct perf_evsel *evsel,
         struct perf_event_attr *attr = &evsel->attr;
         struct perf_evsel *leader = evsel->leader;
 
-        if (config->scale) {
-                attr->read_format = PERF_FORMAT_TOTAL_TIME_ENABLED |
-                                    PERF_FORMAT_TOTAL_TIME_RUNNING;
-        }
+        attr->read_format = PERF_FORMAT_TOTAL_TIME_ENABLED |
+                            PERF_FORMAT_TOTAL_TIME_RUNNING;
 
         /*
          * The event is part of non trivial group, let's enable
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 758bf5f74e6e..5cbad55cd99d 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -6,6 +6,7 @@
 #include <string.h>
 #include <linux/kernel.h>
 #include <linux/mman.h>
+#include <linux/time64.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/param.h>
@@ -39,15 +40,18 @@ int vmlinux_path__nr_entries;
 char **vmlinux_path;
 
 struct symbol_conf symbol_conf = {
+        .nanosecs               = false,
         .use_modules            = true,
         .try_vmlinux_path       = true,
         .demangle               = true,
         .demangle_kernel        = false,
         .cumulate_callchain     = true,
+        .time_quantum           = 100 * NSEC_PER_MSEC, /* 100ms */
         .show_hist_headers      = true,
         .symfs                  = "",
         .event_group            = true,
         .inline_name            = true,
+        .res_sample             = 0,
 };
 
 static enum dso_binary_type binary_type_symtab[] = {
@@ -1451,6 +1455,7 @@ static bool dso__is_compatible_symtab_type(struct dso *dso, bool kmod,
         case DSO_BINARY_TYPE__BUILD_ID_CACHE_DEBUGINFO:
                 return true;
 
+        case DSO_BINARY_TYPE__BPF_PROG_INFO:
         case DSO_BINARY_TYPE__NOT_FOUND:
         default:
                 return false;
diff --git a/tools/perf/util/symbol_conf.h b/tools/perf/util/symbol_conf.h
index fffea68c1203..6c55fa6fccec 100644
--- a/tools/perf/util/symbol_conf.h
+++ b/tools/perf/util/symbol_conf.h
@@ -8,6 +8,7 @@ struct strlist;
 struct intlist;
 
 struct symbol_conf {
+        bool            nanosecs;
         unsigned short  priv_size;
         bool            try_vmlinux_path,
                         init_annotation,
@@ -55,6 +56,7 @@ struct symbol_conf {
                         *sym_list_str,
                         *col_width_list_str,
                         *bt_stop_list_str;
+        unsigned long   time_quantum;
        struct strlist   *dso_list,
                         *comm_list,
                         *sym_list,
@@ -66,6 +68,7 @@ struct symbol_conf {
         struct intlist  *pid_list,
                         *tid_list;
         const char      *symfs;
+        int             res_sample;
 };
 
 extern struct symbol_conf symbol_conf;
diff --git a/tools/perf/util/time-utils.c b/tools/perf/util/time-utils.c
index 0f53baec660e..20663a460df3 100644
--- a/tools/perf/util/time-utils.c
+++ b/tools/perf/util/time-utils.c
@@ -453,6 +453,14 @@ int timestamp__scnprintf_usec(u64 timestamp, char *buf, size_t sz)
         return scnprintf(buf, sz, "%"PRIu64".%06"PRIu64, sec, usec);
 }
 
+int timestamp__scnprintf_nsec(u64 timestamp, char *buf, size_t sz)
+{
+        u64 sec  = timestamp / NSEC_PER_SEC,
+            nsec = timestamp % NSEC_PER_SEC;
+
+        return scnprintf(buf, sz, "%" PRIu64 ".%09" PRIu64, sec, nsec);
+}
+
 int fetch_current_timestamp(char *buf, size_t sz)
 {
         struct timeval tv;
diff --git a/tools/perf/util/time-utils.h b/tools/perf/util/time-utils.h
index b923de44e36f..72a42ea1d513 100644
--- a/tools/perf/util/time-utils.h
+++ b/tools/perf/util/time-utils.h
@@ -30,6 +30,7 @@ int perf_time__parse_for_ranges(const char *str, struct perf_session *session,
                                 int *range_size, int *range_num);
 
 int timestamp__scnprintf_usec(u64 timestamp, char *buf, size_t sz);
+int timestamp__scnprintf_nsec(u64 timestamp, char *buf, size_t sz);
 
 int fetch_current_timestamp(char *buf, size_t sz);
 
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index 9327c0ddc3a5..c3fad065c89c 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -5077,6 +5077,9 @@ int fork_it(char **argv)
                 signal(SIGQUIT, SIG_IGN);
                 if (waitpid(child_pid, &status, 0) == -1)
                         err(status, "waitpid");
+
+                if (WIFEXITED(status))
+                        status = WEXITSTATUS(status);
         }
         /*
          * n.b. fork_it() does not check for errors from for_all_cpus()
diff --git a/tools/testing/nvdimm/Kbuild b/tools/testing/nvdimm/Kbuild
index 10ddf223055b..e1286d2cdfbf 100644
--- a/tools/testing/nvdimm/Kbuild
+++ b/tools/testing/nvdimm/Kbuild
@@ -35,6 +35,8 @@ obj-$(CONFIG_DAX) += dax.o
 endif
 obj-$(CONFIG_DEV_DAX) += device_dax.o
 obj-$(CONFIG_DEV_DAX_PMEM) += dax_pmem.o
+obj-$(CONFIG_DEV_DAX_PMEM) += dax_pmem_core.o
+obj-$(CONFIG_DEV_DAX_PMEM_COMPAT) += dax_pmem_compat.o
 
 nfit-y := $(ACPI_SRC)/core.o
 nfit-y += $(ACPI_SRC)/intel.o
@@ -57,6 +59,7 @@ nd_e820-y := $(NVDIMM_SRC)/e820.o
 nd_e820-y += config_check.o
 
 dax-y := $(DAX_SRC)/super.o
+dax-y += $(DAX_SRC)/bus.o
 dax-y += config_check.o
 
 device_dax-y := $(DAX_SRC)/device.o
@@ -64,7 +67,9 @@ device_dax-y += dax-dev.o
 device_dax-y += device_dax_test.o
 device_dax-y += config_check.o
 
-dax_pmem-y := $(DAX_SRC)/pmem.o
+dax_pmem-y := $(DAX_SRC)/pmem/pmem.o
+dax_pmem_core-y := $(DAX_SRC)/pmem/core.o
+dax_pmem_compat-y := $(DAX_SRC)/pmem/compat.o
 dax_pmem-y += config_check.o
 
 libnvdimm-y := $(NVDIMM_SRC)/core.o
diff --git a/tools/testing/nvdimm/dax-dev.c b/tools/testing/nvdimm/dax-dev.c
index 36ee3d8797c3..f36e708265b8 100644
--- a/tools/testing/nvdimm/dax-dev.c
+++ b/tools/testing/nvdimm/dax-dev.c
@@ -17,20 +17,11 @@
 phys_addr_t dax_pgoff_to_phys(struct dev_dax *dev_dax, pgoff_t pgoff,
                 unsigned long size)
 {
-        struct resource *res;
+        struct resource *res = &dev_dax->region->res;
         phys_addr_t addr;
-        int i;
 
-        for (i = 0; i < dev_dax->num_resources; i++) {
-                res = &dev_dax->res[i];
-                addr = pgoff * PAGE_SIZE + res->start;
-                if (addr >= res->start && addr <= res->end)
-                        break;
-                pgoff -= PHYS_PFN(resource_size(res));
-        }
-
-        if (i < dev_dax->num_resources) {
-                res = &dev_dax->res[i];
+        addr = pgoff * PAGE_SIZE + res->start;
+        if (addr >= res->start && addr <= res->end) {
                 if (addr + size - 1 <= res->end) {
                         if (get_nfit_res(addr)) {
                                 struct page *page;
@@ -44,6 +35,5 @@ phys_addr_t dax_pgoff_to_phys(struct dev_dax *dev_dax, pgoff_t pgoff,
                                 return addr;
                 }
         }
-
         return -1;
 }
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index fb5758ac469e..971fc8428117 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -32,6 +32,7 @@ TARGETS += net
 TARGETS += netfilter
 TARGETS += networking/timestamping
 TARGETS += nsfs
+TARGETS += pidfd
 TARGETS += powerpc
 TARGETS += proc
 TARGETS += pstore
diff --git a/tools/testing/selftests/kvm/.gitignore b/tools/testing/selftests/kvm/.gitignore
index 6210ba41c29e..2689d1ea6d7a 100644
--- a/tools/testing/selftests/kvm/.gitignore
+++ b/tools/testing/selftests/kvm/.gitignore
@@ -3,6 +3,7 @@
 /x86_64/platform_info_test
 /x86_64/set_sregs_test
 /x86_64/sync_regs_test
+/x86_64/vmx_close_while_nested_test
 /x86_64/vmx_tsc_adjust_test
 /x86_64/state_test
 /dirty_log_test
diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile
index f9a0e9938480..3c1f4bdf9000 100644
--- a/tools/testing/selftests/kvm/Makefile
+++ b/tools/testing/selftests/kvm/Makefile
@@ -16,6 +16,7 @@ TEST_GEN_PROGS_x86_64 += x86_64/cr4_cpuid_sync_test
 TEST_GEN_PROGS_x86_64 += x86_64/state_test
 TEST_GEN_PROGS_x86_64 += x86_64/evmcs_test
 TEST_GEN_PROGS_x86_64 += x86_64/hyperv_cpuid
+TEST_GEN_PROGS_x86_64 += x86_64/vmx_close_while_nested_test
 TEST_GEN_PROGS_x86_64 += dirty_log_test
 TEST_GEN_PROGS_x86_64 += clear_dirty_log_test
 
diff --git a/tools/testing/selftests/kvm/x86_64/vmx_close_while_nested_test.c b/tools/testing/selftests/kvm/x86_64/vmx_close_while_nested_test.c
new file mode 100644
index 000000000000..6edec6fd790b
--- /dev/null
+++ b/tools/testing/selftests/kvm/x86_64/vmx_close_while_nested_test.c
@@ -0,0 +1,95 @@
+/*
+ * vmx_close_while_nested
+ *
+ * Copyright (C) 2019, Red Hat, Inc.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ *
+ * Verify that nothing bad happens if a KVM user exits with open
+ * file descriptors while executing a nested guest.
+ */
+
+#include "test_util.h"
+#include "kvm_util.h"
+#include "processor.h"
+#include "vmx.h"
+
+#include <string.h>
+#include <sys/ioctl.h>
+
+#include "kselftest.h"
+
+#define VCPU_ID         5
+
+enum {
+        PORT_L0_EXIT = 0x2000,
+};
+
+/* The virtual machine object. */
+static struct kvm_vm *vm;
+
+static void l2_guest_code(void)
+{
+        /* Exit to L0 */
+        asm volatile("inb %%dx, %%al"
+                     : : [port] "d" (PORT_L0_EXIT) : "rax");
+}
+
+static void l1_guest_code(struct vmx_pages *vmx_pages)
+{
+#define L2_GUEST_STACK_SIZE 64
+        unsigned long l2_guest_stack[L2_GUEST_STACK_SIZE];
+        uint32_t control;
+        uintptr_t save_cr3;
+
+        GUEST_ASSERT(prepare_for_vmx_operation(vmx_pages));
+        GUEST_ASSERT(load_vmcs(vmx_pages));
+
+        /* Prepare the VMCS for L2 execution. */
+        prepare_vmcs(vmx_pages, l2_guest_code,
+                     &l2_guest_stack[L2_GUEST_STACK_SIZE]);
+
+        GUEST_ASSERT(!vmlaunch());
+        GUEST_ASSERT(0);
+}
+
+int main(int argc, char *argv[])
+{
+        struct vmx_pages *vmx_pages;
+        vm_vaddr_t vmx_pages_gva;
+        struct kvm_cpuid_entry2 *entry = kvm_get_supported_cpuid_entry(1);
+
+        if (!(entry->ecx & CPUID_VMX)) {
+                fprintf(stderr, "nested VMX not enabled, skipping test\n");
+                exit(KSFT_SKIP);
+        }
+
+        vm = vm_create_default(VCPU_ID, 0, (void *) l1_guest_code);
+        vcpu_set_cpuid(vm, VCPU_ID, kvm_get_supported_cpuid());
+
+        /* Allocate VMX pages and shared descriptors (vmx_pages). */
+        vmx_pages = vcpu_alloc_vmx(vm, &vmx_pages_gva);
+        vcpu_args_set(vm, VCPU_ID, 1, vmx_pages_gva);
+
+        for (;;) {
+                volatile struct kvm_run *run = vcpu_state(vm, VCPU_ID);
+                struct ucall uc;
+
+                vcpu_run(vm, VCPU_ID);
+                TEST_ASSERT(run->exit_reason == KVM_EXIT_IO,
+                            "Got exit_reason other than KVM_EXIT_IO: %u (%s)\n",
+                            run->exit_reason,
+                            exit_reason_str(run->exit_reason));
+
+                if (run->io.port == PORT_L0_EXIT)
+                        break;
+
+                switch (get_ucall(vm, VCPU_ID, &uc)) {
+                case UCALL_ABORT:
+                        TEST_ASSERT(false, "%s", (const char *)uc.args[0]);
+                        /* NOT REACHED */
+                default:
+                        TEST_ASSERT(false, "Unknown ucall 0x%x.", uc.cmd);
+                }
+        }
+}
diff --git a/tools/testing/selftests/pidfd/Makefile b/tools/testing/selftests/pidfd/Makefile
new file mode 100644
index 000000000000..deaf8073bc06
--- /dev/null
+++ b/tools/testing/selftests/pidfd/Makefile
@@ -0,0 +1,6 @@
+CFLAGS += -g -I../../../../usr/include/
+
+TEST_GEN_PROGS := pidfd_test
+
+include ../lib.mk
+
diff --git a/tools/testing/selftests/pidfd/pidfd_test.c b/tools/testing/selftests/pidfd/pidfd_test.c
new file mode 100644
index 000000000000..d59378a93782
--- /dev/null
+++ b/tools/testing/selftests/pidfd/pidfd_test.c
@@ -0,0 +1,381 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#define _GNU_SOURCE
+#include <errno.h>
+#include <fcntl.h>
+#include <linux/types.h>
+#include <sched.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <syscall.h>
+#include <sys/mount.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+#include "../kselftest.h"
+
+static inline int sys_pidfd_send_signal(int pidfd, int sig, siginfo_t *info,
+                                        unsigned int flags)
+{
+        return syscall(__NR_pidfd_send_signal, pidfd, sig, info, flags);
+}
+
+static int signal_received;
+
+static void set_signal_received_on_sigusr1(int sig)
+{
+        if (sig == SIGUSR1)
+                signal_received = 1;
+}
+
+/*
+ * Straightforward test to see whether pidfd_send_signal() works is to send
+ * a signal to ourself.
+ */
+static int test_pidfd_send_signal_simple_success(void)
+{
+        int pidfd, ret;
+        const char *test_name = "pidfd_send_signal send SIGUSR1";
+
+        pidfd = open("/proc/self", O_DIRECTORY | O_CLOEXEC);
+        if (pidfd < 0)
+                ksft_exit_fail_msg(
+                        "%s test: Failed to open process file descriptor\n",
+                        test_name);
+
+        signal(SIGUSR1, set_signal_received_on_sigusr1);
+
+        ret = sys_pidfd_send_signal(pidfd, SIGUSR1, NULL, 0);
+        close(pidfd);
+        if (ret < 0)
+                ksft_exit_fail_msg("%s test: Failed to send signal\n",
+                                   test_name);
+
+        if (signal_received != 1)
+                ksft_exit_fail_msg("%s test: Failed to receive signal\n",
+                                   test_name);
+
+        signal_received = 0;
+        ksft_test_result_pass("%s test: Sent signal\n", test_name);
+        return 0;
+}
+
+static int wait_for_pid(pid_t pid)
+{
+        int status, ret;
+
+again:
+        ret = waitpid(pid, &status, 0);
+        if (ret == -1) {
+                if (errno == EINTR)
+                        goto again;
+
+                return -1;
+        }
+
+        if (ret != pid)
+                goto again;
+
+        if (!WIFEXITED(status))
+                return -1;
+
+        return WEXITSTATUS(status);
+}
+
+static int test_pidfd_send_signal_exited_fail(void)
+{
+        int pidfd, ret, saved_errno;
+        char buf[256];
+        pid_t pid;
+        const char *test_name = "pidfd_send_signal signal exited process";
+
+        pid = fork();
+        if (pid < 0)
+                ksft_exit_fail_msg("%s test: Failed to create new process\n",
+                                   test_name);
+
+        if (pid == 0)
+                _exit(EXIT_SUCCESS);
+
+        snprintf(buf, sizeof(buf), "/proc/%d", pid);
+
+        pidfd = open(buf, O_DIRECTORY | O_CLOEXEC);
+
+        (void)wait_for_pid(pid);
+
+        if (pidfd < 0)
+                ksft_exit_fail_msg(
+                        "%s test: Failed to open process file descriptor\n",
+                        test_name);
+
+        ret = sys_pidfd_send_signal(pidfd, 0, NULL, 0);
+        saved_errno = errno;
+        close(pidfd);
+        if (ret == 0)
+                ksft_exit_fail_msg(
+                        "%s test: Managed to send signal to process even though it should have failed\n",
+                        test_name);
+
+        if (saved_errno != ESRCH)
+                ksft_exit_fail_msg(
+                        "%s test: Expected to receive ESRCH as errno value but received %d instead\n",
+                        test_name, saved_errno);
+
+        ksft_test_result_pass("%s test: Failed to send signal as expected\n",
+                              test_name);
+        return 0;
+}
+
+/*
+ * The kernel reserves 300 pids via RESERVED_PIDS in kernel/pid.c
+ * That means, when it wraps around any pid < 300 will be skipped.
+ * So we need to use a pid > 300 in order to test recycling.
+ */
+#define PID_RECYCLE 1000
+
+/*
+ * Maximum number of cycles we allow. This is equivalent to PID_MAX_DEFAULT.
+ * If users set a higher limit or we have cycled PIDFD_MAX_DEFAULT number of
+ * times then we skip the test to not go into an infinite loop or block for a
+ * long time.
+ */
+#define PIDFD_MAX_DEFAULT 0x8000
+
+/*
+ * Define a few custom error codes for the child process to clearly indicate
+ * what is happening. This way we can tell the difference between a system
+ * error, a test error, etc.
+ */
+#define PIDFD_PASS 0
+#define PIDFD_FAIL 1
+#define PIDFD_ERROR 2
+#define PIDFD_SKIP 3
+#define PIDFD_XFAIL 4
+
+static int test_pidfd_send_signal_recycled_pid_fail(void)
+{
+        int i, ret;
+        pid_t pid1;
+        const char *test_name = "pidfd_send_signal signal recycled pid";
+
+        ret = unshare(CLONE_NEWPID);
+        if (ret < 0)
+                ksft_exit_fail_msg("%s test: Failed to unshare pid namespace\n",
+                                   test_name);
+
+        ret = unshare(CLONE_NEWNS);
+        if (ret < 0)
+                ksft_exit_fail_msg(
+                        "%s test: Failed to unshare mount namespace\n",
+                        test_name);
+
+        ret = mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, 0);
+        if (ret < 0)
+                ksft_exit_fail_msg("%s test: Failed to remount / private\n",
+                                   test_name);
+
+        /* pid 1 in new pid namespace */
+        pid1 = fork();
+        if (pid1 < 0)
+                ksft_exit_fail_msg("%s test: Failed to create new process\n",
+                                   test_name);
+
+        if (pid1 == 0) {
+                char buf[256];
+                pid_t pid2;
+                int pidfd = -1;
+
+                (void)umount2("/proc", MNT_DETACH);
+                ret = mount("proc", "/proc", "proc", 0, NULL);
+                if (ret < 0)
+                        _exit(PIDFD_ERROR);
+
+                /* grab pid PID_RECYCLE */
+                for (i = 0; i <= PIDFD_MAX_DEFAULT; i++) {
+                        pid2 = fork();
+                        if (pid2 < 0)
+                                _exit(PIDFD_ERROR);
+
+                        if (pid2 == 0)
+                                _exit(PIDFD_PASS);
+
+                        if (pid2 == PID_RECYCLE) {
+                                snprintf(buf, sizeof(buf), "/proc/%d", pid2);
+                                ksft_print_msg("pid to recycle is %d\n", pid2);
+                                pidfd = open(buf, O_DIRECTORY | O_CLOEXEC);
+                        }
+
+                        if (wait_for_pid(pid2))
+                                _exit(PIDFD_ERROR);
+
+                        if (pid2 >= PID_RECYCLE)
+                                break;
+                }
+
+                /*
+                 * We want to be as predictable as we can so if we haven't been
+                 * able to grab pid PID_RECYCLE skip the test.
+                 */
+                if (pid2 != PID_RECYCLE) {
+                        /* skip test */
+                        close(pidfd);
+                        _exit(PIDFD_SKIP);
+                }
+
+                if (pidfd < 0)
+                        _exit(PIDFD_ERROR);
+
+                for (i = 0; i <= PIDFD_MAX_DEFAULT; i++) {
+                        char c;
+                        int pipe_fds[2];
+                        pid_t recycled_pid;
+                        int child_ret = PIDFD_PASS;
+
+                        ret = pipe2(pipe_fds, O_CLOEXEC);
+                        if (ret < 0)
+                                _exit(PIDFD_ERROR);
+
+                        recycled_pid = fork();
+                        if (recycled_pid < 0)
+                                _exit(PIDFD_ERROR);
+
+                        if (recycled_pid == 0) {
+                                close(pipe_fds[1]);
+                                (void)read(pipe_fds[0], &c, 1);
+                                close(pipe_fds[0]);
+
+                                _exit(PIDFD_PASS);
+                        }
+
+                        /*
+                         * Stop the child so we can inspect whether we have
+                         * recycled pid PID_RECYCLE.
+                         */
+                        close(pipe_fds[0]);
+                        ret = kill(recycled_pid, SIGSTOP);
+                        close(pipe_fds[1]);
+                        if (ret) {
+                                (void)wait_for_pid(recycled_pid);
+                                _exit(PIDFD_ERROR);
+                        }
+
+                        /*
+                         * We have recycled the pid. Try to signal it. This
+                         * needs to fail since this is a different process than
+                         * the one the pidfd refers to.
+                         */
+                        if (recycled_pid == PID_RECYCLE) {
+                                ret = sys_pidfd_send_signal(pidfd, SIGCONT,
+                                                            NULL, 0);
+                                if (ret && errno == ESRCH)
+                                        child_ret = PIDFD_XFAIL;
+                                else
+                                        child_ret = PIDFD_FAIL;
+                        }
+
+                        /* let the process move on */
+                        ret = kill(recycled_pid, SIGCONT);
+                        if (ret)
+                                (void)kill(recycled_pid, SIGKILL);
+
+                        if (wait_for_pid(recycled_pid))
+                                _exit(PIDFD_ERROR);
+
+                        switch (child_ret) {
+                        case PIDFD_FAIL:
+                                /* fallthrough */
+                        case PIDFD_XFAIL:
+                                _exit(child_ret);
+                        case PIDFD_PASS:
+                                break;
+                        default:
+                                /* not reached */
+                                _exit(PIDFD_ERROR);
+                        }
+
+                        /*
+                         * If the user set a custom pid_max limit we could be
+                         * in the millions.
+                         * Skip the test in this case.
+                         */
+                        if (recycled_pid > PIDFD_MAX_DEFAULT)
+                                _exit(PIDFD_SKIP);
+                }
+
+                /* failed to recycle pid */
+                _exit(PIDFD_SKIP);
+        }
+
+        ret = wait_for_pid(pid1);
+        switch (ret) {
+        case PIDFD_FAIL:
+                ksft_exit_fail_msg(
+                        "%s test: Managed to signal recycled pid %d\n",
+                        test_name, PID_RECYCLE);
+        case PIDFD_PASS:
+                ksft_exit_fail_msg("%s test: Failed to recycle pid %d\n",
+                                   test_name, PID_RECYCLE);
+        case PIDFD_SKIP:
+                ksft_print_msg("%s test: Skipping test\n", test_name);
+                ret = 0;
+                break;
+        case PIDFD_XFAIL:
+                ksft_test_result_pass(
+                        "%s test: Failed to signal recycled pid as expected\n",
+                        test_name);
+                ret = 0;
+                break;
+        default /* PIDFD_ERROR */:
+                ksft_exit_fail_msg("%s test: Error while running tests\n",
+                                   test_name);
+        }
+
+        return ret;
+}
+
+static int test_pidfd_send_signal_syscall_support(void)
+{
+        int pidfd, ret;
+        const char *test_name = "pidfd_send_signal check for support";
+
+        pidfd = open("/proc/self", O_DIRECTORY | O_CLOEXEC);
+        if (pidfd < 0)
+                ksft_exit_fail_msg(
+                        "%s test: Failed to open process file descriptor\n",
+                        test_name);
+
+        ret = sys_pidfd_send_signal(pidfd, 0, NULL, 0);
+        if (ret < 0) {
+                /*
+                 * pidfd_send_signal() will currently return ENOSYS when
+                 * CONFIG_PROC_FS is not set.
+                 */
+                if (errno == ENOSYS)
+                        ksft_exit_skip(
+                                "%s test: pidfd_send_signal() syscall not supported (Ensure that CONFIG_PROC_FS=y is set)\n",
+                                test_name);
+
+                ksft_exit_fail_msg("%s test: Failed to send signal\n",
+                                   test_name);
+        }
+
+        close(pidfd);
+        ksft_test_result_pass(
+                "%s test: pidfd_send_signal() syscall is supported. Tests can be executed\n",
+                test_name);
+        return 0;
+}
+
+int main(int argc, char **argv)
+{
+        ksft_print_header();
+
+        test_pidfd_send_signal_syscall_support();
+        test_pidfd_send_signal_simple_success();
+        test_pidfd_send_signal_exited_fail();
+        test_pidfd_send_signal_recycled_pid_fail();
+
+        return ksft_exit_pass();
+}
diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c
index b07ac4614e1c..3417f2dbc366 100644
--- a/virt/kvm/arm/arch_timer.c
+++ b/virt/kvm/arm/arch_timer.c
@@ -25,6 +25,7 @@
 
 #include <clocksource/arm_arch_timer.h>
 #include <asm/arch_timer.h>
+#include <asm/kvm_emulate.h>
 #include <asm/kvm_hyp.h>
 
 #include <kvm/arm_vgic.h>
@@ -34,7 +35,9 @@
 
 static struct timecounter *timecounter;
 static unsigned int host_vtimer_irq;
+static unsigned int host_ptimer_irq;
 static u32 host_vtimer_irq_flags;
+static u32 host_ptimer_irq_flags;
 
 static DEFINE_STATIC_KEY_FALSE(has_gic_active_state);
 
@@ -52,12 +55,34 @@ static bool kvm_timer_irq_can_fire(struct arch_timer_context *timer_ctx);
 static void kvm_timer_update_irq(struct kvm_vcpu *vcpu, bool new_level,
                                  struct arch_timer_context *timer_ctx);
 static bool kvm_timer_should_fire(struct arch_timer_context *timer_ctx);
+static void kvm_arm_timer_write(struct kvm_vcpu *vcpu,
+                                struct arch_timer_context *timer,
+                                enum kvm_arch_timer_regs treg,
+                                u64 val);
+static u64 kvm_arm_timer_read(struct kvm_vcpu *vcpu,
+                              struct arch_timer_context *timer,
+                              enum kvm_arch_timer_regs treg);
 
 u64 kvm_phys_timer_read(void)
 {
         return timecounter->cc->read(timecounter->cc);
 }
 
+static void get_timer_map(struct kvm_vcpu *vcpu, struct timer_map *map)
+{
+        if (has_vhe()) {
+                map->direct_vtimer = vcpu_vtimer(vcpu);
+                map->direct_ptimer = vcpu_ptimer(vcpu);
+                map->emul_ptimer = NULL;
+        } else {
+                map->direct_vtimer = vcpu_vtimer(vcpu);
+                map->direct_ptimer = NULL;
+                map->emul_ptimer = vcpu_ptimer(vcpu);
+        }
+
+        trace_kvm_get_timer_map(vcpu->vcpu_id, map);
+}
+
 static inline bool userspace_irqchip(struct kvm *kvm)
 {
         return static_branch_unlikely(&userspace_irqchip_in_use) &&
@@ -78,20 +103,27 @@ static void soft_timer_cancel(struct hrtimer *hrt)
 static irqreturn_t kvm_arch_timer_handler(int irq, void *dev_id)
 {
         struct kvm_vcpu *vcpu = *(struct kvm_vcpu **)dev_id;
-        struct arch_timer_context *vtimer;
+        struct arch_timer_context *ctx;
+        struct timer_map map;
 
         /*
          * We may see a timer interrupt after vcpu_put() has been called which
          * sets the CPU's vcpu pointer to NULL, because even though the timer
-         * has been disabled in vtimer_save_state(), the hardware interrupt
+         * has been disabled in timer_save_state(), the hardware interrupt
          * signal may not have been retired from the interrupt controller yet.
          */
         if (!vcpu)
                 return IRQ_HANDLED;
 
-        vtimer = vcpu_vtimer(vcpu);
-        if (kvm_timer_should_fire(vtimer))
-                kvm_timer_update_irq(vcpu, true, vtimer);
+        get_timer_map(vcpu, &map);
+
+        if (irq == host_vtimer_irq)
+                ctx = map.direct_vtimer;
+        else
+                ctx = map.direct_ptimer;
+
+        if (kvm_timer_should_fire(ctx))
+                kvm_timer_update_irq(vcpu, true, ctx);
 
         if (userspace_irqchip(vcpu->kvm) &&
             !static_branch_unlikely(&has_gic_active_state))
@@ -122,7 +154,9 @@ static u64 kvm_timer_compute_delta(struct arch_timer_context *timer_ctx)
 
 static bool kvm_timer_irq_can_fire(struct arch_timer_context *timer_ctx)
 {
-        return !(timer_ctx->cnt_ctl & ARCH_TIMER_CTRL_IT_MASK) &&
+        WARN_ON(timer_ctx && timer_ctx->loaded);
+        return timer_ctx &&
+               !(timer_ctx->cnt_ctl & ARCH_TIMER_CTRL_IT_MASK) &&
                 (timer_ctx->cnt_ctl & ARCH_TIMER_CTRL_ENABLE);
 }
 
@@ -132,21 +166,22 @@ static bool kvm_timer_irq_can_fire(struct arch_timer_context *timer_ctx)
  */
 static u64 kvm_timer_earliest_exp(struct kvm_vcpu *vcpu)
 {
-        u64 min_virt = ULLONG_MAX, min_phys = ULLONG_MAX;
-        struct arch_timer_context *vtimer = vcpu_vtimer(vcpu);
-        struct arch_timer_context *ptimer = vcpu_ptimer(vcpu);
+        u64 min_delta = ULLONG_MAX;
+        int i;
 
-        if (kvm_timer_irq_can_fire(vtimer))
-                min_virt = kvm_timer_compute_delta(vtimer);
+        for (i = 0; i < NR_KVM_TIMERS; i++) {
+                struct arch_timer_context *ctx = &vcpu->arch.timer_cpu.timers[i];
 
-        if (kvm_timer_irq_can_fire(ptimer))
-                min_phys = kvm_timer_compute_delta(ptimer);
+                WARN(ctx->loaded, "timer %d loaded\n", i);
+                if (kvm_timer_irq_can_fire(ctx))
+                        min_delta = min(min_delta, kvm_timer_compute_delta(ctx));
+        }
 
         /* If none of timers can fire, then return 0 */
-        if ((min_virt == ULLONG_MAX) && (min_phys == ULLONG_MAX))
+        if (min_delta == ULLONG_MAX)
                 return 0;
 
-        return min(min_virt, min_phys);
+        return min_delta;
 }
 
 static enum hrtimer_restart kvm_bg_timer_expire(struct hrtimer *hrt)
@@ -173,41 +208,58 @@ static enum hrtimer_restart kvm_bg_timer_expire(struct hrtimer *hrt)
         return HRTIMER_NORESTART;
 }
 
-static enum hrtimer_restart kvm_phys_timer_expire(struct hrtimer *hrt)
+static enum hrtimer_restart kvm_hrtimer_expire(struct hrtimer *hrt)
 {
-        struct arch_timer_context *ptimer;
-        struct arch_timer_cpu *timer;
+        struct arch_timer_context *ctx;
         struct kvm_vcpu *vcpu;
         u64 ns;
 
-        timer = container_of(hrt, struct arch_timer_cpu, phys_timer);
-        vcpu = container_of(timer, struct kvm_vcpu, arch.timer_cpu);
-        ptimer = vcpu_ptimer(vcpu);
+        ctx = container_of(hrt, struct arch_timer_context, hrtimer);
+        vcpu = ctx->vcpu;
+
+        trace_kvm_timer_hrtimer_expire(ctx);
 
         /*
          * Check that the timer has really expired from the guest's
          * PoV (NTP on the host may have forced it to expire
          * early). If not ready, schedule for a later time.
          */
-        ns = kvm_timer_compute_delta(ptimer);
+        ns = kvm_timer_compute_delta(ctx);
         if (unlikely(ns)) {
                 hrtimer_forward_now(hrt, ns_to_ktime(ns));
                 return HRTIMER_RESTART;
         }
 
-        kvm_timer_update_irq(vcpu, true, ptimer);
+        kvm_timer_update_irq(vcpu, true, ctx);
         return HRTIMER_NORESTART;
 }
 
 static bool kvm_timer_should_fire(struct arch_timer_context *timer_ctx)
 {
+        enum kvm_arch_timers index;
         u64 cval, now;
 
+        if (!timer_ctx)
+                return false;
+
+        index = arch_timer_ctx_index(timer_ctx);
+
         if (timer_ctx->loaded) {
-                u32 cnt_ctl;
+                u32 cnt_ctl = 0;
+
+                switch (index) {
+                case TIMER_VTIMER:
+                        cnt_ctl = read_sysreg_el0(cntv_ctl);
+                        break;
+                case TIMER_PTIMER:
+                        cnt_ctl = read_sysreg_el0(cntp_ctl);
+                        break;
+                case NR_KVM_TIMERS:
+                        /* GCC is braindead */
+                        cnt_ctl = 0;
+                        break;
+                }
 
-                /* Only the virtual timer can be loaded so far */
-                cnt_ctl = read_sysreg_el0(cntv_ctl);
                 return  (cnt_ctl & ARCH_TIMER_CTRL_ENABLE) &&
                         (cnt_ctl & ARCH_TIMER_CTRL_IT_STAT) &&
                        !(cnt_ctl & ARCH_TIMER_CTRL_IT_MASK);
@@ -224,13 +276,13 @@ static bool kvm_timer_should_fire(struct arch_timer_context *timer_ctx)
 
 bool kvm_timer_is_pending(struct kvm_vcpu *vcpu)
 {
-        struct arch_timer_context *vtimer = vcpu_vtimer(vcpu);
-        struct arch_timer_context *ptimer = vcpu_ptimer(vcpu);
+        struct timer_map map;
 
-        if (kvm_timer_should_fire(vtimer))
-                return true;
+        get_timer_map(vcpu, &map);
 
-        return kvm_timer_should_fire(ptimer);
+        return kvm_timer_should_fire(map.direct_vtimer) ||
+               kvm_timer_should_fire(map.direct_ptimer) ||
+               kvm_timer_should_fire(map.emul_ptimer);
 }
 
 /*
@@ -269,77 +321,70 @@ static void kvm_timer_update_irq(struct kvm_vcpu *vcpu, bool new_level,
         }
 }
 
-/* Schedule the background timer for the emulated timer. */
-static void phys_timer_emulate(struct kvm_vcpu *vcpu)
+static void timer_emulate(struct arch_timer_context *ctx)
 {
-        struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
-        struct arch_timer_context *ptimer = vcpu_ptimer(vcpu);
+        bool should_fire = kvm_timer_should_fire(ctx);
+
+        trace_kvm_timer_emulate(ctx, should_fire);
+
+        if (should_fire) {
+                kvm_timer_update_irq(ctx->vcpu, true, ctx);
+                return;
+        }
 
         /*
          * If the timer can fire now, we don't need to have a soft timer
          * scheduled for the future.  If the timer cannot fire at all,
          * then we also don't need a soft timer.
          */
-        if (kvm_timer_should_fire(ptimer) || !kvm_timer_irq_can_fire(ptimer)) {
-                soft_timer_cancel(&timer->phys_timer);
+        if (!kvm_timer_irq_can_fire(ctx)) {
+                soft_timer_cancel(&ctx->hrtimer);
                 return;
         }
 
-        soft_timer_start(&timer->phys_timer, kvm_timer_compute_delta(ptimer));
+        soft_timer_start(&ctx->hrtimer, kvm_timer_compute_delta(ctx));
 }
 
-/*
- * Check if there was a change in the timer state, so that we should either
- * raise or lower the line level to the GIC or schedule a background timer to
- * emulate the physical timer.
- */
-static void kvm_timer_update_state(struct kvm_vcpu *vcpu)
+static void timer_save_state(struct arch_timer_context *ctx)
 {
-        struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
-        struct arch_timer_context *vtimer = vcpu_vtimer(vcpu);
-        struct arch_timer_context *ptimer = vcpu_ptimer(vcpu);
-        bool level;
+        struct arch_timer_cpu *timer = vcpu_timer(ctx->vcpu);
+        enum kvm_arch_timers index = arch_timer_ctx_index(ctx);
+        unsigned long flags;
 
-        if (unlikely(!timer->enabled))
+        if (!timer->enabled)
                 return;
 
-        /*
-         * The vtimer virtual interrupt is a 'mapped' interrupt, meaning part
-         * of its lifecycle is offloaded to the hardware, and we therefore may
-         * not have lowered the irq.level value before having to signal a new
-         * interrupt, but have to signal an interrupt every time the level is
-         * asserted.
-         */
-        level = kvm_timer_should_fire(vtimer);
-        kvm_timer_update_irq(vcpu, level, vtimer);
+        local_irq_save(flags);
 
-        phys_timer_emulate(vcpu);
+        if (!ctx->loaded)
+                goto out;
 
-        if (kvm_timer_should_fire(ptimer) != ptimer->irq.level)
-                kvm_timer_update_irq(vcpu, !ptimer->irq.level, ptimer);
-}
+        switch (index) {
+        case TIMER_VTIMER:
+                ctx->cnt_ctl = read_sysreg_el0(cntv_ctl);
+                ctx->cnt_cval = read_sysreg_el0(cntv_cval);
 
-static void vtimer_save_state(struct kvm_vcpu *vcpu)
-{
-        struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
-        struct arch_timer_context *vtimer = vcpu_vtimer(vcpu);
-        unsigned long flags;
+                /* Disable the timer */
+                write_sysreg_el0(0, cntv_ctl);
+                isb();
 
-        local_irq_save(flags);
+                break;
+        case TIMER_PTIMER:
+                ctx->cnt_ctl = read_sysreg_el0(cntp_ctl);
+                ctx->cnt_cval = read_sysreg_el0(cntp_cval);
 
-        if (!vtimer->loaded)
-                goto out;
+                /* Disable the timer */
+                write_sysreg_el0(0, cntp_ctl);
+                isb();
 
-        if (timer->enabled) {
-                vtimer->cnt_ctl = read_sysreg_el0(cntv_ctl);
-                vtimer->cnt_cval = read_sysreg_el0(cntv_cval);
+                break;
+        case NR_KVM_TIMERS:
+                BUG();
         }
 
-        /* Disable the virtual timer */
-        write_sysreg_el0(0, cntv_ctl);
-        isb();
+        trace_kvm_timer_save_state(ctx);
 
-        vtimer->loaded = false;
+        ctx->loaded = false;
 out:
         local_irq_restore(flags);
 }
@@ -349,67 +394,72 @@ out:
  * thread is removed from its waitqueue and made runnable when there's a timer
  * interrupt to handle.
  */
-void kvm_timer_schedule(struct kvm_vcpu *vcpu)
+static void kvm_timer_blocking(struct kvm_vcpu *vcpu)
 {
-        struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
-        struct arch_timer_context *vtimer = vcpu_vtimer(vcpu);
-        struct arch_timer_context *ptimer = vcpu_ptimer(vcpu);
-
-        vtimer_save_state(vcpu);
+        struct arch_timer_cpu *timer = vcpu_timer(vcpu);
+        struct timer_map map;
 
-        /*
-         * No need to schedule a background timer if any guest timer has
-         * already expired, because kvm_vcpu_block will return before putting
-         * the thread to sleep.
-         */
-        if (kvm_timer_should_fire(vtimer) || kvm_timer_should_fire(ptimer))
-                return;
+        get_timer_map(vcpu, &map);
 
         /*
-         * If both timers are not capable of raising interrupts (disabled or
+         * If no timers are capable of raising interrupts (disabled or
          * masked), then there's no more work for us to do.
          */
-        if (!kvm_timer_irq_can_fire(vtimer) && !kvm_timer_irq_can_fire(ptimer))
+        if (!kvm_timer_irq_can_fire(map.direct_vtimer) &&
+            !kvm_timer_irq_can_fire(map.direct_ptimer) &&
+            !kvm_timer_irq_can_fire(map.emul_ptimer))
                 return;
 
         /*
-         * The guest timers have not yet expired, schedule a background timer.
+         * At least one guest time will expire. Schedule a background timer.
          * Set the earliest expiration time among the guest timers.
          */
         soft_timer_start(&timer->bg_timer, kvm_timer_earliest_exp(vcpu));
 }
 
-static void vtimer_restore_state(struct kvm_vcpu *vcpu)
+static void kvm_timer_unblocking(struct kvm_vcpu *vcpu)
 {
-        struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
-        struct arch_timer_context *vtimer = vcpu_vtimer(vcpu);
+        struct arch_timer_cpu *timer = vcpu_timer(vcpu);
+
+        soft_timer_cancel(&timer->bg_timer);
+}
+
+static void timer_restore_state(struct arch_timer_context *ctx)
+{
+        struct arch_timer_cpu *timer = vcpu_timer(ctx->vcpu);
+        enum kvm_arch_timers index = arch_timer_ctx_index(ctx);
         unsigned long flags;
 
+        if (!timer->enabled)
+                return;
+
         local_irq_save(flags);
 
-        if (vtimer->loaded)
+        if (ctx->loaded)
                 goto out;
 
-        if (timer->enabled) {
-                write_sysreg_el0(vtimer->cnt_cval, cntv_cval);
+        switch (index) {
+        case TIMER_VTIMER:
+                write_sysreg_el0(ctx->cnt_cval, cntv_cval);
                 isb();
-                write_sysreg_el0(vtimer->cnt_ctl, cntv_ctl);
+                write_sysreg_el0(ctx->cnt_ctl, cntv_ctl);
+                break;
+        case TIMER_PTIMER:
+                write_sysreg_el0(ctx->cnt_cval, cntp_cval);
+                isb();
+                write_sysreg_el0(ctx->cnt_ctl, cntp_ctl);
+                break;
+        case NR_KVM_TIMERS:
+                BUG();
         }
 
-        vtimer->loaded = true;
+        trace_kvm_timer_restore_state(ctx);
+
+        ctx->loaded = true;
 out:
         local_irq_restore(flags);
 }
 
-void kvm_timer_unschedule(struct kvm_vcpu *vcpu)
-{
-        struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
-
-        vtimer_restore_state(vcpu);
-
-        soft_timer_cancel(&timer->bg_timer);
-}
-
 static void set_cntvoff(u64 cntvoff)
 {
         u32 low = lower_32_bits(cntvoff);
@@ -425,23 +475,32 @@ static void set_cntvoff(u64 cntvoff)
         kvm_call_hyp(__kvm_timer_set_cntvoff, low, high);
 }
 
-static inline void set_vtimer_irq_phys_active(struct kvm_vcpu *vcpu, bool active)
+static inline void set_timer_irq_phys_active(struct arch_timer_context *ctx, bool active)
 {
         int r;
-        r = irq_set_irqchip_state(host_vtimer_irq, IRQCHIP_STATE_ACTIVE, active);
+        r = irq_set_irqchip_state(ctx->host_timer_irq, IRQCHIP_STATE_ACTIVE, active);
         WARN_ON(r);
 }
 
-static void kvm_timer_vcpu_load_gic(struct kvm_vcpu *vcpu)
+static void kvm_timer_vcpu_load_gic(struct arch_timer_context *ctx)
 {
-        struct arch_timer_context *vtimer = vcpu_vtimer(vcpu);
-        bool phys_active;
+        struct kvm_vcpu *vcpu = ctx->vcpu;
+        bool phys_active = false;
+
+        /*
+         * Update the timer output so that it is likely to match the
+         * state we're about to restore. If the timer expires between
+         * this point and the register restoration, we'll take the
+         * interrupt anyway.
+         */
+        kvm_timer_update_irq(ctx->vcpu, kvm_timer_should_fire(ctx), ctx);
 
         if (irqchip_in_kernel(vcpu->kvm))
-                phys_active = kvm_vgic_map_is_active(vcpu, vtimer->irq.irq);
-        else
-                phys_active = vtimer->irq.level;
-        set_vtimer_irq_phys_active(vcpu, phys_active);
+                phys_active = kvm_vgic_map_is_active(vcpu, ctx->irq.irq);
+
+        phys_active |= ctx->irq.level;
+
+        set_timer_irq_phys_active(ctx, phys_active);
 }
 
 static void kvm_timer_vcpu_load_nogic(struct kvm_vcpu *vcpu)
@@ -466,28 +525,32 @@ static void kvm_timer_vcpu_load_nogic(struct kvm_vcpu *vcpu)
 
 void kvm_timer_vcpu_load(struct kvm_vcpu *vcpu)
 {
-        struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
-        struct arch_timer_context *vtimer = vcpu_vtimer(vcpu);
-        struct arch_timer_context *ptimer = vcpu_ptimer(vcpu);
+        struct arch_timer_cpu *timer = vcpu_timer(vcpu);
+        struct timer_map map;
 
         if (unlikely(!timer->enabled))
                 return;
 
-        if (static_branch_likely(&has_gic_active_state))
-                kvm_timer_vcpu_load_gic(vcpu);
-        else
+        get_timer_map(vcpu, &map);
+
+        if (static_branch_likely(&has_gic_active_state)) {
+                kvm_timer_vcpu_load_gic(map.direct_vtimer);
+                if (map.direct_ptimer)
+                        kvm_timer_vcpu_load_gic(map.direct_ptimer);
+        } else {
                 kvm_timer_vcpu_load_nogic(vcpu);
+        }
 
-        set_cntvoff(vtimer->cntvoff);
+        set_cntvoff(map.direct_vtimer->cntvoff);
 
-        vtimer_restore_state(vcpu);
+        kvm_timer_unblocking(vcpu);
 
-        /* Set the background timer for the physical timer emulation. */
-        phys_timer_emulate(vcpu);
+        timer_restore_state(map.direct_vtimer);
+        if (map.direct_ptimer)
+                timer_restore_state(map.direct_ptimer);
 
-        /* If the timer fired while we weren't running, inject it now */
-        if (kvm_timer_should_fire(ptimer) != ptimer->irq.level)
-                kvm_timer_update_irq(vcpu, !ptimer->irq.level, ptimer);
+        if (map.emul_ptimer)
+                timer_emulate(map.emul_ptimer);
 }
 
 bool kvm_timer_should_notify_user(struct kvm_vcpu *vcpu)
@@ -509,15 +572,20 @@ bool kvm_timer_should_notify_user(struct kvm_vcpu *vcpu)
 
 void kvm_timer_vcpu_put(struct kvm_vcpu *vcpu)
 {
-        struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
+        struct arch_timer_cpu *timer = vcpu_timer(vcpu);
+        struct timer_map map;
 
         if (unlikely(!timer->enabled))
                 return;
 
-        vtimer_save_state(vcpu);
+        get_timer_map(vcpu, &map);
+
+        timer_save_state(map.direct_vtimer);
+        if (map.direct_ptimer)
+                timer_save_state(map.direct_ptimer);
 
         /*
-         * Cancel the physical timer emulation, because the only case where we
+         * Cancel soft timer emulation, because the only case where we
          * need it after a vcpu_put is in the context of a sleeping VCPU, and
          * in that case we already factor in the deadline for the physical
          * timer when scheduling the bg_timer.
@@ -525,7 +593,11 @@ void kvm_timer_vcpu_put(struct kvm_vcpu *vcpu)
          * In any case, we re-schedule the hrtimer for the physical timer when
          * coming back to the VCPU thread in kvm_timer_vcpu_load().
          */
-        soft_timer_cancel(&timer->phys_timer);
+        if (map.emul_ptimer)
+                soft_timer_cancel(&map.emul_ptimer->hrtimer);
+
+        if (swait_active(kvm_arch_vcpu_wq(vcpu)))
+                kvm_timer_blocking(vcpu);
 
         /*
          * The kernel may decide to run userspace after calling vcpu_put, so
@@ -534,8 +606,7 @@ void kvm_timer_vcpu_put(struct kvm_vcpu *vcpu)
          * counter of non-VHE case. For VHE, the virtual counter uses a fixed
          * virtual offset of zero, so no need to zero CNTVOFF_EL2 register.
          */
-        if (!has_vhe())
-                set_cntvoff(0);
+        set_cntvoff(0);
 }
 
 /*
@@ -550,7 +621,7 @@ static void unmask_vtimer_irq_user(struct kvm_vcpu *vcpu)
         if (!kvm_timer_should_fire(vtimer)) {
                 kvm_timer_update_irq(vcpu, false, vtimer);
                 if (static_branch_likely(&has_gic_active_state))
-                        set_vtimer_irq_phys_active(vcpu, false);
+                        set_timer_irq_phys_active(vtimer, false);
                 else
                         enable_percpu_irq(host_vtimer_irq, host_vtimer_irq_flags);
         }
@@ -558,7 +629,7 @@ static void unmask_vtimer_irq_user(struct kvm_vcpu *vcpu)
 
 void kvm_timer_sync_hwstate(struct kvm_vcpu *vcpu)
 {
-        struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
+        struct arch_timer_cpu *timer = vcpu_timer(vcpu);
 
         if (unlikely(!timer->enabled))
                 return;
@@ -569,9 +640,10 @@ void kvm_timer_sync_hwstate(struct kvm_vcpu *vcpu)
 
 int kvm_timer_vcpu_reset(struct kvm_vcpu *vcpu)
 {
-        struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
-        struct arch_timer_context *vtimer = vcpu_vtimer(vcpu);
-        struct arch_timer_context *ptimer = vcpu_ptimer(vcpu);
+        struct arch_timer_cpu *timer = vcpu_timer(vcpu);
+        struct timer_map map;
+
+        get_timer_map(vcpu, &map);
 
         /*
          * The bits in CNTV_CTL are architecturally reset to UNKNOWN for ARMv8
@@ -579,12 +651,22 @@ int kvm_timer_vcpu_reset(struct kvm_vcpu *vcpu)
          * resets the timer to be disabled and unmasked and is compliant with
          * the ARMv7 architecture.
          */
-        vtimer->cnt_ctl = 0;
-        ptimer->cnt_ctl = 0;
-        kvm_timer_update_state(vcpu);
+        vcpu_vtimer(vcpu)->cnt_ctl = 0;
+        vcpu_ptimer(vcpu)->cnt_ctl = 0;
 
-        if (timer->enabled && irqchip_in_kernel(vcpu->kvm))
-                kvm_vgic_reset_mapped_irq(vcpu, vtimer->irq.irq);
+        if (timer->enabled) {
+                kvm_timer_update_irq(vcpu, false, vcpu_vtimer(vcpu));
+                kvm_timer_update_irq(vcpu, false, vcpu_ptimer(vcpu));
+
+                if (irqchip_in_kernel(vcpu->kvm)) {
+                        kvm_vgic_reset_mapped_irq(vcpu, map.direct_vtimer->irq.irq);
+                        if (map.direct_ptimer)
+                                kvm_vgic_reset_mapped_irq(vcpu, map.direct_ptimer->irq.irq);
+                }
+        }
+
+        if (map.emul_ptimer)
+                soft_timer_cancel(&map.emul_ptimer->hrtimer);
 
         return 0;
 }
@@ -610,56 +692,76 @@ static void update_vtimer_cntvoff(struct kvm_vcpu *vcpu, u64 cntvoff)
 
 void kvm_timer_vcpu_init(struct kvm_vcpu *vcpu)
 {
-        struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
+        struct arch_timer_cpu *timer = vcpu_timer(vcpu);
         struct arch_timer_context *vtimer = vcpu_vtimer(vcpu);
         struct arch_timer_context *ptimer = vcpu_ptimer(vcpu);
 
         /* Synchronize cntvoff across all vtimers of a VM. */
         update_vtimer_cntvoff(vcpu, kvm_phys_timer_read());
-        vcpu_ptimer(vcpu)->cntvoff = 0;
+        ptimer->cntvoff = 0;
 
         hrtimer_init(&timer->bg_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
         timer->bg_timer.function = kvm_bg_timer_expire;
 
-        hrtimer_init(&timer->phys_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
-        timer->phys_timer.function = kvm_phys_timer_expire;
+        hrtimer_init(&vtimer->hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+        hrtimer_init(&ptimer->hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+        vtimer->hrtimer.function = kvm_hrtimer_expire;
+        ptimer->hrtimer.function = kvm_hrtimer_expire;
 
         vtimer->irq.irq = default_vtimer_irq.irq;
         ptimer->irq.irq = default_ptimer_irq.irq;
+
+        vtimer->host_timer_irq = host_vtimer_irq;
+        ptimer->host_timer_irq = host_ptimer_irq;
+
+        vtimer->host_timer_irq_flags = host_vtimer_irq_flags;
+        ptimer->host_timer_irq_flags = host_ptimer_irq_flags;
+
+        vtimer->vcpu = vcpu;
+        ptimer->vcpu = vcpu;
 }
 
 static void kvm_timer_init_interrupt(void *info)
 {
         enable_percpu_irq(host_vtimer_irq, host_vtimer_irq_flags);
+        enable_percpu_irq(host_ptimer_irq, host_ptimer_irq_flags);
 }
 
 int kvm_arm_timer_set_reg(struct kvm_vcpu *vcpu, u64 regid, u64 value)
 {
-        struct arch_timer_context *vtimer = vcpu_vtimer(vcpu);
-        struct arch_timer_context *ptimer = vcpu_ptimer(vcpu);
+        struct arch_timer_context *timer;
+        bool level;
 
         switch (regid) {
         case KVM_REG_ARM_TIMER_CTL:
-                vtimer->cnt_ctl = value & ~ARCH_TIMER_CTRL_IT_STAT;
+                timer = vcpu_vtimer(vcpu);
+                kvm_arm_timer_write(vcpu, timer, TIMER_REG_CTL, value);
                 break;
         case KVM_REG_ARM_TIMER_CNT:
+                timer = vcpu_vtimer(vcpu);
                 update_vtimer_cntvoff(vcpu, kvm_phys_timer_read() - value);
                 break;
         case KVM_REG_ARM_TIMER_CVAL:
-                vtimer->cnt_cval = value;
+                timer = vcpu_vtimer(vcpu);
+                kvm_arm_timer_write(vcpu, timer, TIMER_REG_CVAL, value);
                 break;
         case KVM_REG_ARM_PTIMER_CTL:
-                ptimer->cnt_ctl = value & ~ARCH_TIMER_CTRL_IT_STAT;
+                timer = vcpu_ptimer(vcpu);
+                kvm_arm_timer_write(vcpu, timer, TIMER_REG_CTL, value);
                 break;
         case KVM_REG_ARM_PTIMER_CVAL:
-                ptimer->cnt_cval = value;
+                timer = vcpu_ptimer(vcpu);
+                kvm_arm_timer_write(vcpu, timer, TIMER_REG_CVAL, value);
                 break;
 
         default:
                 return -1;
         }
 
-        kvm_timer_update_state(vcpu);
+        level = kvm_timer_should_fire(timer);
+        kvm_timer_update_irq(vcpu, level, timer);
+        timer_emulate(timer);
+
         return 0;
 }
 
@@ -679,26 +781,113 @@ static u64 read_timer_ctl(struct arch_timer_context *timer)
 
 u64 kvm_arm_timer_get_reg(struct kvm_vcpu *vcpu, u64 regid)
 {
-        struct arch_timer_context *ptimer = vcpu_ptimer(vcpu);
-        struct arch_timer_context *vtimer = vcpu_vtimer(vcpu);
-
         switch (regid) {
         case KVM_REG_ARM_TIMER_CTL:
-                return read_timer_ctl(vtimer);
+                return kvm_arm_timer_read(vcpu,
+                                          vcpu_vtimer(vcpu), TIMER_REG_CTL);
         case KVM_REG_ARM_TIMER_CNT:
-                return kvm_phys_timer_read() - vtimer->cntvoff;
+                return kvm_arm_timer_read(vcpu,
+                                          vcpu_vtimer(vcpu), TIMER_REG_CNT);
         case KVM_REG_ARM_TIMER_CVAL:
-                return vtimer->cnt_cval;
+                return kvm_arm_timer_read(vcpu,
+                                          vcpu_vtimer(vcpu), TIMER_REG_CVAL);
         case KVM_REG_ARM_PTIMER_CTL:
-                return read_timer_ctl(ptimer);
-        case KVM_REG_ARM_PTIMER_CVAL:
-                return ptimer->cnt_cval;
+                return kvm_arm_timer_read(vcpu,
+                                          vcpu_ptimer(vcpu), TIMER_REG_CTL);
         case KVM_REG_ARM_PTIMER_CNT:
-                return kvm_phys_timer_read();
+                return kvm_arm_timer_read(vcpu,
+                                          vcpu_vtimer(vcpu), TIMER_REG_CNT);
+        case KVM_REG_ARM_PTIMER_CVAL:
+                return kvm_arm_timer_read(vcpu,
+                                          vcpu_ptimer(vcpu), TIMER_REG_CVAL);
         }
         return (u64)-1;
 }
 
+static u64 kvm_arm_timer_read(struct kvm_vcpu *vcpu,
+                              struct arch_timer_context *timer,
+                              enum kvm_arch_timer_regs treg)
+{
+        u64 val;
+
+        switch (treg) {
+        case TIMER_REG_TVAL:
+                val = kvm_phys_timer_read() - timer->cntvoff - timer->cnt_cval;
+                break;
+
+        case TIMER_REG_CTL:
+                val = read_timer_ctl(timer);
+                break;
+
+        case TIMER_REG_CVAL:
+                val = timer->cnt_cval;
+                break;
+
+        case TIMER_REG_CNT:
+                val = kvm_phys_timer_read() - timer->cntvoff;
+                break;
+
+        default:
+                BUG();
+        }
+
+        return val;
+}
+
+u64 kvm_arm_timer_read_sysreg(struct kvm_vcpu *vcpu,
+                              enum kvm_arch_timers tmr,
+                              enum kvm_arch_timer_regs treg)
+{
+        u64 val;
+
+        preempt_disable();
+        kvm_timer_vcpu_put(vcpu);
+
+        val = kvm_arm_timer_read(vcpu, vcpu_get_timer(vcpu, tmr), treg);
+
+        kvm_timer_vcpu_load(vcpu);
+        preempt_enable();
+
+        return val;
+}
+
+static void kvm_arm_timer_write(struct kvm_vcpu *vcpu,
+                                struct arch_timer_context *timer,
+                                enum kvm_arch_timer_regs treg,
+                                u64 val)
+{
+        switch (treg) {
+        case TIMER_REG_TVAL:
+                timer->cnt_cval = val - kvm_phys_timer_read() - timer->cntvoff;
+                break;
+
+        case TIMER_REG_CTL:
+                timer->cnt_ctl = val & ~ARCH_TIMER_CTRL_IT_STAT;
+                break;
+
+        case TIMER_REG_CVAL:
+                timer->cnt_cval = val;
+                break;
+
+        default:
+                BUG();
+        }
+}
+
+void kvm_arm_timer_write_sysreg(struct kvm_vcpu *vcpu,
+                                enum kvm_arch_timers tmr,
+                                enum kvm_arch_timer_regs treg,
+                                u64 val)
+{
+        preempt_disable();
+        kvm_timer_vcpu_put(vcpu);
+
+        kvm_arm_timer_write(vcpu, vcpu_get_timer(vcpu, tmr), treg, val);
+
+        kvm_timer_vcpu_load(vcpu);
+        preempt_enable();
+}
+
 static int kvm_timer_starting_cpu(unsigned int cpu)
 {
         kvm_timer_init_interrupt(NULL);
@@ -724,6 +913,8 @@ int kvm_timer_hyp_init(bool has_gic)
                 return -ENODEV;
         }
 
+        /* First, do the virtual EL1 timer irq */
+
         if (info->virtual_irq <= 0) {
                 kvm_err("kvm_arch_timer: invalid virtual timer IRQ: %d\n",
                         info->virtual_irq);
@@ -734,15 +925,15 @@ int kvm_timer_hyp_init(bool has_gic)
         host_vtimer_irq_flags = irq_get_trigger_type(host_vtimer_irq);
         if (host_vtimer_irq_flags != IRQF_TRIGGER_HIGH &&
             host_vtimer_irq_flags != IRQF_TRIGGER_LOW) {
-                kvm_err("Invalid trigger for IRQ%d, assuming level low\n",
+                kvm_err("Invalid trigger for vtimer IRQ%d, assuming level low\n",
                         host_vtimer_irq);
                 host_vtimer_irq_flags = IRQF_TRIGGER_LOW;
         }
 
         err = request_percpu_irq(host_vtimer_irq, kvm_arch_timer_handler,
-                                 "kvm guest timer", kvm_get_running_vcpus());
+                                 "kvm guest vtimer", kvm_get_running_vcpus());
         if (err) {
-                kvm_err("kvm_arch_timer: can't request interrupt %d (%d)\n",
+                kvm_err("kvm_arch_timer: can't request vtimer interrupt %d (%d)\n",
                         host_vtimer_irq, err);
                 return err;
         }
@@ -760,6 +951,43 @@ int kvm_timer_hyp_init(bool has_gic)
 
         kvm_debug("virtual timer IRQ%d\n", host_vtimer_irq);
 
+        /* Now let's do the physical EL1 timer irq */
+
+        if (info->physical_irq > 0) {
+                host_ptimer_irq = info->physical_irq;
+                host_ptimer_irq_flags = irq_get_trigger_type(host_ptimer_irq);
+                if (host_ptimer_irq_flags != IRQF_TRIGGER_HIGH &&
+                    host_ptimer_irq_flags != IRQF_TRIGGER_LOW) {
+                        kvm_err("Invalid trigger for ptimer IRQ%d, assuming level low\n",
+                                host_ptimer_irq);
+                        host_ptimer_irq_flags = IRQF_TRIGGER_LOW;
+                }
+
+                err = request_percpu_irq(host_ptimer_irq, kvm_arch_timer_handler,
+                                         "kvm guest ptimer", kvm_get_running_vcpus());
+                if (err) {
+                        kvm_err("kvm_arch_timer: can't request ptimer interrupt %d (%d)\n",
+                                host_ptimer_irq, err);
+                        return err;
+                }
+
+                if (has_gic) {
+                        err = irq_set_vcpu_affinity(host_ptimer_irq,
+                                                    kvm_get_running_vcpus());
+                        if (err) {
+                                kvm_err("kvm_arch_timer: error setting vcpu affinity\n");
+                                goto out_free_irq;
+                        }
+                }
+
+                kvm_debug("physical timer IRQ%d\n", host_ptimer_irq);
+        } else if (has_vhe()) {
+                kvm_err("kvm_arch_timer: invalid physical timer IRQ: %d\n",
+                        info->physical_irq);
+                err = -ENODEV;
+                goto out_free_irq;
+        }
+
         cpuhp_setup_state(CPUHP_AP_KVM_ARM_TIMER_STARTING,
                           "kvm/arm/timer:starting", kvm_timer_starting_cpu,
                           kvm_timer_dying_cpu);
@@ -771,7 +999,7 @@ out_free_irq:
 
 void kvm_timer_vcpu_terminate(struct kvm_vcpu *vcpu)
 {
-        struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
+        struct arch_timer_cpu *timer = vcpu_timer(vcpu);
 
         soft_timer_cancel(&timer->bg_timer);
 }
@@ -807,16 +1035,18 @@ bool kvm_arch_timer_get_input_level(int vintid)
 
         if (vintid == vcpu_vtimer(vcpu)->irq.irq)
                 timer = vcpu_vtimer(vcpu);
+        else if (vintid == vcpu_ptimer(vcpu)->irq.irq)
+                timer = vcpu_ptimer(vcpu);
         else
-                BUG(); /* We only map the vtimer so far */
+                BUG();
 
         return kvm_timer_should_fire(timer);
 }
 
 int kvm_timer_enable(struct kvm_vcpu *vcpu)
 {
-        struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
-        struct arch_timer_context *vtimer = vcpu_vtimer(vcpu);
+        struct arch_timer_cpu *timer = vcpu_timer(vcpu);
+        struct timer_map map;
         int ret;
 
         if (timer->enabled)
@@ -834,19 +1064,33 @@ int kvm_timer_enable(struct kvm_vcpu *vcpu)
                 return -EINVAL;
         }
 
-        ret = kvm_vgic_map_phys_irq(vcpu, host_vtimer_irq, vtimer->irq.irq,
+        get_timer_map(vcpu, &map);
+
+        ret = kvm_vgic_map_phys_irq(vcpu,
+                                    map.direct_vtimer->host_timer_irq,
+                                    map.direct_vtimer->irq.irq,
                                     kvm_arch_timer_get_input_level);
         if (ret)
                 return ret;
 
+        if (map.direct_ptimer) {
+                ret = kvm_vgic_map_phys_irq(vcpu,
+                                            map.direct_ptimer->host_timer_irq,
+                                            map.direct_ptimer->irq.irq,
+                                            kvm_arch_timer_get_input_level);
+        }
+
+        if (ret)
+                return ret;
+
 no_vgic:
         timer->enabled = 1;
         return 0;
 }
 
 /*
- * On VHE system, we only need to configure trap on physical timer and counter
- * accesses in EL0 and EL1 once, not for every world switch.
+ * On VHE system, we only need to configure the EL2 timer trap register once,
+ * not for every world switch.
  * The host kernel runs at EL2 with HCR_EL2.TGE == 1,
  * and this makes those bits have no effect for the host kernel execution.
  */
@@ -857,11 +1101,11 @@ void kvm_timer_init_vhe(void)
         u64 val;
 
         /*
-         * Disallow physical timer access for the guest.
-         * Physical counter access is allowed.
+         * VHE systems allow the guest direct access to the EL1 physical
+         * timer/counter.
          */
         val = read_sysreg(cnthctl_el2);
-        val &= ~(CNTHCTL_EL1PCEN << cnthctl_shift);
+        val |= (CNTHCTL_EL1PCEN << cnthctl_shift);
         val |= (CNTHCTL_EL1PCTEN << cnthctl_shift);
         write_sysreg(val, cnthctl_el2);
 }
diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
index 9c486fad3f9f..99c37384ba7b 100644
--- a/virt/kvm/arm/arm.c
+++ b/virt/kvm/arm/arm.c
@@ -65,7 +65,6 @@ static DEFINE_PER_CPU(struct kvm_vcpu *, kvm_arm_running_vcpu);
 /* The VMID used in the VTTBR */
 static atomic64_t kvm_vmid_gen = ATOMIC64_INIT(1);
 static u32 kvm_next_vmid;
-static unsigned int kvm_vmid_bits __read_mostly;
 static DEFINE_SPINLOCK(kvm_vmid_lock);
 
 static bool vgic_present;
@@ -142,7 +141,7 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
         kvm_vgic_early_init(kvm);
 
         /* Mark the initial VMID generation invalid */
-        kvm->arch.vmid_gen = 0;
+        kvm->arch.vmid.vmid_gen = 0;
 
         /* The maximum number of VCPUs is limited by the host's GIC model */
         kvm->arch.max_vcpus = vgic_present ?
@@ -336,13 +335,11 @@ int kvm_cpu_has_pending_timer(struct kvm_vcpu *vcpu)
 
 void kvm_arch_vcpu_blocking(struct kvm_vcpu *vcpu)
 {
-        kvm_timer_schedule(vcpu);
         kvm_vgic_v4_enable_doorbell(vcpu);
 }
 
 void kvm_arch_vcpu_unblocking(struct kvm_vcpu *vcpu)
 {
-        kvm_timer_unschedule(vcpu);
         kvm_vgic_v4_disable_doorbell(vcpu);
 }
 
@@ -472,37 +469,31 @@ void force_vm_exit(const cpumask_t *mask)
 
 /**
  * need_new_vmid_gen - check that the VMID is still valid
- * @kvm: The VM's VMID to check
+ * @vmid: The VMID to check
  *
  * return true if there is a new generation of VMIDs being used
  *
- * The hardware supports only 256 values with the value zero reserved for the
- * host, so we check if an assigned value belongs to a previous generation,
- * which which requires us to assign a new value. If we're the first to use a
- * VMID for the new generation, we must flush necessary caches and TLBs on all
- * CPUs.
+ * The hardware supports a limited set of values with the value zero reserved
+ * for the host, so we check if an assigned value belongs to a previous
+ * generation, which which requires us to assign a new value. If we're the
+ * first to use a VMID for the new generation, we must flush necessary caches
+ * and TLBs on all CPUs.
  */
-static bool need_new_vmid_gen(struct kvm *kvm)
+static bool need_new_vmid_gen(struct kvm_vmid *vmid)
 {
         u64 current_vmid_gen = atomic64_read(&kvm_vmid_gen);
         smp_rmb(); /* Orders read of kvm_vmid_gen and kvm->arch.vmid */
-        return unlikely(READ_ONCE(kvm->arch.vmid_gen) != current_vmid_gen);
+        return unlikely(READ_ONCE(vmid->vmid_gen) != current_vmid_gen);
 }
 
 /**
- * update_vttbr - Update the VTTBR with a valid VMID before the guest runs
- * @kvm The guest that we are about to run
- *
- * Called from kvm_arch_vcpu_ioctl_run before entering the guest to ensure the
- * VM has a valid VMID, otherwise assigns a new one and flushes corresponding
- * caches and TLBs.
+ * update_vmid - Update the vmid with a valid VMID for the current generation
+ * @kvm: The guest that struct vmid belongs to
+ * @vmid: The stage-2 VMID information struct
  */
-static void update_vttbr(struct kvm *kvm)
+static void update_vmid(struct kvm_vmid *vmid)
 {
-        phys_addr_t pgd_phys;
-        u64 vmid, cnp = kvm_cpu_has_cnp() ? VTTBR_CNP_BIT : 0;
-
-        if (!need_new_vmid_gen(kvm))
+        if (!need_new_vmid_gen(vmid))
                 return;
 
         spin_lock(&kvm_vmid_lock);
@@ -512,7 +503,7 @@ static void update_vttbr(struct kvm *kvm)
          * already allocated a valid vmid for this vm, then this vcpu should
          * use the same vmid.
          */
-        if (!need_new_vmid_gen(kvm)) {
+        if (!need_new_vmid_gen(vmid)) {
                 spin_unlock(&kvm_vmid_lock);
                 return;
         }
@@ -536,18 +527,12 @@ static void update_vttbr(struct kvm *kvm)
                 kvm_call_hyp(__kvm_flush_vm_context);
         }
 
-        kvm->arch.vmid = kvm_next_vmid;
+        vmid->vmid = kvm_next_vmid;
         kvm_next_vmid++;
-        kvm_next_vmid &= (1 << kvm_vmid_bits) - 1;
-
-        /* update vttbr to be used with the new vmid */
-        pgd_phys = virt_to_phys(kvm->arch.pgd);
-        BUG_ON(pgd_phys & ~kvm_vttbr_baddr_mask(kvm));
-        vmid = ((u64)(kvm->arch.vmid) << VTTBR_VMID_SHIFT) & VTTBR_VMID_MASK(kvm_vmid_bits);
-        kvm->arch.vttbr = kvm_phys_to_vttbr(pgd_phys) | vmid | cnp;
+        kvm_next_vmid &= (1 << kvm_get_vmid_bits()) - 1;
 
         smp_wmb();
-        WRITE_ONCE(kvm->arch.vmid_gen, atomic64_read(&kvm_vmid_gen));
+        WRITE_ONCE(vmid->vmid_gen, atomic64_read(&kvm_vmid_gen));
 
         spin_unlock(&kvm_vmid_lock);
 }
@@ -700,7 +685,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run)
                  */
                 cond_resched();
 
-                update_vttbr(vcpu->kvm);
+                update_vmid(&vcpu->kvm->arch.vmid);
 
                 check_vcpu_requests(vcpu);
 
@@ -749,7 +734,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run)
                  */
                 smp_store_mb(vcpu->mode, IN_GUEST_MODE);
 
-                if (ret <= 0 || need_new_vmid_gen(vcpu->kvm) ||
+                if (ret <= 0 || need_new_vmid_gen(&vcpu->kvm->arch.vmid) ||
                     kvm_request_pending(vcpu)) {
                         vcpu->mode = OUTSIDE_GUEST_MODE;
                         isb(); /* Ensure work in x_flush_hwstate is committed */
@@ -775,7 +760,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run)
                         ret = kvm_vcpu_run_vhe(vcpu);
                         kvm_arm_vhe_guest_exit();
                 } else {
-                        ret = kvm_call_hyp(__kvm_vcpu_run_nvhe, vcpu);
+                        ret = kvm_call_hyp_ret(__kvm_vcpu_run_nvhe, vcpu);
                 }
 
                 vcpu->mode = OUTSIDE_GUEST_MODE;
@@ -1427,10 +1412,6 @@ static inline void hyp_cpu_pm_exit(void)
 
 static int init_common_resources(void)
 {
-        /* set size of VMID supported by CPU */
-        kvm_vmid_bits = kvm_get_vmid_bits();
-        kvm_info("%d-bit VMID\n", kvm_vmid_bits);
-
         kvm_set_ipa_limit();
 
         return 0;
@@ -1571,6 +1552,7 @@ static int init_hyp_mode(void)
                 kvm_cpu_context_t *cpu_ctxt;
 
                 cpu_ctxt = per_cpu_ptr(&kvm_host_cpu_state, cpu);
+                kvm_init_host_cpu_context(cpu_ctxt, cpu);
                 err = create_hyp_mappings(cpu_ctxt, cpu_ctxt + 1, PAGE_HYP);
 
                 if (err) {
@@ -1581,7 +1563,7 @@ static int init_hyp_mode(void)
 
         err = hyp_map_aux_data();
         if (err)
-                kvm_err("Cannot map host auxilary data: %d\n", err);
+                kvm_err("Cannot map host auxiliary data: %d\n", err);
 
         return 0;
 
diff --git a/virt/kvm/arm/hyp/vgic-v3-sr.c b/virt/kvm/arm/hyp/vgic-v3-sr.c
index 9652c453480f..264d92da3240 100644
--- a/virt/kvm/arm/hyp/vgic-v3-sr.c
+++ b/virt/kvm/arm/hyp/vgic-v3-sr.c
@@ -226,7 +226,7 @@ void __hyp_text __vgic_v3_save_state(struct kvm_vcpu *vcpu)
                 int i;
                 u32 elrsr;
 
-                elrsr = read_gicreg(ICH_ELSR_EL2);
+                elrsr = read_gicreg(ICH_ELRSR_EL2);
 
                 write_gicreg(cpu_if->vgic_hcr & ~ICH_HCR_EN, ICH_HCR_EL2);
 
diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
index e9d28a7ca673..ffd7acdceac7 100644
--- a/virt/kvm/arm/mmu.c
+++ b/virt/kvm/arm/mmu.c
@@ -908,6 +908,7 @@ int create_hyp_exec_mappings(phys_addr_t phys_addr, size_t size,
  */
 int kvm_alloc_stage2_pgd(struct kvm *kvm)
 {
+        phys_addr_t pgd_phys;
         pgd_t *pgd;
 
         if (kvm->arch.pgd != NULL) {
@@ -920,7 +921,12 @@ int kvm_alloc_stage2_pgd(struct kvm *kvm)
         if (!pgd)
                 return -ENOMEM;
 
+        pgd_phys = virt_to_phys(pgd);
+        if (WARN_ON(pgd_phys & ~kvm_vttbr_baddr_mask(kvm)))
+                return -EINVAL;
+
         kvm->arch.pgd = pgd;
+        kvm->arch.pgd_phys = pgd_phys;
         return 0;
 }
 
@@ -1008,6 +1014,7 @@ void kvm_free_stage2_pgd(struct kvm *kvm)
                 unmap_stage2_range(kvm, 0, kvm_phys_size(kvm));
                 pgd = READ_ONCE(kvm->arch.pgd);
                 kvm->arch.pgd = NULL;
+                kvm->arch.pgd_phys = 0;
         }
         spin_unlock(&kvm->mmu_lock);
 
@@ -1396,14 +1403,6 @@ static bool transparent_hugepage_adjust(kvm_pfn_t *pfnp, phys_addr_t *ipap)
         return false;
 }
 
-static bool kvm_is_write_fault(struct kvm_vcpu *vcpu)
-{
-        if (kvm_vcpu_trap_is_iabt(vcpu))
-                return false;
-
-        return kvm_vcpu_dabt_iswrite(vcpu);
-}
-
 /**
  * stage2_wp_ptes - write protect PMD range
  * @pmd:        pointer to pmd entry
@@ -1598,14 +1597,13 @@ static void kvm_send_hwpoison_signal(unsigned long address,
 static bool fault_supports_stage2_pmd_mappings(struct kvm_memory_slot *memslot,
                                                unsigned long hva)
 {
-        gpa_t gpa_start, gpa_end;
+        gpa_t gpa_start;
         hva_t uaddr_start, uaddr_end;
         size_t size;
 
         size = memslot->npages * PAGE_SIZE;
 
         gpa_start = memslot->base_gfn << PAGE_SHIFT;
-        gpa_end = gpa_start + size;
 
         uaddr_start = memslot->userspace_addr;
         uaddr_end = uaddr_start + size;
@@ -2353,7 +2351,7 @@ int kvm_arch_create_memslot(struct kvm *kvm, struct kvm_memory_slot *slot,
         return 0;
 }
 
-void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots)
+void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen)
 {
 }
 
diff --git a/virt/kvm/arm/trace.h b/virt/kvm/arm/trace.h
index 3828beab93f2..204d210d01c2 100644
--- a/virt/kvm/arm/trace.h
+++ b/virt/kvm/arm/trace.h
@@ -2,6 +2,7 @@
 #if !defined(_TRACE_KVM_H) || defined(TRACE_HEADER_MULTI_READ)
 #define _TRACE_KVM_H
 
+#include <kvm/arm_arch_timer.h>
 #include <linux/tracepoint.h>
 
 #undef TRACE_SYSTEM
@@ -262,10 +263,114 @@ TRACE_EVENT(kvm_timer_update_irq,
                   __entry->vcpu_id, __entry->irq, __entry->level)
 );
 
+TRACE_EVENT(kvm_get_timer_map,
+        TP_PROTO(unsigned long vcpu_id, struct timer_map *map),
+        TP_ARGS(vcpu_id, map),
+
+        TP_STRUCT__entry(
+                __field(        unsigned long,          vcpu_id )
+                __field(        int,                    direct_vtimer   )
+                __field(        int,                    direct_ptimer   )
+                __field(        int,                    emul_ptimer     )
+        ),
+
+        TP_fast_assign(
+                __entry->vcpu_id                = vcpu_id;
+                __entry->direct_vtimer          = arch_timer_ctx_index(map->direct_vtimer);
+                __entry->direct_ptimer =
+                        (map->direct_ptimer) ? arch_timer_ctx_index(map->direct_ptimer) : -1;
+                __entry->emul_ptimer =
+                        (map->emul_ptimer) ? arch_timer_ctx_index(map->emul_ptimer) : -1;
+        ),
+
+        TP_printk("VCPU: %ld, dv: %d, dp: %d, ep: %d",
+                  __entry->vcpu_id,
+                  __entry->direct_vtimer,
+                  __entry->direct_ptimer,
+                  __entry->emul_ptimer)
+);
+
+TRACE_EVENT(kvm_timer_save_state,
+        TP_PROTO(struct arch_timer_context *ctx),
+        TP_ARGS(ctx),
+
+        TP_STRUCT__entry(
+                __field(        unsigned long,          ctl             )
+                __field(        unsigned long long,     cval            )
+                __field(        int,                    timer_idx       )
+        ),
+
+        TP_fast_assign(
+                __entry->ctl                    = ctx->cnt_ctl;
+                __entry->cval                   = ctx->cnt_cval;
+                __entry->timer_idx              = arch_timer_ctx_index(ctx);
+        ),
+
+        TP_printk("   CTL: %#08lx CVAL: %#16llx arch_timer_ctx_index: %d",
+                  __entry->ctl,
+                  __entry->cval,
+                  __entry->timer_idx)
+);
+
+TRACE_EVENT(kvm_timer_restore_state,
+        TP_PROTO(struct arch_timer_context *ctx),
+        TP_ARGS(ctx),
+
+        TP_STRUCT__entry(
+                __field(        unsigned long,          ctl             )
+                __field(        unsigned long long,     cval            )
+                __field(        int,                    timer_idx       )
+        ),
+
+        TP_fast_assign(
+                __entry->ctl                    = ctx->cnt_ctl;
+                __entry->cval                   = ctx->cnt_cval;
+                __entry->timer_idx              = arch_timer_ctx_index(ctx);
+        ),
+
+        TP_printk("CTL: %#08lx CVAL: %#16llx arch_timer_ctx_index: %d",
+                  __entry->ctl,
+                  __entry->cval,
+                  __entry->timer_idx)
+);
+
+TRACE_EVENT(kvm_timer_hrtimer_expire,
+        TP_PROTO(struct arch_timer_context *ctx),
+        TP_ARGS(ctx),
+
+        TP_STRUCT__entry(
+                __field(        int,                    timer_idx       )
+        ),
+
+        TP_fast_assign(
+                __entry->timer_idx              = arch_timer_ctx_index(ctx);
+        ),
+
+        TP_printk("arch_timer_ctx_index: %d", __entry->timer_idx)
+);
+
+TRACE_EVENT(kvm_timer_emulate,
+        TP_PROTO(struct arch_timer_context *ctx, bool should_fire),
+        TP_ARGS(ctx, should_fire),
+
+        TP_STRUCT__entry(
+                __field(        int,                    timer_idx       )
+                __field(        bool,                   should_fire     )
+        ),
+
+        TP_fast_assign(
+                __entry->timer_idx              = arch_timer_ctx_index(ctx);
+                __entry->should_fire            = should_fire;
+        ),
+
+        TP_printk("arch_timer_ctx_index: %d (should_fire: %d)",
+                  __entry->timer_idx, __entry->should_fire)
+);
+
 #endif /* _TRACE_KVM_H */
 
 #undef TRACE_INCLUDE_PATH
-#define TRACE_INCLUDE_PATH ../../../virt/kvm/arm
+#define TRACE_INCLUDE_PATH ../../virt/kvm/arm
 #undef TRACE_INCLUDE_FILE
 #define TRACE_INCLUDE_FILE trace
 
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 4ee0aeb9a905..408a78eb6a97 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -589,7 +589,7 @@ early_param("kvm-arm.vgic_v4_enable", early_gicv4_enable);
  */
 int vgic_v3_probe(const struct gic_kvm_info *info)
 {
-        u32 ich_vtr_el2 = kvm_call_hyp(__vgic_v3_get_ich_vtr_el2);
+        u32 ich_vtr_el2 = kvm_call_hyp_ret(__vgic_v3_get_ich_vtr_el2);
         int ret;
 
         /*
@@ -679,7 +679,7 @@ void vgic_v3_put(struct kvm_vcpu *vcpu)
         struct vgic_v3_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v3;
 
         if (likely(cpu_if->vgic_sre))
-                cpu_if->vgic_vmcr = kvm_call_hyp(__vgic_v3_read_vmcr);
+                cpu_if->vgic_vmcr = kvm_call_hyp_ret(__vgic_v3_read_vmcr);
 
         kvm_call_hyp(__vgic_v3_save_aprs, vcpu);
 
diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c
index 6855cce3e528..5294abb3f178 100644
--- a/virt/kvm/coalesced_mmio.c
+++ b/virt/kvm/coalesced_mmio.c
@@ -144,7 +144,8 @@ int kvm_vm_ioctl_register_coalesced_mmio(struct kvm *kvm,
         if (zone->pio != 1 && zone->pio != 0)
                 return -EINVAL;
 
-        dev = kzalloc(sizeof(struct kvm_coalesced_mmio_dev), GFP_KERNEL);
+        dev = kzalloc(sizeof(struct kvm_coalesced_mmio_dev),
+                      GFP_KERNEL_ACCOUNT);
         if (!dev)
                 return -ENOMEM;
 
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index b20b751286fc..4325250afd72 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -297,7 +297,7 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
         if (!kvm_arch_intc_initialized(kvm))
                 return -EAGAIN;
 
-        irqfd = kzalloc(sizeof(*irqfd), GFP_KERNEL);
+        irqfd = kzalloc(sizeof(*irqfd), GFP_KERNEL_ACCOUNT);
         if (!irqfd)
                 return -ENOMEM;
 
@@ -345,7 +345,8 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
                 }
 
                 if (!irqfd->resampler) {
-                        resampler = kzalloc(sizeof(*resampler), GFP_KERNEL);
+                        resampler = kzalloc(sizeof(*resampler),
+                                            GFP_KERNEL_ACCOUNT);
                         if (!resampler) {
                                 ret = -ENOMEM;
                                 mutex_unlock(&kvm->irqfds.resampler_lock);
@@ -797,7 +798,7 @@ static int kvm_assign_ioeventfd_idx(struct kvm *kvm,
         if (IS_ERR(eventfd))
                 return PTR_ERR(eventfd);
 
-        p = kzalloc(sizeof(*p), GFP_KERNEL);
+        p = kzalloc(sizeof(*p), GFP_KERNEL_ACCOUNT);
         if (!p) {
                 ret = -ENOMEM;
                 goto fail;
diff --git a/virt/kvm/irqchip.c b/virt/kvm/irqchip.c
index b1286c4e0712..3547b0d8c91e 100644
--- a/virt/kvm/irqchip.c
+++ b/virt/kvm/irqchip.c
@@ -196,7 +196,7 @@ int kvm_set_irq_routing(struct kvm *kvm,
         nr_rt_entries += 1;
 
         new = kzalloc(sizeof(*new) + (nr_rt_entries * sizeof(struct hlist_head)),
-                      GFP_KERNEL);
+                      GFP_KERNEL_ACCOUNT);
 
         if (!new)
                 return -ENOMEM;
@@ -208,7 +208,7 @@ int kvm_set_irq_routing(struct kvm *kvm,
 
         for (i = 0; i < nr; ++i) {
                 r = -ENOMEM;
-                e = kzalloc(sizeof(*e), GFP_KERNEL);
+                e = kzalloc(sizeof(*e), GFP_KERNEL_ACCOUNT);
                 if (!e)
                         goto out;
 
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index d237d3350a99..f25aa98a94df 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -81,6 +81,11 @@ unsigned int halt_poll_ns_grow = 2;
 module_param(halt_poll_ns_grow, uint, 0644);
 EXPORT_SYMBOL_GPL(halt_poll_ns_grow);
 
+/* The start value to grow halt_poll_ns from */
+unsigned int halt_poll_ns_grow_start = 10000; /* 10us */
+module_param(halt_poll_ns_grow_start, uint, 0644);
+EXPORT_SYMBOL_GPL(halt_poll_ns_grow_start);
+
 /* Default resets per-vcpu halt_poll_ns . */
 unsigned int halt_poll_ns_shrink;
 module_param(halt_poll_ns_shrink, uint, 0644);
@@ -525,7 +530,7 @@ static struct kvm_memslots *kvm_alloc_memslots(void)
         int i;
         struct kvm_memslots *slots;
 
-        slots = kvzalloc(sizeof(struct kvm_memslots), GFP_KERNEL);
+        slots = kvzalloc(sizeof(struct kvm_memslots), GFP_KERNEL_ACCOUNT);
         if (!slots)
                 return NULL;
 
@@ -601,12 +606,12 @@ static int kvm_create_vm_debugfs(struct kvm *kvm, int fd)
 
         kvm->debugfs_stat_data = kcalloc(kvm_debugfs_num_entries,
                                          sizeof(*kvm->debugfs_stat_data),
-                                         GFP_KERNEL);
+                                         GFP_KERNEL_ACCOUNT);
         if (!kvm->debugfs_stat_data)
                 return -ENOMEM;
 
         for (p = debugfs_entries; p->name; p++) {
-                stat_data = kzalloc(sizeof(*stat_data), GFP_KERNEL);
+                stat_data = kzalloc(sizeof(*stat_data), GFP_KERNEL_ACCOUNT);
                 if (!stat_data)
                         return -ENOMEM;
 
@@ -656,12 +661,8 @@ static struct kvm *kvm_create_vm(unsigned long type)
                 struct kvm_memslots *slots = kvm_alloc_memslots();
                 if (!slots)
                         goto out_err_no_srcu;
-                /*
-                 * Generations must be different for each address space.
-                 * Init kvm generation close to the maximum to easily test the
-                 * code of handling generation number wrap-around.
-                 */
-                slots->generation = i * 2 - 150;
+                /* Generations must be different for each address space. */
+                slots->generation = i;
                 rcu_assign_pointer(kvm->memslots[i], slots);
         }
 
@@ -671,7 +672,7 @@ static struct kvm *kvm_create_vm(unsigned long type)
                 goto out_err_no_irq_srcu;
         for (i = 0; i < KVM_NR_BUSES; i++) {
                 rcu_assign_pointer(kvm->buses[i],
-                        kzalloc(sizeof(struct kvm_io_bus), GFP_KERNEL));
+                        kzalloc(sizeof(struct kvm_io_bus), GFP_KERNEL_ACCOUNT));
                 if (!kvm->buses[i])
                         goto out_err;
         }
@@ -789,7 +790,7 @@ static int kvm_create_dirty_bitmap(struct kvm_memory_slot *memslot)
 {
         unsigned long dirty_bytes = 2 * kvm_dirty_bitmap_bytes(memslot);
 
-        memslot->dirty_bitmap = kvzalloc(dirty_bytes, GFP_KERNEL);
+        memslot->dirty_bitmap = kvzalloc(dirty_bytes, GFP_KERNEL_ACCOUNT);
         if (!memslot->dirty_bitmap)
                 return -ENOMEM;
 
@@ -874,31 +875,34 @@ static struct kvm_memslots *install_new_memslots(struct kvm *kvm,
                 int as_id, struct kvm_memslots *slots)
 {
         struct kvm_memslots *old_memslots = __kvm_memslots(kvm, as_id);
+        u64 gen = old_memslots->generation;
 
-        /*
-         * Set the low bit in the generation, which disables SPTE caching
-         * until the end of synchronize_srcu_expedited.
-         */
-        WARN_ON(old_memslots->generation & 1);
-        slots->generation = old_memslots->generation + 1;
+        WARN_ON(gen & KVM_MEMSLOT_GEN_UPDATE_IN_PROGRESS);
+        slots->generation = gen | KVM_MEMSLOT_GEN_UPDATE_IN_PROGRESS;
 
         rcu_assign_pointer(kvm->memslots[as_id], slots);
         synchronize_srcu_expedited(&kvm->srcu);
 
         /*
-         * Increment the new memslot generation a second time. This prevents
-         * vm exits that race with memslot updates from caching a memslot
-         * generation that will (potentially) be valid forever.
-         *
+         * Increment the new memslot generation a second time, dropping the
+         * update in-progress flag and incrementing then generation based on
+         * the number of address spaces.  This provides a unique and easily
+         * identifiable generation number while the memslots are in flux.
+         */
+        gen = slots->generation & ~KVM_MEMSLOT_GEN_UPDATE_IN_PROGRESS;
+
+        /*
          * Generations must be unique even across address spaces.  We do not need
          * a global counter for that, instead the generation space is evenly split
          * across address spaces.  For example, with two address spaces, address
-         * space 0 will use generations 0, 4, 8, ... while * address space 1 will
-         * use generations 2, 6, 10, 14, ...
+         * space 0 will use generations 0, 2, 4, ... while address space 1 will
+         * use generations 1, 3, 5, ...
          */
-        slots->generation += KVM_ADDRESS_SPACE_NUM * 2 - 1;
+        gen += KVM_ADDRESS_SPACE_NUM;
+
+        kvm_arch_memslots_updated(kvm, gen);
 
-        kvm_arch_memslots_updated(kvm, slots);
+        slots->generation = gen;
 
         return old_memslots;
 }
@@ -1018,7 +1022,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
                         goto out_free;
         }
 
-        slots = kvzalloc(sizeof(struct kvm_memslots), GFP_KERNEL);
+        slots = kvzalloc(sizeof(struct kvm_memslots), GFP_KERNEL_ACCOUNT);
         if (!slots)
                 goto out_free;
         memcpy(slots, __kvm_memslots(kvm, as_id), sizeof(struct kvm_memslots));
@@ -1201,11 +1205,9 @@ int kvm_get_dirty_log_protect(struct kvm *kvm,
                         mask = xchg(&dirty_bitmap[i], 0);
                         dirty_bitmap_buffer[i] = mask;
 
-                        if (mask) {
-                                offset = i * BITS_PER_LONG;
-                                kvm_arch_mmu_enable_log_dirty_pt_masked(kvm, memslot,
-                                                                        offset, mask);
-                        }
+                        offset = i * BITS_PER_LONG;
+                        kvm_arch_mmu_enable_log_dirty_pt_masked(kvm, memslot,
+                                                                offset, mask);
                 }
                 spin_unlock(&kvm->mmu_lock);
         }
@@ -2185,20 +2187,23 @@ void kvm_sigset_deactivate(struct kvm_vcpu *vcpu)
 
 static void grow_halt_poll_ns(struct kvm_vcpu *vcpu)
 {
-        unsigned int old, val, grow;
+        unsigned int old, val, grow, grow_start;
 
         old = val = vcpu->halt_poll_ns;
+        grow_start = READ_ONCE(halt_poll_ns_grow_start);
         grow = READ_ONCE(halt_poll_ns_grow);
-        /* 10us base */
-        if (val == 0 && grow)
-                val = 10000;
-        else
-                val *= grow;
+        if (!grow)
+                goto out;
+
+        val *= grow;
+        if (val < grow_start)
+                val = grow_start;
 
         if (val > halt_poll_ns)
                 val = halt_poll_ns;
 
         vcpu->halt_poll_ns = val;
+out:
         trace_kvm_halt_poll_ns_grow(vcpu->vcpu_id, val, old);
 }
 
@@ -2683,7 +2688,7 @@ static long kvm_vcpu_ioctl(struct file *filp,
                 struct kvm_regs *kvm_regs;
 
                 r = -ENOMEM;
-                kvm_regs = kzalloc(sizeof(struct kvm_regs), GFP_KERNEL);
+                kvm_regs = kzalloc(sizeof(struct kvm_regs), GFP_KERNEL_ACCOUNT);
                 if (!kvm_regs)
                         goto out;
                 r = kvm_arch_vcpu_ioctl_get_regs(vcpu, kvm_regs);
@@ -2711,7 +2716,8 @@ out_free1:
                 break;
         }
         case KVM_GET_SREGS: {
-                kvm_sregs = kzalloc(sizeof(struct kvm_sregs), GFP_KERNEL);
+                kvm_sregs = kzalloc(sizeof(struct kvm_sregs),
+                                    GFP_KERNEL_ACCOUNT);
                 r = -ENOMEM;
                 if (!kvm_sregs)
                         goto out;
@@ -2803,7 +2809,7 @@ out_free1:
                 break;
         }
         case KVM_GET_FPU: {
-                fpu = kzalloc(sizeof(struct kvm_fpu), GFP_KERNEL);
+                fpu = kzalloc(sizeof(struct kvm_fpu), GFP_KERNEL_ACCOUNT);
                 r = -ENOMEM;
                 if (!fpu)
                         goto out;
@@ -2980,7 +2986,7 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
         if (test)
                 return 0;
 
-        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+        dev = kzalloc(sizeof(*dev), GFP_KERNEL_ACCOUNT);
         if (!dev)
                 return -ENOMEM;
 
@@ -3625,6 +3631,7 @@ int kvm_io_bus_write(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
         r = __kvm_io_bus_write(vcpu, bus, &range, val);
         return r < 0 ? r : 0;
 }
+EXPORT_SYMBOL_GPL(kvm_io_bus_write);
 
 /* kvm_io_bus_write_cookie - called under kvm->slots_lock */
 int kvm_io_bus_write_cookie(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx,
@@ -3675,7 +3682,6 @@ static int __kvm_io_bus_read(struct kvm_vcpu *vcpu, struct kvm_io_bus *bus,
 
         return -EOPNOTSUPP;
 }
-EXPORT_SYMBOL_GPL(kvm_io_bus_write);
 
 /* kvm_io_bus_read - called under kvm->slots_lock */
 int kvm_io_bus_read(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
@@ -3697,7 +3703,6 @@ int kvm_io_bus_read(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
         return r < 0 ? r : 0;
 }
 
-
 /* Caller must hold slots_lock. */
 int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
                             int len, struct kvm_io_device *dev)
@@ -3714,8 +3719,8 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
         if (bus->dev_count - bus->ioeventfd_count > NR_IOBUS_DEVS - 1)
                 return -ENOSPC;
 
-        new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count + 1) *
-                          sizeof(struct kvm_io_range)), GFP_KERNEL);
+        new_bus = kmalloc(struct_size(bus, range, bus->dev_count + 1),
+                          GFP_KERNEL_ACCOUNT);
         if (!new_bus)
                 return -ENOMEM;
 
@@ -3760,8 +3765,8 @@ void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
         if (i == bus->dev_count)
                 return;
 
-        new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count - 1) *
-                          sizeof(struct kvm_io_range)), GFP_KERNEL);
+        new_bus = kmalloc(struct_size(bus, range, bus->dev_count - 1),
+                          GFP_KERNEL_ACCOUNT);
         if (!new_bus)  {
                 pr_err("kvm: failed to shrink bus, removing it completely\n");
                 goto broken;
@@ -4029,7 +4034,7 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm)
         active = kvm_active_vms;
         spin_unlock(&kvm_lock);
 
-        env = kzalloc(sizeof(*env), GFP_KERNEL);
+        env = kzalloc(sizeof(*env), GFP_KERNEL_ACCOUNT);
         if (!env)
                 return;
 
@@ -4045,7 +4050,7 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm)
         add_uevent_var(env, "PID=%d", kvm->userspace_pid);
 
         if (!IS_ERR_OR_NULL(kvm->debugfs_dentry)) {
-                char *tmp, *p = kmalloc(PATH_MAX, GFP_KERNEL);
+                char *tmp, *p = kmalloc(PATH_MAX, GFP_KERNEL_ACCOUNT);
 
                 if (p) {
                         tmp = dentry_path_raw(kvm->debugfs_dentry, p, PATH_MAX);
diff --git a/virt/kvm/vfio.c b/virt/kvm/vfio.c
index d99850c462a1..524cbd20379f 100644
--- a/virt/kvm/vfio.c
+++ b/virt/kvm/vfio.c
@@ -219,7 +219,7 @@ static int kvm_vfio_set_group(struct kvm_device *dev, long attr, u64 arg)
                         }
                 }
 
-                kvg = kzalloc(sizeof(*kvg), GFP_KERNEL);
+                kvg = kzalloc(sizeof(*kvg), GFP_KERNEL_ACCOUNT);
                 if (!kvg) {
                         mutex_unlock(&kv->lock);
                         kvm_vfio_group_put_external_user(vfio_group);
@@ -405,7 +405,7 @@ static int kvm_vfio_create(struct kvm_device *dev, u32 type)
                 if (tmp->ops == &kvm_vfio_ops)
                         return -EBUSY;
 
-        kv = kzalloc(sizeof(*kv), GFP_KERNEL);
+        kv = kzalloc(sizeof(*kv), GFP_KERNEL_ACCOUNT);
         if (!kv)
                 return -ENOMEM;