637 files changed, 13267 insertions, 8688 deletions

diff --git a/Documentation/RCU/Design/Data-Structures/Data-Structures.html b/Documentation/RCU/Design/Data-Structures/Data-Structures.html
index 6c06e10bd04b..f5120a00f511 100644
--- a/Documentation/RCU/Design/Data-Structures/Data-Structures.html
+++ b/Documentation/RCU/Design/Data-Structures/Data-Structures.html
@@ -380,31 +380,26 @@ and therefore need no protection.
 as follows:
 
 <pre>
-  1   unsigned long gpnum;
-  2   unsigned long completed;
+  1   unsigned long gp_seq;
 </pre>
 
 <p>RCU grace periods are numbered, and
-the <tt>-&gt;gpnum</tt> field contains the number of the grace
-period that started most recently.
-The <tt>-&gt;completed</tt> field contains the number of the
-grace period that completed most recently.
-If the two fields are equal, the RCU grace period that most recently
-started has already completed, and therefore the corresponding
-flavor of RCU is idle.
-If <tt>-&gt;gpnum</tt> is one greater than <tt>-&gt;completed</tt>,
-then <tt>-&gt;gpnum</tt> gives the number of the current RCU
-grace period, which has not yet completed.
-Any other combination of values indicates that something is broken.
-These two fields are protected by the root <tt>rcu_node</tt>'s
+the <tt>-&gt;gp_seq</tt> field contains the current grace-period
+sequence number.
+The bottom two bits are the state of the current grace period,
+which can be zero for not yet started or one for in progress.
+In other words, if the bottom two bits of <tt>-&gt;gp_seq</tt> are
+zero, the corresponding flavor of RCU is idle.
+Any other value in the bottom two bits indicates that something is broken.
+This field is protected by the root <tt>rcu_node</tt> structure's
 <tt>-&gt;lock</tt> field.
 
-</p><p>There are <tt>-&gt;gpnum</tt> and <tt>-&gt;completed</tt> fields
+</p><p>There are <tt>-&gt;gp_seq</tt> fields
 in the <tt>rcu_node</tt> and <tt>rcu_data</tt> structures
 as well.
 The fields in the <tt>rcu_state</tt> structure represent the
-most current values, and those of the other structures are compared
-in order to detect the start of a new grace period in a distributed
+most current value, and those of the other structures are compared
+in order to detect the beginnings and ends of grace periods in a distributed
 fashion.
 The values flow from <tt>rcu_state</tt> to <tt>rcu_node</tt>
 (down the tree from the root to the leaves) to <tt>rcu_data</tt>.
@@ -512,27 +507,47 @@ than to be heisenbugged out of existence.
 as follows:
 
 <pre>
-  1   unsigned long gpnum;
-  2   unsigned long completed;
+  1   unsigned long gp_seq;
+  2   unsigned long gp_seq_needed;
 </pre>
 
-<p>These fields are the counterparts of the fields of the same name in
-the <tt>rcu_state</tt> structure.
-They each may lag up to one behind their <tt>rcu_state</tt>
-counterparts.
-If a given <tt>rcu_node</tt> structure's <tt>-&gt;gpnum</tt> and
-<tt>-&gt;complete</tt> fields are equal, then this <tt>rcu_node</tt>
+<p>The <tt>rcu_node</tt> structures' <tt>-&gt;gp_seq</tt> fields are
+the counterparts of the field of the same name in the <tt>rcu_state</tt>
+structure.
+They each may lag up to one step behind their <tt>rcu_state</tt>
+counterpart.
+If the bottom two bits of a given <tt>rcu_node</tt> structure's
+<tt>-&gt;gp_seq</tt> field is zero, then this <tt>rcu_node</tt>
 structure believes that RCU is idle.
-Otherwise, as with the <tt>rcu_state</tt> structure,
-the <tt>-&gt;gpnum</tt> field will be one greater than the
-<tt>-&gt;complete</tt> fields, with <tt>-&gt;gpnum</tt>
-indicating which grace period this <tt>rcu_node</tt> believes
-is still being waited for.
+</p><p>The <tt>&gt;gp_seq</tt> field of each <tt>rcu_node</tt>
+structure is updated at the beginning and the end
+of each grace period.
+
+<p>The <tt>-&gt;gp_seq_needed</tt> fields record the
+furthest-in-the-future grace period request seen by the corresponding
+<tt>rcu_node</tt> structure.  The request is considered fulfilled when
+the value of the <tt>-&gt;gp_seq</tt> field equals or exceeds that of
+the <tt>-&gt;gp_seq_needed</tt> field.
 
-</p><p>The <tt>&gt;gpnum</tt> field of each <tt>rcu_node</tt>
-structure is updated at the beginning
-of each grace period, and the <tt>-&gt;completed</tt> fields are
-updated at the end of each grace period.
+<table>
+<tr><th>&nbsp;</th></tr>
+<tr><th align="left">Quick Quiz:</th></tr>
+<tr><td>
+        Suppose that this <tt>rcu_node</tt> structure doesn't see
+        a request for a very long time.
+        Won't wrapping of the <tt>-&gt;gp_seq</tt> field cause
+        problems?
+</td></tr>
+<tr><th align="left">Answer:</th></tr>
+<tr><td bgcolor="#ffffff"><font color="ffffff">
+        No, because if the <tt>-&gt;gp_seq_needed</tt> field lags behind the
+        <tt>-&gt;gp_seq</tt> field, the <tt>-&gt;gp_seq_needed</tt> field
+        will be updated at the end of the grace period.
+        Modulo-arithmetic comparisons therefore will always get the
+        correct answer, even with wrapping.
+</font></td></tr>
+<tr><td>&nbsp;</td></tr>
+</table>
 
 <h5>Quiescent-State Tracking</h5>
 
@@ -626,9 +641,8 @@ normal and expedited grace periods, respectively.
         </ol>
 
         <p><font color="ffffff">So the locking is absolutely required in
-        order to coordinate
-        clearing of the bits with the grace-period numbers in
-        <tt>-&gt;gpnum</tt> and <tt>-&gt;completed</tt>.
+        order to coordinate clearing of the bits with updating of the
+        grace-period sequence number in <tt>-&gt;gp_seq</tt>.
 </font></td></tr>
 <tr><td>&nbsp;</td></tr>
 </table>
@@ -1038,15 +1052,15 @@ out any <tt>rcu_data</tt> structure for which this flag is not set.
 as follows:
 
 <pre>
-  1   unsigned long completed;
-  2   unsigned long gpnum;
+  1   unsigned long gp_seq;
+  2   unsigned long gp_seq_needed;
   3   bool cpu_no_qs;
   4   bool core_needs_qs;
   5   bool gpwrap;
   6   unsigned long rcu_qs_ctr_snap;
 </pre>
 
-<p>The <tt>completed</tt> and <tt>gpnum</tt>
+<p>The <tt>-&gt;gp_seq</tt> and <tt>-&gt;gp_seq_needed</tt>
 fields are the counterparts of the fields of the same name
 in the <tt>rcu_state</tt> and <tt>rcu_node</tt> structures.
 They may each lag up to one behind their <tt>rcu_node</tt>
@@ -1054,15 +1068,9 @@ counterparts, but in <tt>CONFIG_NO_HZ_IDLE</tt> and
 <tt>CONFIG_NO_HZ_FULL</tt> kernels can lag
 arbitrarily far behind for CPUs in dyntick-idle mode (but these counters
 will catch up upon exit from dyntick-idle mode).
-If a given <tt>rcu_data</tt> structure's <tt>-&gt;gpnum</tt> and
-<tt>-&gt;complete</tt> fields are equal, then this <tt>rcu_data</tt>
+If the lower two bits of a given <tt>rcu_data</tt> structure's
+<tt>-&gt;gp_seq</tt> are zero, then this <tt>rcu_data</tt>
 structure believes that RCU is idle.
-Otherwise, as with the <tt>rcu_state</tt> and <tt>rcu_node</tt>
-structure,
-the <tt>-&gt;gpnum</tt> field will be one greater than the
-<tt>-&gt;complete</tt> fields, with <tt>-&gt;gpnum</tt>
-indicating which grace period this <tt>rcu_data</tt> believes
-is still being waited for.
 
 <table>
 <tr><th>&nbsp;</th></tr>
@@ -1070,13 +1078,13 @@ is still being waited for.
 <tr><td>
         All this replication of the grace period numbers can only cause
         massive confusion.
-        Why not just keep a global pair of counters and be done with it???
+        Why not just keep a global sequence number and be done with it???
 </td></tr>
 <tr><th align="left">Answer:</th></tr>
 <tr><td bgcolor="#ffffff"><font color="ffffff">
-        Because if there was only a single global pair of grace-period
+        Because if there was only a single global sequence
         numbers, there would need to be a single global lock to allow
-        safely accessing and updating them.
+        safely accessing and updating it.
         And if we are not going to have a single global lock, we need
         to carefully manage the numbers on a per-node basis.
         Recall from the answer to a previous Quick Quiz that the consequences
@@ -1091,8 +1099,8 @@ CPU has not yet passed through a quiescent state,
 while the <tt>-&gt;core_needs_qs</tt> flag indicates that the
 RCU core needs a quiescent state from the corresponding CPU.
 The <tt>-&gt;gpwrap</tt> field indicates that the corresponding
-CPU has remained idle for so long that the <tt>completed</tt>
-and <tt>gpnum</tt> counters are in danger of overflow, which
+CPU has remained idle for so long that the
+<tt>gp_seq</tt> counter is in danger of overflow, which
 will cause the CPU to disregard the values of its counters on
 its next exit from idle.
 Finally, the <tt>rcu_qs_ctr_snap</tt> field is used to detect
@@ -1130,10 +1138,10 @@ The CPU advances the callbacks in its <tt>rcu_data</tt> structure
 whenever it notices that another RCU grace period has completed.
 The CPU detects the completion of an RCU grace period by noticing
 that the value of its <tt>rcu_data</tt> structure's
-<tt>-&gt;completed</tt> field differs from that of its leaf
+<tt>-&gt;gp_seq</tt> field differs from that of its leaf
 <tt>rcu_node</tt> structure.
 Recall that each <tt>rcu_node</tt> structure's
-<tt>-&gt;completed</tt> field is updated at the end of each
+<tt>-&gt;gp_seq</tt> field is updated at the beginnings and ends of each
 grace period.
 
 <p>
diff --git a/Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.html b/Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.html
index 8651b0b4fd79..a346ce0116eb 100644
--- a/Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.html
+++ b/Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.html
@@ -357,7 +357,7 @@ parts, starting in this section with the various phases of
 grace-period initialization.
 
 <p>The first ordering-related grace-period initialization action is to
-increment the <tt>rcu_state</tt> structure's <tt>-&gt;gpnum</tt>
+advance the <tt>rcu_state</tt> structure's <tt>-&gt;gp_seq</tt>
 grace-period-number counter, as shown below:
 
 </p><p><img src="TreeRCU-gp-init-1.svg" alt="TreeRCU-gp-init-1.svg" width="75%">
@@ -388,7 +388,7 @@ its last CPU and if the next <tt>rcu_node</tt> structure has no online CPUs).
 
 <p>The final <tt>rcu_gp_init()</tt> pass through the <tt>rcu_node</tt>
 tree traverses breadth-first, setting each <tt>rcu_node</tt> structure's
-<tt>-&gt;gpnum</tt> field to the newly incremented value from the
+<tt>-&gt;gp_seq</tt> field to the newly advanced value from the
 <tt>rcu_state</tt> structure, as shown in the following diagram.
 
 </p><p><img src="TreeRCU-gp-init-3.svg" alt="TreeRCU-gp-init-1.svg" width="75%">
@@ -398,9 +398,9 @@ tree traverses breadth-first, setting each <tt>rcu_node</tt> structure's
 to notice that a new grace period has started, as described in the next
 section.
 But because the grace-period kthread started the grace period at the
-root (with the increment of the <tt>rcu_state</tt> structure's
-<tt>-&gt;gpnum</tt> field) before setting each leaf <tt>rcu_node</tt>
-structure's <tt>-&gt;gpnum</tt> field, each CPU's observation of
+root (with the advancing of the <tt>rcu_state</tt> structure's
+<tt>-&gt;gp_seq</tt> field) before setting each leaf <tt>rcu_node</tt>
+structure's <tt>-&gt;gp_seq</tt> field, each CPU's observation of
 the start of the grace period will happen after the actual start
 of the grace period.
 
@@ -466,7 +466,7 @@ section that the grace period must wait on.
 <tr><td>
         But a RCU read-side critical section might have started
         after the beginning of the grace period
-        (the <tt>-&gt;gpnum++</tt> from earlier), so why should
+        (the advancing of <tt>-&gt;gp_seq</tt> from earlier), so why should
         the grace period wait on such a critical section?
 </td></tr>
 <tr><th align="left">Answer:</th></tr>
@@ -609,10 +609,8 @@ states outstanding from other CPUs.
 <h4><a name="Grace-Period Cleanup">Grace-Period Cleanup</a></h4>
 
 <p>Grace-period cleanup first scans the <tt>rcu_node</tt> tree
-breadth-first setting all the <tt>-&gt;completed</tt> fields equal
-to the number of the newly completed grace period, then it sets
-the <tt>rcu_state</tt> structure's <tt>-&gt;completed</tt> field,
-again to the number of the newly completed grace period.
+breadth-first advancing all the <tt>-&gt;gp_seq</tt> fields, then it
+advances the <tt>rcu_state</tt> structure's <tt>-&gt;gp_seq</tt> field.
 The ordering effects are shown below:
 
 </p><p><img src="TreeRCU-gp-cleanup.svg" alt="TreeRCU-gp-cleanup.svg" width="75%">
@@ -634,7 +632,7 @@ grace-period cleanup is complete, the next grace period can begin.
         CPU has reported its quiescent state, but it may be some
         milliseconds before RCU becomes aware of this.
         The latest reasonable candidate is once the <tt>rcu_state</tt>
-        structure's <tt>-&gt;completed</tt> field has been updated,
+        structure's <tt>-&gt;gp_seq</tt> field has been updated,
         but it is quite possible that some CPUs have already completed
         phase two of their updates by that time.
         In short, if you are going to work with RCU, you need to
@@ -647,7 +645,7 @@ grace-period cleanup is complete, the next grace period can begin.
 <h4><a name="Callback Invocation">Callback Invocation</a></h4>
 
 <p>Once a given CPU's leaf <tt>rcu_node</tt> structure's
-<tt>-&gt;completed</tt> field has been updated, that CPU can begin
+<tt>-&gt;gp_seq</tt> field has been updated, that CPU can begin
 invoking its RCU callbacks that were waiting for this grace period
 to end.
 These callbacks are identified by <tt>rcu_advance_cbs()</tt>,
diff --git a/Documentation/RCU/Design/Memory-Ordering/TreeRCU-gp-cleanup.svg b/Documentation/RCU/Design/Memory-Ordering/TreeRCU-gp-cleanup.svg
index 754f426b297a..bf84fbab27ee 100644
--- a/Documentation/RCU/Design/Memory-Ordering/TreeRCU-gp-cleanup.svg
+++ b/Documentation/RCU/Design/Memory-Ordering/TreeRCU-gp-cleanup.svg
@@ -384,11 +384,11 @@
      inkscape:window-height="1144"
      id="namedview208"
      showgrid="true"
-     inkscape:zoom="0.70710678"
-     inkscape:cx="617.89017"
-     inkscape:cy="542.52419"
-     inkscape:window-x="86"
-     inkscape:window-y="28"
+     inkscape:zoom="0.78716603"
+     inkscape:cx="513.06403"
+     inkscape:cy="623.1214"
+     inkscape:window-x="102"
+     inkscape:window-y="38"
      inkscape:window-maximized="0"
      inkscape:current-layer="g3188-3"
      fit-margin-top="5"
@@ -417,13 +417,15 @@
      id="g3188">
     <text
        xml:space="preserve"
-       x="3199.1516"
+       x="3145.9592"
        y="13255.592"
        font-style="normal"
        font-weight="bold"
        font-size="192"
        id="text202"
-       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;font-family:Courier">-&gt;completed = -&gt;gpnum</text>
+       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;font-family:Courier"><tspan
+         style="font-size:172.87567139px"
+         id="tspan3143">rcu_seq_end(&amp;rnp-&gt;gp_seq)</tspan></text>
     <g
        id="g3107"
        transform="translate(947.90548,11584.029)">
@@ -502,13 +504,15 @@
     </g>
     <text
        xml:space="preserve"
-       x="5324.5371"
-       y="15414.598"
+       x="5264.4731"
+       y="15428.84"
        font-style="normal"
        font-weight="bold"
        font-size="192"
-       id="text202-753"
-       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;completed = -&gt;gpnum</text>
+       id="text202-36-7"
+       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier"><tspan
+         style="font-size:172.87567139px"
+         id="tspan3166-5">rcu_seq_end(&amp;rnp-&gt;gp_seq)</tspan></text>
   </g>
   <g
      style="fill:none;stroke-width:0.025in"
@@ -547,15 +551,6 @@
        sodipodi:linespacing="125%"><tspan
          style="font-size:159.57754517px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Liberation Sans;-inkscape-font-specification:Liberation Sans"
          id="tspan3104-6-5-6-0">Leaf</tspan></text>
-    <text
-       xml:space="preserve"
-       x="7479.5796"
-       y="17699.943"
-       font-style="normal"
-       font-weight="bold"
-       font-size="192"
-       id="text202-9"
-       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;completed = -&gt;gpnum</text>
     <path
        sodipodi:nodetypes="cc"
        inkscape:connector-curvature="0"
@@ -566,15 +561,6 @@
        style="fill:none;stroke-width:0.025in"
        transform="translate(-737.93887,7732.6672)"
        id="g3188-3">
-      <text
-         xml:space="preserve"
-         x="3225.7478"
-         y="13175.802"
-         font-style="normal"
-         font-weight="bold"
-         font-size="192"
-         id="text202-60"
-         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;font-family:Courier">rsp-&gt;completed =</text>
       <g
          id="g3107-62"
          transform="translate(947.90548,11584.029)">
@@ -607,15 +593,6 @@
          sodipodi:linespacing="125%"><tspan
            style="font-size:159.57754517px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Liberation Sans;-inkscape-font-specification:Liberation Sans"
            id="tspan3104-6-5-7">Root</tspan></text>
-      <text
-         xml:space="preserve"
-         x="3225.7478"
-         y="13390.038"
-         font-style="normal"
-         font-weight="bold"
-         font-size="192"
-         id="text202-60-3"
-         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">       rnp-&gt;completed</text>
       <flowRoot
          xml:space="preserve"
          id="flowRoot3356"
@@ -627,7 +604,18 @@
              height="63.63961"
              x="332.34018"
              y="681.87292" /></flowRegion><flowPara
-           id="flowPara3362" /></flowRoot>    </g>
+           id="flowPara3362" /></flowRoot>      <text
+         xml:space="preserve"
+         x="3156.6121"
+         y="13317.754"
+         font-style="normal"
+         font-weight="bold"
+         font-size="192"
+         id="text202-36-6"
+         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier"><tspan
+           style="font-size:172.87567139px"
+           id="tspan3166-0">rcu_seq_end(&amp;rsp-&gt;gp_seq)</tspan></text>
+    </g>
     <g
        style="fill:none;stroke-width:0.025in"
        transform="translate(-858.40227,7769.0342)"
@@ -859,6 +847,17 @@
        id="path3414-8-3-6-6"
        inkscape:connector-curvature="0"
        sodipodi:nodetypes="cc" />
+    <text
+       xml:space="preserve"
+       x="7418.769"
+       y="17646.104"
+       font-style="normal"
+       font-weight="bold"
+       font-size="192"
+       id="text202-36-70"
+       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier"><tspan
+         style="font-size:172.87567139px"
+         id="tspan3166-93">rcu_seq_end(&amp;rnp-&gt;gp_seq)</tspan></text>
   </g>
   <g
      transform="translate(-1642.5377,-11611.245)"
@@ -887,13 +886,15 @@
     </g>
     <text
        xml:space="preserve"
-       x="5327.3057"
+       x="5274.1133"
        y="15428.84"
        font-style="normal"
        font-weight="bold"
        font-size="192"
        id="text202-36"
-       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;completed = -&gt;gpnum</text>
+       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier"><tspan
+         style="font-size:172.87567139px"
+         id="tspan3166">rcu_seq_end(&amp;rnp-&gt;gp_seq)</tspan></text>
   </g>
   <g
      transform="translate(-151.71746,-11647.612)"
@@ -972,13 +973,15 @@
          id="tspan3104-6-5-6-0-92">Leaf</tspan></text>
     <text
        xml:space="preserve"
-       x="7486.4907"
-       y="17670.119"
+       x="7408.5918"
+       y="17619.504"
        font-style="normal"
        font-weight="bold"
        font-size="192"
-       id="text202-6"
-       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;completed = -&gt;gpnum</text>
+       id="text202-36-2"
+       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier"><tspan
+         style="font-size:172.87567139px"
+         id="tspan3166-9">rcu_seq_end(&amp;rnp-&gt;gp_seq)</tspan></text>
   </g>
   <g
      transform="translate(-6817.1997,-11647.612)"
@@ -1019,13 +1022,15 @@
          id="tspan3104-6-5-6-0-1">Leaf</tspan></text>
     <text
        xml:space="preserve"
-       x="7474.1382"
-       y="17688.926"
+       x="7416.8003"
+       y="17619.504"
        font-style="normal"
        font-weight="bold"
        font-size="192"
-       id="text202-5"
-       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;completed = -&gt;gpnum</text>
+       id="text202-36-3"
+       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier"><tspan
+         style="font-size:172.87567139px"
+         id="tspan3166-56">rcu_seq_end(&amp;rnp-&gt;gp_seq)</tspan></text>
   </g>
   <path
      style="fill:none;stroke:#000000;stroke-width:13.29812908px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-end:url(#Arrow2Lend)"
@@ -1059,15 +1064,6 @@
      id="path3414-8-3-6"
      inkscape:connector-curvature="0"
      sodipodi:nodetypes="cc" />
-  <text
-     xml:space="preserve"
-     x="7318.9653"
-     y="6031.6353"
-     font-style="normal"
-     font-weight="bold"
-     font-size="192"
-     id="text202-2"
-     style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;completed = -&gt;gpnum</text>
   <g
      style="fill:none;stroke-width:0.025in"
      id="g4504-3-9"
@@ -1123,4 +1119,15 @@
      id="path3134-9-0-3-5"
      d="m 6875.6003,15833.906 1595.7755,0"
      style="fill:none;stroke:#969696;stroke-width:53.19251633;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;marker-end:url(#Arrow1Send-36)" />
+  <text
+     xml:space="preserve"
+     x="7275.2612"
+     y="5971.8916"
+     font-style="normal"
+     font-weight="bold"
+     font-size="192"
+     id="text202-36-1"
+     style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier"><tspan
+       style="font-size:172.87567139px"
+       id="tspan3166-2">rcu_seq_end(&amp;rnp-&gt;gp_seq)</tspan></text>
 </svg>
diff --git a/Documentation/RCU/Design/Memory-Ordering/TreeRCU-gp-init-1.svg b/Documentation/RCU/Design/Memory-Ordering/TreeRCU-gp-init-1.svg
index 0161262904ec..8c207550818f 100644
--- a/Documentation/RCU/Design/Memory-Ordering/TreeRCU-gp-init-1.svg
+++ b/Documentation/RCU/Design/Memory-Ordering/TreeRCU-gp-init-1.svg
@@ -272,13 +272,13 @@
      inkscape:window-height="1144"
      id="namedview208"
      showgrid="true"
-     inkscape:zoom="0.70710678"
-     inkscape:cx="617.89019"
-     inkscape:cy="636.57143"
-     inkscape:window-x="697"
+     inkscape:zoom="2.6330492"
+     inkscape:cx="524.82797"
+     inkscape:cy="519.31194"
+     inkscape:window-x="79"
      inkscape:window-y="28"
      inkscape:window-maximized="0"
-     inkscape:current-layer="svg2"
+     inkscape:current-layer="g3188"
      fit-margin-top="5"
      fit-margin-right="5"
      fit-margin-left="5"
@@ -305,13 +305,15 @@
      id="g3188">
     <text
        xml:space="preserve"
-       x="3305.5364"
+       x="3119.363"
        y="13255.592"
        font-style="normal"
        font-weight="bold"
        font-size="192"
        id="text202"
-       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;font-family:Courier">rsp-&gt;gpnum++</text>
+       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;font-family:Courier"><tspan
+         style="font-size:172.87567139px"
+         id="tspan3071">rcu_seq_start(rsp-&gt;gp_seq)</tspan></text>
     <g
        id="g3107"
        transform="translate(947.90548,11584.029)">
diff --git a/Documentation/RCU/Design/Memory-Ordering/TreeRCU-gp-init-3.svg b/Documentation/RCU/Design/Memory-Ordering/TreeRCU-gp-init-3.svg
index de6ecc51b00e..d24d7d555dbc 100644
--- a/Documentation/RCU/Design/Memory-Ordering/TreeRCU-gp-init-3.svg
+++ b/Documentation/RCU/Design/Memory-Ordering/TreeRCU-gp-init-3.svg
@@ -19,7 +19,7 @@
    id="svg2"
    version="1.1"
    inkscape:version="0.48.4 r9939"
-   sodipodi:docname="TreeRCU-gp-init-2.svg">
+   sodipodi:docname="TreeRCU-gp-init-3.svg">
   <metadata
      id="metadata212">
     <rdf:RDF>
@@ -257,18 +257,22 @@
      inkscape:window-width="1087"
      inkscape:window-height="1144"
      id="namedview208"
-     showgrid="false"
-     inkscape:zoom="0.70710678"
+     showgrid="true"
+     inkscape:zoom="0.68224756"
      inkscape:cx="617.89019"
      inkscape:cy="625.84293"
-     inkscape:window-x="697"
+     inkscape:window-x="54"
      inkscape:window-y="28"
      inkscape:window-maximized="0"
-     inkscape:current-layer="svg2"
+     inkscape:current-layer="g3153"
      fit-margin-top="5"
      fit-margin-right="5"
      fit-margin-left="5"
-     fit-margin-bottom="5" />
+     fit-margin-bottom="5">
+    <inkscape:grid
+       type="xygrid"
+       id="grid3090" />
+  </sodipodi:namedview>
   <path
      sodipodi:nodetypes="cccccccccccccccccccccccc"
      inkscape:connector-curvature="0"
@@ -281,13 +285,13 @@
      id="g3188">
     <text
        xml:space="preserve"
-       x="3305.5364"
+       x="3145.9592"
        y="13255.592"
        font-style="normal"
        font-weight="bold"
        font-size="192"
        id="text202"
-       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;font-family:Courier">-&gt;gpnum = rsp-&gt;gpnum</text>
+       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;font-family:Courier">-&gt;gp_seq = rsp-&gt;gp_seq</text>
     <g
        id="g3107"
        transform="translate(947.90548,11584.029)">
@@ -366,13 +370,13 @@
     </g>
     <text
        xml:space="preserve"
-       x="5392.3345"
-       y="15407.104"
+       x="5253.6904"
+       y="15407.032"
        font-style="normal"
        font-weight="bold"
        font-size="192"
        id="text202-6"
-       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gpnum = rsp-&gt;gpnum</text>
+       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gp_seq = rsp-&gt;gp_seq</text>
   </g>
   <g
      style="fill:none;stroke-width:0.025in"
@@ -413,13 +417,13 @@
          id="tspan3104-6-5-6-0">Leaf</tspan></text>
     <text
        xml:space="preserve"
-       x="7536.4883"
-       y="17640.934"
+       x="7415.4365"
+       y="17670.572"
        font-style="normal"
        font-weight="bold"
        font-size="192"
        id="text202-9"
-       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gpnum = rsp-&gt;gpnum</text>
+       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gp_seq = rsp-&gt;gp_seq</text>
   </g>
   <g
      transform="translate(-1642.5375,-11610.962)"
@@ -448,13 +452,13 @@
     </g>
     <text
        xml:space="preserve"
-       x="5378.4146"
-       y="15436.927"
+       x="5258.0688"
+       y="15412.313"
        font-style="normal"
        font-weight="bold"
        font-size="192"
        id="text202-3"
-       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gpnum = rsp-&gt;gpnum</text>
+       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gp_seq = rsp-&gt;gp_seq</text>
   </g>
   <g
      transform="translate(-151.71726,-11647.329)"
@@ -533,13 +537,13 @@
          id="tspan3104-6-5-6-0-92">Leaf</tspan></text>
     <text
        xml:space="preserve"
-       x="7520.1294"
-       y="17673.639"
+       x="7405.2607"
+       y="17670.572"
        font-style="normal"
        font-weight="bold"
        font-size="192"
        id="text202-35"
-       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gpnum = rsp-&gt;gpnum</text>
+       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gp_seq = rsp-&gt;gp_seq</text>
   </g>
   <g
      transform="translate(-6817.1998,-11647.329)"
@@ -580,13 +584,13 @@
          id="tspan3104-6-5-6-0-1">Leaf</tspan></text>
     <text
        xml:space="preserve"
-       x="7521.4663"
-       y="17666.062"
+       x="7413.4688"
+       y="17670.566"
        font-style="normal"
        font-weight="bold"
        font-size="192"
        id="text202-75"
-       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gpnum = rsp-&gt;gpnum</text>
+       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gp_seq = rsp-&gt;gp_seq</text>
   </g>
   <path
      style="fill:none;stroke:#000000;stroke-width:13.29812908px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-end:url(#Arrow2Lend)"
@@ -622,11 +626,11 @@
      sodipodi:nodetypes="cc" />
   <text
      xml:space="preserve"
-     x="7370.856"
-     y="5997.5972"
+     x="7271.9297"
+     y="6023.2412"
      font-style="normal"
      font-weight="bold"
      font-size="192"
      id="text202-62"
-     style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gpnum = rsp-&gt;gpnum</text>
+     style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gp_seq = rsp-&gt;gp_seq</text>
 </svg>
diff --git a/Documentation/RCU/Design/Memory-Ordering/TreeRCU-gp.svg b/Documentation/RCU/Design/Memory-Ordering/TreeRCU-gp.svg
index b13b7b01bb3a..acd73c7ad0f4 100644
--- a/Documentation/RCU/Design/Memory-Ordering/TreeRCU-gp.svg
+++ b/Documentation/RCU/Design/Memory-Ordering/TreeRCU-gp.svg
@@ -1070,13 +1070,13 @@
      inkscape:window-height="1144"
      id="namedview208"
      showgrid="true"
-     inkscape:zoom="0.6004608"
-     inkscape:cx="826.65969"
-     inkscape:cy="483.3047"
-     inkscape:window-x="66"
-     inkscape:window-y="28"
+     inkscape:zoom="0.81932583"
+     inkscape:cx="840.45848"
+     inkscape:cy="5052.4242"
+     inkscape:window-x="787"
+     inkscape:window-y="24"
      inkscape:window-maximized="0"
-     inkscape:current-layer="svg2"
+     inkscape:current-layer="g4"
      fit-margin-top="5"
      fit-margin-right="5"
      fit-margin-left="5"
@@ -1543,15 +1543,6 @@
        style="fill:none;stroke-width:0.025in"
        transform="translate(1749.0282,658.72243)"
        id="g3188">
-      <text
-         xml:space="preserve"
-         x="3305.5364"
-         y="13255.592"
-         font-style="normal"
-         font-weight="bold"
-         font-size="192"
-         id="text202-5"
-         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;font-family:Courier">rsp-&gt;gpnum++</text>
       <g
          id="g3107-62"
          transform="translate(947.90548,11584.029)">
@@ -1584,6 +1575,17 @@
          sodipodi:linespacing="125%"><tspan
            style="font-size:159.57754517px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Liberation Sans;-inkscape-font-specification:Liberation Sans"
            id="tspan3104-6-5-7">Root</tspan></text>
+      <text
+         xml:space="preserve"
+         x="3137.9988"
+         y="13271.316"
+         font-style="normal"
+         font-weight="bold"
+         font-size="192"
+         id="text202-626"
+         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier"><tspan
+           style="font-size:172.87567139px"
+           id="tspan3071">rcu_seq_start(rsp-&gt;gp_seq)</tspan></text>
     </g>
     <rect
        ry="0"
@@ -2318,15 +2320,6 @@
        style="fill:none;stroke-width:0.025in"
        transform="translate(1739.0986,17188.625)"
        id="g3188-6">
-      <text
-         xml:space="preserve"
-         x="3305.5364"
-         y="13255.592"
-         font-style="normal"
-         font-weight="bold"
-         font-size="192"
-         id="text202-1"
-         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;font-family:Courier">-&gt;gpnum = rsp-&gt;gpnum</text>
       <g
          id="g3107-5"
          transform="translate(947.90548,11584.029)">
@@ -2359,6 +2352,15 @@
          sodipodi:linespacing="125%"><tspan
            style="font-size:159.57754517px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Liberation Sans;-inkscape-font-specification:Liberation Sans"
            id="tspan3104-6-5-1">Root</tspan></text>
+      <text
+         xml:space="preserve"
+         x="3147.9268"
+         y="13240.524"
+         font-style="normal"
+         font-weight="bold"
+         font-size="192"
+         id="text202-1"
+         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gp_seq = rsp-&gt;gp_seq</text>
     </g>
     <g
        style="fill:none;stroke-width:0.025in"
@@ -2387,13 +2389,13 @@
       </g>
       <text
          xml:space="preserve"
-         x="5392.3345"
-         y="15407.104"
+         x="5263.1094"
+         y="15411.646"
          font-style="normal"
          font-weight="bold"
          font-size="192"
-         id="text202-6-7"
-         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gpnum = rsp-&gt;gpnum</text>
+         id="text202-92"
+         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gp_seq = rsp-&gt;gp_seq</text>
     </g>
     <g
        style="fill:none;stroke-width:0.025in"
@@ -2434,13 +2436,13 @@
            id="tspan3104-6-5-6-0-94">Leaf</tspan></text>
       <text
          xml:space="preserve"
-         x="7536.4883"
-         y="17640.934"
+         x="7417.4053"
+         y="17655.502"
          font-style="normal"
          font-weight="bold"
          font-size="192"
-         id="text202-9"
-         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gpnum = rsp-&gt;gpnum</text>
+         id="text202-759"
+         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gp_seq = rsp-&gt;gp_seq</text>
     </g>
     <g
        transform="translate(-2353.8462,17224.992)"
@@ -2469,13 +2471,13 @@
       </g>
       <text
          xml:space="preserve"
-         x="5378.4146"
-         y="15436.927"
+         x="5246.1548"
+         y="15411.648"
          font-style="normal"
          font-weight="bold"
          font-size="192"
-         id="text202-3"
-         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gpnum = rsp-&gt;gpnum</text>
+         id="text202-87"
+         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gp_seq = rsp-&gt;gp_seq</text>
     </g>
     <g
        transform="translate(-863.02613,17188.625)"
@@ -2554,13 +2556,13 @@
            id="tspan3104-6-5-6-0-92-6">Leaf</tspan></text>
       <text
          xml:space="preserve"
-         x="7520.1294"
-         y="17673.639"
+         x="7433.8257"
+         y="17682.098"
          font-style="normal"
          font-weight="bold"
          font-size="192"
-         id="text202-35"
-         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gpnum = rsp-&gt;gpnum</text>
+         id="text202-2"
+         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gp_seq = rsp-&gt;gp_seq</text>
     </g>
     <g
        transform="translate(-7528.5085,17188.625)"
@@ -2601,13 +2603,13 @@
            id="tspan3104-6-5-6-0-1-8">Leaf</tspan></text>
       <text
          xml:space="preserve"
-         x="7521.4663"
-         y="17666.062"
+         x="7415.4404"
+         y="17682.098"
          font-style="normal"
          font-weight="bold"
          font-size="192"
-         id="text202-75-1"
-         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gpnum = rsp-&gt;gpnum</text>
+         id="text202-0"
+         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gp_seq = rsp-&gt;gp_seq</text>
     </g>
     <path
        style="fill:none;stroke:#000000;stroke-width:13.29812813px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-end:url(#Arrow2Lend)"
@@ -2641,15 +2643,6 @@
        id="path3414-8-3-6-4"
        inkscape:connector-curvature="0"
        sodipodi:nodetypes="cc" />
-    <text
-       xml:space="preserve"
-       x="6659.5469"
-       y="34833.551"
-       font-style="normal"
-       font-weight="bold"
-       font-size="192"
-       id="text202-62"
-       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gpnum = rsp-&gt;gpnum</text>
     <path
        sodipodi:nodetypes="ccc"
        inkscape:connector-curvature="0"
@@ -3844,7 +3837,7 @@
          font-weight="bold"
          font-size="192"
          id="text202-6-6-5"
-         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">rdp-&gt;gpnum</text>
+         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">rdp-&gt;gp_seq</text>
       <text
          xml:space="preserve"
          x="5035.4155"
@@ -4284,15 +4277,6 @@
        style="fill:none;stroke-width:0.025in"
        transform="translate(1874.038,53203.538)"
        id="g3188-7">
-      <text
-         xml:space="preserve"
-         x="3199.1516"
-         y="13255.592"
-         font-style="normal"
-         font-weight="bold"
-         font-size="192"
-         id="text202-82"
-         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;font-family:Courier">-&gt;completed = -&gt;gpnum</text>
       <g
          id="g3107-53"
          transform="translate(947.90548,11584.029)">
@@ -4325,6 +4309,17 @@
          sodipodi:linespacing="125%"><tspan
            style="font-size:159.57754517px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Liberation Sans;-inkscape-font-specification:Liberation Sans"
            id="tspan3104-6-5-19">Root</tspan></text>
+      <text
+         xml:space="preserve"
+         x="3175.896"
+         y="13240.11"
+         font-style="normal"
+         font-weight="bold"
+         font-size="192"
+         id="text202-36-3"
+         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier"><tspan
+           style="font-size:172.87567139px"
+           id="tspan3166">rcu_seq_end(&amp;rnp-&gt;gp_seq)</tspan></text>
     </g>
     <rect
        ry="0"
@@ -4371,13 +4366,15 @@
       </g>
       <text
          xml:space="preserve"
-         x="5324.5371"
-         y="15414.598"
+         x="5264.4829"
+         y="15411.231"
          font-style="normal"
          font-weight="bold"
          font-size="192"
-         id="text202-753"
-         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;completed = -&gt;gpnum</text>
+         id="text202-36-7"
+         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier"><tspan
+           style="font-size:172.87567139px"
+           id="tspan3166-5">rcu_seq_end(&amp;rnp-&gt;gp_seq)</tspan></text>
     </g>
     <g
        style="fill:none;stroke-width:0.025in"
@@ -4412,30 +4409,12 @@
        sodipodi:linespacing="125%"><tspan
          style="font-size:159.57754517px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Liberation Sans;-inkscape-font-specification:Liberation Sans"
          id="tspan3104-6-5-6-0-4">Leaf</tspan></text>
-    <text
-       xml:space="preserve"
-       x="10084.225"
-       y="70903.312"
-       font-style="normal"
-       font-weight="bold"
-       font-size="192"
-       id="text202-9-0"
-       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;completed = -&gt;gpnum</text>
     <path
        sodipodi:nodetypes="ccc"
        inkscape:connector-curvature="0"
        id="path3134-9-0-3-9"
        d="m 6315.6122,72629.054 -20.9533,8108.684 1648.968,0"
        style="fill:none;stroke:#969696;stroke-width:53.19251251;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none;marker-end:url(#Arrow1Send)" />
-    <text
-       xml:space="preserve"
-       x="5092.4683"
-       y="74111.672"
-       font-style="normal"
-       font-weight="bold"
-       font-size="192"
-       id="text202-60"
-       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">rsp-&gt;completed =</text>
     <g
        style="fill:none;stroke-width:0.025in"
        id="g3107-62-6"
@@ -4469,15 +4448,6 @@
        sodipodi:linespacing="125%"><tspan
          style="font-size:159.57754517px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;font-family:Liberation Sans;-inkscape-font-specification:Liberation Sans"
          id="tspan3104-6-5-7-7">Root</tspan></text>
-    <text
-       xml:space="preserve"
-       x="5092.4683"
-       y="74325.906"
-       font-style="normal"
-       font-weight="bold"
-       font-size="192"
-       id="text202-60-3"
-       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">       rnp-&gt;completed</text>
     <g
        style="fill:none;stroke-width:0.025in"
        transform="translate(1746.2528,60972.572)"
@@ -4736,13 +4706,15 @@
       </g>
       <text
          xml:space="preserve"
-         x="5327.3057"
-         y="15428.84"
+         x="5274.1216"
+         y="15411.231"
          font-style="normal"
          font-weight="bold"
          font-size="192"
          id="text202-36"
-         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;completed = -&gt;gpnum</text>
+         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier"><tspan
+           style="font-size:172.87567139px"
+           id="tspan3166-6">rcu_seq_end(&amp;rnp-&gt;gp_seq)</tspan></text>
     </g>
     <g
        transform="translate(-728.08545,53203.538)"
@@ -4821,13 +4793,15 @@
            id="tspan3104-6-5-6-0-92-5">Leaf</tspan></text>
       <text
          xml:space="preserve"
-         x="7486.4907"
-         y="17670.119"
+         x="7435.1987"
+         y="17708.281"
          font-style="normal"
          font-weight="bold"
          font-size="192"
-         id="text202-6-2"
-         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;completed = -&gt;gpnum</text>
+         id="text202-36-9"
+         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier"><tspan
+           style="font-size:172.87567139px"
+           id="tspan3166-1">rcu_seq_end(&amp;rnp-&gt;gp_seq)</tspan></text>
     </g>
     <g
        transform="translate(-7393.5687,53203.538)"
@@ -4868,13 +4842,15 @@
            id="tspan3104-6-5-6-0-1-5">Leaf</tspan></text>
       <text
          xml:space="preserve"
-         x="7474.1382"
-         y="17688.926"
+         x="7416.8125"
+         y="17708.281"
          font-style="normal"
          font-weight="bold"
          font-size="192"
-         id="text202-5-1"
-         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;completed = -&gt;gpnum</text>
+         id="text202-36-35"
+         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier"><tspan
+           style="font-size:172.87567139px"
+           id="tspan3166-62">rcu_seq_end(&amp;rnp-&gt;gp_seq)</tspan></text>
     </g>
     <path
        style="fill:none;stroke:#000000;stroke-width:13.29812813px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-end:url(#Arrow2Lend)"
@@ -4908,15 +4884,6 @@
        id="path3414-8-3-6-67"
        inkscape:connector-curvature="0"
        sodipodi:nodetypes="cc" />
-    <text
-       xml:space="preserve"
-       x="6742.6001"
-       y="70882.617"
-       font-style="normal"
-       font-weight="bold"
-       font-size="192"
-       id="text202-2"
-       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;completed = -&gt;gpnum</text>
     <g
        style="fill:none;stroke-width:0.025in"
        id="g4504-3-9-6"
@@ -5131,5 +5098,47 @@
        font-size="192"
        id="text202-7-9-6-6-7"
        style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">rcu_do_batch()</text>
+    <text
+       xml:space="preserve"
+       x="6698.9019"
+       y="70885.211"
+       font-style="normal"
+       font-weight="bold"
+       font-size="192"
+       id="text202-36-2"
+       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier"><tspan
+         style="font-size:172.87567139px"
+         id="tspan3166-7">rcu_seq_end(&amp;rnp-&gt;gp_seq)</tspan></text>
+    <text
+       xml:space="preserve"
+       x="10023.457"
+       y="70885.234"
+       font-style="normal"
+       font-weight="bold"
+       font-size="192"
+       id="text202-36-0"
+       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier"><tspan
+         style="font-size:172.87567139px"
+         id="tspan3166-9">rcu_seq_end(&amp;rnp-&gt;gp_seq)</tspan></text>
+    <text
+       xml:space="preserve"
+       x="5023.3389"
+       y="74209.773"
+       font-style="normal"
+       font-weight="bold"
+       font-size="192"
+       id="text202-36-36"
+       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier"><tspan
+         style="font-size:172.87567139px"
+         id="tspan3166-0">rcu_seq_end(&amp;rsp-&gt;gp_seq)</tspan></text>
+    <text
+       xml:space="preserve"
+       x="6562.5884"
+       y="34870.727"
+       font-style="normal"
+       font-weight="bold"
+       font-size="192"
+       id="text202-3"
+       style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">-&gt;gp_seq = rsp-&gt;gp_seq</text>
   </g>
 </svg>
diff --git a/Documentation/RCU/Design/Memory-Ordering/TreeRCU-qs.svg b/Documentation/RCU/Design/Memory-Ordering/TreeRCU-qs.svg
index de3992f4cbe1..149bec2a4493 100644
--- a/Documentation/RCU/Design/Memory-Ordering/TreeRCU-qs.svg
+++ b/Documentation/RCU/Design/Memory-Ordering/TreeRCU-qs.svg
@@ -300,13 +300,13 @@
      inkscape:window-height="1144"
      id="namedview208"
      showgrid="true"
-     inkscape:zoom="0.70710678"
-     inkscape:cx="616.47598"
-     inkscape:cy="595.41964"
-     inkscape:window-x="813"
+     inkscape:zoom="0.96484375"
+     inkscape:cx="507.0191"
+     inkscape:cy="885.62207"
+     inkscape:window-x="47"
      inkscape:window-y="28"
      inkscape:window-maximized="0"
-     inkscape:current-layer="g4405"
+     inkscape:current-layer="g3115"
      fit-margin-top="5"
      fit-margin-right="5"
      fit-margin-left="5"
@@ -710,7 +710,7 @@
          font-weight="bold"
          font-size="192"
          id="text202-6-6"
-         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">rdp-&gt;gpnum</text>
+         style="font-size:192px;font-style:normal;font-weight:bold;text-anchor:start;fill:#000000;stroke-width:0.025in;font-family:Courier">rdp-&gt;gp_seq</text>
       <text
          xml:space="preserve"
          x="5035.4155"
diff --git a/Documentation/RCU/stallwarn.txt b/Documentation/RCU/stallwarn.txt
index 4259f95c3261..f99cf11b314b 100644
--- a/Documentation/RCU/stallwarn.txt
+++ b/Documentation/RCU/stallwarn.txt
@@ -172,7 +172,7 @@ it will print a message similar to the following:
         INFO: rcu_sched detected stalls on CPUs/tasks:
         2-...: (3 GPs behind) idle=06c/0/0 softirq=1453/1455 fqs=0
         16-...: (0 ticks this GP) idle=81c/0/0 softirq=764/764 fqs=0
-        (detected by 32, t=2603 jiffies, g=7073, c=7072, q=625)
+        (detected by 32, t=2603 jiffies, g=7075, q=625)
 
 This message indicates that CPU 32 detected that CPUs 2 and 16 were both
 causing stalls, and that the stall was affecting RCU-sched.  This message
@@ -215,11 +215,10 @@ CPU since the last time that this CPU noted the beginning of a grace
 period.
 
 The "detected by" line indicates which CPU detected the stall (in this
-case, CPU 32), how many jiffies have elapsed since the start of the
-grace period (in this case 2603), the number of the last grace period
-to start and to complete (7073 and 7072, respectively), and an estimate
-of the total number of RCU callbacks queued across all CPUs (625 in
-this case).
+case, CPU 32), how many jiffies have elapsed since the start of the grace
+period (in this case 2603), the grace-period sequence number (7075), and
+an estimate of the total number of RCU callbacks queued across all CPUs
+(625 in this case).
 
 In kernels with CONFIG_RCU_FAST_NO_HZ, more information is printed
 for each CPU:
@@ -266,15 +265,16 @@ If the relevant grace-period kthread has been unable to run prior to
 the stall warning, as was the case in the "All QSes seen" line above,
 the following additional line is printed:
 
-        kthread starved for 23807 jiffies! g7073 c7072 f0x0 RCU_GP_WAIT_FQS(3) ->state=0x1
+        kthread starved for 23807 jiffies! g7075 f0x0 RCU_GP_WAIT_FQS(3) ->state=0x1 ->cpu=5
 
 Starving the grace-period kthreads of CPU time can of course result
 in RCU CPU stall warnings even when all CPUs and tasks have passed
-through the required quiescent states.  The "g" and "c" numbers flag the
-number of the last grace period started and completed, respectively,
-the "f" precedes the ->gp_flags command to the grace-period kthread,
-the "RCU_GP_WAIT_FQS" indicates that the kthread is waiting for a short
-timeout, and the "state" precedes value of the task_struct ->state field.
+through the required quiescent states.  The "g" number shows the current
+grace-period sequence number, the "f" precedes the ->gp_flags command
+to the grace-period kthread, the "RCU_GP_WAIT_FQS" indicates that the
+kthread is waiting for a short timeout, the "state" precedes value of the
+task_struct ->state field, and the "cpu" indicates that the grace-period
+kthread last ran on CPU 5.
 
 
 Multiple Warnings From One Stall
diff --git a/Documentation/RCU/whatisRCU.txt b/Documentation/RCU/whatisRCU.txt
index 65eb856526b7..c2a7facf7ff9 100644
--- a/Documentation/RCU/whatisRCU.txt
+++ b/Documentation/RCU/whatisRCU.txt
@@ -588,6 +588,7 @@ It is extremely simple:
         void synchronize_rcu(void)
         {
                 write_lock(&rcu_gp_mutex);
+                smp_mb__after_spinlock();
                 write_unlock(&rcu_gp_mutex);
         }
 
@@ -609,12 +610,15 @@ don't forget about them when submitting patches making use of RCU!]
 
 The rcu_read_lock() and rcu_read_unlock() primitive read-acquire
 and release a global reader-writer lock.  The synchronize_rcu()
-primitive write-acquires this same lock, then immediately releases
-it.  This means that once synchronize_rcu() exits, all RCU read-side
-critical sections that were in progress before synchronize_rcu() was
-called are guaranteed to have completed -- there is no way that
-synchronize_rcu() would have been able to write-acquire the lock
-otherwise.
+primitive write-acquires this same lock, then releases it.  This means
+that once synchronize_rcu() exits, all RCU read-side critical sections
+that were in progress before synchronize_rcu() was called are guaranteed
+to have completed -- there is no way that synchronize_rcu() would have
+been able to write-acquire the lock otherwise.  The smp_mb__after_spinlock()
+promotes synchronize_rcu() to a full memory barrier in compliance with
+the "Memory-Barrier Guarantees" listed in:
+
+        Documentation/RCU/Design/Requirements/Requirements.html.
 
 It is possible to nest rcu_read_lock(), since reader-writer locks may
 be recursively acquired.  Note also that rcu_read_lock() is immune
@@ -816,11 +820,13 @@ RCU list traversal:
         list_next_rcu
         list_for_each_entry_rcu
         list_for_each_entry_continue_rcu
+        list_for_each_entry_from_rcu
         hlist_first_rcu
         hlist_next_rcu
         hlist_pprev_rcu
         hlist_for_each_entry_rcu
         hlist_for_each_entry_rcu_bh
+        hlist_for_each_entry_from_rcu
         hlist_for_each_entry_continue_rcu
         hlist_for_each_entry_continue_rcu_bh
         hlist_nulls_first_rcu
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 533ff5c68970..5cde1ff32ff3 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -2835,8 +2835,6 @@
 
         nosync          [HW,M68K] Disables sync negotiation for all devices.
 
-        notsc           [BUGS=X86-32] Disable Time Stamp Counter
-
         nowatchdog      [KNL] Disable both lockup detectors, i.e.
                         soft-lockup and NMI watchdog (hard-lockup).
 
@@ -3632,8 +3630,8 @@
                         Set time (s) after boot for CPU-hotplug testing.
 
         rcutorture.onoff_interval= [KNL]
-                        Set time (s) between CPU-hotplug operations, or
-                        zero to disable CPU-hotplug testing.
+                        Set time (jiffies) between CPU-hotplug operations,
+                        or zero to disable CPU-hotplug testing.
 
         rcutorture.shuffle_interval= [KNL]
                         Set task-shuffle interval (s).  Shuffling tasks
diff --git a/Documentation/core-api/atomic_ops.rst b/Documentation/core-api/atomic_ops.rst
index 2e7165f86f55..724583453e1f 100644
--- a/Documentation/core-api/atomic_ops.rst
+++ b/Documentation/core-api/atomic_ops.rst
@@ -29,7 +29,7 @@ updated by one CPU, local_t is probably more appropriate. Please see
 local_t.
 
 The first operations to implement for atomic_t's are the initializers and
-plain reads. ::
+plain writes. ::
 
         #define ATOMIC_INIT(i)          { (i) }
         #define atomic_set(v, i)        ((v)->counter = (i))
diff --git a/Documentation/devicetree/bindings/interrupt-controller/ingenic,intc.txt b/Documentation/devicetree/bindings/interrupt-controller/ingenic,intc.txt
index 5f89fb635a1b..f97fd8ab5e45 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/ingenic,intc.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/ingenic,intc.txt
@@ -4,6 +4,7 @@ Required properties:
 
 - compatible : should be "ingenic,<socname>-intc". Valid strings are:
     ingenic,jz4740-intc
+    ingenic,jz4725b-intc
     ingenic,jz4770-intc
     ingenic,jz4775-intc
     ingenic,jz4780-intc
diff --git a/Documentation/devicetree/bindings/interrupt-controller/renesas,irqc.txt b/Documentation/devicetree/bindings/interrupt-controller/renesas,irqc.txt
index 20f121daa910..697ca2f26d1b 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/renesas,irqc.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/renesas,irqc.txt
@@ -7,6 +7,7 @@ Required properties:
     - "renesas,irqc-r8a73a4" (R-Mobile APE6)
     - "renesas,irqc-r8a7743" (RZ/G1M)
     - "renesas,irqc-r8a7745" (RZ/G1E)
+    - "renesas,irqc-r8a77470" (RZ/G1C)
     - "renesas,irqc-r8a7790" (R-Car H2)
     - "renesas,irqc-r8a7791" (R-Car M2-W)
     - "renesas,irqc-r8a7792" (R-Car V2H)
@@ -16,6 +17,7 @@ Required properties:
     - "renesas,intc-ex-r8a7796" (R-Car M3-W)
     - "renesas,intc-ex-r8a77965" (R-Car M3-N)
     - "renesas,intc-ex-r8a77970" (R-Car V3M)
+    - "renesas,intc-ex-r8a77980" (R-Car V3H)
     - "renesas,intc-ex-r8a77995" (R-Car D3)
 - #interrupt-cells: has to be <2>: an interrupt index and flags, as defined in
   interrupts.txt in this directory
diff --git a/Documentation/devicetree/bindings/timer/mediatek,mtk-timer.txt b/Documentation/devicetree/bindings/timer/mediatek,mtk-timer.txt
index b1fe7e9de1b4..18d4d0166c76 100644
--- a/Documentation/devicetree/bindings/timer/mediatek,mtk-timer.txt
+++ b/Documentation/devicetree/bindings/timer/mediatek,mtk-timer.txt
@@ -1,19 +1,25 @@
-Mediatek MT6577, MT6572 and MT6589 Timers
----------------------------------------
+Mediatek Timers
+---------------
+
+Mediatek SoCs have two different timers on different platforms,
+- GPT (General Purpose Timer)
+- SYST (System Timer)
+
+The proper timer will be selected automatically by driver.
 
 Required properties:
 - compatible should contain:
-        * "mediatek,mt2701-timer" for MT2701 compatible timers
-        * "mediatek,mt6580-timer" for MT6580 compatible timers
-        * "mediatek,mt6589-timer" for MT6589 compatible timers
-        * "mediatek,mt7623-timer" for MT7623 compatible timers
-        * "mediatek,mt8127-timer" for MT8127 compatible timers
-        * "mediatek,mt8135-timer" for MT8135 compatible timers
-        * "mediatek,mt8173-timer" for MT8173 compatible timers
-        * "mediatek,mt6577-timer" for MT6577 and all above compatible timers
-- reg: Should contain location and length for timers register.
-- clocks: Clocks driving the timer hardware. This list should include two
-        clocks. The order is system clock and as second clock the RTC clock.
+        * "mediatek,mt2701-timer" for MT2701 compatible timers (GPT)
+        * "mediatek,mt6580-timer" for MT6580 compatible timers (GPT)
+        * "mediatek,mt6589-timer" for MT6589 compatible timers (GPT)
+        * "mediatek,mt7623-timer" for MT7623 compatible timers (GPT)
+        * "mediatek,mt8127-timer" for MT8127 compatible timers (GPT)
+        * "mediatek,mt8135-timer" for MT8135 compatible timers (GPT)
+        * "mediatek,mt8173-timer" for MT8173 compatible timers (GPT)
+        * "mediatek,mt6577-timer" for MT6577 and all above compatible timers (GPT)
+        * "mediatek,mt6765-timer" for MT6765 compatible timers (SYST)
+- reg: Should contain location and length for timer register.
+- clocks: Should contain system clock.
 
 Examples:
 
@@ -21,5 +27,5 @@ Examples:
                 compatible = "mediatek,mt6577-timer";
                 reg = <0x10008000 0x80>;
                 interrupts = <GIC_SPI 113 IRQ_TYPE_LEVEL_LOW>;
-                clocks = <&system_clk>, <&rtc_clk>;
+                clocks = <&system_clk>;
         };
diff --git a/Documentation/memory-barriers.txt b/Documentation/memory-barriers.txt
index a02d6bbfc9d0..0d8d7ef131e9 100644
--- a/Documentation/memory-barriers.txt
+++ b/Documentation/memory-barriers.txt
@@ -2179,32 +2179,41 @@ or:
         event_indicated = 1;
         wake_up_process(event_daemon);
 
-A write memory barrier is implied by wake_up() and co.  if and only if they
-wake something up.  The barrier occurs before the task state is cleared, and so
-sits between the STORE to indicate the event and the STORE to set TASK_RUNNING:
+A general memory barrier is executed by wake_up() if it wakes something up.
+If it doesn't wake anything up then a memory barrier may or may not be
+executed; you must not rely on it.  The barrier occurs before the task state
+is accessed, in particular, it sits between the STORE to indicate the event
+and the STORE to set TASK_RUNNING:
 
-        CPU 1                           CPU 2
+        CPU 1 (Sleeper)                 CPU 2 (Waker)
         =============================== ===============================
         set_current_state();            STORE event_indicated
           smp_store_mb();               wake_up();
-            STORE current->state          <write barrier>
-            <general barrier>             STORE current->state
-        LOAD event_indicated
+            STORE current->state          ...
+            <general barrier>             <general barrier>
+        LOAD event_indicated              if ((LOAD task->state) & TASK_NORMAL)
+                                            STORE task->state
 
-To repeat, this write memory barrier is present if and only if something
-is actually awakened.  To see this, consider the following sequence of
-events, where X and Y are both initially zero:
+where "task" is the thread being woken up and it equals CPU 1's "current".
+
+To repeat, a general memory barrier is guaranteed to be executed by wake_up()
+if something is actually awakened, but otherwise there is no such guarantee.
+To see this, consider the following sequence of events, where X and Y are both
+initially zero:
 
         CPU 1                           CPU 2
         =============================== ===============================
-        X = 1;                          STORE event_indicated
+        X = 1;                          Y = 1;
         smp_mb();                       wake_up();
-        Y = 1;                          wait_event(wq, Y == 1);
-        wake_up();                        load from Y sees 1, no memory barrier
-                                        load from X might see 0
+        LOAD Y                          LOAD X
+
+If a wakeup does occur, one (at least) of the two loads must see 1.  If, on
+the other hand, a wakeup does not occur, both loads might see 0.
 
-In contrast, if a wakeup does occur, CPU 2's load from X would be guaranteed
-to see 1.
+wake_up_process() always executes a general memory barrier.  The barrier again
+occurs before the task state is accessed.  In particular, if the wake_up() in
+the previous snippet were replaced by a call to wake_up_process() then one of
+the two loads would be guaranteed to see 1.
 
 The available waker functions include:
 
@@ -2224,6 +2233,8 @@ The available waker functions include:
         wake_up_poll();
         wake_up_process();
 
+In terms of memory ordering, these functions all provide the same guarantees of
+a wake_up() (or stronger).
 
 [!] Note that the memory barriers implied by the sleeper and the waker do _not_
 order multiple stores before the wake-up with respect to loads of those stored
diff --git a/Documentation/networking/dpaa2/overview.rst b/Documentation/networking/dpaa2/overview.rst
index 79fede4447d6..d638b5a8aadd 100644
--- a/Documentation/networking/dpaa2/overview.rst
+++ b/Documentation/networking/dpaa2/overview.rst
@@ -1,5 +1,6 @@
 .. include:: <isonum.txt>
 
+=========================================================
 DPAA2 (Data Path Acceleration Architecture Gen2) Overview
 =========================================================
 
diff --git a/Documentation/translations/ko_KR/memory-barriers.txt b/Documentation/translations/ko_KR/memory-barriers.txt
index 921739d00f69..7f01fb1c1084 100644
--- a/Documentation/translations/ko_KR/memory-barriers.txt
+++ b/Documentation/translations/ko_KR/memory-barriers.txt
@@ -1891,22 +1891,22 @@ Mandatory 배리어들ì�€ SMP 시스템ì—�ì„œë�„ UP 시스템ì—�ì„œë�„ SMP 효ê³
                 /* 소유권� 수정 */
                 desc->status = DEVICE_OWN;
 
-                /* MMIO 를 통해 디바�스� 공지를 하기 전� 메모리를 �기화 */
-                wmb();
-
                 /* 업��트� 디스�립터� 디바�스� 공지 */
                 writel(DESC_NOTIFY, doorbell);
         }
 
      dma_rmb() 는 디스�립터로부터 ��터를 �어오기 전� 디바�스가 소유권�
-     내놓았�� 보장하게 하고, dma_wmb() 는 디바�스가 �신� 소유권� 다시
-     가졌�� 보기 전� 디스�립터� ��터가 쓰였�� 보장합니다.  wmb() 는
-     �시 �관성� 없는 (cache incoherent) MMIO �역� 쓰기를 시�하기 전�
-     �시 �관성� 있는 메모리 (cache coherent memory) 쓰기가 완료�었��
-     보장해주기 위해 필요합니다.
-
-     consistent memory � 대한 �세한 내용� 위해선 Documentation/DMA-API.txt
-     문서를 참고하세요.
+     내려놓았� 것� 보장하고, dma_wmb() 는 디바�스가 �신� 소유권� 다시
+     가졌�� 보기 전� 디스�립터� ��터가 쓰였� 것� 보장합니다.  참고로,
+     writel() � 사용하면 �시 �관성� 있는 메모리 (cache coherent memory)
+     쓰기가 MMIO �역�� 쓰기 전� 완료�었� 것� 보장하므로 writel() 앞�
+     wmb() 를 실행할 필요가 없�� 알아�시기 바�니다.  writel() 보다 비용�
+     저렴한 writel_relaxed() 는 �런 보장� 제공하지 않으므로 여기선 사용�지
+     않아야 합니다.
+
+     writel_relaxed() 와 같� 완화� I/O 접근�들� 대한 �세한 내용� 위해서는
+     "커� I/O 배리어� 효과" 섹션�, consistent memory � 대한 �세한 내용�
+     위해선 Documentation/DMA-API.txt 문서를 참고하세요.
 
 
 MMIO 쓰기 배리어
diff --git a/Documentation/x86/intel_rdt_ui.txt b/Documentation/x86/intel_rdt_ui.txt
index a16aa2113840..f662d3c530e5 100644
--- a/Documentation/x86/intel_rdt_ui.txt
+++ b/Documentation/x86/intel_rdt_ui.txt
@@ -29,7 +29,11 @@ mount options are:
 L2 and L3 CDP are controlled seperately.
 
 RDT features are orthogonal. A particular system may support only
-monitoring, only control, or both monitoring and control.
+monitoring, only control, or both monitoring and control.  Cache
+pseudo-locking is a unique way of using cache control to "pin" or
+"lock" data in the cache. Details can be found in
+"Cache Pseudo-Locking".
+
 
 The mount succeeds if either of allocation or monitoring is present, but
 only those files and directories supported by the system will be created.
@@ -65,6 +69,29 @@ related to allocation:
                         some platforms support devices that have their
                         own settings for cache use which can over-ride
                         these bits.
+"bit_usage":            Annotated capacity bitmasks showing how all
+                        instances of the resource are used. The legend is:
+                        "0" - Corresponding region is unused. When the system's
+                              resources have been allocated and a "0" is found
+                              in "bit_usage" it is a sign that resources are
+                              wasted.
+                        "H" - Corresponding region is used by hardware only
+                              but available for software use. If a resource
+                              has bits set in "shareable_bits" but not all
+                              of these bits appear in the resource groups'
+                              schematas then the bits appearing in
+                              "shareable_bits" but no resource group will
+                              be marked as "H".
+                        "X" - Corresponding region is available for sharing and
+                              used by hardware and software. These are the
+                              bits that appear in "shareable_bits" as
+                              well as a resource group's allocation.
+                        "S" - Corresponding region is used by software
+                              and available for sharing.
+                        "E" - Corresponding region is used exclusively by
+                              one resource group. No sharing allowed.
+                        "P" - Corresponding region is pseudo-locked. No
+                              sharing allowed.
 
 Memory bandwitdh(MB) subdirectory contains the following files
 with respect to allocation:
@@ -151,6 +178,9 @@ All groups contain the following files:
         CPUs to/from this group. As with the tasks file a hierarchy is
         maintained where MON groups may only include CPUs owned by the
         parent CTRL_MON group.
+        When the resouce group is in pseudo-locked mode this file will
+        only be readable, reflecting the CPUs associated with the
+        pseudo-locked region.
 
 
 "cpus_list":
@@ -163,6 +193,21 @@ When control is enabled all CTRL_MON groups will also contain:
         A list of all the resources available to this group.
         Each resource has its own line and format - see below for details.
 
+"size":
+        Mirrors the display of the "schemata" file to display the size in
+        bytes of each allocation instead of the bits representing the
+        allocation.
+
+"mode":
+        The "mode" of the resource group dictates the sharing of its
+        allocations. A "shareable" resource group allows sharing of its
+        allocations while an "exclusive" resource group does not. A
+        cache pseudo-locked region is created by first writing
+        "pseudo-locksetup" to the "mode" file before writing the cache
+        pseudo-locked region's schemata to the resource group's "schemata"
+        file. On successful pseudo-locked region creation the mode will
+        automatically change to "pseudo-locked".
+
 When monitoring is enabled all MON groups will also contain:
 
 "mon_data":
@@ -379,6 +424,170 @@ L3CODE:0=fffff;1=fffff;2=fffff;3=fffff
 L3DATA:0=fffff;1=fffff;2=3c0;3=fffff
 L3CODE:0=fffff;1=fffff;2=fffff;3=fffff
 
+Cache Pseudo-Locking
+--------------------
+CAT enables a user to specify the amount of cache space that an
+application can fill. Cache pseudo-locking builds on the fact that a
+CPU can still read and write data pre-allocated outside its current
+allocated area on a cache hit. With cache pseudo-locking, data can be
+preloaded into a reserved portion of cache that no application can
+fill, and from that point on will only serve cache hits. The cache
+pseudo-locked memory is made accessible to user space where an
+application can map it into its virtual address space and thus have
+a region of memory with reduced average read latency.
+
+The creation of a cache pseudo-locked region is triggered by a request
+from the user to do so that is accompanied by a schemata of the region
+to be pseudo-locked. The cache pseudo-locked region is created as follows:
+- Create a CAT allocation CLOSNEW with a CBM matching the schemata
+  from the user of the cache region that will contain the pseudo-locked
+  memory. This region must not overlap with any current CAT allocation/CLOS
+  on the system and no future overlap with this cache region is allowed
+  while the pseudo-locked region exists.
+- Create a contiguous region of memory of the same size as the cache
+  region.
+- Flush the cache, disable hardware prefetchers, disable preemption.
+- Make CLOSNEW the active CLOS and touch the allocated memory to load
+  it into the cache.
+- Set the previous CLOS as active.
+- At this point the closid CLOSNEW can be released - the cache
+  pseudo-locked region is protected as long as its CBM does not appear in
+  any CAT allocation. Even though the cache pseudo-locked region will from
+  this point on not appear in any CBM of any CLOS an application running with
+  any CLOS will be able to access the memory in the pseudo-locked region since
+  the region continues to serve cache hits.
+- The contiguous region of memory loaded into the cache is exposed to
+  user-space as a character device.
+
+Cache pseudo-locking increases the probability that data will remain
+in the cache via carefully configuring the CAT feature and controlling
+application behavior. There is no guarantee that data is placed in
+cache. Instructions like INVD, WBINVD, CLFLUSH, etc. can still evict
+“locked� data from cache. Power management C-states may shrink or
+power off cache. Deeper C-states will automatically be restricted on
+pseudo-locked region creation.
+
+It is required that an application using a pseudo-locked region runs
+with affinity to the cores (or a subset of the cores) associated
+with the cache on which the pseudo-locked region resides. A sanity check
+within the code will not allow an application to map pseudo-locked memory
+unless it runs with affinity to cores associated with the cache on which the
+pseudo-locked region resides. The sanity check is only done during the
+initial mmap() handling, there is no enforcement afterwards and the
+application self needs to ensure it remains affine to the correct cores.
+
+Pseudo-locking is accomplished in two stages:
+1) During the first stage the system administrator allocates a portion
+   of cache that should be dedicated to pseudo-locking. At this time an
+   equivalent portion of memory is allocated, loaded into allocated
+   cache portion, and exposed as a character device.
+2) During the second stage a user-space application maps (mmap()) the
+   pseudo-locked memory into its address space.
+
+Cache Pseudo-Locking Interface
+------------------------------
+A pseudo-locked region is created using the resctrl interface as follows:
+
+1) Create a new resource group by creating a new directory in /sys/fs/resctrl.
+2) Change the new resource group's mode to "pseudo-locksetup" by writing
+   "pseudo-locksetup" to the "mode" file.
+3) Write the schemata of the pseudo-locked region to the "schemata" file. All
+   bits within the schemata should be "unused" according to the "bit_usage"
+   file.
+
+On successful pseudo-locked region creation the "mode" file will contain
+"pseudo-locked" and a new character device with the same name as the resource
+group will exist in /dev/pseudo_lock. This character device can be mmap()'ed
+by user space in order to obtain access to the pseudo-locked memory region.
+
+An example of cache pseudo-locked region creation and usage can be found below.
+
+Cache Pseudo-Locking Debugging Interface
+---------------------------------------
+The pseudo-locking debugging interface is enabled by default (if
+CONFIG_DEBUG_FS is enabled) and can be found in /sys/kernel/debug/resctrl.
+
+There is no explicit way for the kernel to test if a provided memory
+location is present in the cache. The pseudo-locking debugging interface uses
+the tracing infrastructure to provide two ways to measure cache residency of
+the pseudo-locked region:
+1) Memory access latency using the pseudo_lock_mem_latency tracepoint. Data
+   from these measurements are best visualized using a hist trigger (see
+   example below). In this test the pseudo-locked region is traversed at
+   a stride of 32 bytes while hardware prefetchers and preemption
+   are disabled. This also provides a substitute visualization of cache
+   hits and misses.
+2) Cache hit and miss measurements using model specific precision counters if
+   available. Depending on the levels of cache on the system the pseudo_lock_l2
+   and pseudo_lock_l3 tracepoints are available.
+   WARNING: triggering this  measurement uses from two (for just L2
+   measurements) to four (for L2 and L3 measurements) precision counters on
+   the system, if any other measurements are in progress the counters and
+   their corresponding event registers will be clobbered.
+
+When a pseudo-locked region is created a new debugfs directory is created for
+it in debugfs as /sys/kernel/debug/resctrl/<newdir>. A single
+write-only file, pseudo_lock_measure, is present in this directory. The
+measurement on the pseudo-locked region depends on the number, 1 or 2,
+written to this debugfs file. Since the measurements are recorded with the
+tracing infrastructure the relevant tracepoints need to be enabled before the
+measurement is triggered.
+
+Example of latency debugging interface:
+In this example a pseudo-locked region named "newlock" was created. Here is
+how we can measure the latency in cycles of reading from this region and
+visualize this data with a histogram that is available if CONFIG_HIST_TRIGGERS
+is set:
+# :> /sys/kernel/debug/tracing/trace
+# echo 'hist:keys=latency' > /sys/kernel/debug/tracing/events/resctrl/pseudo_lock_mem_latency/trigger
+# echo 1 > /sys/kernel/debug/tracing/events/resctrl/pseudo_lock_mem_latency/enable
+# echo 1 > /sys/kernel/debug/resctrl/newlock/pseudo_lock_measure
+# echo 0 > /sys/kernel/debug/tracing/events/resctrl/pseudo_lock_mem_latency/enable
+# cat /sys/kernel/debug/tracing/events/resctrl/pseudo_lock_mem_latency/hist
+
+# event histogram
+#
+# trigger info: hist:keys=latency:vals=hitcount:sort=hitcount:size=2048 [active]
+#
+
+{ latency:        456 } hitcount:          1
+{ latency:         50 } hitcount:         83
+{ latency:         36 } hitcount:         96
+{ latency:         44 } hitcount:        174
+{ latency:         48 } hitcount:        195
+{ latency:         46 } hitcount:        262
+{ latency:         42 } hitcount:        693
+{ latency:         40 } hitcount:       3204
+{ latency:         38 } hitcount:       3484
+
+Totals:
+    Hits: 8192
+    Entries: 9
+   Dropped: 0
+
+Example of cache hits/misses debugging:
+In this example a pseudo-locked region named "newlock" was created on the L2
+cache of a platform. Here is how we can obtain details of the cache hits
+and misses using the platform's precision counters.
+
+# :> /sys/kernel/debug/tracing/trace
+# echo 1 > /sys/kernel/debug/tracing/events/resctrl/pseudo_lock_l2/enable
+# echo 2 > /sys/kernel/debug/resctrl/newlock/pseudo_lock_measure
+# echo 0 > /sys/kernel/debug/tracing/events/resctrl/pseudo_lock_l2/enable
+# cat /sys/kernel/debug/tracing/trace
+
+# tracer: nop
+#
+#                              _-----=> irqs-off
+#                             / _----=> need-resched
+#                            | / _---=> hardirq/softirq
+#                            || / _--=> preempt-depth
+#                            ||| /     delay
+#           TASK-PID   CPU#  ||||    TIMESTAMP  FUNCTION
+#              | |       |   ||||       |         |
+ pseudo_lock_mea-1672  [002] ....  3132.860500: pseudo_lock_l2: hits=4097 miss=0
+
+
 Examples for RDT allocation usage:
 
 Example 1
@@ -502,7 +711,172 @@ siblings and only the real time threads are scheduled on the cores 4-7.
 
 # echo F0 > p0/cpus
 
-4) Locking between applications
+Example 4
+---------
+
+The resource groups in previous examples were all in the default "shareable"
+mode allowing sharing of their cache allocations. If one resource group
+configures a cache allocation then nothing prevents another resource group
+to overlap with that allocation.
+
+In this example a new exclusive resource group will be created on a L2 CAT
+system with two L2 cache instances that can be configured with an 8-bit
+capacity bitmask. The new exclusive resource group will be configured to use
+25% of each cache instance.
+
+# mount -t resctrl resctrl /sys/fs/resctrl/
+# cd /sys/fs/resctrl
+
+First, we observe that the default group is configured to allocate to all L2
+cache:
+
+# cat schemata
+L2:0=ff;1=ff
+
+We could attempt to create the new resource group at this point, but it will
+fail because of the overlap with the schemata of the default group:
+# mkdir p0
+# echo 'L2:0=0x3;1=0x3' > p0/schemata
+# cat p0/mode
+shareable
+# echo exclusive > p0/mode
+-sh: echo: write error: Invalid argument
+# cat info/last_cmd_status
+schemata overlaps
+
+To ensure that there is no overlap with another resource group the default
+resource group's schemata has to change, making it possible for the new
+resource group to become exclusive.
+# echo 'L2:0=0xfc;1=0xfc' > schemata
+# echo exclusive > p0/mode
+# grep . p0/*
+p0/cpus:0
+p0/mode:exclusive
+p0/schemata:L2:0=03;1=03
+p0/size:L2:0=262144;1=262144
+
+A new resource group will on creation not overlap with an exclusive resource
+group:
+# mkdir p1
+# grep . p1/*
+p1/cpus:0
+p1/mode:shareable
+p1/schemata:L2:0=fc;1=fc
+p1/size:L2:0=786432;1=786432
+
+The bit_usage will reflect how the cache is used:
+# cat info/L2/bit_usage
+0=SSSSSSEE;1=SSSSSSEE
+
+A resource group cannot be forced to overlap with an exclusive resource group:
+# echo 'L2:0=0x1;1=0x1' > p1/schemata
+-sh: echo: write error: Invalid argument
+# cat info/last_cmd_status
+overlaps with exclusive group
+
+Example of Cache Pseudo-Locking
+-------------------------------
+Lock portion of L2 cache from cache id 1 using CBM 0x3. Pseudo-locked
+region is exposed at /dev/pseudo_lock/newlock that can be provided to
+application for argument to mmap().
+
+# mount -t resctrl resctrl /sys/fs/resctrl/
+# cd /sys/fs/resctrl
+
+Ensure that there are bits available that can be pseudo-locked, since only
+unused bits can be pseudo-locked the bits to be pseudo-locked needs to be
+removed from the default resource group's schemata:
+# cat info/L2/bit_usage
+0=SSSSSSSS;1=SSSSSSSS
+# echo 'L2:1=0xfc' > schemata
+# cat info/L2/bit_usage
+0=SSSSSSSS;1=SSSSSS00
+
+Create a new resource group that will be associated with the pseudo-locked
+region, indicate that it will be used for a pseudo-locked region, and
+configure the requested pseudo-locked region capacity bitmask:
+
+# mkdir newlock
+# echo pseudo-locksetup > newlock/mode
+# echo 'L2:1=0x3' > newlock/schemata
+
+On success the resource group's mode will change to pseudo-locked, the
+bit_usage will reflect the pseudo-locked region, and the character device
+exposing the pseudo-locked region will exist:
+
+# cat newlock/mode
+pseudo-locked
+# cat info/L2/bit_usage
+0=SSSSSSSS;1=SSSSSSPP
+# ls -l /dev/pseudo_lock/newlock
+crw------- 1 root root 243, 0 Apr  3 05:01 /dev/pseudo_lock/newlock
+
+/*
+ * Example code to access one page of pseudo-locked cache region
+ * from user space.
+ */
+#define _GNU_SOURCE
+#include <fcntl.h>
+#include <sched.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/mman.h>
+
+/*
+ * It is required that the application runs with affinity to only
+ * cores associated with the pseudo-locked region. Here the cpu
+ * is hardcoded for convenience of example.
+ */
+static int cpuid = 2;
+
+int main(int argc, char *argv[])
+{
+        cpu_set_t cpuset;
+        long page_size;
+        void *mapping;
+        int dev_fd;
+        int ret;
+
+        page_size = sysconf(_SC_PAGESIZE);
+
+        CPU_ZERO(&cpuset);
+        CPU_SET(cpuid, &cpuset);
+        ret = sched_setaffinity(0, sizeof(cpuset), &cpuset);
+        if (ret < 0) {
+                perror("sched_setaffinity");
+                exit(EXIT_FAILURE);
+        }
+
+        dev_fd = open("/dev/pseudo_lock/newlock", O_RDWR);
+        if (dev_fd < 0) {
+                perror("open");
+                exit(EXIT_FAILURE);
+        }
+
+        mapping = mmap(0, page_size, PROT_READ | PROT_WRITE, MAP_SHARED,
+                       dev_fd, 0);
+        if (mapping == MAP_FAILED) {
+                perror("mmap");
+                close(dev_fd);
+                exit(EXIT_FAILURE);
+        }
+
+        /* Application interacts with pseudo-locked memory @mapping */
+
+        ret = munmap(mapping, page_size);
+        if (ret < 0) {
+                perror("munmap");
+                close(dev_fd);
+                exit(EXIT_FAILURE);
+        }
+
+        close(dev_fd);
+        exit(EXIT_SUCCESS);
+}
+
+Locking between applications
+----------------------------
 
 Certain operations on the resctrl filesystem, composed of read/writes
 to/from multiple files, must be atomic.
@@ -510,7 +884,7 @@ to/from multiple files, must be atomic.
 As an example, the allocation of an exclusive reservation of L3 cache
 involves:
 
-  1. Read the cbmmasks from each directory
+  1. Read the cbmmasks from each directory or the per-resource "bit_usage"
   2. Find a contiguous set of bits in the global CBM bitmask that is clear
      in any of the directory cbmmasks
   3. Create a new directory
diff --git a/Documentation/x86/x86_64/boot-options.txt b/Documentation/x86/x86_64/boot-options.txt
index 8d109ef67ab6..ad6d2a80cf05 100644
--- a/Documentation/x86/x86_64/boot-options.txt
+++ b/Documentation/x86/x86_64/boot-options.txt
@@ -92,9 +92,7 @@ APICs
 Timing
 
   notsc
-  Don't use the CPU time stamp counter to read the wall time.
-  This can be used to work around timing problems on multiprocessor systems
-  with not properly synchronized CPUs.
+  Deprecated, use tsc=unstable instead.
 
   nohpet
   Don't use the HPET timer.
@@ -156,6 +154,10 @@ NUMA
                 If given as an integer, fills all system RAM with N fake nodes
                 interleaved over physical nodes.
 
+  numa=fake=<N>U
+                If given as an integer followed by 'U', it will divide each
+                physical node into N emulated nodes.
+
 ACPI
 
   acpi=off      Don't enable ACPI
diff --git a/MAINTAINERS b/MAINTAINERS
index f6a9b0842319..629e08703c82 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -5444,6 +5444,7 @@ F:	drivers/iommu/exynos-iommu.c
 
 EZchip NPS platform support
 M:      Vineet Gupta <vgupta@synopsys.com>
+M:      Ofer Levi <oferle@mellanox.com>
 S:      Supported
 F:      arch/arc/plat-eznps
 F:      arch/arc/boot/dts/eznps.dts
@@ -5929,7 +5930,7 @@ F:	Documentation/dev-tools/gcov.rst
 
 GDB KERNEL DEBUGGING HELPER SCRIPTS
 M:      Jan Kiszka <jan.kiszka@siemens.com>
-M:      Kieran Bingham <kieran@bingham.xyz>
+M:      Kieran Bingham <kbingham@kernel.org>
 S:      Supported
 F:      scripts/gdb/
 
@@ -8316,10 +8317,16 @@ M:	Jade Alglave <j.alglave@ucl.ac.uk>
 M:      Luc Maranget <luc.maranget@inria.fr>
 M:      "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
 R:      Akira Yokosawa <akiyks@gmail.com>
+R:      Daniel Lustig <dlustig@nvidia.com>
 L:      linux-kernel@vger.kernel.org
+L:      linux-arch@vger.kernel.org
 S:      Supported
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu.git
 F:      tools/memory-model/
+F:      Documentation/atomic_bitops.txt
+F:      Documentation/atomic_t.txt
+F:      Documentation/core-api/atomic_ops.rst
+F:      Documentation/core-api/refcount-vs-atomic.rst
 F:      Documentation/memory-barriers.txt
 
 LINUX SECURITY MODULE (LSM) FRAMEWORK
@@ -12038,9 +12045,9 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu.git
 F:      Documentation/RCU/
 X:      Documentation/RCU/torture.txt
 F:      include/linux/rcu*
-X:      include/linux/srcu.h
+X:      include/linux/srcu*.h
 F:      kernel/rcu/
-X:      kernel/torture.c
+X:      kernel/rcu/srcu*.c
 
 REAL TIME CLOCK (RTC) SUBSYSTEM
 M:      Alessandro Zummo <a.zummo@towertech.it>
@@ -13077,8 +13084,8 @@ L:	linux-kernel@vger.kernel.org
 W:      http://www.rdrop.com/users/paulmck/RCU/
 S:      Supported
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu.git
-F:      include/linux/srcu.h
-F:      kernel/rcu/srcu.c
+F:      include/linux/srcu*.h
+F:      kernel/rcu/srcu*.c
 
 SERIAL LOW-POWER INTER-CHIP MEDIA BUS (SLIMbus)
 M:      Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
@@ -14437,6 +14444,7 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu.git
 F:      Documentation/RCU/torture.txt
 F:      kernel/torture.c
 F:      kernel/rcu/rcutorture.c
+F:      kernel/rcu/rcuperf.c
 F:      kernel/locking/locktorture.c
 
 TOSHIBA ACPI EXTRAS DRIVER
diff --git a/Makefile b/Makefile
index 85f3481a56d6..863f58503bee 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 4
 PATCHLEVEL = 18
 SUBLEVEL = 0
-EXTRAVERSION = -rc7
+EXTRAVERSION =
 NAME = Merciless Moray
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/include/asm/atomic.h b/arch/alpha/include/asm/atomic.h
index 767bfdd42992..150a1c5d6a2c 100644
--- a/arch/alpha/include/asm/atomic.h
+++ b/arch/alpha/include/asm/atomic.h
@@ -18,11 +18,11 @@
  * To ensure dependency ordering is preserved for the _relaxed and
  * _release atomics, an smp_read_barrier_depends() is unconditionally
  * inserted into the _relaxed variants, which are used to build the
- * barriered versions. To avoid redundant back-to-back fences, we can
- * define the _acquire and _fence versions explicitly.
+ * barriered versions. Avoid redundant back-to-back fences in the
+ * _acquire and _fence versions.
  */
-#define __atomic_op_acquire(op, args...)        op##_relaxed(args)
-#define __atomic_op_fence                       __atomic_op_release
+#define __atomic_acquire_fence()
+#define __atomic_post_full_fence()
 
 #define ATOMIC_INIT(i)          { (i) }
 #define ATOMIC64_INIT(i)        { (i) }
@@ -206,7 +206,7 @@ ATOMIC_OPS(xor, xor)
 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
 
 /**
- * __atomic_add_unless - add unless the number is a given value
+ * atomic_fetch_add_unless - add unless the number is a given value
  * @v: pointer of type atomic_t
  * @a: the amount to add to v...
  * @u: ...unless v is equal to u.
@@ -214,7 +214,7 @@ ATOMIC_OPS(xor, xor)
  * Atomically adds @a to @v, so long as it was not @u.
  * Returns the old value of @v.
  */
-static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
+static __inline__ int atomic_fetch_add_unless(atomic_t *v, int a, int u)
 {
         int c, new, old;
         smp_mb();
@@ -235,38 +235,39 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
         smp_mb();
         return old;
 }
-
+#define atomic_fetch_add_unless atomic_fetch_add_unless
 
 /**
- * atomic64_add_unless - add unless the number is a given value
+ * atomic64_fetch_add_unless - add unless the number is a given value
  * @v: pointer of type atomic64_t
  * @a: the amount to add to v...
  * @u: ...unless v is equal to u.
  *
  * Atomically adds @a to @v, so long as it was not @u.
- * Returns true iff @v was not @u.
+ * Returns the old value of @v.
  */
-static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
+static __inline__ long atomic64_fetch_add_unless(atomic64_t *v, long a, long u)
 {
-        long c, tmp;
+        long c, new, old;
         smp_mb();
         __asm__ __volatile__(
-        "1:     ldq_l   %[tmp],%[mem]\n"
-        "       cmpeq   %[tmp],%[u],%[c]\n"
-        "       addq    %[tmp],%[a],%[tmp]\n"
+        "1:     ldq_l   %[old],%[mem]\n"
+        "       cmpeq   %[old],%[u],%[c]\n"
+        "       addq    %[old],%[a],%[new]\n"
         "       bne     %[c],2f\n"
-        "       stq_c   %[tmp],%[mem]\n"
-        "       beq     %[tmp],3f\n"
+        "       stq_c   %[new],%[mem]\n"
+        "       beq     %[new],3f\n"
         "2:\n"
         ".subsection 2\n"
         "3:     br      1b\n"
         ".previous"
-        : [tmp] "=&r"(tmp), [c] "=&r"(c)
+        : [old] "=&r"(old), [new] "=&r"(new), [c] "=&r"(c)
         : [mem] "m"(*v), [a] "rI"(a), [u] "rI"(u)
         : "memory");
         smp_mb();
-        return !c;
+        return old;
 }
+#define atomic64_fetch_add_unless atomic64_fetch_add_unless
 
 /*
  * atomic64_dec_if_positive - decrement by 1 if old value positive
@@ -295,31 +296,6 @@ static inline long atomic64_dec_if_positive(atomic64_t *v)
         smp_mb();
         return old - 1;
 }
-
-#define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-
-#define atomic_add_negative(a, v) (atomic_add_return((a), (v)) < 0)
-#define atomic64_add_negative(a, v) (atomic64_add_return((a), (v)) < 0)
-
-#define atomic_dec_return(v) atomic_sub_return(1,(v))
-#define atomic64_dec_return(v) atomic64_sub_return(1,(v))
-
-#define atomic_inc_return(v) atomic_add_return(1,(v))
-#define atomic64_inc_return(v) atomic64_add_return(1,(v))
-
-#define atomic_sub_and_test(i,v) (atomic_sub_return((i), (v)) == 0)
-#define atomic64_sub_and_test(i,v) (atomic64_sub_return((i), (v)) == 0)
-
-#define atomic_inc_and_test(v) (atomic_add_return(1, (v)) == 0)
-#define atomic64_inc_and_test(v) (atomic64_add_return(1, (v)) == 0)
-
-#define atomic_dec_and_test(v) (atomic_sub_return(1, (v)) == 0)
-#define atomic64_dec_and_test(v) (atomic64_sub_return(1, (v)) == 0)
-
-#define atomic_inc(v) atomic_add(1,(v))
-#define atomic64_inc(v) atomic64_add(1,(v))
-
-#define atomic_dec(v) atomic_sub(1,(v))
-#define atomic64_dec(v) atomic64_sub(1,(v))
+#define atomic64_dec_if_positive atomic64_dec_if_positive
 
 #endif /* _ALPHA_ATOMIC_H */
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index 9cf59fc60eab..5151d81476a1 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -50,6 +50,9 @@ config ARC
         select HAVE_KERNEL_LZMA
         select ARCH_HAS_PTE_SPECIAL
 
+config ARCH_HAS_CACHE_LINE_SIZE
+        def_bool y
+
 config MIGHT_HAVE_PCI
         bool
 
diff --git a/arch/arc/include/asm/atomic.h b/arch/arc/include/asm/atomic.h
index 11859287c52a..4e0072730241 100644
--- a/arch/arc/include/asm/atomic.h
+++ b/arch/arc/include/asm/atomic.h
@@ -187,7 +187,8 @@ static inline int atomic_fetch_##op(int i, atomic_t *v)			\
 ATOMIC_OPS(add, +=, add)
 ATOMIC_OPS(sub, -=, sub)
 
-#define atomic_andnot atomic_andnot
+#define atomic_andnot           atomic_andnot
+#define atomic_fetch_andnot     atomic_fetch_andnot
 
 #undef ATOMIC_OPS
 #define ATOMIC_OPS(op, c_op, asm_op)                                    \
@@ -296,8 +297,6 @@ ATOMIC_OPS(add, +=, CTOP_INST_AADD_DI_R2_R2_R3)
         ATOMIC_FETCH_OP(op, c_op, asm_op)
 
 ATOMIC_OPS(and, &=, CTOP_INST_AAND_DI_R2_R2_R3)
-#define atomic_andnot(mask, v) atomic_and(~(mask), (v))
-#define atomic_fetch_andnot(mask, v) atomic_fetch_and(~(mask), (v))
 ATOMIC_OPS(or, |=, CTOP_INST_AOR_DI_R2_R2_R3)
 ATOMIC_OPS(xor, ^=, CTOP_INST_AXOR_DI_R2_R2_R3)
 
@@ -308,48 +307,6 @@ ATOMIC_OPS(xor, ^=, CTOP_INST_AXOR_DI_R2_R2_R3)
 #undef ATOMIC_OP_RETURN
 #undef ATOMIC_OP
 
-/**
- * __atomic_add_unless - add unless the number is a given value
- * @v: pointer of type atomic_t
- * @a: the amount to add to v...
- * @u: ...unless v is equal to u.
- *
- * Atomically adds @a to @v, so long as it was not @u.
- * Returns the old value of @v
- */
-#define __atomic_add_unless(v, a, u)                                    \
-({                                                                      \
-        int c, old;                                                     \
-                                                                        \
-        /*                                                              \
-         * Explicit full memory barrier needed before/after as          \
-         * LLOCK/SCOND thmeselves don't provide any such semantics      \
-         */                                                             \
-        smp_mb();                                                       \
-                                                                        \
-        c = atomic_read(v);                                             \
-        while (c != (u) && (old = atomic_cmpxchg((v), c, c + (a))) != c)\
-                c = old;                                                \
-                                                                        \
-        smp_mb();                                                       \
-                                                                        \
-        c;                                                              \
-})
-
-#define atomic_inc_not_zero(v)          atomic_add_unless((v), 1, 0)
-
-#define atomic_inc(v)                   atomic_add(1, v)
-#define atomic_dec(v)                   atomic_sub(1, v)
-
-#define atomic_inc_and_test(v)          (atomic_add_return(1, v) == 0)
-#define atomic_dec_and_test(v)          (atomic_sub_return(1, v) == 0)
-#define atomic_inc_return(v)            atomic_add_return(1, (v))
-#define atomic_dec_return(v)            atomic_sub_return(1, (v))
-#define atomic_sub_and_test(i, v)       (atomic_sub_return(i, v) == 0)
-
-#define atomic_add_negative(i, v)       (atomic_add_return(i, v) < 0)
-
-
 #ifdef CONFIG_GENERIC_ATOMIC64
 
 #include <asm-generic/atomic64.h>
@@ -472,7 +429,8 @@ static inline long long atomic64_fetch_##op(long long a, atomic64_t *v)	\
         ATOMIC64_OP_RETURN(op, op1, op2)                                \
         ATOMIC64_FETCH_OP(op, op1, op2)
 
-#define atomic64_andnot atomic64_andnot
+#define atomic64_andnot         atomic64_andnot
+#define atomic64_fetch_andnot   atomic64_fetch_andnot
 
 ATOMIC64_OPS(add, add.f, adc)
 ATOMIC64_OPS(sub, sub.f, sbc)
@@ -559,53 +517,43 @@ static inline long long atomic64_dec_if_positive(atomic64_t *v)
 
         return val;
 }
+#define atomic64_dec_if_positive atomic64_dec_if_positive
 
 /**
- * atomic64_add_unless - add unless the number is a given value
+ * atomic64_fetch_add_unless - add unless the number is a given value
  * @v: pointer of type atomic64_t
  * @a: the amount to add to v...
  * @u: ...unless v is equal to u.
  *
- * if (v != u) { v += a; ret = 1} else {ret = 0}
- * Returns 1 iff @v was not @u (i.e. if add actually happened)
+ * Atomically adds @a to @v, if it was not @u.
+ * Returns the old value of @v
  */
-static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
+static inline long long atomic64_fetch_add_unless(atomic64_t *v, long long a,
+                                                  long long u)
 {
-        long long val;
-        int op_done;
+        long long old, temp;
 
         smp_mb();
 
         __asm__ __volatile__(
         "1:     llockd  %0, [%2]        \n"
-        "       mov     %1, 1           \n"
         "       brne    %L0, %L4, 2f    # continue to add since v != u \n"
         "       breq.d  %H0, %H4, 3f    # return since v == u \n"
-        "       mov     %1, 0           \n"
         "2:                             \n"
-        "       add.f   %L0, %L0, %L3   \n"
-        "       adc     %H0, %H0, %H3   \n"
-        "       scondd  %0, [%2]        \n"
+        "       add.f   %L1, %L0, %L3   \n"
+        "       adc     %H1, %H0, %H3   \n"
+        "       scondd  %1, [%2]        \n"
         "       bnz     1b              \n"
         "3:                             \n"
-        : "=&r"(val), "=&r" (op_done)
+        : "=&r"(old), "=&r" (temp)
         : "r"(&v->counter), "r"(a), "r"(u)
         : "cc");        /* memory clobber comes from smp_mb() */
 
         smp_mb();
 
-        return op_done;
+        return old;
 }
-
-#define atomic64_add_negative(a, v)     (atomic64_add_return((a), (v)) < 0)
-#define atomic64_inc(v)                 atomic64_add(1LL, (v))
-#define atomic64_inc_return(v)          atomic64_add_return(1LL, (v))
-#define atomic64_inc_and_test(v)        (atomic64_inc_return(v) == 0)
-#define atomic64_sub_and_test(a, v)     (atomic64_sub_return((a), (v)) == 0)
-#define atomic64_dec(v)                 atomic64_sub(1LL, (v))
-#define atomic64_dec_return(v)          atomic64_sub_return(1LL, (v))
-#define atomic64_dec_and_test(v)        (atomic64_dec_return((v)) == 0)
-#define atomic64_inc_not_zero(v)        atomic64_add_unless((v), 1LL, 0LL)
+#define atomic64_fetch_add_unless atomic64_fetch_add_unless
 
 #endif  /* !CONFIG_GENERIC_ATOMIC64 */
 
diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h
index 8486f328cc5d..ff7d3232764a 100644
--- a/arch/arc/include/asm/cache.h
+++ b/arch/arc/include/asm/cache.h
@@ -48,7 +48,9 @@
 })
 
 /* Largest line length for either L1 or L2 is 128 bytes */
-#define ARCH_DMA_MINALIGN      128
+#define SMP_CACHE_BYTES         128
+#define cache_line_size()       SMP_CACHE_BYTES
+#define ARCH_DMA_MINALIGN       SMP_CACHE_BYTES
 
 extern void arc_cache_init(void);
 extern char *arc_cache_mumbojumbo(int cpu_id, char *buf, int len);
diff --git a/arch/arc/include/asm/delay.h b/arch/arc/include/asm/delay.h
index d5da2115d78a..03d6bb0f4e13 100644
--- a/arch/arc/include/asm/delay.h
+++ b/arch/arc/include/asm/delay.h
@@ -17,8 +17,11 @@
 #ifndef __ASM_ARC_UDELAY_H
 #define __ASM_ARC_UDELAY_H
 
+#include <asm-generic/types.h>
 #include <asm/param.h>          /* HZ */
 
+extern unsigned long loops_per_jiffy;
+
 static inline void __delay(unsigned long loops)
 {
         __asm__ __volatile__(
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index 9dbe645ee127..25c631942500 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -1038,7 +1038,7 @@ void flush_cache_mm(struct mm_struct *mm)
 void flush_cache_page(struct vm_area_struct *vma, unsigned long u_vaddr,
                       unsigned long pfn)
 {
-        unsigned int paddr = pfn << PAGE_SHIFT;
+        phys_addr_t paddr = pfn << PAGE_SHIFT;
 
         u_vaddr &= PAGE_MASK;
 
@@ -1058,8 +1058,9 @@ void flush_anon_page(struct vm_area_struct *vma, struct page *page,
                      unsigned long u_vaddr)
 {
         /* TBD: do we really need to clear the kernel mapping */
-        __flush_dcache_page(page_address(page), u_vaddr);
-        __flush_dcache_page(page_address(page), page_address(page));
+        __flush_dcache_page((phys_addr_t)page_address(page), u_vaddr);
+        __flush_dcache_page((phys_addr_t)page_address(page),
+                            (phys_addr_t)page_address(page));
 
 }
 
@@ -1246,6 +1247,16 @@ void __init arc_cache_init_master(void)
                 }
         }
 
+        /*
+         * Check that SMP_CACHE_BYTES (and hence ARCH_DMA_MINALIGN) is larger
+         * or equal to any cache line length.
+         */
+        BUILD_BUG_ON_MSG(L1_CACHE_BYTES > SMP_CACHE_BYTES,
+                         "SMP_CACHE_BYTES must be >= any cache line length");
+        if (is_isa_arcv2() && (l2_line_sz > SMP_CACHE_BYTES))
+                panic("L2 Cache line [%d] > kernel Config [%d]\n",
+                      l2_line_sz, SMP_CACHE_BYTES);
+
         /* Note that SLC disable not formally supported till HS 3.0 */
         if (is_isa_arcv2() && l2_line_sz && !slc_enable)
                 arc_slc_disable();
diff --git a/arch/arc/mm/dma.c b/arch/arc/mm/dma.c
index 8c1071840979..ec47e6079f5d 100644
--- a/arch/arc/mm/dma.c
+++ b/arch/arc/mm/dma.c
@@ -129,14 +129,59 @@ int arch_dma_mmap(struct device *dev, struct vm_area_struct *vma,
         return ret;
 }
 
+/*
+ * Cache operations depending on function and direction argument, inspired by
+ * https://lkml.org/lkml/2018/5/18/979
+ * "dma_sync_*_for_cpu and direction=TO_DEVICE (was Re: [PATCH 02/20]
+ * dma-mapping: provide a generic dma-noncoherent implementation)"
+ *
+ *          |   map          ==  for_device     |   unmap     ==  for_cpu
+ *          |----------------------------------------------------------------
+ * TO_DEV   |   writeback        writeback      |   none          none
+ * FROM_DEV |   invalidate       invalidate     |   invalidate*   invalidate*
+ * BIDIR    |   writeback+inv    writeback+inv  |   invalidate    invalidate
+ *
+ *     [*] needed for CPU speculative prefetches
+ *
+ * NOTE: we don't check the validity of direction argument as it is done in
+ * upper layer functions (in include/linux/dma-mapping.h)
+ */
+
 void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr,
                 size_t size, enum dma_data_direction dir)
 {
-        dma_cache_wback(paddr, size);
+        switch (dir) {
+        case DMA_TO_DEVICE:
+                dma_cache_wback(paddr, size);
+                break;
+
+        case DMA_FROM_DEVICE:
+                dma_cache_inv(paddr, size);
+                break;
+
+        case DMA_BIDIRECTIONAL:
+                dma_cache_wback_inv(paddr, size);
+                break;
+
+        default:
+                break;
+        }
 }
 
 void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr,
                 size_t size, enum dma_data_direction dir)
 {
-        dma_cache_inv(paddr, size);
+        switch (dir) {
+        case DMA_TO_DEVICE:
+                break;
+
+        /* FROM_DEVICE invalidate needed if speculative CPU prefetch only */
+        case DMA_FROM_DEVICE:
+        case DMA_BIDIRECTIONAL:
+                dma_cache_inv(paddr, size);
+                break;
+
+        default:
+                break;
+        }
 }
diff --git a/arch/arc/plat-eznps/include/plat/ctop.h b/arch/arc/plat-eznps/include/plat/ctop.h
index 0c7d11022d0f..4f6a1673b3a6 100644
--- a/arch/arc/plat-eznps/include/plat/ctop.h
+++ b/arch/arc/plat-eznps/include/plat/ctop.h
@@ -21,6 +21,7 @@
 #error "Incorrect ctop.h include"
 #endif
 
+#include <linux/types.h>
 #include <soc/nps/common.h>
 
 /* core auxiliary registers */
@@ -143,6 +144,15 @@ struct nps_host_reg_gim_p_int_dst {
 };
 
 /* AUX registers definition */
+struct nps_host_reg_aux_dpc {
+        union {
+                struct {
+                        u32 ien:1, men:1, hen:1, reserved:29;
+                };
+                u32 value;
+        };
+};
+
 struct nps_host_reg_aux_udmc {
         union {
                 struct {
diff --git a/arch/arc/plat-eznps/mtm.c b/arch/arc/plat-eznps/mtm.c
index 2388de3d09ef..ed0077ef666e 100644
--- a/arch/arc/plat-eznps/mtm.c
+++ b/arch/arc/plat-eznps/mtm.c
@@ -15,6 +15,8 @@
  */
 
 #include <linux/smp.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
 #include <linux/io.h>
 #include <linux/log2.h>
 #include <asm/arcregs.h>
@@ -157,10 +159,10 @@ void mtm_enable_core(unsigned int cpu)
 /* Verify and set the value of the mtm hs counter */
 static int __init set_mtm_hs_ctr(char *ctr_str)
 {
-        long hs_ctr;
+        int hs_ctr;
         int ret;
 
-        ret = kstrtol(ctr_str, 0, &hs_ctr);
+        ret = kstrtoint(ctr_str, 0, &hs_ctr);
 
         if (ret || hs_ctr > MT_HS_CNT_MAX || hs_ctr < MT_HS_CNT_MIN) {
                 pr_err("** Invalid @nps_mtm_hs_ctr [%d] needs to be [%d:%d] (incl)\n",
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 843edfd000be..d7a81284c272 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -337,8 +337,8 @@ config ARCH_MULTIPLATFORM
         select TIMER_OF
         select COMMON_CLK
         select GENERIC_CLOCKEVENTS
+        select GENERIC_IRQ_MULTI_HANDLER
         select MIGHT_HAVE_PCI
-        select MULTI_IRQ_HANDLER
         select PCI_DOMAINS if PCI
         select SPARSE_IRQ
         select USE_OF
@@ -465,9 +465,9 @@ config ARCH_DOVE
         bool "Marvell Dove"
         select CPU_PJ4
         select GENERIC_CLOCKEVENTS
+        select GENERIC_IRQ_MULTI_HANDLER
         select GPIOLIB
         select MIGHT_HAVE_PCI
-        select MULTI_IRQ_HANDLER
         select MVEBU_MBUS
         select PINCTRL
         select PINCTRL_DOVE
@@ -512,8 +512,8 @@ config ARCH_LPC32XX
         select COMMON_CLK
         select CPU_ARM926T
         select GENERIC_CLOCKEVENTS
+        select GENERIC_IRQ_MULTI_HANDLER
         select GPIOLIB
-        select MULTI_IRQ_HANDLER
         select SPARSE_IRQ
         select USE_OF
         help
@@ -532,11 +532,11 @@ config ARCH_PXA
         select TIMER_OF
         select CPU_XSCALE if !CPU_XSC3
         select GENERIC_CLOCKEVENTS
+        select GENERIC_IRQ_MULTI_HANDLER
         select GPIO_PXA
         select GPIOLIB
         select HAVE_IDE
         select IRQ_DOMAIN
-        select MULTI_IRQ_HANDLER
         select PLAT_PXA
         select SPARSE_IRQ
         help
@@ -572,11 +572,11 @@ config ARCH_SA1100
         select CPU_FREQ
         select CPU_SA1100
         select GENERIC_CLOCKEVENTS
+        select GENERIC_IRQ_MULTI_HANDLER
         select GPIOLIB
         select HAVE_IDE
         select IRQ_DOMAIN
         select ISA
-        select MULTI_IRQ_HANDLER
         select NEED_MACH_MEMORY_H
         select SPARSE_IRQ
         help
@@ -590,10 +590,10 @@ config ARCH_S3C24XX
         select GENERIC_CLOCKEVENTS
         select GPIO_SAMSUNG
         select GPIOLIB
+        select GENERIC_IRQ_MULTI_HANDLER
         select HAVE_S3C2410_I2C if I2C
         select HAVE_S3C2410_WATCHDOG if WATCHDOG
         select HAVE_S3C_RTC if RTC_CLASS
-        select MULTI_IRQ_HANDLER
         select NEED_MACH_IO_H
         select SAMSUNG_ATAGS
         select USE_OF
@@ -627,10 +627,10 @@ config ARCH_OMAP1
         select CLKSRC_MMIO
         select GENERIC_CLOCKEVENTS
         select GENERIC_IRQ_CHIP
+        select GENERIC_IRQ_MULTI_HANDLER
         select GPIOLIB
         select HAVE_IDE
         select IRQ_DOMAIN
-        select MULTI_IRQ_HANDLER
         select NEED_MACH_IO_H if PCCARD
         select NEED_MACH_MEMORY_H
         select SPARSE_IRQ
@@ -921,11 +921,6 @@ config IWMMXT
           Enable support for iWMMXt context switching at run time if
           running on a CPU that supports it.
 
-config MULTI_IRQ_HANDLER
-        bool
-        help
-          Allow each machine to specify it's own IRQ handler at run time.
-
 if !MMU
 source "arch/arm/Kconfig-nommu"
 endif
diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
index 66d0e215a773..f74756641410 100644
--- a/arch/arm/include/asm/atomic.h
+++ b/arch/arm/include/asm/atomic.h
@@ -130,7 +130,7 @@ static inline int atomic_cmpxchg_relaxed(atomic_t *ptr, int old, int new)
 }
 #define atomic_cmpxchg_relaxed          atomic_cmpxchg_relaxed
 
-static inline int __atomic_add_unless(atomic_t *v, int a, int u)
+static inline int atomic_fetch_add_unless(atomic_t *v, int a, int u)
 {
         int oldval, newval;
         unsigned long tmp;
@@ -156,6 +156,7 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
 
         return oldval;
 }
+#define atomic_fetch_add_unless         atomic_fetch_add_unless
 
 #else /* ARM_ARCH_6 */
 
@@ -215,15 +216,7 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
         return ret;
 }
 
-static inline int __atomic_add_unless(atomic_t *v, int a, int u)
-{
-        int c, old;
-
-        c = atomic_read(v);
-        while (c != u && (old = atomic_cmpxchg((v), c, c + a)) != c)
-                c = old;
-        return c;
-}
+#define atomic_fetch_andnot             atomic_fetch_andnot
 
 #endif /* __LINUX_ARM_ARCH__ */
 
@@ -254,17 +247,6 @@ ATOMIC_OPS(xor, ^=, eor)
 
 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
 
-#define atomic_inc(v)           atomic_add(1, v)
-#define atomic_dec(v)           atomic_sub(1, v)
-
-#define atomic_inc_and_test(v)  (atomic_add_return(1, v) == 0)
-#define atomic_dec_and_test(v)  (atomic_sub_return(1, v) == 0)
-#define atomic_inc_return_relaxed(v)    (atomic_add_return_relaxed(1, v))
-#define atomic_dec_return_relaxed(v)    (atomic_sub_return_relaxed(1, v))
-#define atomic_sub_and_test(i, v) (atomic_sub_return(i, v) == 0)
-
-#define atomic_add_negative(i,v) (atomic_add_return(i, v) < 0)
-
 #ifndef CONFIG_GENERIC_ATOMIC64
 typedef struct {
         long long counter;
@@ -494,12 +476,13 @@ static inline long long atomic64_dec_if_positive(atomic64_t *v)
 
         return result;
 }
+#define atomic64_dec_if_positive atomic64_dec_if_positive
 
-static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
+static inline long long atomic64_fetch_add_unless(atomic64_t *v, long long a,
+                                                  long long u)
 {
-        long long val;
+        long long oldval, newval;
         unsigned long tmp;
-        int ret = 1;
 
         smp_mb();
         prefetchw(&v->counter);
@@ -508,33 +491,23 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
 "1:     ldrexd  %0, %H0, [%4]\n"
 "       teq     %0, %5\n"
 "       teqeq   %H0, %H5\n"
-"       moveq   %1, #0\n"
 "       beq     2f\n"
-"       adds    %Q0, %Q0, %Q6\n"
-"       adc     %R0, %R0, %R6\n"
-"       strexd  %2, %0, %H0, [%4]\n"
+"       adds    %Q1, %Q0, %Q6\n"
+"       adc     %R1, %R0, %R6\n"
+"       strexd  %2, %1, %H1, [%4]\n"
 "       teq     %2, #0\n"
 "       bne     1b\n"
 "2:"
-        : "=&r" (val), "+r" (ret), "=&r" (tmp), "+Qo" (v->counter)
+        : "=&r" (oldval), "=&r" (newval), "=&r" (tmp), "+Qo" (v->counter)
         : "r" (&v->counter), "r" (u), "r" (a)
         : "cc");
 
-        if (ret)
+        if (oldval != u)
                 smp_mb();
 
-        return ret;
+        return oldval;
 }
-
-#define atomic64_add_negative(a, v)     (atomic64_add_return((a), (v)) < 0)
-#define atomic64_inc(v)                 atomic64_add(1LL, (v))
-#define atomic64_inc_return_relaxed(v)  atomic64_add_return_relaxed(1LL, (v))
-#define atomic64_inc_and_test(v)        (atomic64_inc_return(v) == 0)
-#define atomic64_sub_and_test(a, v)     (atomic64_sub_return((a), (v)) == 0)
-#define atomic64_dec(v)                 atomic64_sub(1LL, (v))
-#define atomic64_dec_return_relaxed(v)  atomic64_sub_return_relaxed(1LL, (v))
-#define atomic64_dec_and_test(v)        (atomic64_dec_return((v)) == 0)
-#define atomic64_inc_not_zero(v)        atomic64_add_unless((v), 1LL, 0LL)
+#define atomic64_fetch_add_unless atomic64_fetch_add_unless
 
 #endif /* !CONFIG_GENERIC_ATOMIC64 */
 #endif
diff --git a/arch/arm/include/asm/efi.h b/arch/arm/include/asm/efi.h
index 17f1f1a814ff..38badaae8d9d 100644
--- a/arch/arm/include/asm/efi.h
+++ b/arch/arm/include/asm/efi.h
@@ -58,6 +58,9 @@ void efi_virtmap_unload(void);
 #define efi_call_runtime(f, ...)        sys_table_arg->runtime->f(__VA_ARGS__)
 #define efi_is_64bit()                  (false)
 
+#define efi_table_attr(table, attr, instance)                           \
+        ((table##_t *)instance)->attr
+
 #define efi_call_proto(protocol, f, instance, ...)                      \
         ((protocol##_t *)instance)->f(instance, ##__VA_ARGS__)
 
diff --git a/arch/arm/include/asm/irq.h b/arch/arm/include/asm/irq.h
index b6f319606e30..c883fcbe93b6 100644
--- a/arch/arm/include/asm/irq.h
+++ b/arch/arm/include/asm/irq.h
@@ -31,11 +31,6 @@ extern void asm_do_IRQ(unsigned int, struct pt_regs *);
 void handle_IRQ(unsigned int, struct pt_regs *);
 void init_IRQ(void);
 
-#ifdef CONFIG_MULTI_IRQ_HANDLER
-extern void (*handle_arch_irq)(struct pt_regs *);
-extern void set_handle_irq(void (*handle_irq)(struct pt_regs *));
-#endif
-
 #ifdef CONFIG_SMP
 extern void arch_trigger_cpumask_backtrace(const cpumask_t *mask,
                                            bool exclude_self);
diff --git a/arch/arm/include/asm/mach/arch.h b/arch/arm/include/asm/mach/arch.h
index 5c1ad11aa392..bb8851208e17 100644
--- a/arch/arm/include/asm/mach/arch.h
+++ b/arch/arm/include/asm/mach/arch.h
@@ -59,7 +59,7 @@ struct machine_desc {
         void                    (*init_time)(void);
         void                    (*init_machine)(void);
         void                    (*init_late)(void);
-#ifdef CONFIG_MULTI_IRQ_HANDLER
+#ifdef CONFIG_GENERIC_IRQ_MULTI_HANDLER
         void                    (*handle_irq)(struct pt_regs *);
 #endif
         void                    (*restart)(enum reboot_mode, const char *);
diff --git a/arch/arm/include/asm/mach/time.h b/arch/arm/include/asm/mach/time.h
index 0f79e4dec7f9..4ac3a019a46f 100644
--- a/arch/arm/include/asm/mach/time.h
+++ b/arch/arm/include/asm/mach/time.h
@@ -13,7 +13,6 @@
 extern void timer_tick(void);
 
 typedef void (*clock_access_fn)(struct timespec64 *);
-extern int register_persistent_clock(clock_access_fn read_boot,
-                                     clock_access_fn read_persistent);
+extern int register_persistent_clock(clock_access_fn read_persistent);
 
 #endif
diff --git a/arch/arm/include/asm/tlb.h b/arch/arm/include/asm/tlb.h
index d5562f9ce600..f854148c8d7c 100644
--- a/arch/arm/include/asm/tlb.h
+++ b/arch/arm/include/asm/tlb.h
@@ -292,5 +292,13 @@ static inline void tlb_remove_check_page_size_change(struct mmu_gather *tlb,
 {
 }
 
+static inline void tlb_flush_remove_tables(struct mm_struct *mm)
+{
+}
+
+static inline void tlb_flush_remove_tables_local(void *arg)
+{
+}
+
 #endif /* CONFIG_MMU */
 #endif
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index 179a9f6bd1e3..e85a3af9ddeb 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -22,7 +22,7 @@
 #include <asm/glue-df.h>
 #include <asm/glue-pf.h>
 #include <asm/vfpmacros.h>
-#ifndef CONFIG_MULTI_IRQ_HANDLER
+#ifndef CONFIG_GENERIC_IRQ_MULTI_HANDLER
 #include <mach/entry-macro.S>
 #endif
 #include <asm/thread_notify.h>
@@ -39,7 +39,7 @@
  * Interrupt handling.
  */
         .macro  irq_handler
-#ifdef CONFIG_MULTI_IRQ_HANDLER
+#ifdef CONFIG_GENERIC_IRQ_MULTI_HANDLER
         ldr     r1, =handle_arch_irq
         mov     r0, sp
         badr    lr, 9997f
@@ -1226,9 +1226,3 @@ vector_addrexcptn:
         .globl  cr_alignment
 cr_alignment:
         .space  4
-
-#ifdef CONFIG_MULTI_IRQ_HANDLER
-        .globl  handle_arch_irq
-handle_arch_irq:
-        .space  4
-#endif
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index 106a1466518d..746565a876dc 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -48,6 +48,7 @@ saved_pc	.req	lr
  * from those features make this path too inefficient.
  */
 ret_fast_syscall:
+__ret_fast_syscall:
  UNWIND(.fnstart        )
  UNWIND(.cantunwind     )
         disable_irq_notrace                     @ disable interrupts
@@ -78,6 +79,7 @@ fast_work_pending:
  * call.
  */
 ret_fast_syscall:
+__ret_fast_syscall:
  UNWIND(.fnstart        )
  UNWIND(.cantunwind     )
         str     r0, [sp, #S_R0 + S_OFF]!        @ save returned r0
@@ -255,7 +257,7 @@ local_restart:
         tst     r10, #_TIF_SYSCALL_WORK         @ are we tracing syscalls?
         bne     __sys_trace
 
-        invoke_syscall tbl, scno, r10, ret_fast_syscall
+        invoke_syscall tbl, scno, r10, __ret_fast_syscall
 
         add     r1, sp, #S_OFF
 2:      cmp     scno, #(__ARM_NR_BASE - __NR_SYSCALL_BASE)
diff --git a/arch/arm/kernel/irq.c b/arch/arm/kernel/irq.c
index ece04a457486..9908dacf9229 100644
--- a/arch/arm/kernel/irq.c
+++ b/arch/arm/kernel/irq.c
@@ -102,16 +102,6 @@ void __init init_IRQ(void)
         uniphier_cache_init();
 }
 
-#ifdef CONFIG_MULTI_IRQ_HANDLER
-void __init set_handle_irq(void (*handle_irq)(struct pt_regs *))
-{
-        if (handle_arch_irq)
-                return;
-
-        handle_arch_irq = handle_irq;
-}
-#endif
-
 #ifdef CONFIG_SPARSE_IRQ
 int __init arch_probe_nr_irqs(void)
 {
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index 35ca494c028c..4c249cb261f3 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -1145,7 +1145,7 @@ void __init setup_arch(char **cmdline_p)
 
         reserve_crashkernel();
 
-#ifdef CONFIG_MULTI_IRQ_HANDLER
+#ifdef CONFIG_GENERIC_IRQ_MULTI_HANDLER
         handle_arch_irq = mdesc->handle_irq;
 #endif
 
diff --git a/arch/arm/kernel/time.c b/arch/arm/kernel/time.c
index cf2701cb0de8..078b259ead4e 100644
--- a/arch/arm/kernel/time.c
+++ b/arch/arm/kernel/time.c
@@ -83,29 +83,18 @@ static void dummy_clock_access(struct timespec64 *ts)
 }
 
 static clock_access_fn __read_persistent_clock = dummy_clock_access;
-static clock_access_fn __read_boot_clock = dummy_clock_access;
 
 void read_persistent_clock64(struct timespec64 *ts)
 {
         __read_persistent_clock(ts);
 }
 
-void read_boot_clock64(struct timespec64 *ts)
-{
-        __read_boot_clock(ts);
-}
-
-int __init register_persistent_clock(clock_access_fn read_boot,
-                                     clock_access_fn read_persistent)
+int __init register_persistent_clock(clock_access_fn read_persistent)
 {
         /* Only allow the clockaccess functions to be registered once */
-        if (__read_persistent_clock == dummy_clock_access &&
-            __read_boot_clock == dummy_clock_access) {
-                if (read_boot)
-                        __read_boot_clock = read_boot;
+        if (__read_persistent_clock == dummy_clock_access) {
                 if (read_persistent)
                         __read_persistent_clock = read_persistent;
-
                 return 0;
         }
 
diff --git a/arch/arm/mach-rpc/ecard.c b/arch/arm/mach-rpc/ecard.c
index 8db62cc54a6a..04b2f22c2739 100644
--- a/arch/arm/mach-rpc/ecard.c
+++ b/arch/arm/mach-rpc/ecard.c
@@ -212,7 +212,7 @@ static DEFINE_MUTEX(ecard_mutex);
  */
 static void ecard_init_pgtables(struct mm_struct *mm)
 {
-        struct vm_area_struct vma;
+        struct vm_area_struct vma = TLB_FLUSH_VMA(mm, VM_EXEC);
 
         /* We want to set up the page tables for the following mapping:
          *  Virtual     Physical
@@ -237,9 +237,6 @@ static void ecard_init_pgtables(struct mm_struct *mm)
 
         memcpy(dst_pgd, src_pgd, sizeof(pgd_t) * (EASI_SIZE / PGDIR_SIZE));
 
-        vma_init(&vma, mm);
-        vma.vm_flags = VM_EXEC;
-
         flush_tlb_range(&vma, IO_START, IO_START + IO_SIZE);
         flush_tlb_range(&vma, EASI_START, EASI_START + EASI_SIZE);
 }
diff --git a/arch/arm/plat-omap/counter_32k.c b/arch/arm/plat-omap/counter_32k.c
index 2438b96004c1..fcc5bfec8bd1 100644
--- a/arch/arm/plat-omap/counter_32k.c
+++ b/arch/arm/plat-omap/counter_32k.c
@@ -110,7 +110,7 @@ int __init omap_init_clocksource_32k(void __iomem *vbase)
         }
 
         sched_clock_register(omap_32k_read_sched_clock, 32, 32768);
-        register_persistent_clock(NULL, omap_read_persistent_clock64);
+        register_persistent_clock(omap_read_persistent_clock64);
         pr_info("OMAP clocksource: 32k_counter at 32768 Hz\n");
 
         return 0;
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 42c090cf0292..3d1011957823 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -74,6 +74,7 @@ config ARM64
         select GENERIC_CPU_AUTOPROBE
         select GENERIC_EARLY_IOREMAP
         select GENERIC_IDLE_POLL_SETUP
+        select GENERIC_IRQ_MULTI_HANDLER
         select GENERIC_IRQ_PROBE
         select GENERIC_IRQ_SHOW
         select GENERIC_IRQ_SHOW_LEVEL
@@ -264,9 +265,6 @@ config ARCH_SUPPORTS_UPROBES
 config ARCH_PROC_KCORE_TEXT
         def_bool y
 
-config MULTI_IRQ_HANDLER
-        def_bool y
-
 source "init/Kconfig"
 
 source "kernel/Kconfig.freezer"
diff --git a/arch/arm64/crypto/aes-ce-ccm-core.S b/arch/arm64/crypto/aes-ce-ccm-core.S
index 88f5aef7934c..e3a375c4cb83 100644
--- a/arch/arm64/crypto/aes-ce-ccm-core.S
+++ b/arch/arm64/crypto/aes-ce-ccm-core.S
@@ -19,33 +19,24 @@
          *                           u32 *macp, u8 const rk[], u32 rounds);
          */
 ENTRY(ce_aes_ccm_auth_data)
-        frame_push      7
-
-        mov     x19, x0
-        mov     x20, x1
-        mov     x21, x2
-        mov     x22, x3
-        mov     x23, x4
-        mov     x24, x5
-
-        ldr     w25, [x22]                      /* leftover from prev round? */
+        ldr     w8, [x3]                        /* leftover from prev round? */
         ld1     {v0.16b}, [x0]                  /* load mac */
-        cbz     w25, 1f
-        sub     w25, w25, #16
+        cbz     w8, 1f
+        sub     w8, w8, #16
         eor     v1.16b, v1.16b, v1.16b
-0:      ldrb    w7, [x20], #1                   /* get 1 byte of input */
-        subs    w21, w21, #1
-        add     w25, w25, #1
+0:      ldrb    w7, [x1], #1                    /* get 1 byte of input */
+        subs    w2, w2, #1
+        add     w8, w8, #1
         ins     v1.b[0], w7
         ext     v1.16b, v1.16b, v1.16b, #1      /* rotate in the input bytes */
         beq     8f                              /* out of input? */
-        cbnz    w25, 0b
+        cbnz    w8, 0b
         eor     v0.16b, v0.16b, v1.16b
-1:      ld1     {v3.4s}, [x23]                  /* load first round key */
-        prfm    pldl1strm, [x20]
-        cmp     w24, #12                        /* which key size? */
-        add     x6, x23, #16
-        sub     w7, w24, #2                     /* modified # of rounds */
+1:      ld1     {v3.4s}, [x4]                   /* load first round key */
+        prfm    pldl1strm, [x1]
+        cmp     w5, #12                         /* which key size? */
+        add     x6, x4, #16
+        sub     w7, w5, #2                      /* modified # of rounds */
         bmi     2f
         bne     5f
         mov     v5.16b, v3.16b
@@ -64,43 +55,33 @@ ENTRY(ce_aes_ccm_auth_data)
         ld1     {v5.4s}, [x6], #16              /* load next round key */
         bpl     3b
         aese    v0.16b, v4.16b
-        subs    w21, w21, #16                   /* last data? */
+        subs    w2, w2, #16                     /* last data? */
         eor     v0.16b, v0.16b, v5.16b          /* final round */
         bmi     6f
-        ld1     {v1.16b}, [x20], #16            /* load next input block */
+        ld1     {v1.16b}, [x1], #16             /* load next input block */
         eor     v0.16b, v0.16b, v1.16b          /* xor with mac */
-        beq     6f
-
-        if_will_cond_yield_neon
-        st1     {v0.16b}, [x19]                 /* store mac */
-        do_cond_yield_neon
-        ld1     {v0.16b}, [x19]                 /* reload mac */
-        endif_yield_neon
-
-        b       1b
-6:      st1     {v0.16b}, [x19]                 /* store mac */
+        bne     1b
+6:      st1     {v0.16b}, [x0]                  /* store mac */
         beq     10f
-        adds    w21, w21, #16
+        adds    w2, w2, #16
         beq     10f
-        mov     w25, w21
-7:      ldrb    w7, [x20], #1
+        mov     w8, w2
+7:      ldrb    w7, [x1], #1
         umov    w6, v0.b[0]
         eor     w6, w6, w7
-        strb    w6, [x19], #1
-        subs    w21, w21, #1
+        strb    w6, [x0], #1
+        subs    w2, w2, #1
         beq     10f
         ext     v0.16b, v0.16b, v0.16b, #1      /* rotate out the mac bytes */
         b       7b
-8:      mov     w7, w25
-        add     w25, w25, #16
+8:      mov     w7, w8
+        add     w8, w8, #16
 9:      ext     v1.16b, v1.16b, v1.16b, #1
         adds    w7, w7, #1
         bne     9b
         eor     v0.16b, v0.16b, v1.16b
-        st1     {v0.16b}, [x19]
-10:     str     w25, [x22]
-
-        frame_pop
+        st1     {v0.16b}, [x0]
+10:     str     w8, [x3]
         ret
 ENDPROC(ce_aes_ccm_auth_data)
 
@@ -145,29 +126,19 @@ ENTRY(ce_aes_ccm_final)
 ENDPROC(ce_aes_ccm_final)
 
         .macro  aes_ccm_do_crypt,enc
-        frame_push      8
-
-        mov     x19, x0
-        mov     x20, x1
-        mov     x21, x2
-        mov     x22, x3
-        mov     x23, x4
-        mov     x24, x5
-        mov     x25, x6
-
-        ldr     x26, [x25, #8]                  /* load lower ctr */
-        ld1     {v0.16b}, [x24]                 /* load mac */
-CPU_LE( rev     x26, x26                )       /* keep swabbed ctr in reg */
+        ldr     x8, [x6, #8]                    /* load lower ctr */
+        ld1     {v0.16b}, [x5]                  /* load mac */
+CPU_LE( rev     x8, x8                  )       /* keep swabbed ctr in reg */
 0:      /* outer loop */
-        ld1     {v1.8b}, [x25]                  /* load upper ctr */
-        prfm    pldl1strm, [x20]
-        add     x26, x26, #1
-        rev     x9, x26
-        cmp     w23, #12                        /* which key size? */
-        sub     w7, w23, #2                     /* get modified # of rounds */
+        ld1     {v1.8b}, [x6]                   /* load upper ctr */
+        prfm    pldl1strm, [x1]
+        add     x8, x8, #1
+        rev     x9, x8
+        cmp     w4, #12                         /* which key size? */
+        sub     w7, w4, #2                      /* get modified # of rounds */
         ins     v1.d[1], x9                     /* no carry in lower ctr */
-        ld1     {v3.4s}, [x22]                  /* load first round key */
-        add     x10, x22, #16
+        ld1     {v3.4s}, [x3]                   /* load first round key */
+        add     x10, x3, #16
         bmi     1f
         bne     4f
         mov     v5.16b, v3.16b
@@ -194,9 +165,9 @@ CPU_LE(	rev	x26, x26		)	/* keep swabbed ctr in reg */
         bpl     2b
         aese    v0.16b, v4.16b
         aese    v1.16b, v4.16b
-        subs    w21, w21, #16
-        bmi     7f                              /* partial block? */
-        ld1     {v2.16b}, [x20], #16            /* load next input block */
+        subs    w2, w2, #16
+        bmi     6f                              /* partial block? */
+        ld1     {v2.16b}, [x1], #16             /* load next input block */
         .if     \enc == 1
         eor     v2.16b, v2.16b, v5.16b          /* final round enc+mac */
         eor     v1.16b, v1.16b, v2.16b          /* xor with crypted ctr */
@@ -205,29 +176,18 @@ CPU_LE(	rev	x26, x26		)	/* keep swabbed ctr in reg */
         eor     v1.16b, v2.16b, v5.16b          /* final round enc */
         .endif
         eor     v0.16b, v0.16b, v2.16b          /* xor mac with pt ^ rk[last] */
-        st1     {v1.16b}, [x19], #16            /* write output block */
-        beq     5f
-
-        if_will_cond_yield_neon
-        st1     {v0.16b}, [x24]                 /* store mac */
-        do_cond_yield_neon
-        ld1     {v0.16b}, [x24]                 /* reload mac */
-        endif_yield_neon
-
-        b       0b
-5:
-CPU_LE( rev     x26, x26                        )
-        st1     {v0.16b}, [x24]                 /* store mac */
-        str     x26, [x25, #8]                  /* store lsb end of ctr (BE) */
-
-6:      frame_pop
-        ret
-
-7:      eor     v0.16b, v0.16b, v5.16b          /* final round mac */
+        st1     {v1.16b}, [x0], #16             /* write output block */
+        bne     0b
+CPU_LE( rev     x8, x8                  )
+        st1     {v0.16b}, [x5]                  /* store mac */
+        str     x8, [x6, #8]                    /* store lsb end of ctr (BE) */
+5:      ret
+
+6:      eor     v0.16b, v0.16b, v5.16b          /* final round mac */
         eor     v1.16b, v1.16b, v5.16b          /* final round enc */
-        st1     {v0.16b}, [x24]                 /* store mac */
-        add     w21, w21, #16                   /* process partial tail block */
-8:      ldrb    w9, [x20], #1                   /* get 1 byte of input */
+        st1     {v0.16b}, [x5]                  /* store mac */
+        add     w2, w2, #16                     /* process partial tail block */
+7:      ldrb    w9, [x1], #1                    /* get 1 byte of input */
         umov    w6, v1.b[0]                     /* get top crypted ctr byte */
         umov    w7, v0.b[0]                     /* get top mac byte */
         .if     \enc == 1
@@ -237,13 +197,13 @@ CPU_LE(	rev	x26, x26			)
         eor     w9, w9, w6
         eor     w7, w7, w9
         .endif
-        strb    w9, [x19], #1                   /* store out byte */
-        strb    w7, [x24], #1                   /* store mac byte */
-        subs    w21, w21, #1
-        beq     6b
+        strb    w9, [x0], #1                    /* store out byte */
+        strb    w7, [x5], #1                    /* store mac byte */
+        subs    w2, w2, #1
+        beq     5b
         ext     v0.16b, v0.16b, v0.16b, #1      /* shift out mac byte */
         ext     v1.16b, v1.16b, v1.16b, #1      /* shift out ctr byte */
-        b       8b
+        b       7b
         .endm
 
         /*
diff --git a/arch/arm64/crypto/ghash-ce-core.S b/arch/arm64/crypto/ghash-ce-core.S
index dcffb9e77589..c723647b37db 100644
--- a/arch/arm64/crypto/ghash-ce-core.S
+++ b/arch/arm64/crypto/ghash-ce-core.S
@@ -322,55 +322,41 @@ ENDPROC(pmull_ghash_update_p8)
         .endm
 
         .macro          pmull_gcm_do_crypt, enc
-        frame_push      10
+        ld1             {SHASH.2d}, [x4]
+        ld1             {XL.2d}, [x1]
+        ldr             x8, [x5, #8]                    // load lower counter
 
-        mov             x19, x0
-        mov             x20, x1
-        mov             x21, x2
-        mov             x22, x3
-        mov             x23, x4
-        mov             x24, x5
-        mov             x25, x6
-        mov             x26, x7
-        .if             \enc == 1
-        ldr             x27, [sp, #96]                  // first stacked arg
-        .endif
-
-        ldr             x28, [x24, #8]                  // load lower counter
-CPU_LE( rev             x28, x28        )
-
-0:      mov             x0, x25
-        load_round_keys w26, x0
-        ld1             {SHASH.2d}, [x23]
-        ld1             {XL.2d}, [x20]
+        load_round_keys w7, x6
 
         movi            MASK.16b, #0xe1
         ext             SHASH2.16b, SHASH.16b, SHASH.16b, #8
+CPU_LE( rev             x8, x8          )
         shl             MASK.2d, MASK.2d, #57
         eor             SHASH2.16b, SHASH2.16b, SHASH.16b
 
         .if             \enc == 1
-        ld1             {KS.16b}, [x27]
+        ldr             x10, [sp]
+        ld1             {KS.16b}, [x10]
         .endif
 
-1:      ld1             {CTR.8b}, [x24]                 // load upper counter
-        ld1             {INP.16b}, [x22], #16
-        rev             x9, x28
-        add             x28, x28, #1
-        sub             w19, w19, #1
+0:      ld1             {CTR.8b}, [x5]                  // load upper counter
+        ld1             {INP.16b}, [x3], #16
+        rev             x9, x8
+        add             x8, x8, #1
+        sub             w0, w0, #1
         ins             CTR.d[1], x9                    // set lower counter
 
         .if             \enc == 1
         eor             INP.16b, INP.16b, KS.16b        // encrypt input
-        st1             {INP.16b}, [x21], #16
+        st1             {INP.16b}, [x2], #16
         .endif
 
         rev64           T1.16b, INP.16b
 
-        cmp             w26, #12
-        b.ge            4f                              // AES-192/256?
+        cmp             w7, #12
+        b.ge            2f                              // AES-192/256?
 
-2:      enc_round       CTR, v21
+1:      enc_round       CTR, v21
 
         ext             T2.16b, XL.16b, XL.16b, #8
         ext             IN1.16b, T1.16b, T1.16b, #8
@@ -425,39 +411,27 @@ CPU_LE(	rev		x28, x28	)
 
         .if             \enc == 0
         eor             INP.16b, INP.16b, KS.16b
-        st1             {INP.16b}, [x21], #16
+        st1             {INP.16b}, [x2], #16
         .endif
 
-        cbz             w19, 3f
+        cbnz            w0, 0b
 
-        if_will_cond_yield_neon
-        st1             {XL.2d}, [x20]
-        .if             \enc == 1
-        st1             {KS.16b}, [x27]
-        .endif
-        do_cond_yield_neon
-        b               0b
-        endif_yield_neon
+CPU_LE( rev             x8, x8          )
+        st1             {XL.2d}, [x1]
+        str             x8, [x5, #8]                    // store lower counter
 
-        b               1b
-
-3:      st1             {XL.2d}, [x20]
         .if             \enc == 1
-        st1             {KS.16b}, [x27]
+        st1             {KS.16b}, [x10]
         .endif
 
-CPU_LE( rev             x28, x28        )
-        str             x28, [x24, #8]                  // store lower counter
-
-        frame_pop
         ret
 
-4:      b.eq            5f                              // AES-192?
+2:      b.eq            3f                              // AES-192?
         enc_round       CTR, v17
         enc_round       CTR, v18
-5:      enc_round       CTR, v19
+3:      enc_round       CTR, v19
         enc_round       CTR, v20
-        b               2b
+        b               1b
         .endm
 
         /*
diff --git a/arch/arm64/crypto/ghash-ce-glue.c b/arch/arm64/crypto/ghash-ce-glue.c
index 7cf0b1aa6ea8..8a10f1d7199a 100644
--- a/arch/arm64/crypto/ghash-ce-glue.c
+++ b/arch/arm64/crypto/ghash-ce-glue.c
@@ -488,9 +488,13 @@ static int gcm_decrypt(struct aead_request *req)
                         err = skcipher_walk_done(&walk,
                                                  walk.nbytes % AES_BLOCK_SIZE);
                 }
-                if (walk.nbytes)
-                        pmull_gcm_encrypt_block(iv, iv, NULL,
+                if (walk.nbytes) {
+                        kernel_neon_begin();
+                        pmull_gcm_encrypt_block(iv, iv, ctx->aes_key.key_enc,
                                                 num_rounds(&ctx->aes_key));
+                        kernel_neon_end();
+                }
+
         } else {
                 __aes_arm64_encrypt(ctx->aes_key.key_enc, tag, iv,
                                     num_rounds(&ctx->aes_key));
diff --git a/arch/arm64/include/asm/atomic.h b/arch/arm64/include/asm/atomic.h
index c0235e0ff849..9bca54dda75c 100644
--- a/arch/arm64/include/asm/atomic.h
+++ b/arch/arm64/include/asm/atomic.h
@@ -40,17 +40,6 @@
 
 #include <asm/cmpxchg.h>
 
-#define ___atomic_add_unless(v, a, u, sfx)                              \
-({                                                                      \
-        typeof((v)->counter) c, old;                                    \
-                                                                        \
-        c = atomic##sfx##_read(v);                                      \
-        while (c != (u) &&                                              \
-              (old = atomic##sfx##_cmpxchg((v), c, c + (a))) != c)      \
-                c = old;                                                \
-        c;                                                              \
- })
-
 #define ATOMIC_INIT(i)  { (i) }
 
 #define atomic_read(v)                  READ_ONCE((v)->counter)
@@ -61,21 +50,11 @@
 #define atomic_add_return_release       atomic_add_return_release
 #define atomic_add_return               atomic_add_return
 
-#define atomic_inc_return_relaxed(v)    atomic_add_return_relaxed(1, (v))
-#define atomic_inc_return_acquire(v)    atomic_add_return_acquire(1, (v))
-#define atomic_inc_return_release(v)    atomic_add_return_release(1, (v))
-#define atomic_inc_return(v)            atomic_add_return(1, (v))
-
 #define atomic_sub_return_relaxed       atomic_sub_return_relaxed
 #define atomic_sub_return_acquire       atomic_sub_return_acquire
 #define atomic_sub_return_release       atomic_sub_return_release
 #define atomic_sub_return               atomic_sub_return
 
-#define atomic_dec_return_relaxed(v)    atomic_sub_return_relaxed(1, (v))
-#define atomic_dec_return_acquire(v)    atomic_sub_return_acquire(1, (v))
-#define atomic_dec_return_release(v)    atomic_sub_return_release(1, (v))
-#define atomic_dec_return(v)            atomic_sub_return(1, (v))
-
 #define atomic_fetch_add_relaxed        atomic_fetch_add_relaxed
 #define atomic_fetch_add_acquire        atomic_fetch_add_acquire
 #define atomic_fetch_add_release        atomic_fetch_add_release
@@ -119,13 +98,6 @@
         cmpxchg_release(&((v)->counter), (old), (new))
 #define atomic_cmpxchg(v, old, new)     cmpxchg(&((v)->counter), (old), (new))
 
-#define atomic_inc(v)                   atomic_add(1, (v))
-#define atomic_dec(v)                   atomic_sub(1, (v))
-#define atomic_inc_and_test(v)          (atomic_inc_return(v) == 0)
-#define atomic_dec_and_test(v)          (atomic_dec_return(v) == 0)
-#define atomic_sub_and_test(i, v)       (atomic_sub_return((i), (v)) == 0)
-#define atomic_add_negative(i, v)       (atomic_add_return((i), (v)) < 0)
-#define __atomic_add_unless(v, a, u)    ___atomic_add_unless(v, a, u,)
 #define atomic_andnot                   atomic_andnot
 
 /*
@@ -140,21 +112,11 @@
 #define atomic64_add_return_release     atomic64_add_return_release
 #define atomic64_add_return             atomic64_add_return
 
-#define atomic64_inc_return_relaxed(v)  atomic64_add_return_relaxed(1, (v))
-#define atomic64_inc_return_acquire(v)  atomic64_add_return_acquire(1, (v))
-#define atomic64_inc_return_release(v)  atomic64_add_return_release(1, (v))
-#define atomic64_inc_return(v)          atomic64_add_return(1, (v))
-
 #define atomic64_sub_return_relaxed     atomic64_sub_return_relaxed
 #define atomic64_sub_return_acquire     atomic64_sub_return_acquire
 #define atomic64_sub_return_release     atomic64_sub_return_release
 #define atomic64_sub_return             atomic64_sub_return
 
-#define atomic64_dec_return_relaxed(v)  atomic64_sub_return_relaxed(1, (v))
-#define atomic64_dec_return_acquire(v)  atomic64_sub_return_acquire(1, (v))
-#define atomic64_dec_return_release(v)  atomic64_sub_return_release(1, (v))
-#define atomic64_dec_return(v)          atomic64_sub_return(1, (v))
-
 #define atomic64_fetch_add_relaxed      atomic64_fetch_add_relaxed
 #define atomic64_fetch_add_acquire      atomic64_fetch_add_acquire
 #define atomic64_fetch_add_release      atomic64_fetch_add_release
@@ -195,16 +157,9 @@
 #define atomic64_cmpxchg_release        atomic_cmpxchg_release
 #define atomic64_cmpxchg                atomic_cmpxchg
 
-#define atomic64_inc(v)                 atomic64_add(1, (v))
-#define atomic64_dec(v)                 atomic64_sub(1, (v))
-#define atomic64_inc_and_test(v)        (atomic64_inc_return(v) == 0)
-#define atomic64_dec_and_test(v)        (atomic64_dec_return(v) == 0)
-#define atomic64_sub_and_test(i, v)     (atomic64_sub_return((i), (v)) == 0)
-#define atomic64_add_negative(i, v)     (atomic64_add_return((i), (v)) < 0)
-#define atomic64_add_unless(v, a, u)    (___atomic_add_unless(v, a, u, 64) != u)
 #define atomic64_andnot                 atomic64_andnot
 
-#define atomic64_inc_not_zero(v)        atomic64_add_unless((v), 1, 0)
+#define atomic64_dec_if_positive        atomic64_dec_if_positive
 
 #endif
 #endif
diff --git a/arch/arm64/include/asm/bitops.h b/arch/arm64/include/asm/bitops.h
index 9c19594ce7cb..10d536b1af74 100644
--- a/arch/arm64/include/asm/bitops.h
+++ b/arch/arm64/include/asm/bitops.h
@@ -17,22 +17,11 @@
 #define __ASM_BITOPS_H
 
 #include <linux/compiler.h>
-#include <asm/barrier.h>
 
 #ifndef _LINUX_BITOPS_H
 #error only <linux/bitops.h> can be included directly
 #endif
 
-/*
- * Little endian assembly atomic bitops.
- */
-extern void set_bit(int nr, volatile unsigned long *p);
-extern void clear_bit(int nr, volatile unsigned long *p);
-extern void change_bit(int nr, volatile unsigned long *p);
-extern int test_and_set_bit(int nr, volatile unsigned long *p);
-extern int test_and_clear_bit(int nr, volatile unsigned long *p);
-extern int test_and_change_bit(int nr, volatile unsigned long *p);
-
 #include <asm-generic/bitops/builtin-__ffs.h>
 #include <asm-generic/bitops/builtin-ffs.h>
 #include <asm-generic/bitops/builtin-__fls.h>
@@ -44,15 +33,11 @@ extern int test_and_change_bit(int nr, volatile unsigned long *p);
 
 #include <asm-generic/bitops/sched.h>
 #include <asm-generic/bitops/hweight.h>
-#include <asm-generic/bitops/lock.h>
 
+#include <asm-generic/bitops/atomic.h>
+#include <asm-generic/bitops/lock.h>
 #include <asm-generic/bitops/non-atomic.h>
 #include <asm-generic/bitops/le.h>
-
-/*
- * Ext2 is defined to use little-endian byte ordering.
- */
-#define ext2_set_bit_atomic(lock, nr, p)        test_and_set_bit_le(nr, p)
-#define ext2_clear_bit_atomic(lock, nr, p)      test_and_clear_bit_le(nr, p)
+#include <asm-generic/bitops/ext2-atomic-setbit.h>
 
 #endif /* __ASM_BITOPS_H */
diff --git a/arch/arm64/include/asm/efi.h b/arch/arm64/include/asm/efi.h
index 192d791f1103..7ed320895d1f 100644
--- a/arch/arm64/include/asm/efi.h
+++ b/arch/arm64/include/asm/efi.h
@@ -87,6 +87,9 @@ static inline unsigned long efi_get_max_initrd_addr(unsigned long dram_base,
 #define efi_call_runtime(f, ...)        sys_table_arg->runtime->f(__VA_ARGS__)
 #define efi_is_64bit()                  (true)
 
+#define efi_table_attr(table, attr, instance)                           \
+        ((table##_t *)instance)->attr
+
 #define efi_call_proto(protocol, f, instance, ...)                      \
         ((protocol##_t *)instance)->f(instance, ##__VA_ARGS__)
 
diff --git a/arch/arm64/include/asm/irq.h b/arch/arm64/include/asm/irq.h
index a0fee6985e6a..b2b0c6405eb0 100644
--- a/arch/arm64/include/asm/irq.h
+++ b/arch/arm64/include/asm/irq.h
@@ -8,8 +8,6 @@
 
 struct pt_regs;
 
-extern void set_handle_irq(void (*handle_irq)(struct pt_regs *));
-
 static inline int nr_legacy_irqs(void)
 {
         return 0;
diff --git a/arch/arm64/include/asm/tlb.h b/arch/arm64/include/asm/tlb.h
index d87f2d646caa..0ad1cf233470 100644
--- a/arch/arm64/include/asm/tlb.h
+++ b/arch/arm64/include/asm/tlb.h
@@ -37,9 +37,7 @@ static inline void __tlb_remove_table(void *_table)
 
 static inline void tlb_flush(struct mmu_gather *tlb)
 {
-        struct vm_area_struct vma;
-
-        vma_init(&vma, tlb->mm);
+        struct vm_area_struct vma = TLB_FLUSH_VMA(tlb->mm, 0);
 
         /*
          * The ASID allocator will either invalidate the ASID or mark
diff --git a/arch/arm64/kernel/irq.c b/arch/arm64/kernel/irq.c
index 60e5fc661f74..780a12f59a8f 100644
--- a/arch/arm64/kernel/irq.c
+++ b/arch/arm64/kernel/irq.c
@@ -42,16 +42,6 @@ int arch_show_interrupts(struct seq_file *p, int prec)
         return 0;
 }
 
-void (*handle_arch_irq)(struct pt_regs *) = NULL;
-
-void __init set_handle_irq(void (*handle_irq)(struct pt_regs *))
-{
-        if (handle_arch_irq)
-                return;
-
-        handle_arch_irq = handle_irq;
-}
-
 #ifdef CONFIG_VMAP_STACK
 static void init_irq_stacks(void)
 {
diff --git a/arch/arm64/lib/Makefile b/arch/arm64/lib/Makefile
index 137710f4dac3..68755fd70dcf 100644
--- a/arch/arm64/lib/Makefile
+++ b/arch/arm64/lib/Makefile
@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0
-lib-y           := bitops.o clear_user.o delay.o copy_from_user.o       \
+lib-y           := clear_user.o delay.o copy_from_user.o                \
                    copy_to_user.o copy_in_user.o copy_page.o            \
                    clear_page.o memchr.o memcpy.o memmove.o memset.o    \
                    memcmp.o strcmp.o strncmp.o strlen.o strnlen.o       \
diff --git a/arch/arm64/lib/bitops.S b/arch/arm64/lib/bitops.S
deleted file mode 100644
index 43ac736baa5b..000000000000
--- a/arch/arm64/lib/bitops.S
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * Based on arch/arm/lib/bitops.h
- *
- * Copyright (C) 2013 ARM Ltd.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-#include <linux/linkage.h>
-#include <asm/assembler.h>
-#include <asm/lse.h>
-
-/*
- * x0: bits 5:0  bit offset
- *     bits 31:6 word offset
- * x1: address
- */
-        .macro  bitop, name, llsc, lse
-ENTRY(  \name   )
-        and     w3, w0, #63             // Get bit offset
-        eor     w0, w0, w3              // Clear low bits
-        mov     x2, #1
-        add     x1, x1, x0, lsr #3      // Get word offset
-alt_lse "       prfm    pstl1strm, [x1]",       "nop"
-        lsl     x3, x2, x3              // Create mask
-
-alt_lse "1:     ldxr    x2, [x1]",              "\lse   x3, [x1]"
-alt_lse "       \llsc   x2, x2, x3",            "nop"
-alt_lse "       stxr    w0, x2, [x1]",          "nop"
-alt_lse "       cbnz    w0, 1b",                "nop"
-
-        ret
-ENDPROC(\name   )
-        .endm
-
-        .macro  testop, name, llsc, lse
-ENTRY(  \name   )
-        and     w3, w0, #63             // Get bit offset
-        eor     w0, w0, w3              // Clear low bits
-        mov     x2, #1
-        add     x1, x1, x0, lsr #3      // Get word offset
-alt_lse "       prfm    pstl1strm, [x1]",       "nop"
-        lsl     x4, x2, x3              // Create mask
-
-alt_lse "1:     ldxr    x2, [x1]",              "\lse   x4, x2, [x1]"
-        lsr     x0, x2, x3
-alt_lse "       \llsc   x2, x2, x4",            "nop"
-alt_lse "       stlxr   w5, x2, [x1]",          "nop"
-alt_lse "       cbnz    w5, 1b",                "nop"
-alt_lse "       dmb     ish",                   "nop"
-
-        and     x0, x0, #1
-        ret
-ENDPROC(\name   )
-        .endm
-
-/*
- * Atomic bit operations.
- */
-        bitop   change_bit, eor, steor
-        bitop   clear_bit, bic, stclr
-        bitop   set_bit, orr, stset
-
-        testop  test_and_change_bit, eor, ldeoral
-        testop  test_and_clear_bit, bic, ldclral
-        testop  test_and_set_bit, orr, ldsetal
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index 1854e49aa18a..192b3ba07075 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -108,13 +108,10 @@ static pte_t get_clear_flush(struct mm_struct *mm,
                              unsigned long pgsize,
                              unsigned long ncontig)
 {
-        struct vm_area_struct vma;
         pte_t orig_pte = huge_ptep_get(ptep);
         bool valid = pte_valid(orig_pte);
         unsigned long i, saddr = addr;
 
-        vma_init(&vma, mm);
-
         for (i = 0; i < ncontig; i++, addr += pgsize, ptep++) {
                 pte_t pte = ptep_get_and_clear(mm, addr, ptep);
 
@@ -127,8 +124,10 @@ static pte_t get_clear_flush(struct mm_struct *mm,
                         orig_pte = pte_mkdirty(orig_pte);
         }
 
-        if (valid)
+        if (valid) {
+                struct vm_area_struct vma = TLB_FLUSH_VMA(mm, 0);
                 flush_tlb_range(&vma, saddr, addr);
+        }
         return orig_pte;
 }
 
@@ -147,10 +146,9 @@ static void clear_flush(struct mm_struct *mm,
                              unsigned long pgsize,
                              unsigned long ncontig)
 {
-        struct vm_area_struct vma;
+        struct vm_area_struct vma = TLB_FLUSH_VMA(mm, 0);
         unsigned long i, saddr = addr;
 
-        vma_init(&vma, mm);
         for (i = 0; i < ncontig; i++, addr += pgsize, ptep++)
                 pte_clear(mm, addr, ptep);
 
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 493ff75670ff..8ae5d7ae4af3 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -977,12 +977,12 @@ int pmd_clear_huge(pmd_t *pmdp)
         return 1;
 }
 
-int pud_free_pmd_page(pud_t *pud)
+int pud_free_pmd_page(pud_t *pud, unsigned long addr)
 {
         return pud_none(*pud);
 }
 
-int pmd_free_pte_page(pmd_t *pmd)
+int pmd_free_pte_page(pmd_t *pmd, unsigned long addr)
 {
         return pmd_none(*pmd);
 }
diff --git a/arch/h8300/include/asm/atomic.h b/arch/h8300/include/asm/atomic.h
index 941e7554e886..c6b6a06231b2 100644
--- a/arch/h8300/include/asm/atomic.h
+++ b/arch/h8300/include/asm/atomic.h
@@ -2,8 +2,10 @@
 #ifndef __ARCH_H8300_ATOMIC__
 #define __ARCH_H8300_ATOMIC__
 
+#include <linux/compiler.h>
 #include <linux/types.h>
 #include <asm/cmpxchg.h>
+#include <asm/irqflags.h>
 
 /*
  * Atomic operations that C can't guarantee us.  Useful for
@@ -15,8 +17,6 @@
 #define atomic_read(v)          READ_ONCE((v)->counter)
 #define atomic_set(v, i)        WRITE_ONCE(((v)->counter), (i))
 
-#include <linux/kernel.h>
-
 #define ATOMIC_OP_RETURN(op, c_op)                              \
 static inline int atomic_##op##_return(int i, atomic_t *v)      \
 {                                                               \
@@ -69,18 +69,6 @@ ATOMIC_OPS(sub, -=)
 #undef ATOMIC_OP_RETURN
 #undef ATOMIC_OP
 
-#define atomic_add_negative(a, v)       (atomic_add_return((a), (v)) < 0)
-#define atomic_sub_and_test(i, v)       (atomic_sub_return(i, v) == 0)
-
-#define atomic_inc_return(v)            atomic_add_return(1, v)
-#define atomic_dec_return(v)            atomic_sub_return(1, v)
-
-#define atomic_inc(v)                   (void)atomic_inc_return(v)
-#define atomic_inc_and_test(v)          (atomic_inc_return(v) == 0)
-
-#define atomic_dec(v)                   (void)atomic_dec_return(v)
-#define atomic_dec_and_test(v)          (atomic_dec_return(v) == 0)
-
 static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
 {
         int ret;
@@ -94,7 +82,7 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
         return ret;
 }
 
-static inline int __atomic_add_unless(atomic_t *v, int a, int u)
+static inline int atomic_fetch_add_unless(atomic_t *v, int a, int u)
 {
         int ret;
         h8300flags flags;
@@ -106,5 +94,6 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
         arch_local_irq_restore(flags);
         return ret;
 }
+#define atomic_fetch_add_unless         atomic_fetch_add_unless
 
 #endif /* __ARCH_H8300_ATOMIC __ */
diff --git a/arch/hexagon/include/asm/atomic.h b/arch/hexagon/include/asm/atomic.h
index fb3dfb2a667e..311b9894ccc8 100644
--- a/arch/hexagon/include/asm/atomic.h
+++ b/arch/hexagon/include/asm/atomic.h
@@ -164,7 +164,7 @@ ATOMIC_OPS(xor)
 #undef ATOMIC_OP
 
 /**
- * __atomic_add_unless - add unless the number is a given value
+ * atomic_fetch_add_unless - add unless the number is a given value
  * @v: pointer to value
  * @a: amount to add
  * @u: unless value is equal to u
@@ -173,7 +173,7 @@ ATOMIC_OPS(xor)
  *
  */
 
-static inline int __atomic_add_unless(atomic_t *v, int a, int u)
+static inline int atomic_fetch_add_unless(atomic_t *v, int a, int u)
 {
         int __oldval;
         register int tmp;
@@ -196,18 +196,6 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
         );
         return __oldval;
 }
-
-#define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-
-#define atomic_inc(v) atomic_add(1, (v))
-#define atomic_dec(v) atomic_sub(1, (v))
-
-#define atomic_inc_and_test(v) (atomic_add_return(1, (v)) == 0)
-#define atomic_dec_and_test(v) (atomic_sub_return(1, (v)) == 0)
-#define atomic_sub_and_test(i, v) (atomic_sub_return(i, (v)) == 0)
-#define atomic_add_negative(i, v) (atomic_add_return(i, (v)) < 0)
-
-#define atomic_inc_return(v) (atomic_add_return(1, v))
-#define atomic_dec_return(v) (atomic_sub_return(1, v))
+#define atomic_fetch_add_unless atomic_fetch_add_unless
 
 #endif
diff --git a/arch/ia64/include/asm/atomic.h b/arch/ia64/include/asm/atomic.h
index 2524fb60fbc2..206530d0751b 100644
--- a/arch/ia64/include/asm/atomic.h
+++ b/arch/ia64/include/asm/atomic.h
@@ -215,91 +215,10 @@ ATOMIC64_FETCH_OP(xor, ^)
         (cmpxchg(&((v)->counter), old, new))
 #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
 
-static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
-{
-        int c, old;
-        c = atomic_read(v);
-        for (;;) {
-                if (unlikely(c == (u)))
-                        break;
-                old = atomic_cmpxchg((v), c, c + (a));
-                if (likely(old == c))
-                        break;
-                c = old;
-        }
-        return c;
-}
-
-
-static __inline__ long atomic64_add_unless(atomic64_t *v, long a, long u)
-{
-        long c, old;
-        c = atomic64_read(v);
-        for (;;) {
-                if (unlikely(c == (u)))
-                        break;
-                old = atomic64_cmpxchg((v), c, c + (a));
-                if (likely(old == c))
-                        break;
-                c = old;
-        }
-        return c != (u);
-}
-
-#define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-
-static __inline__ long atomic64_dec_if_positive(atomic64_t *v)
-{
-        long c, old, dec;
-        c = atomic64_read(v);
-        for (;;) {
-                dec = c - 1;
-                if (unlikely(dec < 0))
-                        break;
-                old = atomic64_cmpxchg((v), c, dec);
-                if (likely(old == c))
-                        break;
-                c = old;
-        }
-        return dec;
-}
-
-/*
- * Atomically add I to V and return TRUE if the resulting value is
- * negative.
- */
-static __inline__ int
-atomic_add_negative (int i, atomic_t *v)
-{
-        return atomic_add_return(i, v) < 0;
-}
-
-static __inline__ long
-atomic64_add_negative (__s64 i, atomic64_t *v)
-{
-        return atomic64_add_return(i, v) < 0;
-}
-
-#define atomic_dec_return(v)            atomic_sub_return(1, (v))
-#define atomic_inc_return(v)            atomic_add_return(1, (v))
-#define atomic64_dec_return(v)          atomic64_sub_return(1, (v))
-#define atomic64_inc_return(v)          atomic64_add_return(1, (v))
-
-#define atomic_sub_and_test(i,v)        (atomic_sub_return((i), (v)) == 0)
-#define atomic_dec_and_test(v)          (atomic_sub_return(1, (v)) == 0)
-#define atomic_inc_and_test(v)          (atomic_add_return(1, (v)) == 0)
-#define atomic64_sub_and_test(i,v)      (atomic64_sub_return((i), (v)) == 0)
-#define atomic64_dec_and_test(v)        (atomic64_sub_return(1, (v)) == 0)
-#define atomic64_inc_and_test(v)        (atomic64_add_return(1, (v)) == 0)
-
 #define atomic_add(i,v)                 (void)atomic_add_return((i), (v))
 #define atomic_sub(i,v)                 (void)atomic_sub_return((i), (v))
-#define atomic_inc(v)                   atomic_add(1, (v))
-#define atomic_dec(v)                   atomic_sub(1, (v))
 
 #define atomic64_add(i,v)               (void)atomic64_add_return((i), (v))
 #define atomic64_sub(i,v)               (void)atomic64_sub_return((i), (v))
-#define atomic64_inc(v)                 atomic64_add(1, (v))
-#define atomic64_dec(v)                 atomic64_sub(1, (v))
 
 #endif /* _ASM_IA64_ATOMIC_H */
diff --git a/arch/ia64/include/asm/tlb.h b/arch/ia64/include/asm/tlb.h
index db89e7306081..516355a774bf 100644
--- a/arch/ia64/include/asm/tlb.h
+++ b/arch/ia64/include/asm/tlb.h
@@ -115,12 +115,11 @@ ia64_tlb_flush_mmu_tlbonly(struct mmu_gather *tlb, unsigned long start, unsigned
                 flush_tlb_all();
         } else {
                 /*
-                 * XXX fix me: flush_tlb_range() should take an mm pointer instead of a
-                 * vma pointer.
+                 * flush_tlb_range() takes a vma instead of a mm pointer because
+                 * some architectures want the vm_flags for ITLB/DTLB flush.
                  */
-                struct vm_area_struct vma;
+                struct vm_area_struct vma = TLB_FLUSH_VMA(tlb->mm, 0);
 
-                vma_init(&vma, tlb->mm);
                 /* flush the address range from the tlb: */
                 flush_tlb_range(&vma, start, end);
                 /* now flush the virt. page-table area mapping the address range: */
diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
index e6c6dfd98de2..3b85c3ecac38 100644
--- a/arch/ia64/mm/init.c
+++ b/arch/ia64/mm/init.c
@@ -116,6 +116,7 @@ ia64_init_addr_space (void)
          */
         vma = vm_area_alloc(current->mm);
         if (vma) {
+                vma_set_anonymous(vma);
                 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
                 vma->vm_end = vma->vm_start + PAGE_SIZE;
                 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
@@ -133,6 +134,7 @@ ia64_init_addr_space (void)
         if (!(current->personality & MMAP_PAGE_ZERO)) {
                 vma = vm_area_alloc(current->mm);
                 if (vma) {
+                        vma_set_anonymous(vma);
                         vma->vm_end = PAGE_SIZE;
                         vma->vm_page_prot = __pgprot(pgprot_val(PAGE_READONLY) | _PAGE_MA_NAT);
                         vma->vm_flags = VM_READ | VM_MAYREAD | VM_IO |
diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig
index 785612b576f7..b29f93774d95 100644
--- a/arch/m68k/Kconfig
+++ b/arch/m68k/Kconfig
@@ -2,6 +2,7 @@
 config M68K
         bool
         default y
+        select ARCH_HAS_SYNC_DMA_FOR_DEVICE if HAS_DMA
         select ARCH_MIGHT_HAVE_PC_PARPORT if ISA
         select ARCH_NO_COHERENT_DMA_MMAP if !MMU
         select HAVE_IDE
@@ -24,6 +25,10 @@ config M68K
         select MODULES_USE_ELF_RELA
         select OLD_SIGSUSPEND3
         select OLD_SIGACTION
+        select DMA_NONCOHERENT_OPS if HAS_DMA
+        select HAVE_MEMBLOCK
+        select ARCH_DISCARD_MEMBLOCK
+        select NO_BOOTMEM
 
 config CPU_BIG_ENDIAN
         def_bool y
diff --git a/arch/m68k/apollo/config.c b/arch/m68k/apollo/config.c
index b2a6bc63f8cd..aef8d42e078d 100644
--- a/arch/m68k/apollo/config.c
+++ b/arch/m68k/apollo/config.c
@@ -31,7 +31,6 @@ extern void dn_sched_init(irq_handler_t handler);
 extern void dn_init_IRQ(void);
 extern u32 dn_gettimeoffset(void);
 extern int dn_dummy_hwclk(int, struct rtc_time *);
-extern int dn_dummy_set_clock_mmss(unsigned long);
 extern void dn_dummy_reset(void);
 #ifdef CONFIG_HEARTBEAT
 static void dn_heartbeat(int on);
@@ -156,7 +155,6 @@ void __init config_apollo(void)
         arch_gettimeoffset   = dn_gettimeoffset;
         mach_max_dma_address = 0xffffffff;
         mach_hwclk           = dn_dummy_hwclk; /* */
-        mach_set_clock_mmss  = dn_dummy_set_clock_mmss; /* */
         mach_reset           = dn_dummy_reset;  /* */
 #ifdef CONFIG_HEARTBEAT
         mach_heartbeat = dn_heartbeat;
@@ -240,12 +238,6 @@ int dn_dummy_hwclk(int op, struct rtc_time *t) {
 
 }
 
-int dn_dummy_set_clock_mmss(unsigned long nowtime)
-{
-        pr_info("set_clock_mmss\n");
-        return 0;
-}
-
 void dn_dummy_reset(void) {
 
   dn_serial_print("The end !\n");
diff --git a/arch/m68k/atari/config.c b/arch/m68k/atari/config.c
index 565c6f06ab0b..bd96702a1ad0 100644
--- a/arch/m68k/atari/config.c
+++ b/arch/m68k/atari/config.c
@@ -81,9 +81,6 @@ extern void atari_sched_init(irq_handler_t);
 extern u32 atari_gettimeoffset(void);
 extern int atari_mste_hwclk (int, struct rtc_time *);
 extern int atari_tt_hwclk (int, struct rtc_time *);
-extern int atari_mste_set_clock_mmss (unsigned long);
-extern int atari_tt_set_clock_mmss (unsigned long);
-
 
 /* ++roman: This is a more elaborate test for an SCC chip, since the plain
  * Medusa board generates DTACK at the SCC's standard addresses, but a SCC
@@ -362,13 +359,11 @@ void __init config_atari(void)
                 ATARIHW_SET(TT_CLK);
                 pr_cont(" TT_CLK");
                 mach_hwclk = atari_tt_hwclk;
-                mach_set_clock_mmss = atari_tt_set_clock_mmss;
         }
         if (hwreg_present(&mste_rtc.sec_ones)) {
                 ATARIHW_SET(MSTE_CLK);
                 pr_cont(" MSTE_CLK");
                 mach_hwclk = atari_mste_hwclk;
-                mach_set_clock_mmss = atari_mste_set_clock_mmss;
         }
         if (!MACH_IS_MEDUSA && hwreg_present(&dma_wd.fdc_speed) &&
             hwreg_write(&dma_wd.fdc_speed, 0)) {
diff --git a/arch/m68k/atari/time.c b/arch/m68k/atari/time.c
index c549b48174ec..9cca64286464 100644
--- a/arch/m68k/atari/time.c
+++ b/arch/m68k/atari/time.c
@@ -285,69 +285,6 @@ int atari_tt_hwclk( int op, struct rtc_time *t )
     return( 0 );
 }
 
-
-int atari_mste_set_clock_mmss (unsigned long nowtime)
-{
-    short real_seconds = nowtime % 60, real_minutes = (nowtime / 60) % 60;
-    struct MSTE_RTC val;
-    unsigned char rtc_minutes;
-
-    mste_read(&val);
-    rtc_minutes= val.min_ones + val.min_tens * 10;
-    if ((rtc_minutes < real_minutes
-         ? real_minutes - rtc_minutes
-         : rtc_minutes - real_minutes) < 30)
-    {
-        val.sec_ones = real_seconds % 10;
-        val.sec_tens = real_seconds / 10;
-        val.min_ones = real_minutes % 10;
-        val.min_tens = real_minutes / 10;
-        mste_write(&val);
-    }
-    else
-        return -1;
-    return 0;
-}
-
-int atari_tt_set_clock_mmss (unsigned long nowtime)
-{
-    int retval = 0;
-    short real_seconds = nowtime % 60, real_minutes = (nowtime / 60) % 60;
-    unsigned char save_control, save_freq_select, rtc_minutes;
-
-    save_control = RTC_READ (RTC_CONTROL); /* tell the clock it's being set */
-    RTC_WRITE (RTC_CONTROL, save_control | RTC_SET);
-
-    save_freq_select = RTC_READ (RTC_FREQ_SELECT); /* stop and reset prescaler */
-    RTC_WRITE (RTC_FREQ_SELECT, save_freq_select | RTC_DIV_RESET2);
-
-    rtc_minutes = RTC_READ (RTC_MINUTES);
-    if (!(save_control & RTC_DM_BINARY))
-        rtc_minutes = bcd2bin(rtc_minutes);
-
-    /* Since we're only adjusting minutes and seconds, don't interfere
-       with hour overflow.  This avoids messing with unknown time zones
-       but requires your RTC not to be off by more than 30 minutes.  */
-    if ((rtc_minutes < real_minutes
-         ? real_minutes - rtc_minutes
-         : rtc_minutes - real_minutes) < 30)
-        {
-            if (!(save_control & RTC_DM_BINARY))
-                {
-                    real_seconds = bin2bcd(real_seconds);
-                    real_minutes = bin2bcd(real_minutes);
-                }
-            RTC_WRITE (RTC_SECONDS, real_seconds);
-            RTC_WRITE (RTC_MINUTES, real_minutes);
-        }
-    else
-        retval = -1;
-
-    RTC_WRITE (RTC_FREQ_SELECT, save_freq_select);
-    RTC_WRITE (RTC_CONTROL, save_control);
-    return retval;
-}
-
 /*
  * Local variables:
  *  c-indent-level: 4
diff --git a/arch/m68k/bvme6000/config.c b/arch/m68k/bvme6000/config.c
index 2cfff4765040..143ee9fa3893 100644
--- a/arch/m68k/bvme6000/config.c
+++ b/arch/m68k/bvme6000/config.c
@@ -41,7 +41,6 @@ static void bvme6000_get_model(char *model);
 extern void bvme6000_sched_init(irq_handler_t handler);
 extern u32 bvme6000_gettimeoffset(void);
 extern int bvme6000_hwclk (int, struct rtc_time *);
-extern int bvme6000_set_clock_mmss (unsigned long);
 extern void bvme6000_reset (void);
 void bvme6000_set_vectors (void);
 
@@ -113,7 +112,6 @@ void __init config_bvme6000(void)
     mach_init_IRQ        = bvme6000_init_IRQ;
     arch_gettimeoffset   = bvme6000_gettimeoffset;
     mach_hwclk           = bvme6000_hwclk;
-    mach_set_clock_mmss  = bvme6000_set_clock_mmss;
     mach_reset           = bvme6000_reset;
     mach_get_model       = bvme6000_get_model;
 
@@ -305,46 +303,3 @@ int bvme6000_hwclk(int op, struct rtc_time *t)
 
         return 0;
 }
-
-/*
- * Set the minutes and seconds from seconds value 'nowtime'.  Fail if
- * clock is out by > 30 minutes.  Logic lifted from atari code.
- * Algorithm is to wait for the 10ms register to change, and then to
- * wait a short while, and then set it.
- */
-
-int bvme6000_set_clock_mmss (unsigned long nowtime)
-{
-        int retval = 0;
-        short real_seconds = nowtime % 60, real_minutes = (nowtime / 60) % 60;
-        unsigned char rtc_minutes, rtc_tenms;
-        volatile RtcPtr_t rtc = (RtcPtr_t)BVME_RTC_BASE;
-        unsigned char msr = rtc->msr & 0xc0;
-        unsigned long flags;
-        volatile int i;
-
-        rtc->msr = 0;           /* Ensure clock accessible */
-        rtc_minutes = bcd2bin (rtc->bcd_min);
-
-        if ((rtc_minutes < real_minutes
-                ? real_minutes - rtc_minutes
-                        : rtc_minutes - real_minutes) < 30)
-        {
-                local_irq_save(flags);
-                rtc_tenms = rtc->bcd_tenms;
-                while (rtc_tenms == rtc->bcd_tenms)
-                        ;
-                for (i = 0; i < 1000; i++)
-                        ;
-                rtc->bcd_min = bin2bcd(real_minutes);
-                rtc->bcd_sec = bin2bcd(real_seconds);
-                local_irq_restore(flags);
-        }
-        else
-                retval = -1;
-
-        rtc->msr = msr;
-
-        return retval;
-}
-
diff --git a/arch/m68k/configs/amiga_defconfig b/arch/m68k/configs/amiga_defconfig
index a874e54404d1..1d5483f6e457 100644
--- a/arch/m68k/configs/amiga_defconfig
+++ b/arch/m68k/configs/amiga_defconfig
@@ -52,6 +52,7 @@ CONFIG_UNIX_DIAG=m
 CONFIG_TLS=m
 CONFIG_XFRM_MIGRATE=y
 CONFIG_NET_KEY=y
+CONFIG_XDP_SOCKETS=y
 CONFIG_INET=y
 CONFIG_IP_PNP=y
 CONFIG_IP_PNP_DHCP=y
@@ -98,18 +99,14 @@ CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
 CONFIG_NF_TABLES=m
+CONFIG_NF_TABLES_SET=m
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_EXTHDR=m
-CONFIG_NFT_META=m
-CONFIG_NFT_RT=m
 CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_FLOW_OFFLOAD=m
-CONFIG_NFT_SET_RBTREE=m
-CONFIG_NFT_SET_HASH=m
-CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
+CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
 CONFIG_NFT_MASQ=m
@@ -122,6 +119,7 @@ CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
 CONFIG_NFT_FIB_INET=m
+CONFIG_NFT_SOCKET=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NFT_FIB_NETDEV=m
@@ -200,7 +198,6 @@ CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
-CONFIG_NF_SOCKET_IPV4=m
 CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
@@ -231,7 +228,6 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
-CONFIG_NF_SOCKET_IPV6=m
 CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_NFT_MASQ_IPV6=m
@@ -260,7 +256,6 @@ CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=y
-CONFIG_NFT_BRIDGE_META=m
 CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_LOG_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
@@ -301,6 +296,7 @@ CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
 CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
+# CONFIG_BATMAN_ADV_BATMAN_V is not set
 CONFIG_BATMAN_ADV_DAT=y
 CONFIG_BATMAN_ADV_NC=y
 CONFIG_BATMAN_ADV_MCAST=y
@@ -356,6 +352,7 @@ CONFIG_A2091_SCSI=y
 CONFIG_GVP11_SCSI=y
 CONFIG_SCSI_A4000T=y
 CONFIG_SCSI_ZORRO7XX=y
+CONFIG_SCSI_ZORRO_ESP=y
 CONFIG_MD=y
 CONFIG_MD_LINEAR=m
 CONFIG_BLK_DEV_DM=m
@@ -363,6 +360,7 @@ CONFIG_DM_UNSTRIPED=m
 CONFIG_DM_CRYPT=m
 CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_THIN_PROVISIONING=m
+CONFIG_DM_WRITECACHE=m
 CONFIG_DM_ERA=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_RAID=m
@@ -402,8 +400,8 @@ CONFIG_A2065=y
 CONFIG_ARIADNE=y
 # CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
-# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
+# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_CIRRUS is not set
 # CONFIG_NET_VENDOR_CORTINA is not set
 # CONFIG_NET_VENDOR_EZCHIP is not set
@@ -412,8 +410,10 @@ CONFIG_ARIADNE=y
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_MICROSEMI is not set
 # CONFIG_NET_VENDOR_NETRONOME is not set
 # CONFIG_NET_VENDOR_NI is not set
+CONFIG_XSURF100=y
 CONFIG_HYDRA=y
 CONFIG_APNE=y
 CONFIG_ZORRO8390=y
@@ -426,9 +426,9 @@ CONFIG_ZORRO8390=y
 # CONFIG_NET_VENDOR_SMSC is not set
 # CONFIG_NET_VENDOR_SOCIONEXT is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
 CONFIG_PPP_DEFLATE=m
@@ -478,6 +478,7 @@ CONFIG_HIDRAW=y
 CONFIG_UHID=m
 # CONFIG_HID_GENERIC is not set
 # CONFIG_HID_ITE is not set
+# CONFIG_HID_REDRAGON is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_RTC_CLASS=y
 # CONFIG_RTC_NVMEM is not set
@@ -499,7 +500,7 @@ CONFIG_FS_ENCRYPTION=m
 CONFIG_FANOTIFY=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 # CONFIG_PRINT_QUOTA_WARNING is not set
-CONFIG_AUTOFS4_FS=m
+CONFIG_AUTOFS_FS=m
 CONFIG_FUSE_FS=m
 CONFIG_CUSE=m
 CONFIG_OVERLAY_FS=m
@@ -600,6 +601,7 @@ CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
 CONFIG_TEST_UUID=m
+CONFIG_TEST_OVERFLOW=m
 CONFIG_TEST_RHASHTABLE=m
 CONFIG_TEST_HASH=m
 CONFIG_TEST_USER_COPY=m
@@ -622,6 +624,11 @@ CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_MCRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
+CONFIG_CRYPTO_AEGIS128=m
+CONFIG_CRYPTO_AEGIS128L=m
+CONFIG_CRYPTO_AEGIS256=m
+CONFIG_CRYPTO_MORUS640=m
+CONFIG_CRYPTO_MORUS1280=m
 CONFIG_CRYPTO_CFB=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
@@ -657,6 +664,7 @@ CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ZSTD=m
 CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_DRBG_HASH=y
 CONFIG_CRYPTO_DRBG_CTR=y
diff --git a/arch/m68k/configs/apollo_defconfig b/arch/m68k/configs/apollo_defconfig
index 8ce39e23aa42..52a0af127951 100644
--- a/arch/m68k/configs/apollo_defconfig
+++ b/arch/m68k/configs/apollo_defconfig
@@ -50,6 +50,7 @@ CONFIG_UNIX_DIAG=m
 CONFIG_TLS=m
 CONFIG_XFRM_MIGRATE=y
 CONFIG_NET_KEY=y
+CONFIG_XDP_SOCKETS=y
 CONFIG_INET=y
 CONFIG_IP_PNP=y
 CONFIG_IP_PNP_DHCP=y
@@ -96,18 +97,14 @@ CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
 CONFIG_NF_TABLES=m
+CONFIG_NF_TABLES_SET=m
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_EXTHDR=m
-CONFIG_NFT_META=m
-CONFIG_NFT_RT=m
 CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_FLOW_OFFLOAD=m
-CONFIG_NFT_SET_RBTREE=m
-CONFIG_NFT_SET_HASH=m
-CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
+CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
 CONFIG_NFT_MASQ=m
@@ -120,6 +117,7 @@ CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
 CONFIG_NFT_FIB_INET=m
+CONFIG_NFT_SOCKET=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NFT_FIB_NETDEV=m
@@ -198,7 +196,6 @@ CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
-CONFIG_NF_SOCKET_IPV4=m
 CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
@@ -229,7 +226,6 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
-CONFIG_NF_SOCKET_IPV6=m
 CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_NFT_MASQ_IPV6=m
@@ -258,7 +254,6 @@ CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=y
-CONFIG_NFT_BRIDGE_META=m
 CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_LOG_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
@@ -299,6 +294,7 @@ CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
 CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
+# CONFIG_BATMAN_ADV_BATMAN_V is not set
 CONFIG_BATMAN_ADV_DAT=y
 CONFIG_BATMAN_ADV_NC=y
 CONFIG_BATMAN_ADV_MCAST=y
@@ -345,6 +341,7 @@ CONFIG_DM_UNSTRIPED=m
 CONFIG_DM_CRYPT=m
 CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_THIN_PROVISIONING=m
+CONFIG_DM_WRITECACHE=m
 CONFIG_DM_ERA=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_RAID=m
@@ -381,14 +378,15 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_AMAZON is not set
 # CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
-# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
+# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_CORTINA is not set
 # CONFIG_NET_VENDOR_EZCHIP is not set
 # CONFIG_NET_VENDOR_HUAWEI is not set
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_MICROSEMI is not set
 # CONFIG_NET_VENDOR_NATSEMI is not set
 # CONFIG_NET_VENDOR_NETRONOME is not set
 # CONFIG_NET_VENDOR_NI is not set
@@ -400,9 +398,9 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_SOCIONEXT is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
 CONFIG_PPP_DEFLATE=m
@@ -440,6 +438,7 @@ CONFIG_HIDRAW=y
 CONFIG_UHID=m
 # CONFIG_HID_GENERIC is not set
 # CONFIG_HID_ITE is not set
+# CONFIG_HID_REDRAGON is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_RTC_CLASS=y
 # CONFIG_RTC_NVMEM is not set
@@ -458,7 +457,7 @@ CONFIG_FS_ENCRYPTION=m
 CONFIG_FANOTIFY=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 # CONFIG_PRINT_QUOTA_WARNING is not set
-CONFIG_AUTOFS4_FS=m
+CONFIG_AUTOFS_FS=m
 CONFIG_FUSE_FS=m
 CONFIG_CUSE=m
 CONFIG_OVERLAY_FS=m
@@ -559,6 +558,7 @@ CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
 CONFIG_TEST_UUID=m
+CONFIG_TEST_OVERFLOW=m
 CONFIG_TEST_RHASHTABLE=m
 CONFIG_TEST_HASH=m
 CONFIG_TEST_USER_COPY=m
@@ -581,6 +581,11 @@ CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_MCRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
+CONFIG_CRYPTO_AEGIS128=m
+CONFIG_CRYPTO_AEGIS128L=m
+CONFIG_CRYPTO_AEGIS256=m
+CONFIG_CRYPTO_MORUS640=m
+CONFIG_CRYPTO_MORUS1280=m
 CONFIG_CRYPTO_CFB=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
@@ -616,6 +621,7 @@ CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ZSTD=m
 CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_DRBG_HASH=y
 CONFIG_CRYPTO_DRBG_CTR=y
diff --git a/arch/m68k/configs/atari_defconfig b/arch/m68k/configs/atari_defconfig
index 346c4e75edf8..b3103e51268a 100644
--- a/arch/m68k/configs/atari_defconfig
+++ b/arch/m68k/configs/atari_defconfig
@@ -50,6 +50,7 @@ CONFIG_UNIX_DIAG=m
 CONFIG_TLS=m
 CONFIG_XFRM_MIGRATE=y
 CONFIG_NET_KEY=y
+CONFIG_XDP_SOCKETS=y
 CONFIG_INET=y
 CONFIG_IP_PNP=y
 CONFIG_IP_PNP_DHCP=y
@@ -96,18 +97,14 @@ CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
 CONFIG_NF_TABLES=m
+CONFIG_NF_TABLES_SET=m
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_EXTHDR=m
-CONFIG_NFT_META=m
-CONFIG_NFT_RT=m
 CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_FLOW_OFFLOAD=m
-CONFIG_NFT_SET_RBTREE=m
-CONFIG_NFT_SET_HASH=m
-CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
+CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
 CONFIG_NFT_MASQ=m
@@ -120,6 +117,7 @@ CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
 CONFIG_NFT_FIB_INET=m
+CONFIG_NFT_SOCKET=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NFT_FIB_NETDEV=m
@@ -198,7 +196,6 @@ CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
-CONFIG_NF_SOCKET_IPV4=m
 CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
@@ -229,7 +226,6 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
-CONFIG_NF_SOCKET_IPV6=m
 CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_NFT_MASQ_IPV6=m
@@ -258,7 +254,6 @@ CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=y
-CONFIG_NFT_BRIDGE_META=m
 CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_LOG_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
@@ -299,6 +294,7 @@ CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
 CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
+# CONFIG_BATMAN_ADV_BATMAN_V is not set
 CONFIG_BATMAN_ADV_DAT=y
 CONFIG_BATMAN_ADV_NC=y
 CONFIG_BATMAN_ADV_MCAST=y
@@ -354,6 +350,7 @@ CONFIG_DM_UNSTRIPED=m
 CONFIG_DM_CRYPT=m
 CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_THIN_PROVISIONING=m
+CONFIG_DM_WRITECACHE=m
 CONFIG_DM_ERA=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_RAID=m
@@ -391,14 +388,15 @@ CONFIG_VETH=m
 CONFIG_ATARILANCE=y
 # CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
-# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
+# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_CORTINA is not set
 # CONFIG_NET_VENDOR_EZCHIP is not set
 # CONFIG_NET_VENDOR_HUAWEI is not set
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_MICROSEMI is not set
 # CONFIG_NET_VENDOR_NETRONOME is not set
 # CONFIG_NET_VENDOR_NI is not set
 CONFIG_NE2000=y
@@ -411,9 +409,9 @@ CONFIG_NE2000=y
 CONFIG_SMC91X=y
 # CONFIG_NET_VENDOR_SOCIONEXT is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
 CONFIG_PPP_DEFLATE=m
@@ -480,7 +478,7 @@ CONFIG_FS_ENCRYPTION=m
 CONFIG_FANOTIFY=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 # CONFIG_PRINT_QUOTA_WARNING is not set
-CONFIG_AUTOFS4_FS=m
+CONFIG_AUTOFS_FS=m
 CONFIG_FUSE_FS=m
 CONFIG_CUSE=m
 CONFIG_OVERLAY_FS=m
@@ -581,6 +579,7 @@ CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
 CONFIG_TEST_UUID=m
+CONFIG_TEST_OVERFLOW=m
 CONFIG_TEST_RHASHTABLE=m
 CONFIG_TEST_HASH=m
 CONFIG_TEST_USER_COPY=m
@@ -603,6 +602,11 @@ CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_MCRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
+CONFIG_CRYPTO_AEGIS128=m
+CONFIG_CRYPTO_AEGIS128L=m
+CONFIG_CRYPTO_AEGIS256=m
+CONFIG_CRYPTO_MORUS640=m
+CONFIG_CRYPTO_MORUS1280=m
 CONFIG_CRYPTO_CFB=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
@@ -638,6 +642,7 @@ CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ZSTD=m
 CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_DRBG_HASH=y
 CONFIG_CRYPTO_DRBG_CTR=y
diff --git a/arch/m68k/configs/bvme6000_defconfig b/arch/m68k/configs/bvme6000_defconfig
index fca9c7aa71a3..fb7d651a4cab 100644
--- a/arch/m68k/configs/bvme6000_defconfig
+++ b/arch/m68k/configs/bvme6000_defconfig
@@ -48,6 +48,7 @@ CONFIG_UNIX_DIAG=m
 CONFIG_TLS=m
 CONFIG_XFRM_MIGRATE=y
 CONFIG_NET_KEY=y
+CONFIG_XDP_SOCKETS=y
 CONFIG_INET=y
 CONFIG_IP_PNP=y
 CONFIG_IP_PNP_DHCP=y
@@ -94,18 +95,14 @@ CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
 CONFIG_NF_TABLES=m
+CONFIG_NF_TABLES_SET=m
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_EXTHDR=m
-CONFIG_NFT_META=m
-CONFIG_NFT_RT=m
 CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_FLOW_OFFLOAD=m
-CONFIG_NFT_SET_RBTREE=m
-CONFIG_NFT_SET_HASH=m
-CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
+CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
 CONFIG_NFT_MASQ=m
@@ -118,6 +115,7 @@ CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
 CONFIG_NFT_FIB_INET=m
+CONFIG_NFT_SOCKET=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NFT_FIB_NETDEV=m
@@ -196,7 +194,6 @@ CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
-CONFIG_NF_SOCKET_IPV4=m
 CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
@@ -227,7 +224,6 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
-CONFIG_NF_SOCKET_IPV6=m
 CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_NFT_MASQ_IPV6=m
@@ -256,7 +252,6 @@ CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=y
-CONFIG_NFT_BRIDGE_META=m
 CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_LOG_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
@@ -297,6 +292,7 @@ CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
 CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
+# CONFIG_BATMAN_ADV_BATMAN_V is not set
 CONFIG_BATMAN_ADV_DAT=y
 CONFIG_BATMAN_ADV_NC=y
 CONFIG_BATMAN_ADV_MCAST=y
@@ -344,6 +340,7 @@ CONFIG_DM_UNSTRIPED=m
 CONFIG_DM_CRYPT=m
 CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_THIN_PROVISIONING=m
+CONFIG_DM_WRITECACHE=m
 CONFIG_DM_ERA=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_RAID=m
@@ -380,14 +377,15 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_AMAZON is not set
 # CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
-# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
+# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_CORTINA is not set
 # CONFIG_NET_VENDOR_EZCHIP is not set
 # CONFIG_NET_VENDOR_HUAWEI is not set
 CONFIG_BVME6000_NET=y
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_MICROSEMI is not set
 # CONFIG_NET_VENDOR_NATSEMI is not set
 # CONFIG_NET_VENDOR_NETRONOME is not set
 # CONFIG_NET_VENDOR_NI is not set
@@ -399,9 +397,9 @@ CONFIG_BVME6000_NET=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_SOCIONEXT is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
 CONFIG_PPP_DEFLATE=m
@@ -433,6 +431,7 @@ CONFIG_HIDRAW=y
 CONFIG_UHID=m
 # CONFIG_HID_GENERIC is not set
 # CONFIG_HID_ITE is not set
+# CONFIG_HID_REDRAGON is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_RTC_CLASS=y
 # CONFIG_RTC_NVMEM is not set
@@ -450,7 +449,7 @@ CONFIG_FS_ENCRYPTION=m
 CONFIG_FANOTIFY=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 # CONFIG_PRINT_QUOTA_WARNING is not set
-CONFIG_AUTOFS4_FS=m
+CONFIG_AUTOFS_FS=m
 CONFIG_FUSE_FS=m
 CONFIG_CUSE=m
 CONFIG_OVERLAY_FS=m
@@ -551,6 +550,7 @@ CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
 CONFIG_TEST_UUID=m
+CONFIG_TEST_OVERFLOW=m
 CONFIG_TEST_RHASHTABLE=m
 CONFIG_TEST_HASH=m
 CONFIG_TEST_USER_COPY=m
@@ -573,6 +573,11 @@ CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_MCRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
+CONFIG_CRYPTO_AEGIS128=m
+CONFIG_CRYPTO_AEGIS128L=m
+CONFIG_CRYPTO_AEGIS256=m
+CONFIG_CRYPTO_MORUS640=m
+CONFIG_CRYPTO_MORUS1280=m
 CONFIG_CRYPTO_CFB=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
@@ -608,6 +613,7 @@ CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ZSTD=m
 CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_DRBG_HASH=y
 CONFIG_CRYPTO_DRBG_CTR=y
diff --git a/arch/m68k/configs/hp300_defconfig b/arch/m68k/configs/hp300_defconfig
index f9eab174915c..6b37f5537c39 100644
--- a/arch/m68k/configs/hp300_defconfig
+++ b/arch/m68k/configs/hp300_defconfig
@@ -50,6 +50,7 @@ CONFIG_UNIX_DIAG=m
 CONFIG_TLS=m
 CONFIG_XFRM_MIGRATE=y
 CONFIG_NET_KEY=y
+CONFIG_XDP_SOCKETS=y
 CONFIG_INET=y
 CONFIG_IP_PNP=y
 CONFIG_IP_PNP_DHCP=y
@@ -96,18 +97,14 @@ CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
 CONFIG_NF_TABLES=m
+CONFIG_NF_TABLES_SET=m
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_EXTHDR=m
-CONFIG_NFT_META=m
-CONFIG_NFT_RT=m
 CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_FLOW_OFFLOAD=m
-CONFIG_NFT_SET_RBTREE=m
-CONFIG_NFT_SET_HASH=m
-CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
+CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
 CONFIG_NFT_MASQ=m
@@ -120,6 +117,7 @@ CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
 CONFIG_NFT_FIB_INET=m
+CONFIG_NFT_SOCKET=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NFT_FIB_NETDEV=m
@@ -198,7 +196,6 @@ CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
-CONFIG_NF_SOCKET_IPV4=m
 CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
@@ -229,7 +226,6 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
-CONFIG_NF_SOCKET_IPV6=m
 CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_NFT_MASQ_IPV6=m
@@ -258,7 +254,6 @@ CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=y
-CONFIG_NFT_BRIDGE_META=m
 CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_LOG_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
@@ -299,6 +294,7 @@ CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
 CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
+# CONFIG_BATMAN_ADV_BATMAN_V is not set
 CONFIG_BATMAN_ADV_DAT=y
 CONFIG_BATMAN_ADV_NC=y
 CONFIG_BATMAN_ADV_MCAST=y
@@ -345,6 +341,7 @@ CONFIG_DM_UNSTRIPED=m
 CONFIG_DM_CRYPT=m
 CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_THIN_PROVISIONING=m
+CONFIG_DM_WRITECACHE=m
 CONFIG_DM_ERA=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_RAID=m
@@ -382,14 +379,15 @@ CONFIG_VETH=m
 CONFIG_HPLANCE=y
 # CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
-# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
+# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_CORTINA is not set
 # CONFIG_NET_VENDOR_EZCHIP is not set
 # CONFIG_NET_VENDOR_HUAWEI is not set
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_MICROSEMI is not set
 # CONFIG_NET_VENDOR_NATSEMI is not set
 # CONFIG_NET_VENDOR_NETRONOME is not set
 # CONFIG_NET_VENDOR_NI is not set
@@ -401,9 +399,9 @@ CONFIG_HPLANCE=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_SOCIONEXT is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
 CONFIG_PPP_DEFLATE=m
@@ -443,6 +441,7 @@ CONFIG_HIDRAW=y
 CONFIG_UHID=m
 # CONFIG_HID_GENERIC is not set
 # CONFIG_HID_ITE is not set
+# CONFIG_HID_REDRAGON is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_RTC_CLASS=y
 # CONFIG_RTC_NVMEM is not set
@@ -460,7 +459,7 @@ CONFIG_FS_ENCRYPTION=m
 CONFIG_FANOTIFY=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 # CONFIG_PRINT_QUOTA_WARNING is not set
-CONFIG_AUTOFS4_FS=m
+CONFIG_AUTOFS_FS=m
 CONFIG_FUSE_FS=m
 CONFIG_CUSE=m
 CONFIG_OVERLAY_FS=m
@@ -561,6 +560,7 @@ CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
 CONFIG_TEST_UUID=m
+CONFIG_TEST_OVERFLOW=m
 CONFIG_TEST_RHASHTABLE=m
 CONFIG_TEST_HASH=m
 CONFIG_TEST_USER_COPY=m
@@ -583,6 +583,11 @@ CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_MCRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
+CONFIG_CRYPTO_AEGIS128=m
+CONFIG_CRYPTO_AEGIS128L=m
+CONFIG_CRYPTO_AEGIS256=m
+CONFIG_CRYPTO_MORUS640=m
+CONFIG_CRYPTO_MORUS1280=m
 CONFIG_CRYPTO_CFB=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
@@ -618,6 +623,7 @@ CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ZSTD=m
 CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_DRBG_HASH=y
 CONFIG_CRYPTO_DRBG_CTR=y
diff --git a/arch/m68k/configs/mac_defconfig b/arch/m68k/configs/mac_defconfig
index b52e597899eb..930cc2965a11 100644
--- a/arch/m68k/configs/mac_defconfig
+++ b/arch/m68k/configs/mac_defconfig
@@ -49,6 +49,7 @@ CONFIG_UNIX_DIAG=m
 CONFIG_TLS=m
 CONFIG_XFRM_MIGRATE=y
 CONFIG_NET_KEY=y
+CONFIG_XDP_SOCKETS=y
 CONFIG_INET=y
 CONFIG_IP_PNP=y
 CONFIG_IP_PNP_DHCP=y
@@ -95,18 +96,14 @@ CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
 CONFIG_NF_TABLES=m
+CONFIG_NF_TABLES_SET=m
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_EXTHDR=m
-CONFIG_NFT_META=m
-CONFIG_NFT_RT=m
 CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_FLOW_OFFLOAD=m
-CONFIG_NFT_SET_RBTREE=m
-CONFIG_NFT_SET_HASH=m
-CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
+CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
 CONFIG_NFT_MASQ=m
@@ -119,6 +116,7 @@ CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
 CONFIG_NFT_FIB_INET=m
+CONFIG_NFT_SOCKET=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NFT_FIB_NETDEV=m
@@ -197,7 +195,6 @@ CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
-CONFIG_NF_SOCKET_IPV4=m
 CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
@@ -228,7 +225,6 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
-CONFIG_NF_SOCKET_IPV6=m
 CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_NFT_MASQ_IPV6=m
@@ -257,7 +253,6 @@ CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=y
-CONFIG_NFT_BRIDGE_META=m
 CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_LOG_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
@@ -301,6 +296,7 @@ CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
 CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
+# CONFIG_BATMAN_ADV_BATMAN_V is not set
 CONFIG_BATMAN_ADV_DAT=y
 CONFIG_BATMAN_ADV_NC=y
 CONFIG_BATMAN_ADV_MCAST=y
@@ -354,6 +350,7 @@ CONFIG_DM_UNSTRIPED=m
 CONFIG_DM_CRYPT=m
 CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_THIN_PROVISIONING=m
+CONFIG_DM_WRITECACHE=m
 CONFIG_DM_ERA=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_RAID=m
@@ -398,8 +395,8 @@ CONFIG_VETH=m
 CONFIG_MACMACE=y
 # CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
-# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
+# CONFIG_NET_CADENCE is not set
 CONFIG_MAC89x0=y
 # CONFIG_NET_VENDOR_CORTINA is not set
 # CONFIG_NET_VENDOR_EZCHIP is not set
@@ -407,6 +404,7 @@ CONFIG_MAC89x0=y
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_MICROSEMI is not set
 CONFIG_MACSONIC=y
 # CONFIG_NET_VENDOR_NETRONOME is not set
 # CONFIG_NET_VENDOR_NI is not set
@@ -420,9 +418,9 @@ CONFIG_MAC8390=y
 # CONFIG_NET_VENDOR_SMSC is not set
 # CONFIG_NET_VENDOR_SOCIONEXT is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
 CONFIG_PPP_DEFLATE=m
@@ -465,6 +463,7 @@ CONFIG_HIDRAW=y
 CONFIG_UHID=m
 # CONFIG_HID_GENERIC is not set
 # CONFIG_HID_ITE is not set
+# CONFIG_HID_REDRAGON is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_RTC_CLASS=y
 # CONFIG_RTC_NVMEM is not set
@@ -482,7 +481,7 @@ CONFIG_FS_ENCRYPTION=m
 CONFIG_FANOTIFY=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 # CONFIG_PRINT_QUOTA_WARNING is not set
-CONFIG_AUTOFS4_FS=m
+CONFIG_AUTOFS_FS=m
 CONFIG_FUSE_FS=m
 CONFIG_CUSE=m
 CONFIG_OVERLAY_FS=m
@@ -583,6 +582,7 @@ CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
 CONFIG_TEST_UUID=m
+CONFIG_TEST_OVERFLOW=m
 CONFIG_TEST_RHASHTABLE=m
 CONFIG_TEST_HASH=m
 CONFIG_TEST_USER_COPY=m
@@ -605,6 +605,11 @@ CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_MCRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
+CONFIG_CRYPTO_AEGIS128=m
+CONFIG_CRYPTO_AEGIS128L=m
+CONFIG_CRYPTO_AEGIS256=m
+CONFIG_CRYPTO_MORUS640=m
+CONFIG_CRYPTO_MORUS1280=m
 CONFIG_CRYPTO_CFB=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
@@ -640,6 +645,7 @@ CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ZSTD=m
 CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_DRBG_HASH=y
 CONFIG_CRYPTO_DRBG_CTR=y
diff --git a/arch/m68k/configs/multi_defconfig b/arch/m68k/configs/multi_defconfig
index 2a84eeec5b02..e7dd25300127 100644
--- a/arch/m68k/configs/multi_defconfig
+++ b/arch/m68k/configs/multi_defconfig
@@ -59,6 +59,7 @@ CONFIG_UNIX_DIAG=m
 CONFIG_TLS=m
 CONFIG_XFRM_MIGRATE=y
 CONFIG_NET_KEY=y
+CONFIG_XDP_SOCKETS=y
 CONFIG_INET=y
 CONFIG_IP_PNP=y
 CONFIG_IP_PNP_DHCP=y
@@ -105,18 +106,14 @@ CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
 CONFIG_NF_TABLES=m
+CONFIG_NF_TABLES_SET=m
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_EXTHDR=m
-CONFIG_NFT_META=m
-CONFIG_NFT_RT=m
 CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_FLOW_OFFLOAD=m
-CONFIG_NFT_SET_RBTREE=m
-CONFIG_NFT_SET_HASH=m
-CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
+CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
 CONFIG_NFT_MASQ=m
@@ -129,6 +126,7 @@ CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
 CONFIG_NFT_FIB_INET=m
+CONFIG_NFT_SOCKET=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NFT_FIB_NETDEV=m
@@ -207,7 +205,6 @@ CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
-CONFIG_NF_SOCKET_IPV4=m
 CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
@@ -238,7 +235,6 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
-CONFIG_NF_SOCKET_IPV6=m
 CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_NFT_MASQ_IPV6=m
@@ -267,7 +263,6 @@ CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=y
-CONFIG_NFT_BRIDGE_META=m
 CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_LOG_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
@@ -311,6 +306,7 @@ CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
 CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
+# CONFIG_BATMAN_ADV_BATMAN_V is not set
 CONFIG_BATMAN_ADV_DAT=y
 CONFIG_BATMAN_ADV_NC=y
 CONFIG_BATMAN_ADV_MCAST=y
@@ -373,6 +369,7 @@ CONFIG_A2091_SCSI=y
 CONFIG_GVP11_SCSI=y
 CONFIG_SCSI_A4000T=y
 CONFIG_SCSI_ZORRO7XX=y
+CONFIG_SCSI_ZORRO_ESP=y
 CONFIG_ATARI_SCSI=y
 CONFIG_MAC_SCSI=y
 CONFIG_SCSI_MAC_ESP=y
@@ -387,6 +384,7 @@ CONFIG_DM_UNSTRIPED=m
 CONFIG_DM_CRYPT=m
 CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_THIN_PROVISIONING=m
+CONFIG_DM_WRITECACHE=m
 CONFIG_DM_ERA=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_RAID=m
@@ -438,8 +436,8 @@ CONFIG_SUN3LANCE=y
 CONFIG_MACMACE=y
 # CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
-# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
+# CONFIG_NET_CADENCE is not set
 CONFIG_MAC89x0=y
 # CONFIG_NET_VENDOR_CORTINA is not set
 # CONFIG_NET_VENDOR_EZCHIP is not set
@@ -449,9 +447,11 @@ CONFIG_BVME6000_NET=y
 CONFIG_MVME16x_NET=y
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_MICROSEMI is not set
 CONFIG_MACSONIC=y
 # CONFIG_NET_VENDOR_NETRONOME is not set
 # CONFIG_NET_VENDOR_NI is not set
+CONFIG_XSURF100=y
 CONFIG_HYDRA=y
 CONFIG_MAC8390=y
 CONFIG_NE2000=y
@@ -466,9 +466,9 @@ CONFIG_ZORRO8390=y
 CONFIG_SMC91X=y
 # CONFIG_NET_VENDOR_SOCIONEXT is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 CONFIG_PLIP=m
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -533,6 +533,7 @@ CONFIG_HIDRAW=y
 CONFIG_UHID=m
 # CONFIG_HID_GENERIC is not set
 # CONFIG_HID_ITE is not set
+# CONFIG_HID_REDRAGON is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_RTC_CLASS=y
 # CONFIG_RTC_NVMEM is not set
@@ -562,7 +563,7 @@ CONFIG_FS_ENCRYPTION=m
 CONFIG_FANOTIFY=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 # CONFIG_PRINT_QUOTA_WARNING is not set
-CONFIG_AUTOFS4_FS=m
+CONFIG_AUTOFS_FS=m
 CONFIG_FUSE_FS=m
 CONFIG_CUSE=m
 CONFIG_OVERLAY_FS=m
@@ -663,6 +664,7 @@ CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
 CONFIG_TEST_UUID=m
+CONFIG_TEST_OVERFLOW=m
 CONFIG_TEST_RHASHTABLE=m
 CONFIG_TEST_HASH=m
 CONFIG_TEST_USER_COPY=m
@@ -685,6 +687,11 @@ CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_MCRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
+CONFIG_CRYPTO_AEGIS128=m
+CONFIG_CRYPTO_AEGIS128L=m
+CONFIG_CRYPTO_AEGIS256=m
+CONFIG_CRYPTO_MORUS640=m
+CONFIG_CRYPTO_MORUS1280=m
 CONFIG_CRYPTO_CFB=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
@@ -720,6 +727,7 @@ CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ZSTD=m
 CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_DRBG_HASH=y
 CONFIG_CRYPTO_DRBG_CTR=y
diff --git a/arch/m68k/configs/mvme147_defconfig b/arch/m68k/configs/mvme147_defconfig
index 476e69994340..b383327fd77a 100644
--- a/arch/m68k/configs/mvme147_defconfig
+++ b/arch/m68k/configs/mvme147_defconfig
@@ -47,6 +47,7 @@ CONFIG_UNIX_DIAG=m
 CONFIG_TLS=m
 CONFIG_XFRM_MIGRATE=y
 CONFIG_NET_KEY=y
+CONFIG_XDP_SOCKETS=y
 CONFIG_INET=y
 CONFIG_IP_PNP=y
 CONFIG_IP_PNP_DHCP=y
@@ -93,18 +94,14 @@ CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
 CONFIG_NF_TABLES=m
+CONFIG_NF_TABLES_SET=m
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_EXTHDR=m
-CONFIG_NFT_META=m
-CONFIG_NFT_RT=m
 CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_FLOW_OFFLOAD=m
-CONFIG_NFT_SET_RBTREE=m
-CONFIG_NFT_SET_HASH=m
-CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
+CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
 CONFIG_NFT_MASQ=m
@@ -117,6 +114,7 @@ CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
 CONFIG_NFT_FIB_INET=m
+CONFIG_NFT_SOCKET=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NFT_FIB_NETDEV=m
@@ -195,7 +193,6 @@ CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
-CONFIG_NF_SOCKET_IPV4=m
 CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
@@ -226,7 +223,6 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
-CONFIG_NF_SOCKET_IPV6=m
 CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_NFT_MASQ_IPV6=m
@@ -255,7 +251,6 @@ CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=y
-CONFIG_NFT_BRIDGE_META=m
 CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_LOG_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
@@ -296,6 +291,7 @@ CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
 CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
+# CONFIG_BATMAN_ADV_BATMAN_V is not set
 CONFIG_BATMAN_ADV_DAT=y
 CONFIG_BATMAN_ADV_NC=y
 CONFIG_BATMAN_ADV_MCAST=y
@@ -343,6 +339,7 @@ CONFIG_DM_UNSTRIPED=m
 CONFIG_DM_CRYPT=m
 CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_THIN_PROVISIONING=m
+CONFIG_DM_WRITECACHE=m
 CONFIG_DM_ERA=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_RAID=m
@@ -380,14 +377,15 @@ CONFIG_VETH=m
 CONFIG_MVME147_NET=y
 # CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
-# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
+# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_CORTINA is not set
 # CONFIG_NET_VENDOR_EZCHIP is not set
 # CONFIG_NET_VENDOR_HUAWEI is not set
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_MICROSEMI is not set
 # CONFIG_NET_VENDOR_NATSEMI is not set
 # CONFIG_NET_VENDOR_NETRONOME is not set
 # CONFIG_NET_VENDOR_NI is not set
@@ -399,9 +397,9 @@ CONFIG_MVME147_NET=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_SOCIONEXT is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
 CONFIG_PPP_DEFLATE=m
@@ -433,6 +431,7 @@ CONFIG_HIDRAW=y
 CONFIG_UHID=m
 # CONFIG_HID_GENERIC is not set
 # CONFIG_HID_ITE is not set
+# CONFIG_HID_REDRAGON is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_RTC_CLASS=y
 # CONFIG_RTC_NVMEM is not set
@@ -450,7 +449,7 @@ CONFIG_FS_ENCRYPTION=m
 CONFIG_FANOTIFY=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 # CONFIG_PRINT_QUOTA_WARNING is not set
-CONFIG_AUTOFS4_FS=m
+CONFIG_AUTOFS_FS=m
 CONFIG_FUSE_FS=m
 CONFIG_CUSE=m
 CONFIG_OVERLAY_FS=m
@@ -551,6 +550,7 @@ CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
 CONFIG_TEST_UUID=m
+CONFIG_TEST_OVERFLOW=m
 CONFIG_TEST_RHASHTABLE=m
 CONFIG_TEST_HASH=m
 CONFIG_TEST_USER_COPY=m
@@ -573,6 +573,11 @@ CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_MCRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
+CONFIG_CRYPTO_AEGIS128=m
+CONFIG_CRYPTO_AEGIS128L=m
+CONFIG_CRYPTO_AEGIS256=m
+CONFIG_CRYPTO_MORUS640=m
+CONFIG_CRYPTO_MORUS1280=m
 CONFIG_CRYPTO_CFB=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
@@ -608,6 +613,7 @@ CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ZSTD=m
 CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_DRBG_HASH=y
 CONFIG_CRYPTO_DRBG_CTR=y
diff --git a/arch/m68k/configs/mvme16x_defconfig b/arch/m68k/configs/mvme16x_defconfig
index 1477cda9146e..9783d3deb9e9 100644
--- a/arch/m68k/configs/mvme16x_defconfig
+++ b/arch/m68k/configs/mvme16x_defconfig
@@ -48,6 +48,7 @@ CONFIG_UNIX_DIAG=m
 CONFIG_TLS=m
 CONFIG_XFRM_MIGRATE=y
 CONFIG_NET_KEY=y
+CONFIG_XDP_SOCKETS=y
 CONFIG_INET=y
 CONFIG_IP_PNP=y
 CONFIG_IP_PNP_DHCP=y
@@ -94,18 +95,14 @@ CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
 CONFIG_NF_TABLES=m
+CONFIG_NF_TABLES_SET=m
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_EXTHDR=m
-CONFIG_NFT_META=m
-CONFIG_NFT_RT=m
 CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_FLOW_OFFLOAD=m
-CONFIG_NFT_SET_RBTREE=m
-CONFIG_NFT_SET_HASH=m
-CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
+CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
 CONFIG_NFT_MASQ=m
@@ -118,6 +115,7 @@ CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
 CONFIG_NFT_FIB_INET=m
+CONFIG_NFT_SOCKET=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NFT_FIB_NETDEV=m
@@ -196,7 +194,6 @@ CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
-CONFIG_NF_SOCKET_IPV4=m
 CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
@@ -227,7 +224,6 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
-CONFIG_NF_SOCKET_IPV6=m
 CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_NFT_MASQ_IPV6=m
@@ -256,7 +252,6 @@ CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=y
-CONFIG_NFT_BRIDGE_META=m
 CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_LOG_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
@@ -297,6 +292,7 @@ CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
 CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
+# CONFIG_BATMAN_ADV_BATMAN_V is not set
 CONFIG_BATMAN_ADV_DAT=y
 CONFIG_BATMAN_ADV_NC=y
 CONFIG_BATMAN_ADV_MCAST=y
@@ -344,6 +340,7 @@ CONFIG_DM_UNSTRIPED=m
 CONFIG_DM_CRYPT=m
 CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_THIN_PROVISIONING=m
+CONFIG_DM_WRITECACHE=m
 CONFIG_DM_ERA=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_RAID=m
@@ -380,14 +377,15 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_AMAZON is not set
 # CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
-# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
+# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_CORTINA is not set
 # CONFIG_NET_VENDOR_EZCHIP is not set
 # CONFIG_NET_VENDOR_HUAWEI is not set
 CONFIG_MVME16x_NET=y
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_MICROSEMI is not set
 # CONFIG_NET_VENDOR_NATSEMI is not set
 # CONFIG_NET_VENDOR_NETRONOME is not set
 # CONFIG_NET_VENDOR_NI is not set
@@ -399,9 +397,9 @@ CONFIG_MVME16x_NET=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_SOCIONEXT is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
 CONFIG_PPP_DEFLATE=m
@@ -433,6 +431,7 @@ CONFIG_HIDRAW=y
 CONFIG_UHID=m
 # CONFIG_HID_GENERIC is not set
 # CONFIG_HID_ITE is not set
+# CONFIG_HID_REDRAGON is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_RTC_CLASS=y
 # CONFIG_RTC_NVMEM is not set
@@ -450,7 +449,7 @@ CONFIG_FS_ENCRYPTION=m
 CONFIG_FANOTIFY=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 # CONFIG_PRINT_QUOTA_WARNING is not set
-CONFIG_AUTOFS4_FS=m
+CONFIG_AUTOFS_FS=m
 CONFIG_FUSE_FS=m
 CONFIG_CUSE=m
 CONFIG_OVERLAY_FS=m
@@ -551,6 +550,7 @@ CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
 CONFIG_TEST_UUID=m
+CONFIG_TEST_OVERFLOW=m
 CONFIG_TEST_RHASHTABLE=m
 CONFIG_TEST_HASH=m
 CONFIG_TEST_USER_COPY=m
@@ -573,6 +573,11 @@ CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_MCRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
+CONFIG_CRYPTO_AEGIS128=m
+CONFIG_CRYPTO_AEGIS128L=m
+CONFIG_CRYPTO_AEGIS256=m
+CONFIG_CRYPTO_MORUS640=m
+CONFIG_CRYPTO_MORUS1280=m
 CONFIG_CRYPTO_CFB=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
@@ -608,6 +613,7 @@ CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ZSTD=m
 CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_DRBG_HASH=y
 CONFIG_CRYPTO_DRBG_CTR=y
diff --git a/arch/m68k/configs/q40_defconfig b/arch/m68k/configs/q40_defconfig
index b3a543dc48a0..a35d10ee10cb 100644
--- a/arch/m68k/configs/q40_defconfig
+++ b/arch/m68k/configs/q40_defconfig
@@ -48,6 +48,7 @@ CONFIG_UNIX_DIAG=m
 CONFIG_TLS=m
 CONFIG_XFRM_MIGRATE=y
 CONFIG_NET_KEY=y
+CONFIG_XDP_SOCKETS=y
 CONFIG_INET=y
 CONFIG_IP_PNP=y
 CONFIG_IP_PNP_DHCP=y
@@ -94,18 +95,14 @@ CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
 CONFIG_NF_TABLES=m
+CONFIG_NF_TABLES_SET=m
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_EXTHDR=m
-CONFIG_NFT_META=m
-CONFIG_NFT_RT=m
 CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_FLOW_OFFLOAD=m
-CONFIG_NFT_SET_RBTREE=m
-CONFIG_NFT_SET_HASH=m
-CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
+CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
 CONFIG_NFT_MASQ=m
@@ -118,6 +115,7 @@ CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
 CONFIG_NFT_FIB_INET=m
+CONFIG_NFT_SOCKET=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NFT_FIB_NETDEV=m
@@ -196,7 +194,6 @@ CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
-CONFIG_NF_SOCKET_IPV4=m
 CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
@@ -227,7 +224,6 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
-CONFIG_NF_SOCKET_IPV6=m
 CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_NFT_MASQ_IPV6=m
@@ -256,7 +252,6 @@ CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=y
-CONFIG_NFT_BRIDGE_META=m
 CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_LOG_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
@@ -297,6 +292,7 @@ CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
 CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
+# CONFIG_BATMAN_ADV_BATMAN_V is not set
 CONFIG_BATMAN_ADV_DAT=y
 CONFIG_BATMAN_ADV_NC=y
 CONFIG_BATMAN_ADV_MCAST=y
@@ -350,6 +346,7 @@ CONFIG_DM_UNSTRIPED=m
 CONFIG_DM_CRYPT=m
 CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_THIN_PROVISIONING=m
+CONFIG_DM_WRITECACHE=m
 CONFIG_DM_ERA=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_RAID=m
@@ -388,8 +385,8 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_AMD is not set
 # CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
-# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
+# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_CIRRUS is not set
 # CONFIG_NET_VENDOR_CORTINA is not set
 # CONFIG_NET_VENDOR_EZCHIP is not set
@@ -398,6 +395,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_MICROSEMI is not set
 # CONFIG_NET_VENDOR_NETRONOME is not set
 # CONFIG_NET_VENDOR_NI is not set
 CONFIG_NE2000=y
@@ -410,9 +408,9 @@ CONFIG_NE2000=y
 # CONFIG_NET_VENDOR_SMSC is not set
 # CONFIG_NET_VENDOR_SOCIONEXT is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 CONFIG_PLIP=m
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -455,6 +453,7 @@ CONFIG_HIDRAW=y
 CONFIG_UHID=m
 # CONFIG_HID_GENERIC is not set
 # CONFIG_HID_ITE is not set
+# CONFIG_HID_REDRAGON is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_RTC_CLASS=y
 # CONFIG_RTC_NVMEM is not set
@@ -473,7 +472,7 @@ CONFIG_FS_ENCRYPTION=m
 CONFIG_FANOTIFY=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 # CONFIG_PRINT_QUOTA_WARNING is not set
-CONFIG_AUTOFS4_FS=m
+CONFIG_AUTOFS_FS=m
 CONFIG_FUSE_FS=m
 CONFIG_CUSE=m
 CONFIG_OVERLAY_FS=m
@@ -574,6 +573,7 @@ CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
 CONFIG_TEST_UUID=m
+CONFIG_TEST_OVERFLOW=m
 CONFIG_TEST_RHASHTABLE=m
 CONFIG_TEST_HASH=m
 CONFIG_TEST_USER_COPY=m
@@ -596,6 +596,11 @@ CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_MCRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
+CONFIG_CRYPTO_AEGIS128=m
+CONFIG_CRYPTO_AEGIS128L=m
+CONFIG_CRYPTO_AEGIS256=m
+CONFIG_CRYPTO_MORUS640=m
+CONFIG_CRYPTO_MORUS1280=m
 CONFIG_CRYPTO_CFB=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
@@ -631,6 +636,7 @@ CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ZSTD=m
 CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_DRBG_HASH=y
 CONFIG_CRYPTO_DRBG_CTR=y
diff --git a/arch/m68k/configs/sun3_defconfig b/arch/m68k/configs/sun3_defconfig
index d543ed5dfa96..573bf922d448 100644
--- a/arch/m68k/configs/sun3_defconfig
+++ b/arch/m68k/configs/sun3_defconfig
@@ -45,6 +45,7 @@ CONFIG_UNIX_DIAG=m
 CONFIG_TLS=m
 CONFIG_XFRM_MIGRATE=y
 CONFIG_NET_KEY=y
+CONFIG_XDP_SOCKETS=y
 CONFIG_INET=y
 CONFIG_IP_PNP=y
 CONFIG_IP_PNP_DHCP=y
@@ -91,18 +92,14 @@ CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
 CONFIG_NF_TABLES=m
+CONFIG_NF_TABLES_SET=m
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_EXTHDR=m
-CONFIG_NFT_META=m
-CONFIG_NFT_RT=m
 CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_FLOW_OFFLOAD=m
-CONFIG_NFT_SET_RBTREE=m
-CONFIG_NFT_SET_HASH=m
-CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
+CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
 CONFIG_NFT_MASQ=m
@@ -115,6 +112,7 @@ CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
 CONFIG_NFT_FIB_INET=m
+CONFIG_NFT_SOCKET=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NFT_FIB_NETDEV=m
@@ -193,7 +191,6 @@ CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
-CONFIG_NF_SOCKET_IPV4=m
 CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
@@ -224,7 +221,6 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
-CONFIG_NF_SOCKET_IPV6=m
 CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_NFT_MASQ_IPV6=m
@@ -253,7 +249,6 @@ CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=y
-CONFIG_NFT_BRIDGE_META=m
 CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_LOG_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
@@ -294,6 +289,7 @@ CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
 CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
+# CONFIG_BATMAN_ADV_BATMAN_V is not set
 CONFIG_BATMAN_ADV_DAT=y
 CONFIG_BATMAN_ADV_NC=y
 CONFIG_BATMAN_ADV_MCAST=y
@@ -341,6 +337,7 @@ CONFIG_DM_UNSTRIPED=m
 CONFIG_DM_CRYPT=m
 CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_THIN_PROVISIONING=m
+CONFIG_DM_WRITECACHE=m
 CONFIG_DM_ERA=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_RAID=m
@@ -385,6 +382,7 @@ CONFIG_SUN3LANCE=y
 CONFIG_SUN3_82586=y
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_MICROSEMI is not set
 # CONFIG_NET_VENDOR_NATSEMI is not set
 # CONFIG_NET_VENDOR_NETRONOME is not set
 # CONFIG_NET_VENDOR_NI is not set
@@ -397,9 +395,9 @@ CONFIG_SUN3_82586=y
 # CONFIG_NET_VENDOR_SOCIONEXT is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
 # CONFIG_NET_VENDOR_SUN is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
 CONFIG_PPP_DEFLATE=m
@@ -435,6 +433,7 @@ CONFIG_HIDRAW=y
 CONFIG_UHID=m
 # CONFIG_HID_GENERIC is not set
 # CONFIG_HID_ITE is not set
+# CONFIG_HID_REDRAGON is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_RTC_CLASS=y
 # CONFIG_RTC_NVMEM is not set
@@ -452,7 +451,7 @@ CONFIG_FS_ENCRYPTION=m
 CONFIG_FANOTIFY=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 # CONFIG_PRINT_QUOTA_WARNING is not set
-CONFIG_AUTOFS4_FS=m
+CONFIG_AUTOFS_FS=m
 CONFIG_FUSE_FS=m
 CONFIG_CUSE=m
 CONFIG_OVERLAY_FS=m
@@ -553,6 +552,7 @@ CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
 CONFIG_TEST_UUID=m
+CONFIG_TEST_OVERFLOW=m
 CONFIG_TEST_RHASHTABLE=m
 CONFIG_TEST_HASH=m
 CONFIG_TEST_USER_COPY=m
@@ -574,6 +574,11 @@ CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_MCRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
+CONFIG_CRYPTO_AEGIS128=m
+CONFIG_CRYPTO_AEGIS128L=m
+CONFIG_CRYPTO_AEGIS256=m
+CONFIG_CRYPTO_MORUS640=m
+CONFIG_CRYPTO_MORUS1280=m
 CONFIG_CRYPTO_CFB=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
@@ -609,6 +614,7 @@ CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ZSTD=m
 CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_DRBG_HASH=y
 CONFIG_CRYPTO_DRBG_CTR=y
diff --git a/arch/m68k/configs/sun3x_defconfig b/arch/m68k/configs/sun3x_defconfig
index a67e54246023..efb27a7fcc55 100644
--- a/arch/m68k/configs/sun3x_defconfig
+++ b/arch/m68k/configs/sun3x_defconfig
@@ -45,6 +45,7 @@ CONFIG_UNIX_DIAG=m
 CONFIG_TLS=m
 CONFIG_XFRM_MIGRATE=y
 CONFIG_NET_KEY=y
+CONFIG_XDP_SOCKETS=y
 CONFIG_INET=y
 CONFIG_IP_PNP=y
 CONFIG_IP_PNP_DHCP=y
@@ -91,18 +92,14 @@ CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
 CONFIG_NF_TABLES=m
+CONFIG_NF_TABLES_SET=m
 CONFIG_NF_TABLES_INET=y
 CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_EXTHDR=m
-CONFIG_NFT_META=m
-CONFIG_NFT_RT=m
 CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_FLOW_OFFLOAD=m
-CONFIG_NFT_SET_RBTREE=m
-CONFIG_NFT_SET_HASH=m
-CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
+CONFIG_NFT_CONNLIMIT=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
 CONFIG_NFT_MASQ=m
@@ -115,6 +112,7 @@ CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
 CONFIG_NFT_HASH=m
 CONFIG_NFT_FIB_INET=m
+CONFIG_NFT_SOCKET=m
 CONFIG_NFT_DUP_NETDEV=m
 CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NFT_FIB_NETDEV=m
@@ -193,7 +191,6 @@ CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
-CONFIG_NF_SOCKET_IPV4=m
 CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
@@ -224,7 +221,6 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
-CONFIG_NF_SOCKET_IPV6=m
 CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_NFT_MASQ_IPV6=m
@@ -253,7 +249,6 @@ CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
 CONFIG_NF_TABLES_BRIDGE=y
-CONFIG_NFT_BRIDGE_META=m
 CONFIG_NFT_BRIDGE_REJECT=m
 CONFIG_NF_LOG_BRIDGE=m
 CONFIG_BRIDGE_NF_EBTABLES=m
@@ -294,6 +289,7 @@ CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
 CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
+# CONFIG_BATMAN_ADV_BATMAN_V is not set
 CONFIG_BATMAN_ADV_DAT=y
 CONFIG_BATMAN_ADV_NC=y
 CONFIG_BATMAN_ADV_MCAST=y
@@ -341,6 +337,7 @@ CONFIG_DM_UNSTRIPED=m
 CONFIG_DM_CRYPT=m
 CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_THIN_PROVISIONING=m
+CONFIG_DM_WRITECACHE=m
 CONFIG_DM_ERA=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_RAID=m
@@ -378,14 +375,15 @@ CONFIG_VETH=m
 CONFIG_SUN3LANCE=y
 # CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
-# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
+# CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_CORTINA is not set
 # CONFIG_NET_VENDOR_EZCHIP is not set
 # CONFIG_NET_VENDOR_HUAWEI is not set
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_MICROSEMI is not set
 # CONFIG_NET_VENDOR_NATSEMI is not set
 # CONFIG_NET_VENDOR_NETRONOME is not set
 # CONFIG_NET_VENDOR_NI is not set
@@ -397,9 +395,9 @@ CONFIG_SUN3LANCE=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_SOCIONEXT is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
 CONFIG_PPP_DEFLATE=m
@@ -435,6 +433,7 @@ CONFIG_HIDRAW=y
 CONFIG_UHID=m
 # CONFIG_HID_GENERIC is not set
 # CONFIG_HID_ITE is not set
+# CONFIG_HID_REDRAGON is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_RTC_CLASS=y
 # CONFIG_RTC_NVMEM is not set
@@ -452,7 +451,7 @@ CONFIG_FS_ENCRYPTION=m
 CONFIG_FANOTIFY=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 # CONFIG_PRINT_QUOTA_WARNING is not set
-CONFIG_AUTOFS4_FS=m
+CONFIG_AUTOFS_FS=m
 CONFIG_FUSE_FS=m
 CONFIG_CUSE=m
 CONFIG_OVERLAY_FS=m
@@ -553,6 +552,7 @@ CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
 CONFIG_TEST_UUID=m
+CONFIG_TEST_OVERFLOW=m
 CONFIG_TEST_RHASHTABLE=m
 CONFIG_TEST_HASH=m
 CONFIG_TEST_USER_COPY=m
@@ -575,6 +575,11 @@ CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_MCRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
+CONFIG_CRYPTO_AEGIS128=m
+CONFIG_CRYPTO_AEGIS128L=m
+CONFIG_CRYPTO_AEGIS256=m
+CONFIG_CRYPTO_MORUS640=m
+CONFIG_CRYPTO_MORUS1280=m
 CONFIG_CRYPTO_CFB=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
@@ -610,6 +615,7 @@ CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ZSTD=m
 CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_DRBG_HASH=y
 CONFIG_CRYPTO_DRBG_CTR=y
diff --git a/arch/m68k/include/asm/Kbuild b/arch/m68k/include/asm/Kbuild
index 4d8d68c4e3dd..a4b8d3331a9e 100644
--- a/arch/m68k/include/asm/Kbuild
+++ b/arch/m68k/include/asm/Kbuild
@@ -1,6 +1,7 @@
 generic-y += barrier.h
 generic-y += compat.h
 generic-y += device.h
+generic-y += dma-mapping.h
 generic-y += emergency-restart.h
 generic-y += exec.h
 generic-y += extable.h
diff --git a/arch/m68k/include/asm/atomic.h b/arch/m68k/include/asm/atomic.h
index e993e2860ee1..47228b0d4163 100644
--- a/arch/m68k/include/asm/atomic.h
+++ b/arch/m68k/include/asm/atomic.h
@@ -126,11 +126,13 @@ static inline void atomic_inc(atomic_t *v)
 {
         __asm__ __volatile__("addql #1,%0" : "+m" (*v));
 }
+#define atomic_inc atomic_inc
 
 static inline void atomic_dec(atomic_t *v)
 {
         __asm__ __volatile__("subql #1,%0" : "+m" (*v));
 }
+#define atomic_dec atomic_dec
 
 static inline int atomic_dec_and_test(atomic_t *v)
 {
@@ -138,6 +140,7 @@ static inline int atomic_dec_and_test(atomic_t *v)
         __asm__ __volatile__("subql #1,%1; seq %0" : "=d" (c), "+m" (*v));
         return c != 0;
 }
+#define atomic_dec_and_test atomic_dec_and_test
 
 static inline int atomic_dec_and_test_lt(atomic_t *v)
 {
@@ -155,6 +158,7 @@ static inline int atomic_inc_and_test(atomic_t *v)
         __asm__ __volatile__("addql #1,%1; seq %0" : "=d" (c), "+m" (*v));
         return c != 0;
 }
+#define atomic_inc_and_test atomic_inc_and_test
 
 #ifdef CONFIG_RMW_INSNS
 
@@ -190,9 +194,6 @@ static inline int atomic_xchg(atomic_t *v, int new)
 
 #endif /* !CONFIG_RMW_INSNS */
 
-#define atomic_dec_return(v)    atomic_sub_return(1, (v))
-#define atomic_inc_return(v)    atomic_add_return(1, (v))
-
 static inline int atomic_sub_and_test(int i, atomic_t *v)
 {
         char c;
@@ -201,6 +202,7 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
                              : ASM_DI (i));
         return c != 0;
 }
+#define atomic_sub_and_test atomic_sub_and_test
 
 static inline int atomic_add_negative(int i, atomic_t *v)
 {
@@ -210,20 +212,6 @@ static inline int atomic_add_negative(int i, atomic_t *v)
                              : ASM_DI (i));
         return c != 0;
 }
-
-static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
-{
-        int c, old;
-        c = atomic_read(v);
-        for (;;) {
-                if (unlikely(c == (u)))
-                        break;
-                old = atomic_cmpxchg((v), c, c + (a));
-                if (likely(old == c))
-                        break;
-                c = old;
-        }
-        return c;
-}
+#define atomic_add_negative atomic_add_negative
 
 #endif /* __ARCH_M68K_ATOMIC __ */
diff --git a/arch/m68k/include/asm/bitops.h b/arch/m68k/include/asm/bitops.h
index 93b47b1f6fb4..d979f38af751 100644
--- a/arch/m68k/include/asm/bitops.h
+++ b/arch/m68k/include/asm/bitops.h
@@ -454,7 +454,7 @@ static inline unsigned long ffz(unsigned long word)
  */
 #if (defined(__mcfisaaplus__) || defined(__mcfisac__)) && \
         !defined(CONFIG_M68000) && !defined(CONFIG_MCPU32)
-static inline int __ffs(int x)
+static inline unsigned long __ffs(unsigned long x)
 {
         __asm__ __volatile__ ("bitrev %0; ff1 %0"
                 : "=d" (x)
@@ -493,7 +493,11 @@ static inline int ffs(int x)
                 : "dm" (x & -x));
         return 32 - cnt;
 }
-#define __ffs(x) (ffs(x) - 1)
+
+static inline unsigned long __ffs(unsigned long x)
+{
+        return ffs(x) - 1;
+}
 
 /*
  *      fls: find last bit set.
@@ -515,12 +519,16 @@ static inline int __fls(int x)
 
 #endif
 
+/* Simple test-and-set bit locks */
+#define test_and_set_bit_lock   test_and_set_bit
+#define clear_bit_unlock        clear_bit
+#define __clear_bit_unlock      clear_bit_unlock
+
 #include <asm-generic/bitops/ext2-atomic.h>
 #include <asm-generic/bitops/le.h>
 #include <asm-generic/bitops/fls64.h>
 #include <asm-generic/bitops/sched.h>
 #include <asm-generic/bitops/hweight.h>
-#include <asm-generic/bitops/lock.h>
 #endif /* __KERNEL__ */
 
 #endif /* _M68K_BITOPS_H */
diff --git a/arch/m68k/include/asm/dma-mapping.h b/arch/m68k/include/asm/dma-mapping.h
deleted file mode 100644
index e3722ed04fbb..000000000000
--- a/arch/m68k/include/asm/dma-mapping.h
+++ /dev/null
@@ -1,12 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef _M68K_DMA_MAPPING_H
-#define _M68K_DMA_MAPPING_H
-
-extern const struct dma_map_ops m68k_dma_ops;
-
-static inline const struct dma_map_ops *get_arch_dma_ops(struct bus_type *bus)
-{
-        return &m68k_dma_ops;
-}
-
-#endif  /* _M68K_DMA_MAPPING_H */
diff --git a/arch/m68k/include/asm/io.h b/arch/m68k/include/asm/io.h
index ca2849afb087..aabe6420ead2 100644
--- a/arch/m68k/include/asm/io.h
+++ b/arch/m68k/include/asm/io.h
@@ -1,6 +1,13 @@
 /* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _M68K_IO_H
+#define _M68K_IO_H
+
 #if defined(__uClinux__) || defined(CONFIG_COLDFIRE)
 #include <asm/io_no.h>
 #else
 #include <asm/io_mm.h>
 #endif
+
+#include <asm-generic/io.h>
+
+#endif /* _M68K_IO_H */
diff --git a/arch/m68k/include/asm/io_mm.h b/arch/m68k/include/asm/io_mm.h
index fe485f4f5fac..782b78f8a048 100644
--- a/arch/m68k/include/asm/io_mm.h
+++ b/arch/m68k/include/asm/io_mm.h
@@ -16,13 +16,11 @@
  *    isa_readX(),isa_writeX()  are for ISA memory
  */
 
-#ifndef _IO_H
-#define _IO_H
+#ifndef _M68K_IO_MM_H
+#define _M68K_IO_MM_H
 
 #ifdef __KERNEL__
 
-#define ARCH_HAS_IOREMAP_WT
-
 #include <linux/compiler.h>
 #include <asm/raw_io.h>
 #include <asm/virtconvert.h>
@@ -369,40 +367,6 @@ static inline void isa_delay(void)
 #define writew(val, addr)       out_le16((addr), (val))
 #endif /* CONFIG_ATARI_ROM_ISA */
 
-#if !defined(CONFIG_ISA) && !defined(CONFIG_ATARI_ROM_ISA)
-/*
- * We need to define dummy functions for GENERIC_IOMAP support.
- */
-#define inb(port)          0xff
-#define inb_p(port)        0xff
-#define outb(val,port)     ((void)0)
-#define outb_p(val,port)   ((void)0)
-#define inw(port)          0xffff
-#define inw_p(port)        0xffff
-#define outw(val,port)     ((void)0)
-#define outw_p(val,port)   ((void)0)
-#define inl(port)          0xffffffffUL
-#define inl_p(port)        0xffffffffUL
-#define outl(val,port)     ((void)0)
-#define outl_p(val,port)   ((void)0)
-
-#define insb(port,buf,nr)  ((void)0)
-#define outsb(port,buf,nr) ((void)0)
-#define insw(port,buf,nr)  ((void)0)
-#define outsw(port,buf,nr) ((void)0)
-#define insl(port,buf,nr)  ((void)0)
-#define outsl(port,buf,nr) ((void)0)
-
-/*
- * These should be valid on any ioremap()ed region
- */
-#define readb(addr)      in_8(addr)
-#define writeb(val,addr) out_8((addr),(val))
-#define readw(addr)      in_le16(addr)
-#define writew(val,addr) out_le16((addr),(val))
-
-#endif /* !CONFIG_ISA && !CONFIG_ATARI_ROM_ISA */
-
 #define readl(addr)      in_le32(addr)
 #define writel(val,addr) out_le32((addr),(val))
 
@@ -444,4 +408,4 @@ static inline void isa_delay(void)
 #define writew_relaxed(b, addr) writew(b, addr)
 #define writel_relaxed(b, addr) writel(b, addr)
 
-#endif /* _IO_H */
+#endif /* _M68K_IO_MM_H */
diff --git a/arch/m68k/include/asm/io_no.h b/arch/m68k/include/asm/io_no.h
index 83a0a6d449f4..0498192e1d98 100644
--- a/arch/m68k/include/asm/io_no.h
+++ b/arch/m68k/include/asm/io_no.h
@@ -131,19 +131,7 @@ static inline void writel(u32 value, volatile void __iomem *addr)
 #define PCI_SPACE_LIMIT PCI_IO_MASK
 #endif /* CONFIG_PCI */
 
-/*
- * These are defined in kmap.h as static inline functions. To maintain
- * previous behavior we put these define guards here so io_mm.h doesn't
- * see them.
- */
-#ifdef CONFIG_MMU
-#define memset_io memset_io
-#define memcpy_fromio memcpy_fromio
-#define memcpy_toio memcpy_toio
-#endif
-
 #include <asm/kmap.h>
 #include <asm/virtconvert.h>
-#include <asm-generic/io.h>
 
 #endif /* _M68KNOMMU_IO_H */
diff --git a/arch/m68k/include/asm/kmap.h b/arch/m68k/include/asm/kmap.h
index 84b8333db8ad..aac7f045f7f0 100644
--- a/arch/m68k/include/asm/kmap.h
+++ b/arch/m68k/include/asm/kmap.h
@@ -4,6 +4,8 @@
 
 #ifdef CONFIG_MMU
 
+#define ARCH_HAS_IOREMAP_WT
+
 /* Values for nocacheflag and cmode */
 #define IOMAP_FULL_CACHING              0
 #define IOMAP_NOCACHE_SER               1
@@ -16,6 +18,7 @@
  */
 extern void __iomem *__ioremap(unsigned long physaddr, unsigned long size,
                                int cacheflag);
+#define iounmap iounmap
 extern void iounmap(void __iomem *addr);
 extern void __iounmap(void *addr, unsigned long size);
 
@@ -33,31 +36,35 @@ static inline void __iomem *ioremap_nocache(unsigned long physaddr,
 }
 
 #define ioremap_uc ioremap_nocache
+#define ioremap_wt ioremap_wt
 static inline void __iomem *ioremap_wt(unsigned long physaddr,
                                        unsigned long size)
 {
         return __ioremap(physaddr, size, IOMAP_WRITETHROUGH);
 }
 
-#define ioremap_fillcache ioremap_fullcache
+#define ioremap_fullcache ioremap_fullcache
 static inline void __iomem *ioremap_fullcache(unsigned long physaddr,
                                               unsigned long size)
 {
         return __ioremap(physaddr, size, IOMAP_FULL_CACHING);
 }
 
+#define memset_io memset_io
 static inline void memset_io(volatile void __iomem *addr, unsigned char val,
                              int count)
 {
         __builtin_memset((void __force *) addr, val, count);
 }
 
+#define memcpy_fromio memcpy_fromio
 static inline void memcpy_fromio(void *dst, const volatile void __iomem *src,
                                  int count)
 {
         __builtin_memcpy(dst, (void __force *) src, count);
 }
 
+#define memcpy_toio memcpy_toio
 static inline void memcpy_toio(volatile void __iomem *dst, const void *src,
                                int count)
 {
diff --git a/arch/m68k/include/asm/machdep.h b/arch/m68k/include/asm/machdep.h
index 1605da48ebf2..49bd3266b4b1 100644
--- a/arch/m68k/include/asm/machdep.h
+++ b/arch/m68k/include/asm/machdep.h
@@ -22,7 +22,6 @@ extern int (*mach_hwclk)(int, struct rtc_time*);
 extern unsigned int (*mach_get_ss)(void);
 extern int (*mach_get_rtc_pll)(struct rtc_pll_info *);
 extern int (*mach_set_rtc_pll)(struct rtc_pll_info *);
-extern int (*mach_set_clock_mmss)(unsigned long);
 extern void (*mach_reset)( void );
 extern void (*mach_halt)( void );
 extern void (*mach_power_off)( void );
diff --git a/arch/m68k/include/asm/macintosh.h b/arch/m68k/include/asm/macintosh.h
index 9b840c03ebb7..08cee11180e6 100644
--- a/arch/m68k/include/asm/macintosh.h
+++ b/arch/m68k/include/asm/macintosh.h
@@ -57,7 +57,6 @@ struct mac_model
 #define MAC_SCSI_IIFX           5
 #define MAC_SCSI_DUO            6
 #define MAC_SCSI_LC             7
-#define MAC_SCSI_LATE           8
 
 #define MAC_IDE_NONE            0
 #define MAC_IDE_QUADRA          1
diff --git a/arch/m68k/include/asm/page_no.h b/arch/m68k/include/asm/page_no.h
index e644c4daf540..6bbe52025de3 100644
--- a/arch/m68k/include/asm/page_no.h
+++ b/arch/m68k/include/asm/page_no.h
@@ -18,7 +18,7 @@ extern unsigned long memory_end;
 #define __HAVE_ARCH_ALLOC_ZEROED_USER_HIGHPAGE
 
 #define __pa(vaddr)             ((unsigned long)(vaddr))
-#define __va(paddr)             ((void *)(paddr))
+#define __va(paddr)             ((void *)((unsigned long)(paddr)))
 
 #define virt_to_pfn(kaddr)      (__pa(kaddr) >> PAGE_SHIFT)
 #define pfn_to_virt(pfn)        __va((pfn) << PAGE_SHIFT)
diff --git a/arch/m68k/kernel/dma.c b/arch/m68k/kernel/dma.c
index 463572c4943f..e99993c57d6b 100644
--- a/arch/m68k/kernel/dma.c
+++ b/arch/m68k/kernel/dma.c
@@ -6,7 +6,7 @@
 
 #undef DEBUG
 
-#include <linux/dma-mapping.h>
+#include <linux/dma-noncoherent.h>
 #include <linux/device.h>
 #include <linux/kernel.h>
 #include <linux/platform_device.h>
@@ -19,7 +19,7 @@
 
 #if defined(CONFIG_MMU) && !defined(CONFIG_COLDFIRE)
 
-static void *m68k_dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,
+void *arch_dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,
                 gfp_t flag, unsigned long attrs)
 {
         struct page *page, **map;
@@ -62,7 +62,7 @@ static void *m68k_dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,
         return addr;
 }
 
-static void m68k_dma_free(struct device *dev, size_t size, void *addr,
+void arch_dma_free(struct device *dev, size_t size, void *addr,
                 dma_addr_t handle, unsigned long attrs)
 {
         pr_debug("dma_free_coherent: %p, %x\n", addr, handle);
@@ -73,8 +73,8 @@ static void m68k_dma_free(struct device *dev, size_t size, void *addr,
 
 #include <asm/cacheflush.h>
 
-static void *m68k_dma_alloc(struct device *dev, size_t size,
-                dma_addr_t *dma_handle, gfp_t gfp, unsigned long attrs)
+void *arch_dma_alloc(struct device *dev, size_t size, dma_addr_t *dma_handle,
+                gfp_t gfp, unsigned long attrs)
 {
         void *ret;
 
@@ -89,7 +89,7 @@ static void *m68k_dma_alloc(struct device *dev, size_t size,
         return ret;
 }
 
-static void m68k_dma_free(struct device *dev, size_t size, void *vaddr,
+void arch_dma_free(struct device *dev, size_t size, void *vaddr,
                 dma_addr_t dma_handle, unsigned long attrs)
 {
         free_pages((unsigned long)vaddr, get_order(size));
@@ -97,8 +97,8 @@ static void m68k_dma_free(struct device *dev, size_t size, void *vaddr,
 
 #endif /* CONFIG_MMU && !CONFIG_COLDFIRE */
 
-static void m68k_dma_sync_single_for_device(struct device *dev,
-                dma_addr_t handle, size_t size, enum dma_data_direction dir)
+void arch_sync_dma_for_device(struct device *dev, phys_addr_t handle,
+                size_t size, enum dma_data_direction dir)
 {
         switch (dir) {
         case DMA_BIDIRECTIONAL:
@@ -115,58 +115,6 @@ static void m68k_dma_sync_single_for_device(struct device *dev,
         }
 }
 
-static void m68k_dma_sync_sg_for_device(struct device *dev,
-                struct scatterlist *sglist, int nents, enum dma_data_direction dir)
-{
-        int i;
-        struct scatterlist *sg;
-
-        for_each_sg(sglist, sg, nents, i) {
-                dma_sync_single_for_device(dev, sg->dma_address, sg->length,
-                                           dir);
-        }
-}
-
-static dma_addr_t m68k_dma_map_page(struct device *dev, struct page *page,
-                unsigned long offset, size_t size, enum dma_data_direction dir,
-                unsigned long attrs)
-{
-        dma_addr_t handle = page_to_phys(page) + offset;
-
-        if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC))
-                dma_sync_single_for_device(dev, handle, size, dir);
-
-        return handle;
-}
-
-static int m68k_dma_map_sg(struct device *dev, struct scatterlist *sglist,
-                int nents, enum dma_data_direction dir, unsigned long attrs)
-{
-        int i;
-        struct scatterlist *sg;
-
-        for_each_sg(sglist, sg, nents, i) {
-                sg->dma_address = sg_phys(sg);
-
-                if (attrs & DMA_ATTR_SKIP_CPU_SYNC)
-                        continue;
-
-                dma_sync_single_for_device(dev, sg->dma_address, sg->length,
-                                           dir);
-        }
-        return nents;
-}
-
-const struct dma_map_ops m68k_dma_ops = {
-        .alloc                  = m68k_dma_alloc,
-        .free                   = m68k_dma_free,
-        .map_page               = m68k_dma_map_page,
-        .map_sg                 = m68k_dma_map_sg,
-        .sync_single_for_device = m68k_dma_sync_single_for_device,
-        .sync_sg_for_device     = m68k_dma_sync_sg_for_device,
-};
-EXPORT_SYMBOL(m68k_dma_ops);
-
 void arch_setup_pdev_archdata(struct platform_device *pdev)
 {
         if (pdev->dev.coherent_dma_mask == DMA_MASK_NONE &&
diff --git a/arch/m68k/kernel/setup_mm.c b/arch/m68k/kernel/setup_mm.c
index f35e3ebd6331..5d3596c180f9 100644
--- a/arch/m68k/kernel/setup_mm.c
+++ b/arch/m68k/kernel/setup_mm.c
@@ -21,6 +21,7 @@
 #include <linux/string.h>
 #include <linux/init.h>
 #include <linux/bootmem.h>
+#include <linux/memblock.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/module.h>
@@ -88,7 +89,6 @@ void (*mach_get_hardware_list) (struct seq_file *m);
 /* machine dependent timer functions */
 int (*mach_hwclk) (int, struct rtc_time*);
 EXPORT_SYMBOL(mach_hwclk);
-int (*mach_set_clock_mmss) (unsigned long);
 unsigned int (*mach_get_ss)(void);
 int (*mach_get_rtc_pll)(struct rtc_pll_info *);
 int (*mach_set_rtc_pll)(struct rtc_pll_info *);
@@ -165,6 +165,8 @@ static void __init m68k_parse_bootinfo(const struct bi_record *record)
                                         be32_to_cpu(m->addr);
                                 m68k_memory[m68k_num_memory].size =
                                         be32_to_cpu(m->size);
+                                memblock_add(m68k_memory[m68k_num_memory].addr,
+                                             m68k_memory[m68k_num_memory].size);
                                 m68k_num_memory++;
                         } else
                                 pr_warn("%s: too many memory chunks\n",
@@ -224,10 +226,6 @@ static void __init m68k_parse_bootinfo(const struct bi_record *record)
 
 void __init setup_arch(char **cmdline_p)
 {
-#ifndef CONFIG_SUN3
-        int i;
-#endif
-
         /* The bootinfo is located right after the kernel */
         if (!CPU_IS_COLDFIRE)
                 m68k_parse_bootinfo((const struct bi_record *)_end);
@@ -356,14 +354,9 @@ void __init setup_arch(char **cmdline_p)
 #endif
 
 #ifndef CONFIG_SUN3
-        for (i = 1; i < m68k_num_memory; i++)
-                free_bootmem_node(NODE_DATA(i), m68k_memory[i].addr,
-                                  m68k_memory[i].size);
 #ifdef CONFIG_BLK_DEV_INITRD
         if (m68k_ramdisk.size) {
-                reserve_bootmem_node(__virt_to_node(phys_to_virt(m68k_ramdisk.addr)),
-                                     m68k_ramdisk.addr, m68k_ramdisk.size,
-                                     BOOTMEM_DEFAULT);
+                memblock_reserve(m68k_ramdisk.addr, m68k_ramdisk.size);
                 initrd_start = (unsigned long)phys_to_virt(m68k_ramdisk.addr);
                 initrd_end = initrd_start + m68k_ramdisk.size;
                 pr_info("initrd: %08lx - %08lx\n", initrd_start, initrd_end);
diff --git a/arch/m68k/kernel/setup_no.c b/arch/m68k/kernel/setup_no.c
index a98af1018201..cfd5475bfc31 100644
--- a/arch/m68k/kernel/setup_no.c
+++ b/arch/m68k/kernel/setup_no.c
@@ -28,6 +28,7 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/bootmem.h>
+#include <linux/memblock.h>
 #include <linux/seq_file.h>
 #include <linux/init.h>
 #include <linux/initrd.h>
@@ -51,7 +52,6 @@ char __initdata command_line[COMMAND_LINE_SIZE];
 
 /* machine dependent timer functions */
 void (*mach_sched_init)(irq_handler_t handler) __initdata = NULL;
-int (*mach_set_clock_mmss)(unsigned long);
 int (*mach_hwclk) (int, struct rtc_time*);
 
 /* machine dependent reboot functions */
@@ -86,8 +86,6 @@ void (*mach_power_off)(void);
 
 void __init setup_arch(char **cmdline_p)
 {
-        int bootmap_size;
-
         memory_start = PAGE_ALIGN(_ramstart);
         memory_end = _ramend;
 
@@ -142,6 +140,8 @@ void __init setup_arch(char **cmdline_p)
         pr_debug("MEMORY -> ROMFS=0x%p-0x%06lx MEM=0x%06lx-0x%06lx\n ",
                  __bss_stop, memory_start, memory_start, memory_end);
 
+        memblock_add(memory_start, memory_end - memory_start);
+
         /* Keep a copy of command line */
         *cmdline_p = &command_line[0];
         memcpy(boot_command_line, command_line, COMMAND_LINE_SIZE);
@@ -158,23 +158,10 @@ void __init setup_arch(char **cmdline_p)
         min_low_pfn = PFN_DOWN(memory_start);
         max_pfn = max_low_pfn = PFN_DOWN(memory_end);
 
-        bootmap_size = init_bootmem_node(
-                        NODE_DATA(0),
-                        min_low_pfn,            /* map goes here */
-                        PFN_DOWN(PAGE_OFFSET),
-                        max_pfn);
-        /*
-         * Free the usable memory, we have to make sure we do not free
-         * the bootmem bitmap so we then reserve it after freeing it :-)
-         */
-        free_bootmem(memory_start, memory_end - memory_start);
-        reserve_bootmem(memory_start, bootmap_size, BOOTMEM_DEFAULT);
-
 #if defined(CONFIG_UBOOT) && defined(CONFIG_BLK_DEV_INITRD)
         if ((initrd_start > 0) && (initrd_start < initrd_end) &&
                         (initrd_end < memory_end))
-                reserve_bootmem(initrd_start, initrd_end - initrd_start,
-                                 BOOTMEM_DEFAULT);
+                memblock_reserve(initrd_start, initrd_end - initrd_start);
 #endif /* if defined(CONFIG_BLK_DEV_INITRD) */
 
         /*
diff --git a/arch/m68k/mac/config.c b/arch/m68k/mac/config.c
index e522307db47c..b02d7254b73a 100644
--- a/arch/m68k/mac/config.c
+++ b/arch/m68k/mac/config.c
@@ -57,7 +57,6 @@ static unsigned long mac_orig_videoaddr;
 /* Mac specific timer functions */
 extern u32 mac_gettimeoffset(void);
 extern int mac_hwclk(int, struct rtc_time *);
-extern int mac_set_clock_mmss(unsigned long);
 extern void iop_preinit(void);
 extern void iop_init(void);
 extern void via_init(void);
@@ -158,7 +157,6 @@ void __init config_mac(void)
         mach_get_model = mac_get_model;
         arch_gettimeoffset = mac_gettimeoffset;
         mach_hwclk = mac_hwclk;
-        mach_set_clock_mmss = mac_set_clock_mmss;
         mach_reset = mac_reset;
         mach_halt = mac_poweroff;
         mach_power_off = mac_poweroff;
@@ -709,7 +707,7 @@ static struct mac_model mac_data_table[] = {
                 .name           = "PowerBook 520",
                 .adb_type       = MAC_ADB_PB2,
                 .via_type       = MAC_VIA_QUADRA,
-                .scsi_type      = MAC_SCSI_LATE,
+                .scsi_type      = MAC_SCSI_OLD,
                 .scc_type       = MAC_SCC_QUADRA,
                 .ether_type     = MAC_ETHER_SONIC,
                 .floppy_type    = MAC_FLOPPY_SWIM_ADDR2,
@@ -943,18 +941,6 @@ static const struct resource mac_scsi_old_rsrc[] __initconst = {
         },
 };
 
-static const struct resource mac_scsi_late_rsrc[] __initconst = {
-        {
-                .flags = IORESOURCE_IRQ,
-                .start = IRQ_MAC_SCSI,
-                .end   = IRQ_MAC_SCSI,
-        }, {
-                .flags = IORESOURCE_MEM,
-                .start = 0x50010000,
-                .end   = 0x50011FFF,
-        },
-};
-
 static const struct resource mac_scsi_ccl_rsrc[] __initconst = {
         {
                 .flags = IORESOURCE_IRQ,
@@ -1064,11 +1050,6 @@ int __init mac_platform_init(void)
                 platform_device_register_simple("mac_scsi", 0,
                         mac_scsi_old_rsrc, ARRAY_SIZE(mac_scsi_old_rsrc));
                 break;
-        case MAC_SCSI_LATE:
-                /* XXX PDMA support for PowerBook 500 series needs testing */
-                platform_device_register_simple("mac_scsi", 0,
-                        mac_scsi_late_rsrc, ARRAY_SIZE(mac_scsi_late_rsrc));
-                break;
         case MAC_SCSI_LC:
                 /* Addresses from Mac LC data in Designing Cards & Drivers 3ed.
                  * Also from the Developer Notes for Classic II, LC III,
diff --git a/arch/m68k/mac/misc.c b/arch/m68k/mac/misc.c
index c68054361615..19e9d8eef1f2 100644
--- a/arch/m68k/mac/misc.c
+++ b/arch/m68k/mac/misc.c
@@ -26,33 +26,38 @@
 
 #include <asm/machdep.h>
 
-/* Offset between Unix time (1970-based) and Mac time (1904-based) */
+/*
+ * Offset between Unix time (1970-based) and Mac time (1904-based). Cuda and PMU
+ * times wrap in 2040. If we need to handle later times, the read_time functions
+ * need to be changed to interpret wrapped times as post-2040.
+ */
 
 #define RTC_OFFSET 2082844800
 
 static void (*rom_reset)(void);
 
 #ifdef CONFIG_ADB_CUDA
-static long cuda_read_time(void)
+static time64_t cuda_read_time(void)
 {
         struct adb_request req;
-        long time;
+        time64_t time;
 
         if (cuda_request(&req, NULL, 2, CUDA_PACKET, CUDA_GET_TIME) < 0)
                 return 0;
         while (!req.complete)
                 cuda_poll();
 
-        time = (req.reply[3] << 24) | (req.reply[4] << 16) |
-               (req.reply[5] << 8) | req.reply[6];
+        time = (u32)((req.reply[3] << 24) | (req.reply[4] << 16) |
+                     (req.reply[5] << 8) | req.reply[6]);
+
         return time - RTC_OFFSET;
 }
 
-static void cuda_write_time(long data)
+static void cuda_write_time(time64_t time)
 {
         struct adb_request req;
+        u32 data = lower_32_bits(time + RTC_OFFSET);
 
-        data += RTC_OFFSET;
         if (cuda_request(&req, NULL, 6, CUDA_PACKET, CUDA_SET_TIME,
                          (data >> 24) & 0xFF, (data >> 16) & 0xFF,
                          (data >> 8) & 0xFF, data & 0xFF) < 0)
@@ -86,26 +91,27 @@ static void cuda_write_pram(int offset, __u8 data)
 #endif /* CONFIG_ADB_CUDA */
 
 #ifdef CONFIG_ADB_PMU68K
-static long pmu_read_time(void)
+static time64_t pmu_read_time(void)
 {
         struct adb_request req;
-        long time;
+        time64_t time;
 
         if (pmu_request(&req, NULL, 1, PMU_READ_RTC) < 0)
                 return 0;
         while (!req.complete)
                 pmu_poll();
 
-        time = (req.reply[1] << 24) | (req.reply[2] << 16) |
-               (req.reply[3] << 8) | req.reply[4];
+        time = (u32)((req.reply[1] << 24) | (req.reply[2] << 16) |
+                     (req.reply[3] << 8) | req.reply[4]);
+
         return time - RTC_OFFSET;
 }
 
-static void pmu_write_time(long data)
+static void pmu_write_time(time64_t time)
 {
         struct adb_request req;
+        u32 data = lower_32_bits(time + RTC_OFFSET);
 
-        data += RTC_OFFSET;
         if (pmu_request(&req, NULL, 5, PMU_SET_RTC,
                         (data >> 24) & 0xFF, (data >> 16) & 0xFF,
                         (data >> 8) & 0xFF, data & 0xFF) < 0)
@@ -245,11 +251,11 @@ static void via_write_pram(int offset, __u8 data)
  * is basically any machine with Mac II-style ADB.
  */
 
-static long via_read_time(void)
+static time64_t via_read_time(void)
 {
         union {
                 __u8 cdata[4];
-                long idata;
+                __u32 idata;
         } result, last_result;
         int count = 1;
 
@@ -270,7 +276,7 @@ static long via_read_time(void)
                 via_pram_command(0x8D, &result.cdata[0]);
 
                 if (result.idata == last_result.idata)
-                        return result.idata - RTC_OFFSET;
+                        return (time64_t)result.idata - RTC_OFFSET;
 
                 if (++count > 10)
                         break;
@@ -278,8 +284,8 @@ static long via_read_time(void)
                 last_result.idata = result.idata;
         }
 
-        pr_err("via_read_time: failed to read a stable value; got 0x%08lx then 0x%08lx\n",
-               last_result.idata, result.idata);
+        pr_err("%s: failed to read a stable value; got 0x%08x then 0x%08x\n",
+               __func__, last_result.idata, result.idata);
 
         return 0;
 }
@@ -291,11 +297,11 @@ static long via_read_time(void)
  * is basically any machine with Mac II-style ADB.
  */
 
-static void via_write_time(long time)
+static void via_write_time(time64_t time)
 {
         union {
                 __u8 cdata[4];
-                long idata;
+                __u32 idata;
         } data;
         __u8 temp;
 
@@ -304,7 +310,7 @@ static void via_write_time(long time)
         temp = 0x55;
         via_pram_command(0x35, &temp);
 
-        data.idata = time + RTC_OFFSET;
+        data.idata = lower_32_bits(time + RTC_OFFSET);
         via_pram_command(0x01, &data.cdata[3]);
         via_pram_command(0x05, &data.cdata[2]);
         via_pram_command(0x09, &data.cdata[1]);
@@ -585,12 +591,15 @@ void mac_reset(void)
  * This function translates seconds since 1970 into a proper date.
  *
  * Algorithm cribbed from glibc2.1, __offtime().
+ *
+ * This is roughly same as rtc_time64_to_tm(), which we should probably
+ * use here, but it's only available when CONFIG_RTC_LIB is enabled.
  */
 #define SECS_PER_MINUTE (60)
 #define SECS_PER_HOUR  (SECS_PER_MINUTE * 60)
 #define SECS_PER_DAY   (SECS_PER_HOUR * 24)
 
-static void unmktime(unsigned long time, long offset,
+static void unmktime(time64_t time, long offset,
                      int *yearp, int *monp, int *dayp,
                      int *hourp, int *minp, int *secp)
 {
@@ -602,11 +611,10 @@ static void unmktime(unsigned long time, long offset,
                 /* Leap years.  */
                 { 0, 31, 60, 91, 121, 152, 182, 213, 244, 274, 305, 335, 366 }
         };
-        long int days, rem, y, wday, yday;
+        int days, rem, y, wday, yday;
         const unsigned short int *ip;
 
-        days = time / SECS_PER_DAY;
-        rem = time % SECS_PER_DAY;
+        days = div_u64_rem(time, SECS_PER_DAY, &rem);
         rem += offset;
         while (rem < 0) {
                 rem += SECS_PER_DAY;
@@ -657,7 +665,7 @@ static void unmktime(unsigned long time, long offset,
 
 int mac_hwclk(int op, struct rtc_time *t)
 {
-        unsigned long now;
+        time64_t now;
 
         if (!op) { /* read */
                 switch (macintosh_config->adb_type) {
@@ -693,8 +701,8 @@ int mac_hwclk(int op, struct rtc_time *t)
                          __func__, t->tm_year + 1900, t->tm_mon + 1, t->tm_mday,
                          t->tm_hour, t->tm_min, t->tm_sec);
 
-                now = mktime(t->tm_year + 1900, t->tm_mon + 1, t->tm_mday,
-                             t->tm_hour, t->tm_min, t->tm_sec);
+                now = mktime64(t->tm_year + 1900, t->tm_mon + 1, t->tm_mday,
+                               t->tm_hour, t->tm_min, t->tm_sec);
 
                 switch (macintosh_config->adb_type) {
                 case MAC_ADB_IOP:
@@ -719,19 +727,3 @@ int mac_hwclk(int op, struct rtc_time *t)
         }
         return 0;
 }
-
-/*
- * Set minutes/seconds in the hardware clock
- */
-
-int mac_set_clock_mmss (unsigned long nowtime)
-{
-        struct rtc_time now;
-
-        mac_hwclk(0, &now);
-        now.tm_sec = nowtime % 60;
-        now.tm_min = (nowtime / 60) % 60;
-        mac_hwclk(1, &now);
-
-        return 0;
-}
diff --git a/arch/m68k/mm/init.c b/arch/m68k/mm/init.c
index 8827b7f91402..38e2b272c220 100644
--- a/arch/m68k/mm/init.c
+++ b/arch/m68k/mm/init.c
@@ -71,7 +71,6 @@ void __init m68k_setup_node(int node)
                 pg_data_table[i] = pg_data_map + node;
         }
 #endif
-        pg_data_map[node].bdata = bootmem_node_data + node;
         node_set_online(node);
 }
 
diff --git a/arch/m68k/mm/mcfmmu.c b/arch/m68k/mm/mcfmmu.c
index 2925d795d71a..70dde040779b 100644
--- a/arch/m68k/mm/mcfmmu.c
+++ b/arch/m68k/mm/mcfmmu.c
@@ -14,6 +14,7 @@
 #include <linux/init.h>
 #include <linux/string.h>
 #include <linux/bootmem.h>
+#include <linux/memblock.h>
 
 #include <asm/setup.h>
 #include <asm/page.h>
@@ -153,31 +154,31 @@ int cf_tlb_miss(struct pt_regs *regs, int write, int dtlb, int extension_word)
 
 void __init cf_bootmem_alloc(void)
 {
-        unsigned long start_pfn;
         unsigned long memstart;
 
         /* _rambase and _ramend will be naturally page aligned */
         m68k_memory[0].addr = _rambase;
         m68k_memory[0].size = _ramend - _rambase;
 
+        memblock_add(m68k_memory[0].addr, m68k_memory[0].size);
+
         /* compute total pages in system */
         num_pages = PFN_DOWN(_ramend - _rambase);
 
         /* page numbers */
         memstart = PAGE_ALIGN(_ramstart);
         min_low_pfn = PFN_DOWN(_rambase);
-        start_pfn = PFN_DOWN(memstart);
         max_pfn = max_low_pfn = PFN_DOWN(_ramend);
         high_memory = (void *)_ramend;
 
+        /* Reserve kernel text/data/bss */
+        memblock_reserve(memstart, memstart - _rambase);
+
         m68k_virt_to_node_shift = fls(_ramend - 1) - 6;
         module_fixup(NULL, __start_fixup, __stop_fixup);
 
-        /* setup bootmem data */
+        /* setup node data */
         m68k_setup_node(0);
-        memstart += init_bootmem_node(NODE_DATA(0), start_pfn,
-                min_low_pfn, max_low_pfn);
-        free_bootmem_node(NODE_DATA(0), memstart, _ramend - memstart);
 }
 
 /*
diff --git a/arch/m68k/mm/motorola.c b/arch/m68k/mm/motorola.c
index e490ecc7842c..4e17ecb5928a 100644
--- a/arch/m68k/mm/motorola.c
+++ b/arch/m68k/mm/motorola.c
@@ -19,6 +19,7 @@
 #include <linux/types.h>
 #include <linux/init.h>
 #include <linux/bootmem.h>
+#include <linux/memblock.h>
 #include <linux/gfp.h>
 
 #include <asm/setup.h>
@@ -208,7 +209,7 @@ void __init paging_init(void)
 {
         unsigned long zones_size[MAX_NR_ZONES] = { 0, };
         unsigned long min_addr, max_addr;
-        unsigned long addr, size, end;
+        unsigned long addr;
         int i;
 
 #ifdef DEBUG
@@ -253,34 +254,20 @@ void __init paging_init(void)
         min_low_pfn = availmem >> PAGE_SHIFT;
         max_pfn = max_low_pfn = max_addr >> PAGE_SHIFT;
 
-        for (i = 0; i < m68k_num_memory; i++) {
-                addr = m68k_memory[i].addr;
-                end = addr + m68k_memory[i].size;
-                m68k_setup_node(i);
-                availmem = PAGE_ALIGN(availmem);
-                availmem += init_bootmem_node(NODE_DATA(i),
-                                              availmem >> PAGE_SHIFT,
-                                              addr >> PAGE_SHIFT,
-                                              end >> PAGE_SHIFT);
-        }
+        /* Reserve kernel text/data/bss and the memory allocated in head.S */
+        memblock_reserve(m68k_memory[0].addr, availmem - m68k_memory[0].addr);
 
         /*
          * Map the physical memory available into the kernel virtual
-         * address space. First initialize the bootmem allocator with
-         * the memory we already mapped, so map_node() has something
-         * to allocate.
+         * address space. Make sure memblock will not try to allocate
+         * pages beyond the memory we already mapped in head.S
          */
-        addr = m68k_memory[0].addr;
-        size = m68k_memory[0].size;
-        free_bootmem_node(NODE_DATA(0), availmem,
-                          min(m68k_init_mapped_size, size) - (availmem - addr));
-        map_node(0);
-        if (size > m68k_init_mapped_size)
-                free_bootmem_node(NODE_DATA(0), addr + m68k_init_mapped_size,
-                                  size - m68k_init_mapped_size);
-
-        for (i = 1; i < m68k_num_memory; i++)
+        memblock_set_bottom_up(true);
+
+        for (i = 0; i < m68k_num_memory; i++) {
+                m68k_setup_node(i);
                 map_node(i);
+        }
 
         flush_tlb_all();
 
diff --git a/arch/m68k/mvme147/config.c b/arch/m68k/mvme147/config.c
index f8a710fd84cd..adea549d240e 100644
--- a/arch/m68k/mvme147/config.c
+++ b/arch/m68k/mvme147/config.c
@@ -40,7 +40,6 @@ static void mvme147_get_model(char *model);
 extern void mvme147_sched_init(irq_handler_t handler);
 extern u32 mvme147_gettimeoffset(void);
 extern int mvme147_hwclk (int, struct rtc_time *);
-extern int mvme147_set_clock_mmss (unsigned long);
 extern void mvme147_reset (void);
 
 
@@ -92,7 +91,6 @@ void __init config_mvme147(void)
         mach_init_IRQ           = mvme147_init_IRQ;
         arch_gettimeoffset      = mvme147_gettimeoffset;
         mach_hwclk              = mvme147_hwclk;
-        mach_set_clock_mmss     = mvme147_set_clock_mmss;
         mach_reset              = mvme147_reset;
         mach_get_model          = mvme147_get_model;
 
@@ -164,8 +162,3 @@ int mvme147_hwclk(int op, struct rtc_time *t)
         }
         return 0;
 }
-
-int mvme147_set_clock_mmss (unsigned long nowtime)
-{
-        return 0;
-}
diff --git a/arch/m68k/mvme16x/config.c b/arch/m68k/mvme16x/config.c
index 4ffd9ef98de4..6ee36a5b528d 100644
--- a/arch/m68k/mvme16x/config.c
+++ b/arch/m68k/mvme16x/config.c
@@ -46,7 +46,6 @@ static void mvme16x_get_model(char *model);
 extern void mvme16x_sched_init(irq_handler_t handler);
 extern u32 mvme16x_gettimeoffset(void);
 extern int mvme16x_hwclk (int, struct rtc_time *);
-extern int mvme16x_set_clock_mmss (unsigned long);
 extern void mvme16x_reset (void);
 
 int bcd2int (unsigned char b);
@@ -280,7 +279,6 @@ void __init config_mvme16x(void)
     mach_init_IRQ        = mvme16x_init_IRQ;
     arch_gettimeoffset   = mvme16x_gettimeoffset;
     mach_hwclk           = mvme16x_hwclk;
-    mach_set_clock_mmss  = mvme16x_set_clock_mmss;
     mach_reset           = mvme16x_reset;
     mach_get_model       = mvme16x_get_model;
     mach_get_hardware_list = mvme16x_get_hardware_list;
@@ -411,9 +409,3 @@ int mvme16x_hwclk(int op, struct rtc_time *t)
         }
         return 0;
 }
-
-int mvme16x_set_clock_mmss (unsigned long nowtime)
-{
-        return 0;
-}
-
diff --git a/arch/m68k/q40/config.c b/arch/m68k/q40/config.c
index 71c0867ecf20..96810d91da2b 100644
--- a/arch/m68k/q40/config.c
+++ b/arch/m68k/q40/config.c
@@ -43,7 +43,6 @@ extern void q40_sched_init(irq_handler_t handler);
 static u32 q40_gettimeoffset(void);
 static int q40_hwclk(int, struct rtc_time *);
 static unsigned int q40_get_ss(void);
-static int q40_set_clock_mmss(unsigned long);
 static int q40_get_rtc_pll(struct rtc_pll_info *pll);
 static int q40_set_rtc_pll(struct rtc_pll_info *pll);
 
@@ -175,7 +174,6 @@ void __init config_q40(void)
         mach_get_ss = q40_get_ss;
         mach_get_rtc_pll = q40_get_rtc_pll;
         mach_set_rtc_pll = q40_set_rtc_pll;
-        mach_set_clock_mmss = q40_set_clock_mmss;
 
         mach_reset = q40_reset;
         mach_get_model = q40_get_model;
@@ -267,34 +265,6 @@ static unsigned int q40_get_ss(void)
         return bcd2bin(Q40_RTC_SECS);
 }
 
-/*
- * Set the minutes and seconds from seconds value 'nowtime'.  Fail if
- * clock is out by > 30 minutes.  Logic lifted from atari code.
- */
-
-static int q40_set_clock_mmss(unsigned long nowtime)
-{
-        int retval = 0;
-        short real_seconds = nowtime % 60, real_minutes = (nowtime / 60) % 60;
-
-        int rtc_minutes;
-
-        rtc_minutes = bcd2bin(Q40_RTC_MINS);
-
-        if ((rtc_minutes < real_minutes ?
-             real_minutes - rtc_minutes :
-             rtc_minutes - real_minutes) < 30) {
-                Q40_RTC_CTRL |= Q40_RTC_WRITE;
-                Q40_RTC_MINS = bin2bcd(real_minutes);
-                Q40_RTC_SECS = bin2bcd(real_seconds);
-                Q40_RTC_CTRL &= ~(Q40_RTC_WRITE);
-        } else
-                retval = -1;
-
-        return retval;
-}
-
-
 /* get and set PLL calibration of RTC clock */
 #define Q40_RTC_PLL_MASK ((1<<5)-1)
 #define Q40_RTC_PLL_SIGN (1<<5)
diff --git a/arch/m68k/sun3/config.c b/arch/m68k/sun3/config.c
index 1d28d380e8cc..79a2bb857906 100644
--- a/arch/m68k/sun3/config.c
+++ b/arch/m68k/sun3/config.c
@@ -123,10 +123,6 @@ static void __init sun3_bootmem_alloc(unsigned long memory_start,
         availmem = memory_start;
 
         m68k_setup_node(0);
-        availmem += init_bootmem(start_page, num_pages);
-        availmem = (availmem + (PAGE_SIZE-1)) & PAGE_MASK;
-
-        free_bootmem(__pa(availmem), memory_end - (availmem));
 }
 
 
diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
index 0ab176bdb8e8..79be687de4ab 100644
--- a/arch/mips/include/asm/atomic.h
+++ b/arch/mips/include/asm/atomic.h
@@ -274,97 +274,12 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
 #define atomic_xchg(v, new) (xchg(&((v)->counter), (new)))
 
-/**
- * __atomic_add_unless - add unless the number is a given value
- * @v: pointer of type atomic_t
- * @a: the amount to add to v...
- * @u: ...unless v is equal to u.
- *
- * Atomically adds @a to @v, so long as it was not @u.
- * Returns the old value of @v.
- */
-static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
-{
-        int c, old;
-        c = atomic_read(v);
-        for (;;) {
-                if (unlikely(c == (u)))
-                        break;
-                old = atomic_cmpxchg((v), c, c + (a));
-                if (likely(old == c))
-                        break;
-                c = old;
-        }
-        return c;
-}
-
-#define atomic_dec_return(v) atomic_sub_return(1, (v))
-#define atomic_inc_return(v) atomic_add_return(1, (v))
-
-/*
- * atomic_sub_and_test - subtract value from variable and test result
- * @i: integer value to subtract
- * @v: pointer of type atomic_t
- *
- * Atomically subtracts @i from @v and returns
- * true if the result is zero, or false for all
- * other cases.
- */
-#define atomic_sub_and_test(i, v) (atomic_sub_return((i), (v)) == 0)
-
-/*
- * atomic_inc_and_test - increment and test
- * @v: pointer of type atomic_t
- *
- * Atomically increments @v by 1
- * and returns true if the result is zero, or false for all
- * other cases.
- */
-#define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
-
-/*
- * atomic_dec_and_test - decrement by 1 and test
- * @v: pointer of type atomic_t
- *
- * Atomically decrements @v by 1 and
- * returns true if the result is 0, or false for all other
- * cases.
- */
-#define atomic_dec_and_test(v) (atomic_sub_return(1, (v)) == 0)
-
 /*
  * atomic_dec_if_positive - decrement by 1 if old value positive
  * @v: pointer of type atomic_t
  */
 #define atomic_dec_if_positive(v)       atomic_sub_if_positive(1, v)
 
-/*
- * atomic_inc - increment atomic variable
- * @v: pointer of type atomic_t
- *
- * Atomically increments @v by 1.
- */
-#define atomic_inc(v) atomic_add(1, (v))
-
-/*
- * atomic_dec - decrement and test
- * @v: pointer of type atomic_t
- *
- * Atomically decrements @v by 1.
- */
-#define atomic_dec(v) atomic_sub(1, (v))
-
-/*
- * atomic_add_negative - add and test if negative
- * @v: pointer of type atomic_t
- * @i: integer value to add
- *
- * Atomically adds @i to @v and returns true
- * if the result is negative, or false when
- * result is greater than or equal to zero.
- */
-#define atomic_add_negative(i, v) (atomic_add_return(i, (v)) < 0)
-
 #ifdef CONFIG_64BIT
 
 #define ATOMIC64_INIT(i)    { (i) }
@@ -620,99 +535,12 @@ static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
         ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
 #define atomic64_xchg(v, new) (xchg(&((v)->counter), (new)))
 
-/**
- * atomic64_add_unless - add unless the number is a given value
- * @v: pointer of type atomic64_t
- * @a: the amount to add to v...
- * @u: ...unless v is equal to u.
- *
- * Atomically adds @a to @v, so long as it was not @u.
- * Returns true iff @v was not @u.
- */
-static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
-{
-        long c, old;
-        c = atomic64_read(v);
-        for (;;) {
-                if (unlikely(c == (u)))
-                        break;
-                old = atomic64_cmpxchg((v), c, c + (a));
-                if (likely(old == c))
-                        break;
-                c = old;
-        }
-        return c != (u);
-}
-
-#define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-
-#define atomic64_dec_return(v) atomic64_sub_return(1, (v))
-#define atomic64_inc_return(v) atomic64_add_return(1, (v))
-
-/*
- * atomic64_sub_and_test - subtract value from variable and test result
- * @i: integer value to subtract
- * @v: pointer of type atomic64_t
- *
- * Atomically subtracts @i from @v and returns
- * true if the result is zero, or false for all
- * other cases.
- */
-#define atomic64_sub_and_test(i, v) (atomic64_sub_return((i), (v)) == 0)
-
-/*
- * atomic64_inc_and_test - increment and test
- * @v: pointer of type atomic64_t
- *
- * Atomically increments @v by 1
- * and returns true if the result is zero, or false for all
- * other cases.
- */
-#define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
-
-/*
- * atomic64_dec_and_test - decrement by 1 and test
- * @v: pointer of type atomic64_t
- *
- * Atomically decrements @v by 1 and
- * returns true if the result is 0, or false for all other
- * cases.
- */
-#define atomic64_dec_and_test(v) (atomic64_sub_return(1, (v)) == 0)
-
 /*
  * atomic64_dec_if_positive - decrement by 1 if old value positive
  * @v: pointer of type atomic64_t
  */
 #define atomic64_dec_if_positive(v)     atomic64_sub_if_positive(1, v)
 
-/*
- * atomic64_inc - increment atomic variable
- * @v: pointer of type atomic64_t
- *
- * Atomically increments @v by 1.
- */
-#define atomic64_inc(v) atomic64_add(1, (v))
-
-/*
- * atomic64_dec - decrement and test
- * @v: pointer of type atomic64_t
- *
- * Atomically decrements @v by 1.
- */
-#define atomic64_dec(v) atomic64_sub(1, (v))
-
-/*
- * atomic64_add_negative - add and test if negative
- * @v: pointer of type atomic64_t
- * @i: integer value to add
- *
- * Atomically adds @i to @v and returns true
- * if the result is negative, or false when
- * result is greater than or equal to zero.
- */
-#define atomic64_add_negative(i, v) (atomic64_add_return(i, (v)) < 0)
-
 #endif /* CONFIG_64BIT */
 
 #endif /* _ASM_ATOMIC_H */
diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
index 7cd76f93a438..f7ea8e21656b 100644
--- a/arch/mips/kvm/mips.c
+++ b/arch/mips/kvm/mips.c
@@ -515,7 +515,7 @@ int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
         dvcpu->arch.wait = 0;
 
         if (swq_has_sleeper(&dvcpu->wq))
-                swake_up(&dvcpu->wq);
+                swake_up_one(&dvcpu->wq);
 
         return 0;
 }
@@ -1204,7 +1204,7 @@ static void kvm_mips_comparecount_func(unsigned long data)
 
         vcpu->arch.wait = 0;
         if (swq_has_sleeper(&vcpu->wq))
-                swake_up(&vcpu->wq);
+                swake_up_one(&vcpu->wq);
 }
 
 /* low level hrtimer wake routine */
diff --git a/arch/openrisc/Kconfig b/arch/openrisc/Kconfig
index 9ecad05bfc73..dfb6a79ba7ff 100644
--- a/arch/openrisc/Kconfig
+++ b/arch/openrisc/Kconfig
@@ -27,7 +27,6 @@ config OPENRISC
         select GENERIC_STRNLEN_USER
         select GENERIC_SMP_IDLE_THREAD
         select MODULES_USE_ELF_RELA
-        select MULTI_IRQ_HANDLER
         select HAVE_DEBUG_STACKOVERFLOW
         select OR1K_PIC
         select CPU_NO_EFFICIENT_FFS if !OPENRISC_HAVE_INST_FF1
@@ -36,6 +35,7 @@ config OPENRISC
         select ARCH_USE_QUEUED_RWLOCKS
         select OMPIC if SMP
         select ARCH_WANT_FRAME_POINTERS
+        select GENERIC_IRQ_MULTI_HANDLER
 
 config CPU_BIG_ENDIAN
         def_bool y
@@ -69,9 +69,6 @@ config STACKTRACE_SUPPORT
 config LOCKDEP_SUPPORT
         def_bool  y
 
-config MULTI_IRQ_HANDLER
-        def_bool y
-
 source "init/Kconfig"
 
 source "kernel/Kconfig.freezer"
diff --git a/arch/openrisc/include/asm/atomic.h b/arch/openrisc/include/asm/atomic.h
index 146e1660f00e..b589fac39b92 100644
--- a/arch/openrisc/include/asm/atomic.h
+++ b/arch/openrisc/include/asm/atomic.h
@@ -100,7 +100,7 @@ ATOMIC_OP(xor)
  *
  * This is often used through atomic_inc_not_zero()
  */
-static inline int __atomic_add_unless(atomic_t *v, int a, int u)
+static inline int atomic_fetch_add_unless(atomic_t *v, int a, int u)
 {
         int old, tmp;
 
@@ -119,7 +119,7 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
 
         return old;
 }
-#define __atomic_add_unless     __atomic_add_unless
+#define atomic_fetch_add_unless atomic_fetch_add_unless
 
 #include <asm-generic/atomic.h>
 
diff --git a/arch/openrisc/include/asm/cmpxchg.h b/arch/openrisc/include/asm/cmpxchg.h
index d29f7db53906..f9cd43a39d72 100644
--- a/arch/openrisc/include/asm/cmpxchg.h
+++ b/arch/openrisc/include/asm/cmpxchg.h
@@ -16,8 +16,9 @@
 #ifndef __ASM_OPENRISC_CMPXCHG_H
 #define __ASM_OPENRISC_CMPXCHG_H
 
+#include  <linux/bits.h>
+#include  <linux/compiler.h>
 #include  <linux/types.h>
-#include  <linux/bitops.h>
 
 #define __HAVE_ARCH_CMPXCHG 1
 
diff --git a/arch/openrisc/include/asm/irq.h b/arch/openrisc/include/asm/irq.h
index d9eee0a2b7b4..eb612b1865d2 100644
--- a/arch/openrisc/include/asm/irq.h
+++ b/arch/openrisc/include/asm/irq.h
@@ -24,6 +24,4 @@
 
 #define NO_IRQ          (-1)
 
-extern void set_handle_irq(void (*handle_irq)(struct pt_regs *));
-
 #endif /* __ASM_OPENRISC_IRQ_H__ */
diff --git a/arch/openrisc/kernel/irq.c b/arch/openrisc/kernel/irq.c
index 35e478a93116..5f9445effaf8 100644
--- a/arch/openrisc/kernel/irq.c
+++ b/arch/openrisc/kernel/irq.c
@@ -41,13 +41,6 @@ void __init init_IRQ(void)
         irqchip_init();
 }
 
-static void (*handle_arch_irq)(struct pt_regs *);
-
-void __init set_handle_irq(void (*handle_irq)(struct pt_regs *))
-{
-        handle_arch_irq = handle_irq;
-}
-
 void __irq_entry do_IRQ(struct pt_regs *regs)
 {
         handle_arch_irq(regs);
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index 17526bebcbd2..e7705dde953f 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -11,7 +11,6 @@ config PARISC
         select ARCH_HAS_ELF_RANDOMIZE
         select ARCH_HAS_STRICT_KERNEL_RWX
         select ARCH_HAS_UBSAN_SANITIZE_ALL
-        select ARCH_WANTS_UBSAN_NO_NULL
         select ARCH_SUPPORTS_MEMORY_FAILURE
         select RTC_CLASS
         select RTC_DRV_GENERIC
@@ -195,7 +194,7 @@ config PREFETCH
 
 config MLONGCALLS
         bool "Enable the -mlong-calls compiler option for big kernels"
-        def_bool y if (!MODULES)
+        default y
         depends on PA8X00
         help
           If you configure the kernel to include many drivers built-in instead
diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h
index 88bae6676c9b..118953d41763 100644
--- a/arch/parisc/include/asm/atomic.h
+++ b/arch/parisc/include/asm/atomic.h
@@ -77,30 +77,6 @@ static __inline__ int atomic_read(const atomic_t *v)
 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
 
-/**
- * __atomic_add_unless - add unless the number is a given value
- * @v: pointer of type atomic_t
- * @a: the amount to add to v...
- * @u: ...unless v is equal to u.
- *
- * Atomically adds @a to @v, so long as it was not @u.
- * Returns the old value of @v.
- */
-static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
-{
-        int c, old;
-        c = atomic_read(v);
-        for (;;) {
-                if (unlikely(c == (u)))
-                        break;
-                old = atomic_cmpxchg((v), c, c + (a));
-                if (likely(old == c))
-                        break;
-                c = old;
-        }
-        return c;
-}
-
 #define ATOMIC_OP(op, c_op)                                             \
 static __inline__ void atomic_##op(int i, atomic_t *v)                  \
 {                                                                       \
@@ -160,28 +136,6 @@ ATOMIC_OPS(xor, ^=)
 #undef ATOMIC_OP_RETURN
 #undef ATOMIC_OP
 
-#define atomic_inc(v)   (atomic_add(   1,(v)))
-#define atomic_dec(v)   (atomic_add(  -1,(v)))
-
-#define atomic_inc_return(v)    (atomic_add_return(   1,(v)))
-#define atomic_dec_return(v)    (atomic_add_return(  -1,(v)))
-
-#define atomic_add_negative(a, v)       (atomic_add_return((a), (v)) < 0)
-
-/*
- * atomic_inc_and_test - increment and test
- * @v: pointer of type atomic_t
- *
- * Atomically increments @v by 1
- * and returns true if the result is zero, or false for all
- * other cases.
- */
-#define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
-
-#define atomic_dec_and_test(v)  (atomic_dec_return(v) == 0)
-
-#define atomic_sub_and_test(i,v)        (atomic_sub_return((i),(v)) == 0)
-
 #define ATOMIC_INIT(i)  { (i) }
 
 #ifdef CONFIG_64BIT
@@ -264,72 +218,11 @@ atomic64_read(const atomic64_t *v)
         return READ_ONCE((v)->counter);
 }
 
-#define atomic64_inc(v)         (atomic64_add(   1,(v)))
-#define atomic64_dec(v)         (atomic64_add(  -1,(v)))
-
-#define atomic64_inc_return(v)          (atomic64_add_return(   1,(v)))
-#define atomic64_dec_return(v)          (atomic64_add_return(  -1,(v)))
-
-#define atomic64_add_negative(a, v)     (atomic64_add_return((a), (v)) < 0)
-
-#define atomic64_inc_and_test(v)        (atomic64_inc_return(v) == 0)
-#define atomic64_dec_and_test(v)        (atomic64_dec_return(v) == 0)
-#define atomic64_sub_and_test(i,v)      (atomic64_sub_return((i),(v)) == 0)
-
 /* exported interface */
 #define atomic64_cmpxchg(v, o, n) \
         ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
 #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
 
-/**
- * atomic64_add_unless - add unless the number is a given value
- * @v: pointer of type atomic64_t
- * @a: the amount to add to v...
- * @u: ...unless v is equal to u.
- *
- * Atomically adds @a to @v, so long as it was not @u.
- * Returns the old value of @v.
- */
-static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
-{
-        long c, old;
-        c = atomic64_read(v);
-        for (;;) {
-                if (unlikely(c == (u)))
-                        break;
-                old = atomic64_cmpxchg((v), c, c + (a));
-                if (likely(old == c))
-                        break;
-                c = old;
-        }
-        return c != (u);
-}
-
-#define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-
-/*
- * atomic64_dec_if_positive - decrement by 1 if old value positive
- * @v: pointer of type atomic_t
- *
- * The function returns the old value of *v minus 1, even if
- * the atomic variable, v, was not decremented.
- */
-static inline long atomic64_dec_if_positive(atomic64_t *v)
-{
-        long c, old, dec;
-        c = atomic64_read(v);
-        for (;;) {
-                dec = c - 1;
-                if (unlikely(dec < 0))
-                        break;
-                old = atomic64_cmpxchg((v), c, dec);
-                if (likely(old == c))
-                        break;
-                c = old;
-        }
-        return dec;
-}
-
 #endif /* !CONFIG_64BIT */
 
 
diff --git a/arch/parisc/include/asm/barrier.h b/arch/parisc/include/asm/barrier.h
new file mode 100644
index 000000000000..dbaaca84f27f
--- /dev/null
+++ b/arch/parisc/include/asm/barrier.h
@@ -0,0 +1,32 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef __ASM_BARRIER_H
+#define __ASM_BARRIER_H
+
+#ifndef __ASSEMBLY__
+
+/* The synchronize caches instruction executes as a nop on systems in
+   which all memory references are performed in order. */
+#define synchronize_caches() __asm__ __volatile__ ("sync" : : : "memory")
+
+#if defined(CONFIG_SMP)
+#define mb()            do { synchronize_caches(); } while (0)
+#define rmb()           mb()
+#define wmb()           mb()
+#define dma_rmb()       mb()
+#define dma_wmb()       mb()
+#else
+#define mb()            barrier()
+#define rmb()           barrier()
+#define wmb()           barrier()
+#define dma_rmb()       barrier()
+#define dma_wmb()       barrier()
+#endif
+
+#define __smp_mb()      mb()
+#define __smp_rmb()     mb()
+#define __smp_wmb()     mb()
+
+#include <asm-generic/barrier.h>
+
+#endif /* !__ASSEMBLY__ */
+#endif /* __ASM_BARRIER_H */
diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
index e95207c0565e..1b4732e20137 100644
--- a/arch/parisc/kernel/entry.S
+++ b/arch/parisc/kernel/entry.S
@@ -482,6 +482,8 @@
         .macro          tlb_unlock0     spc,tmp
 #ifdef CONFIG_SMP
         or,COND(=)      %r0,\spc,%r0
+        sync
+        or,COND(=)      %r0,\spc,%r0
         stw             \spc,0(\tmp)
 #endif
         .endm
diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S
index 22e6374ece44..97451e67d35b 100644
--- a/arch/parisc/kernel/pacache.S
+++ b/arch/parisc/kernel/pacache.S
@@ -353,6 +353,7 @@ ENDPROC_CFI(flush_data_cache_local)
         .macro  tlb_unlock      la,flags,tmp
 #ifdef CONFIG_SMP
         ldi             1,\tmp
+        sync
         stw             \tmp,0(\la)
         mtsm            \flags
 #endif
diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
index e775f80ae28c..4886a6db42e9 100644
--- a/arch/parisc/kernel/syscall.S
+++ b/arch/parisc/kernel/syscall.S
@@ -633,6 +633,7 @@ cas_action:
         sub,<>  %r28, %r25, %r0
 2:      stw,ma  %r24, 0(%r26)
         /* Free lock */
+        sync
         stw,ma  %r20, 0(%sr2,%r20)
 #if ENABLE_LWS_DEBUG
         /* Clear thread register indicator */
@@ -647,6 +648,7 @@ cas_action:
 3:              
         /* Error occurred on load or store */
         /* Free lock */
+        sync
         stw     %r20, 0(%sr2,%r20)
 #if ENABLE_LWS_DEBUG
         stw     %r0, 4(%sr2,%r20)
@@ -848,6 +850,7 @@ cas2_action:
 
 cas2_end:
         /* Free lock */
+        sync
         stw,ma  %r20, 0(%sr2,%r20)
         /* Enable interrupts */
         ssm     PSW_SM_I, %r0
@@ -858,6 +861,7 @@ cas2_end:
 22:
         /* Error occurred on load or store */
         /* Free lock */
+        sync
         stw     %r20, 0(%sr2,%r20)
         ssm     PSW_SM_I, %r0
         ldo     1(%r0),%r28
diff --git a/arch/powerpc/include/asm/atomic.h b/arch/powerpc/include/asm/atomic.h
index 682b3e6a1e21..963abf8bf1c0 100644
--- a/arch/powerpc/include/asm/atomic.h
+++ b/arch/powerpc/include/asm/atomic.h
@@ -18,18 +18,11 @@
  * a "bne-" instruction at the end, so an isync is enough as a acquire barrier
  * on the platform without lwsync.
  */
-#define __atomic_op_acquire(op, args...)                                \
-({                                                                      \
-        typeof(op##_relaxed(args)) __ret  = op##_relaxed(args);         \
-        __asm__ __volatile__(PPC_ACQUIRE_BARRIER "" : : : "memory");    \
-        __ret;                                                          \
-})
-
-#define __atomic_op_release(op, args...)                                \
-({                                                                      \
-        __asm__ __volatile__(PPC_RELEASE_BARRIER "" : : : "memory");    \
-        op##_relaxed(args);                                             \
-})
+#define __atomic_acquire_fence()                                        \
+        __asm__ __volatile__(PPC_ACQUIRE_BARRIER "" : : : "memory")
+
+#define __atomic_release_fence()                                        \
+        __asm__ __volatile__(PPC_RELEASE_BARRIER "" : : : "memory")
 
 static __inline__ int atomic_read(const atomic_t *v)
 {
@@ -129,8 +122,6 @@ ATOMIC_OPS(xor, xor)
 #undef ATOMIC_OP_RETURN_RELAXED
 #undef ATOMIC_OP
 
-#define atomic_add_negative(a, v)       (atomic_add_return((a), (v)) < 0)
-
 static __inline__ void atomic_inc(atomic_t *v)
 {
         int t;
@@ -145,6 +136,7 @@ static __inline__ void atomic_inc(atomic_t *v)
         : "r" (&v->counter)
         : "cc", "xer");
 }
+#define atomic_inc atomic_inc
 
 static __inline__ int atomic_inc_return_relaxed(atomic_t *v)
 {
@@ -163,16 +155,6 @@ static __inline__ int atomic_inc_return_relaxed(atomic_t *v)
         return t;
 }
 
-/*
- * atomic_inc_and_test - increment and test
- * @v: pointer of type atomic_t
- *
- * Atomically increments @v by 1
- * and returns true if the result is zero, or false for all
- * other cases.
- */
-#define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
-
 static __inline__ void atomic_dec(atomic_t *v)
 {
         int t;
@@ -187,6 +169,7 @@ static __inline__ void atomic_dec(atomic_t *v)
         : "r" (&v->counter)
         : "cc", "xer");
 }
+#define atomic_dec atomic_dec
 
 static __inline__ int atomic_dec_return_relaxed(atomic_t *v)
 {
@@ -218,7 +201,7 @@ static __inline__ int atomic_dec_return_relaxed(atomic_t *v)
 #define atomic_xchg_relaxed(v, new) xchg_relaxed(&((v)->counter), (new))
 
 /**
- * __atomic_add_unless - add unless the number is a given value
+ * atomic_fetch_add_unless - add unless the number is a given value
  * @v: pointer of type atomic_t
  * @a: the amount to add to v...
  * @u: ...unless v is equal to u.
@@ -226,13 +209,13 @@ static __inline__ int atomic_dec_return_relaxed(atomic_t *v)
  * Atomically adds @a to @v, so long as it was not @u.
  * Returns the old value of @v.
  */
-static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
+static __inline__ int atomic_fetch_add_unless(atomic_t *v, int a, int u)
 {
         int t;
 
         __asm__ __volatile__ (
         PPC_ATOMIC_ENTRY_BARRIER
-"1:     lwarx   %0,0,%1         # __atomic_add_unless\n\
+"1:     lwarx   %0,0,%1         # atomic_fetch_add_unless\n\
         cmpw    0,%0,%3 \n\
         beq     2f \n\
         add     %0,%2,%0 \n"
@@ -248,6 +231,7 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
 
         return t;
 }
+#define atomic_fetch_add_unless atomic_fetch_add_unless
 
 /**
  * atomic_inc_not_zero - increment unless the number is zero
@@ -280,9 +264,6 @@ static __inline__ int atomic_inc_not_zero(atomic_t *v)
 }
 #define atomic_inc_not_zero(v) atomic_inc_not_zero((v))
 
-#define atomic_sub_and_test(a, v)       (atomic_sub_return((a), (v)) == 0)
-#define atomic_dec_and_test(v)          (atomic_dec_return((v)) == 0)
-
 /*
  * Atomically test *v and decrement if it is greater than 0.
  * The function returns the old value of *v minus 1, even if
@@ -412,8 +393,6 @@ ATOMIC64_OPS(xor, xor)
 #undef ATOMIC64_OP_RETURN_RELAXED
 #undef ATOMIC64_OP
 
-#define atomic64_add_negative(a, v)     (atomic64_add_return((a), (v)) < 0)
-
 static __inline__ void atomic64_inc(atomic64_t *v)
 {
         long t;
@@ -427,6 +406,7 @@ static __inline__ void atomic64_inc(atomic64_t *v)
         : "r" (&v->counter)
         : "cc", "xer");
 }
+#define atomic64_inc atomic64_inc
 
 static __inline__ long atomic64_inc_return_relaxed(atomic64_t *v)
 {
@@ -444,16 +424,6 @@ static __inline__ long atomic64_inc_return_relaxed(atomic64_t *v)
         return t;
 }
 
-/*
- * atomic64_inc_and_test - increment and test
- * @v: pointer of type atomic64_t
- *
- * Atomically increments @v by 1
- * and returns true if the result is zero, or false for all
- * other cases.
- */
-#define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
-
 static __inline__ void atomic64_dec(atomic64_t *v)
 {
         long t;
@@ -467,6 +437,7 @@ static __inline__ void atomic64_dec(atomic64_t *v)
         : "r" (&v->counter)
         : "cc", "xer");
 }
+#define atomic64_dec atomic64_dec
 
 static __inline__ long atomic64_dec_return_relaxed(atomic64_t *v)
 {
@@ -487,9 +458,6 @@ static __inline__ long atomic64_dec_return_relaxed(atomic64_t *v)
 #define atomic64_inc_return_relaxed atomic64_inc_return_relaxed
 #define atomic64_dec_return_relaxed atomic64_dec_return_relaxed
 
-#define atomic64_sub_and_test(a, v)     (atomic64_sub_return((a), (v)) == 0)
-#define atomic64_dec_and_test(v)        (atomic64_dec_return((v)) == 0)
-
 /*
  * Atomically test *v and decrement if it is greater than 0.
  * The function returns the old value of *v minus 1.
@@ -513,6 +481,7 @@ static __inline__ long atomic64_dec_if_positive(atomic64_t *v)
 
         return t;
 }
+#define atomic64_dec_if_positive atomic64_dec_if_positive
 
 #define atomic64_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
 #define atomic64_cmpxchg_relaxed(v, o, n) \
@@ -524,7 +493,7 @@ static __inline__ long atomic64_dec_if_positive(atomic64_t *v)
 #define atomic64_xchg_relaxed(v, new) xchg_relaxed(&((v)->counter), (new))
 
 /**
- * atomic64_add_unless - add unless the number is a given value
+ * atomic64_fetch_add_unless - add unless the number is a given value
  * @v: pointer of type atomic64_t
  * @a: the amount to add to v...
  * @u: ...unless v is equal to u.
@@ -532,13 +501,13 @@ static __inline__ long atomic64_dec_if_positive(atomic64_t *v)
  * Atomically adds @a to @v, so long as it was not @u.
  * Returns the old value of @v.
  */
-static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
+static __inline__ long atomic64_fetch_add_unless(atomic64_t *v, long a, long u)
 {
         long t;
 
         __asm__ __volatile__ (
         PPC_ATOMIC_ENTRY_BARRIER
-"1:     ldarx   %0,0,%1         # __atomic_add_unless\n\
+"1:     ldarx   %0,0,%1         # atomic64_fetch_add_unless\n\
         cmpd    0,%0,%3 \n\
         beq     2f \n\
         add     %0,%2,%0 \n"
@@ -551,8 +520,9 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
         : "r" (&v->counter), "r" (a), "r" (u)
         : "cc", "memory");
 
-        return t != u;
+        return t;
 }
+#define atomic64_fetch_add_unless atomic64_fetch_add_unless
 
 /**
  * atomic_inc64_not_zero - increment unless the number is zero
@@ -582,6 +552,7 @@ static __inline__ int atomic64_inc_not_zero(atomic64_t *v)
 
         return t1 != 0;
 }
+#define atomic64_inc_not_zero(v) atomic64_inc_not_zero((v))
 
 #endif /* __powerpc64__ */
 
diff --git a/arch/powerpc/include/asm/mmu_context.h b/arch/powerpc/include/asm/mmu_context.h
index 79d570cbf332..b2f89b621b15 100644
--- a/arch/powerpc/include/asm/mmu_context.h
+++ b/arch/powerpc/include/asm/mmu_context.h
@@ -143,24 +143,33 @@ static inline void mm_context_remove_copro(struct mm_struct *mm)
 {
         int c;
 
-        c = atomic_dec_if_positive(&mm->context.copros);
-
-        /* Detect imbalance between add and remove */
-        WARN_ON(c < 0);
-
         /*
-         * Need to broadcast a global flush of the full mm before
-         * decrementing active_cpus count, as the next TLBI may be
-         * local and the nMMU and/or PSL need to be cleaned up.
-         * Should be rare enough so that it's acceptable.
+         * When removing the last copro, we need to broadcast a global
+         * flush of the full mm, as the next TLBI may be local and the
+         * nMMU and/or PSL need to be cleaned up.
+         *
+         * Both the 'copros' and 'active_cpus' counts are looked at in
+         * flush_all_mm() to determine the scope (local/global) of the
+         * TLBIs, so we need to flush first before decrementing
+         * 'copros'. If this API is used by several callers for the
+         * same context, it can lead to over-flushing. It's hopefully
+         * not common enough to be a problem.
          *
          * Skip on hash, as we don't know how to do the proper flush
          * for the time being. Invalidations will remain global if
-         * used on hash.
+         * used on hash. Note that we can't drop 'copros' either, as
+         * it could make some invalidations local with no flush
+         * in-between.
          */
-        if (c == 0 && radix_enabled()) {
+        if (radix_enabled()) {
                 flush_all_mm(mm);
-                dec_mm_active_cpus(mm);
+
+                c = atomic_dec_if_positive(&mm->context.copros);
+                /* Detect imbalance between add and remove */
+                WARN_ON(c < 0);
+
+                if (c == 0)
+                        dec_mm_active_cpus(mm);
         }
 }
 #else
diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
index fe9733ffffaa..471aac313b89 100644
--- a/arch/powerpc/kernel/pci-common.c
+++ b/arch/powerpc/kernel/pci-common.c
@@ -42,6 +42,8 @@
 #include <asm/ppc-pci.h>
 #include <asm/eeh.h>
 
+#include "../../../drivers/pci/pci.h"
+
 /* hose_spinlock protects accesses to the the phb_bitmap. */
 static DEFINE_SPINLOCK(hose_spinlock);
 LIST_HEAD(hose_list);
@@ -1014,7 +1016,7 @@ void pcibios_setup_bus_devices(struct pci_bus *bus)
                 /* Cardbus can call us to add new devices to a bus, so ignore
                  * those who are already fully discovered
                  */
-                if (dev->is_added)
+                if (pci_dev_is_added(dev))
                         continue;
 
                 pcibios_setup_device(dev);
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index de686b340f4a..ee4a8854985e 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -216,7 +216,7 @@ static void kvmppc_fast_vcpu_kick_hv(struct kvm_vcpu *vcpu)
 
         wqp = kvm_arch_vcpu_wq(vcpu);
         if (swq_has_sleeper(wqp)) {
-                swake_up(wqp);
+                swake_up_one(wqp);
                 ++vcpu->stat.halt_wakeup;
         }
 
@@ -3188,7 +3188,7 @@ static void kvmppc_vcore_blocked(struct kvmppc_vcore *vc)
                 }
         }
 
-        prepare_to_swait(&vc->wq, &wait, TASK_INTERRUPTIBLE);
+        prepare_to_swait_exclusive(&vc->wq, &wait, TASK_INTERRUPTIBLE);
 
         if (kvmppc_vcore_check_block(vc)) {
                 finish_swait(&vc->wq, &wait);
@@ -3311,7 +3311,7 @@ static int kvmppc_run_vcpu(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
                         kvmppc_start_thread(vcpu, vc);
                         trace_kvm_guest_enter(vcpu);
                 } else if (vc->vcore_state == VCORE_SLEEPING) {
-                        swake_up(&vc->wq);
+                        swake_up_one(&vc->wq);
                 }
 
         }
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index 5bd0eb6681bc..70b2e1e0f23c 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -46,6 +46,7 @@
 
 #include "powernv.h"
 #include "pci.h"
+#include "../../../../drivers/pci/pci.h"
 
 #define PNV_IODA1_M64_NUM       16      /* Number of M64 BARs   */
 #define PNV_IODA1_M64_SEGS      8       /* Segments per M64 BAR */
@@ -3138,7 +3139,7 @@ static void pnv_pci_ioda_fixup_iov_resources(struct pci_dev *pdev)
         struct pci_dn *pdn;
         int mul, total_vfs;
 
-        if (!pdev->is_physfn || pdev->is_added)
+        if (!pdev->is_physfn || pci_dev_is_added(pdev))
                 return;
 
         pdn = pci_get_pdn(pdev);
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index 139f0af6c3d9..8a4868a3964b 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -71,6 +71,7 @@
 #include <asm/security_features.h>
 
 #include "pseries.h"
+#include "../../../../drivers/pci/pci.h"
 
 int CMO_PrPSP = -1;
 int CMO_SecPSP = -1;
@@ -664,7 +665,7 @@ static void pseries_pci_fixup_iov_resources(struct pci_dev *pdev)
         const int *indexes;
         struct device_node *dn = pci_device_to_OF_node(pdev);
 
-        if (!pdev->is_physfn || pdev->is_added)
+        if (!pdev->is_physfn || pci_dev_is_added(pdev))
                 return;
         /*Firmware must support open sriov otherwise dont configure*/
         indexes = of_get_property(dn, "ibm,open-sriov-vf-bar-info", NULL);
diff --git a/arch/riscv/include/asm/atomic.h b/arch/riscv/include/asm/atomic.h
index 855115ace98c..c452359c9cb8 100644
--- a/arch/riscv/include/asm/atomic.h
+++ b/arch/riscv/include/asm/atomic.h
@@ -25,18 +25,11 @@
 
 #define ATOMIC_INIT(i)  { (i) }
 
-#define __atomic_op_acquire(op, args...)                                \
-({                                                                      \
-        typeof(op##_relaxed(args)) __ret  = op##_relaxed(args);         \
-        __asm__ __volatile__(RISCV_ACQUIRE_BARRIER "" ::: "memory");    \
-        __ret;                                                          \
-})
-
-#define __atomic_op_release(op, args...)                                \
-({                                                                      \
-        __asm__ __volatile__(RISCV_RELEASE_BARRIER "" ::: "memory");    \
-        op##_relaxed(args);                                             \
-})
+#define __atomic_acquire_fence()                                        \
+        __asm__ __volatile__(RISCV_ACQUIRE_BARRIER "" ::: "memory")
+
+#define __atomic_release_fence()                                        \
+        __asm__ __volatile__(RISCV_RELEASE_BARRIER "" ::: "memory");
 
 static __always_inline int atomic_read(const atomic_t *v)
 {
@@ -209,130 +202,8 @@ ATOMIC_OPS(xor, xor, i)
 #undef ATOMIC_FETCH_OP
 #undef ATOMIC_OP_RETURN
 
-/*
- * The extra atomic operations that are constructed from one of the core
- * AMO-based operations above (aside from sub, which is easier to fit above).
- * These are required to perform a full barrier, but they're OK this way
- * because atomic_*_return is also required to perform a full barrier.
- *
- */
-#define ATOMIC_OP(op, func_op, comp_op, I, c_type, prefix)              \
-static __always_inline                                                  \
-bool atomic##prefix##_##op(c_type i, atomic##prefix##_t *v)             \
-{                                                                       \
-        return atomic##prefix##_##func_op##_return(i, v) comp_op I;     \
-}
-
-#ifdef CONFIG_GENERIC_ATOMIC64
-#define ATOMIC_OPS(op, func_op, comp_op, I)                             \
-        ATOMIC_OP(op, func_op, comp_op, I,  int,   )
-#else
-#define ATOMIC_OPS(op, func_op, comp_op, I)                             \
-        ATOMIC_OP(op, func_op, comp_op, I,  int,   )                    \
-        ATOMIC_OP(op, func_op, comp_op, I, long, 64)
-#endif
-
-ATOMIC_OPS(add_and_test, add, ==, 0)
-ATOMIC_OPS(sub_and_test, sub, ==, 0)
-ATOMIC_OPS(add_negative, add,  <, 0)
-
-#undef ATOMIC_OP
-#undef ATOMIC_OPS
-
-#define ATOMIC_OP(op, func_op, I, c_type, prefix)                       \
-static __always_inline                                                  \
-void atomic##prefix##_##op(atomic##prefix##_t *v)                       \
-{                                                                       \
-        atomic##prefix##_##func_op(I, v);                               \
-}
-
-#define ATOMIC_FETCH_OP(op, func_op, I, c_type, prefix)                 \
-static __always_inline                                                  \
-c_type atomic##prefix##_fetch_##op##_relaxed(atomic##prefix##_t *v)     \
-{                                                                       \
-        return atomic##prefix##_fetch_##func_op##_relaxed(I, v);        \
-}                                                                       \
-static __always_inline                                                  \
-c_type atomic##prefix##_fetch_##op(atomic##prefix##_t *v)               \
-{                                                                       \
-        return atomic##prefix##_fetch_##func_op(I, v);                  \
-}
-
-#define ATOMIC_OP_RETURN(op, asm_op, c_op, I, c_type, prefix)           \
-static __always_inline                                                  \
-c_type atomic##prefix##_##op##_return_relaxed(atomic##prefix##_t *v)    \
-{                                                                       \
-        return atomic##prefix##_fetch_##op##_relaxed(v) c_op I;         \
-}                                                                       \
-static __always_inline                                                  \
-c_type atomic##prefix##_##op##_return(atomic##prefix##_t *v)            \
-{                                                                       \
-        return atomic##prefix##_fetch_##op(v) c_op I;                   \
-}
-
-#ifdef CONFIG_GENERIC_ATOMIC64
-#define ATOMIC_OPS(op, asm_op, c_op, I)                                 \
-        ATOMIC_OP(       op, asm_op,       I,  int,   )                 \
-        ATOMIC_FETCH_OP( op, asm_op,       I,  int,   )                 \
-        ATOMIC_OP_RETURN(op, asm_op, c_op, I,  int,   )
-#else
-#define ATOMIC_OPS(op, asm_op, c_op, I)                                 \
-        ATOMIC_OP(       op, asm_op,       I,  int,   )                 \
-        ATOMIC_FETCH_OP( op, asm_op,       I,  int,   )                 \
-        ATOMIC_OP_RETURN(op, asm_op, c_op, I,  int,   )                 \
-        ATOMIC_OP(       op, asm_op,       I, long, 64)                 \
-        ATOMIC_FETCH_OP( op, asm_op,       I, long, 64)                 \
-        ATOMIC_OP_RETURN(op, asm_op, c_op, I, long, 64)
-#endif
-
-ATOMIC_OPS(inc, add, +,  1)
-ATOMIC_OPS(dec, add, +, -1)
-
-#define atomic_inc_return_relaxed       atomic_inc_return_relaxed
-#define atomic_dec_return_relaxed       atomic_dec_return_relaxed
-#define atomic_inc_return               atomic_inc_return
-#define atomic_dec_return               atomic_dec_return
-
-#define atomic_fetch_inc_relaxed        atomic_fetch_inc_relaxed
-#define atomic_fetch_dec_relaxed        atomic_fetch_dec_relaxed
-#define atomic_fetch_inc                atomic_fetch_inc
-#define atomic_fetch_dec                atomic_fetch_dec
-
-#ifndef CONFIG_GENERIC_ATOMIC64
-#define atomic64_inc_return_relaxed     atomic64_inc_return_relaxed
-#define atomic64_dec_return_relaxed     atomic64_dec_return_relaxed
-#define atomic64_inc_return             atomic64_inc_return
-#define atomic64_dec_return             atomic64_dec_return
-
-#define atomic64_fetch_inc_relaxed      atomic64_fetch_inc_relaxed
-#define atomic64_fetch_dec_relaxed      atomic64_fetch_dec_relaxed
-#define atomic64_fetch_inc              atomic64_fetch_inc
-#define atomic64_fetch_dec              atomic64_fetch_dec
-#endif
-
-#undef ATOMIC_OPS
-#undef ATOMIC_OP
-#undef ATOMIC_FETCH_OP
-#undef ATOMIC_OP_RETURN
-
-#define ATOMIC_OP(op, func_op, comp_op, I, prefix)                      \
-static __always_inline                                                  \
-bool atomic##prefix##_##op(atomic##prefix##_t *v)                       \
-{                                                                       \
-        return atomic##prefix##_##func_op##_return(v) comp_op I;        \
-}
-
-ATOMIC_OP(inc_and_test, inc, ==, 0,   )
-ATOMIC_OP(dec_and_test, dec, ==, 0,   )
-#ifndef CONFIG_GENERIC_ATOMIC64
-ATOMIC_OP(inc_and_test, inc, ==, 0, 64)
-ATOMIC_OP(dec_and_test, dec, ==, 0, 64)
-#endif
-
-#undef ATOMIC_OP
-
 /* This is required to provide a full barrier on success. */
-static __always_inline int __atomic_add_unless(atomic_t *v, int a, int u)
+static __always_inline int atomic_fetch_add_unless(atomic_t *v, int a, int u)
 {
        int prev, rc;
 
@@ -349,9 +220,10 @@ static __always_inline int __atomic_add_unless(atomic_t *v, int a, int u)
                 : "memory");
         return prev;
 }
+#define atomic_fetch_add_unless atomic_fetch_add_unless
 
 #ifndef CONFIG_GENERIC_ATOMIC64
-static __always_inline long __atomic64_add_unless(atomic64_t *v, long a, long u)
+static __always_inline long atomic64_fetch_add_unless(atomic64_t *v, long a, long u)
 {
        long prev, rc;
 
@@ -368,27 +240,7 @@ static __always_inline long __atomic64_add_unless(atomic64_t *v, long a, long u)
                 : "memory");
         return prev;
 }
-
-static __always_inline int atomic64_add_unless(atomic64_t *v, long a, long u)
-{
-        return __atomic64_add_unless(v, a, u) != u;
-}
-#endif
-
-/*
- * The extra atomic operations that are constructed from one of the core
- * LR/SC-based operations above.
- */
-static __always_inline int atomic_inc_not_zero(atomic_t *v)
-{
-        return __atomic_add_unless(v, 1, 0);
-}
-
-#ifndef CONFIG_GENERIC_ATOMIC64
-static __always_inline long atomic64_inc_not_zero(atomic64_t *v)
-{
-        return atomic64_add_unless(v, 1, 0);
-}
+#define atomic64_fetch_add_unless atomic64_fetch_add_unless
 #endif
 
 /*
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 8a1863d9ed53..4fe5b2affa23 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -106,7 +106,6 @@ config S390
         select ARCH_USE_BUILTIN_BSWAP
         select ARCH_USE_CMPXCHG_LOCKREF
         select ARCH_WANTS_DYNAMIC_TASK_STRUCT
-        select ARCH_WANTS_UBSAN_NO_NULL
         select ARCH_WANT_IPC_PARSE_VERSION
         select BUILDTIME_EXTABLE_SORT
         select CLONE_BACKWARDS2
diff --git a/arch/s390/include/asm/atomic.h b/arch/s390/include/asm/atomic.h
index 4b55532f15c4..fd20ab5d4cf7 100644
--- a/arch/s390/include/asm/atomic.h
+++ b/arch/s390/include/asm/atomic.h
@@ -55,17 +55,9 @@ static inline void atomic_add(int i, atomic_t *v)
         __atomic_add(i, &v->counter);
 }
 
-#define atomic_add_negative(_i, _v)     (atomic_add_return(_i, _v) < 0)
-#define atomic_inc(_v)                  atomic_add(1, _v)
-#define atomic_inc_return(_v)           atomic_add_return(1, _v)
-#define atomic_inc_and_test(_v)         (atomic_add_return(1, _v) == 0)
 #define atomic_sub(_i, _v)              atomic_add(-(int)(_i), _v)
 #define atomic_sub_return(_i, _v)       atomic_add_return(-(int)(_i), _v)
 #define atomic_fetch_sub(_i, _v)        atomic_fetch_add(-(int)(_i), _v)
-#define atomic_sub_and_test(_i, _v)     (atomic_sub_return(_i, _v) == 0)
-#define atomic_dec(_v)                  atomic_sub(1, _v)
-#define atomic_dec_return(_v)           atomic_sub_return(1, _v)
-#define atomic_dec_and_test(_v)         (atomic_sub_return(1, _v) == 0)
 
 #define ATOMIC_OPS(op)                                                  \
 static inline void atomic_##op(int i, atomic_t *v)                      \
@@ -90,21 +82,6 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
         return __atomic_cmpxchg(&v->counter, old, new);
 }
 
-static inline int __atomic_add_unless(atomic_t *v, int a, int u)
-{
-        int c, old;
-        c = atomic_read(v);
-        for (;;) {
-                if (unlikely(c == u))
-                        break;
-                old = atomic_cmpxchg(v, c, c + a);
-                if (likely(old == c))
-                        break;
-                c = old;
-        }
-        return c;
-}
-
 #define ATOMIC64_INIT(i)  { (i) }
 
 static inline long atomic64_read(const atomic64_t *v)
@@ -168,50 +145,8 @@ ATOMIC64_OPS(xor)
 
 #undef ATOMIC64_OPS
 
-static inline int atomic64_add_unless(atomic64_t *v, long i, long u)
-{
-        long c, old;
-
-        c = atomic64_read(v);
-        for (;;) {
-                if (unlikely(c == u))
-                        break;
-                old = atomic64_cmpxchg(v, c, c + i);
-                if (likely(old == c))
-                        break;
-                c = old;
-        }
-        return c != u;
-}
-
-static inline long atomic64_dec_if_positive(atomic64_t *v)
-{
-        long c, old, dec;
-
-        c = atomic64_read(v);
-        for (;;) {
-                dec = c - 1;
-                if (unlikely(dec < 0))
-                        break;
-                old = atomic64_cmpxchg((v), c, dec);
-                if (likely(old == c))
-                        break;
-                c = old;
-        }
-        return dec;
-}
-
-#define atomic64_add_negative(_i, _v)   (atomic64_add_return(_i, _v) < 0)
-#define atomic64_inc(_v)                atomic64_add(1, _v)
-#define atomic64_inc_return(_v)         atomic64_add_return(1, _v)
-#define atomic64_inc_and_test(_v)       (atomic64_add_return(1, _v) == 0)
 #define atomic64_sub_return(_i, _v)     atomic64_add_return(-(long)(_i), _v)
 #define atomic64_fetch_sub(_i, _v)      atomic64_fetch_add(-(long)(_i), _v)
 #define atomic64_sub(_i, _v)            atomic64_add(-(long)(_i), _v)
-#define atomic64_sub_and_test(_i, _v)   (atomic64_sub_return(_i, _v) == 0)
-#define atomic64_dec(_v)                atomic64_sub(1, _v)
-#define atomic64_dec_return(_v)         atomic64_sub_return(1, _v)
-#define atomic64_dec_and_test(_v)       (atomic64_sub_return(1, _v) == 0)
-#define atomic64_inc_not_zero(v)        atomic64_add_unless((v), 1, 0)
 
 #endif /* __ARCH_S390_ATOMIC__  */
diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
index cf561160ea88..e8766beee5ad 100644
--- a/arch/s390/kernel/time.c
+++ b/arch/s390/kernel/time.c
@@ -221,17 +221,22 @@ void read_persistent_clock64(struct timespec64 *ts)
         ext_to_timespec64(clk, ts);
 }
 
-void read_boot_clock64(struct timespec64 *ts)
+void __init read_persistent_wall_and_boot_offset(struct timespec64 *wall_time,
+                                                 struct timespec64 *boot_offset)
 {
         unsigned char clk[STORE_CLOCK_EXT_SIZE];
+        struct timespec64 boot_time;
         __u64 delta;
 
         delta = initial_leap_seconds + TOD_UNIX_EPOCH;
-        memcpy(clk, tod_clock_base, 16);
-        *(__u64 *) &clk[1] -= delta;
-        if (*(__u64 *) &clk[1] > delta)
+        memcpy(clk, tod_clock_base, STORE_CLOCK_EXT_SIZE);
+        *(__u64 *)&clk[1] -= delta;
+        if (*(__u64 *)&clk[1] > delta)
                 clk[0]--;
-        ext_to_timespec64(clk, ts);
+        ext_to_timespec64(clk, &boot_time);
+
+        read_persistent_clock64(wall_time);
+        *boot_offset = timespec64_sub(*wall_time, boot_time);
 }
 
 static u64 read_tod_clock(struct clocksource *cs)
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index daa09f89ca2d..fcb55b02990e 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -1145,7 +1145,7 @@ void kvm_s390_vcpu_wakeup(struct kvm_vcpu *vcpu)
                  * yield-candidate.
                  */
                 vcpu->preempted = true;
-                swake_up(&vcpu->wq);
+                swake_up_one(&vcpu->wq);
                 vcpu->stat.halt_wakeup++;
         }
         /*
diff --git a/arch/sh/include/asm/atomic.h b/arch/sh/include/asm/atomic.h
index 0fd0099f43cc..f37b95a80232 100644
--- a/arch/sh/include/asm/atomic.h
+++ b/arch/sh/include/asm/atomic.h
@@ -32,44 +32,9 @@
 #include <asm/atomic-irq.h>
 #endif
 
-#define atomic_add_negative(a, v)       (atomic_add_return((a), (v)) < 0)
-#define atomic_dec_return(v)            atomic_sub_return(1, (v))
-#define atomic_inc_return(v)            atomic_add_return(1, (v))
-#define atomic_inc_and_test(v)          (atomic_inc_return(v) == 0)
-#define atomic_sub_and_test(i,v)        (atomic_sub_return((i), (v)) == 0)
-#define atomic_dec_and_test(v)          (atomic_sub_return(1, (v)) == 0)
-
-#define atomic_inc(v)                   atomic_add(1, (v))
-#define atomic_dec(v)                   atomic_sub(1, (v))
-
 #define atomic_xchg(v, new)             (xchg(&((v)->counter), new))
 #define atomic_cmpxchg(v, o, n)         (cmpxchg(&((v)->counter), (o), (n)))
 
-/**
- * __atomic_add_unless - add unless the number is a given value
- * @v: pointer of type atomic_t
- * @a: the amount to add to v...
- * @u: ...unless v is equal to u.
- *
- * Atomically adds @a to @v, so long as it was not @u.
- * Returns the old value of @v.
- */
-static inline int __atomic_add_unless(atomic_t *v, int a, int u)
-{
-        int c, old;
-        c = atomic_read(v);
-        for (;;) {
-                if (unlikely(c == (u)))
-                        break;
-                old = atomic_cmpxchg((v), c, c + (a));
-                if (likely(old == c))
-                        break;
-                c = old;
-        }
-
-        return c;
-}
-
 #endif /* CONFIG_CPU_J2 */
 
 #endif /* __ASM_SH_ATOMIC_H */
diff --git a/arch/sh/include/asm/cmpxchg-xchg.h b/arch/sh/include/asm/cmpxchg-xchg.h
index 1e881f5db659..593a9704782b 100644
--- a/arch/sh/include/asm/cmpxchg-xchg.h
+++ b/arch/sh/include/asm/cmpxchg-xchg.h
@@ -8,7 +8,8 @@
  * This work is licensed under the terms of the GNU GPL, version 2.  See the
  * file "COPYING" in the main directory of this archive for more details.
  */
-#include <linux/bitops.h>
+#include <linux/bits.h>
+#include <linux/compiler.h>
 #include <asm/byteorder.h>
 
 /*
diff --git a/arch/sparc/include/asm/Kbuild b/arch/sparc/include/asm/Kbuild
index ac67828da201..410b263ef5c8 100644
--- a/arch/sparc/include/asm/Kbuild
+++ b/arch/sparc/include/asm/Kbuild
@@ -13,6 +13,7 @@ generic-y += local64.h
 generic-y += mcs_spinlock.h
 generic-y += mm-arch-hooks.h
 generic-y += module.h
+generic-y += msi.h
 generic-y += preempt.h
 generic-y += rwsem.h
 generic-y += serial.h
diff --git a/arch/sparc/include/asm/atomic_32.h b/arch/sparc/include/asm/atomic_32.h
index d13ce517f4b9..94c930f0bc62 100644
--- a/arch/sparc/include/asm/atomic_32.h
+++ b/arch/sparc/include/asm/atomic_32.h
@@ -27,17 +27,17 @@ int atomic_fetch_or(int, atomic_t *);
 int atomic_fetch_xor(int, atomic_t *);
 int atomic_cmpxchg(atomic_t *, int, int);
 int atomic_xchg(atomic_t *, int);
-int __atomic_add_unless(atomic_t *, int, int);
+int atomic_fetch_add_unless(atomic_t *, int, int);
 void atomic_set(atomic_t *, int);
 
+#define atomic_fetch_add_unless atomic_fetch_add_unless
+
 #define atomic_set_release(v, i)        atomic_set((v), (i))
 
 #define atomic_read(v)          READ_ONCE((v)->counter)
 
 #define atomic_add(i, v)        ((void)atomic_add_return( (int)(i), (v)))
 #define atomic_sub(i, v)        ((void)atomic_add_return(-(int)(i), (v)))
-#define atomic_inc(v)           ((void)atomic_add_return(        1, (v)))
-#define atomic_dec(v)           ((void)atomic_add_return(       -1, (v)))
 
 #define atomic_and(i, v)        ((void)atomic_fetch_and((i), (v)))
 #define atomic_or(i, v)         ((void)atomic_fetch_or((i), (v)))
@@ -46,22 +46,4 @@ void atomic_set(atomic_t *, int);
 #define atomic_sub_return(i, v) (atomic_add_return(-(int)(i), (v)))
 #define atomic_fetch_sub(i, v)  (atomic_fetch_add (-(int)(i), (v)))
 
-#define atomic_inc_return(v)    (atomic_add_return(        1, (v)))
-#define atomic_dec_return(v)    (atomic_add_return(       -1, (v)))
-
-#define atomic_add_negative(a, v)       (atomic_add_return((a), (v)) < 0)
-
-/*
- * atomic_inc_and_test - increment and test
- * @v: pointer of type atomic_t
- *
- * Atomically increments @v by 1
- * and returns true if the result is zero, or false for all
- * other cases.
- */
-#define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
-
-#define atomic_dec_and_test(v) (atomic_dec_return(v) == 0)
-#define atomic_sub_and_test(i, v) (atomic_sub_return(i, v) == 0)
-
 #endif /* !(__ARCH_SPARC_ATOMIC__) */
diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
index 28db058d471b..6963482c81d8 100644
--- a/arch/sparc/include/asm/atomic_64.h
+++ b/arch/sparc/include/asm/atomic_64.h
@@ -50,38 +50,6 @@ ATOMIC_OPS(xor)
 #undef ATOMIC_OP_RETURN
 #undef ATOMIC_OP
 
-#define atomic_dec_return(v)   atomic_sub_return(1, v)
-#define atomic64_dec_return(v) atomic64_sub_return(1, v)
-
-#define atomic_inc_return(v)   atomic_add_return(1, v)
-#define atomic64_inc_return(v) atomic64_add_return(1, v)
-
-/*
- * atomic_inc_and_test - increment and test
- * @v: pointer of type atomic_t
- *
- * Atomically increments @v by 1
- * and returns true if the result is zero, or false for all
- * other cases.
- */
-#define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
-#define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
-
-#define atomic_sub_and_test(i, v) (atomic_sub_return(i, v) == 0)
-#define atomic64_sub_and_test(i, v) (atomic64_sub_return(i, v) == 0)
-
-#define atomic_dec_and_test(v) (atomic_sub_return(1, v) == 0)
-#define atomic64_dec_and_test(v) (atomic64_sub_return(1, v) == 0)
-
-#define atomic_inc(v) atomic_add(1, v)
-#define atomic64_inc(v) atomic64_add(1, v)
-
-#define atomic_dec(v) atomic_sub(1, v)
-#define atomic64_dec(v) atomic64_sub(1, v)
-
-#define atomic_add_negative(i, v) (atomic_add_return(i, v) < 0)
-#define atomic64_add_negative(i, v) (atomic64_add_return(i, v) < 0)
-
 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
 
 static inline int atomic_xchg(atomic_t *v, int new)
@@ -89,42 +57,11 @@ static inline int atomic_xchg(atomic_t *v, int new)
         return xchg(&v->counter, new);
 }
 
-static inline int __atomic_add_unless(atomic_t *v, int a, int u)
-{
-        int c, old;
-        c = atomic_read(v);
-        for (;;) {
-                if (unlikely(c == (u)))
-                        break;
-                old = atomic_cmpxchg((v), c, c + (a));
-                if (likely(old == c))
-                        break;
-                c = old;
-        }
-        return c;
-}
-
 #define atomic64_cmpxchg(v, o, n) \
         ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
 #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
 
-static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
-{
-        long c, old;
-        c = atomic64_read(v);
-        for (;;) {
-                if (unlikely(c == (u)))
-                        break;
-                old = atomic64_cmpxchg((v), c, c + (a));
-                if (likely(old == c))
-                        break;
-                c = old;
-        }
-        return c != (u);
-}
-
-#define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-
 long atomic64_dec_if_positive(atomic64_t *v);
+#define atomic64_dec_if_positive atomic64_dec_if_positive
 
 #endif /* !(__ARCH_SPARC64_ATOMIC__) */
diff --git a/arch/sparc/include/asm/msi.h b/arch/sparc/include/asm/msi.h
deleted file mode 100644
index 3c17c1074431..000000000000
--- a/arch/sparc/include/asm/msi.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/*
- * msi.h:  Defines specific to the MBus - Sbus - Interface.
- *
- * Copyright (C) 1996 David S. Miller (davem@caip.rutgers.edu)
- * Copyright (C) 1996 Eddie C. Dost   (ecd@skynet.be)
- */
-
-#ifndef _SPARC_MSI_H
-#define _SPARC_MSI_H
-
-/*
- * Locations of MSI Registers.
- */
-#define MSI_MBUS_ARBEN  0xe0001008      /* MBus Arbiter Enable register */
-
-/*
- * Useful bits in the MSI Registers.
- */
-#define MSI_ASYNC_MODE  0x80000000      /* Operate the MSI asynchronously */
-
-
-static inline void msi_set_sync(void)
-{
-        __asm__ __volatile__ ("lda [%0] %1, %%g3\n\t"
-                              "andn %%g3, %2, %%g3\n\t"
-                              "sta %%g3, [%0] %1\n\t" : :
-                              "r" (MSI_MBUS_ARBEN),
-                              "i" (ASI_M_CTL), "r" (MSI_ASYNC_MODE) : "g3");
-}
-
-#endif /* !(_SPARC_MSI_H) */
diff --git a/arch/sparc/kernel/time_64.c b/arch/sparc/kernel/time_64.c
index 2ef8cfa9677e..f0eba72aa1ad 100644
--- a/arch/sparc/kernel/time_64.c
+++ b/arch/sparc/kernel/time_64.c
@@ -814,7 +814,7 @@ static void __init get_tick_patch(void)
         }
 }
 
-static void init_tick_ops(struct sparc64_tick_ops *ops)
+static void __init init_tick_ops(struct sparc64_tick_ops *ops)
 {
         unsigned long freq, quotient, tick;
 
diff --git a/arch/sparc/lib/atomic32.c b/arch/sparc/lib/atomic32.c
index 465a901a0ada..281fa634bb1a 100644
--- a/arch/sparc/lib/atomic32.c
+++ b/arch/sparc/lib/atomic32.c
@@ -95,7 +95,7 @@ int atomic_cmpxchg(atomic_t *v, int old, int new)
 }
 EXPORT_SYMBOL(atomic_cmpxchg);
 
-int __atomic_add_unless(atomic_t *v, int a, int u)
+int atomic_fetch_add_unless(atomic_t *v, int a, int u)
 {
         int ret;
         unsigned long flags;
@@ -107,7 +107,7 @@ int __atomic_add_unless(atomic_t *v, int a, int u)
         spin_unlock_irqrestore(ATOMIC_HASH(v), flags);
         return ret;
 }
-EXPORT_SYMBOL(__atomic_add_unless);
+EXPORT_SYMBOL(atomic_fetch_add_unless);
 
 /* Atomic operations are already serializing */
 void atomic_set(atomic_t *v, int i)
diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c
index 1d70c3f6d986..be9cb0065179 100644
--- a/arch/sparc/mm/srmmu.c
+++ b/arch/sparc/mm/srmmu.c
@@ -37,7 +37,6 @@
 #include <asm/mbus.h>
 #include <asm/page.h>
 #include <asm/asi.h>
-#include <asm/msi.h>
 #include <asm/smp.h>
 #include <asm/io.h>
 
@@ -116,6 +115,25 @@ static inline void srmmu_ctxd_set(ctxd_t *ctxp, pgd_t *pgdp)
         set_pte((pte_t *)ctxp, pte);
 }
 
+/*
+ * Locations of MSI Registers.
+ */
+#define MSI_MBUS_ARBEN  0xe0001008      /* MBus Arbiter Enable register */
+
+/*
+ * Useful bits in the MSI Registers.
+ */
+#define MSI_ASYNC_MODE  0x80000000      /* Operate the MSI asynchronously */
+
+static void msi_set_sync(void)
+{
+        __asm__ __volatile__ ("lda [%0] %1, %%g3\n\t"
+                              "andn %%g3, %2, %%g3\n\t"
+                              "sta %%g3, [%0] %1\n\t" : :
+                              "r" (MSI_MBUS_ARBEN),
+                              "i" (ASI_M_CTL), "r" (MSI_ASYNC_MODE) : "g3");
+}
+
 void pmd_set(pmd_t *pmdp, pte_t *ptep)
 {
         unsigned long ptp;      /* Physical address, shifted right by 4 */
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 887d3a7bb646..6d4774f203d0 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -180,7 +180,7 @@ config X86
         select HAVE_PERF_USER_STACK_DUMP
         select HAVE_RCU_TABLE_FREE
         select HAVE_REGS_AND_STACK_ACCESS_API
-        select HAVE_RELIABLE_STACKTRACE         if X86_64 && UNWINDER_FRAME_POINTER && STACK_VALIDATION
+        select HAVE_RELIABLE_STACKTRACE         if X86_64 && (UNWINDER_FRAME_POINTER || UNWINDER_ORC) && STACK_VALIDATION
         select HAVE_STACKPROTECTOR              if CC_HAS_SANE_STACKPROTECTOR
         select HAVE_STACK_VALIDATION            if X86_64
         select HAVE_RSEQ
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index a08e82856563..7e3c07d6ad42 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -80,11 +80,6 @@ ifeq ($(CONFIG_X86_32),y)
         # alignment instructions.
         KBUILD_CFLAGS += $(call cc-option,$(cc_stack_align4))
 
-        # Disable unit-at-a-time mode on pre-gcc-4.0 compilers, it makes gcc use
-        # a lot more stack due to the lack of sharing of stacklots:
-        KBUILD_CFLAGS += $(call cc-ifversion, -lt, 0400, \
-                                $(call cc-option,-fno-unit-at-a-time))
-
         # CPU-specific tuning. Anything which can be shared with UML should go here.
         include arch/x86/Makefile_32.cpu
         KBUILD_CFLAGS += $(cflags-y)
diff --git a/arch/x86/boot/bitops.h b/arch/x86/boot/bitops.h
index 0d41d68131cc..2e1382486e91 100644
--- a/arch/x86/boot/bitops.h
+++ b/arch/x86/boot/bitops.h
@@ -17,6 +17,7 @@
 #define _LINUX_BITOPS_H         /* Inhibit inclusion of <linux/bitops.h> */
 
 #include <linux/types.h>
+#include <asm/asm.h>
 
 static inline bool constant_test_bit(int nr, const void *addr)
 {
@@ -28,7 +29,7 @@ static inline bool variable_test_bit(int nr, const void *addr)
         bool v;
         const u32 *p = (const u32 *)addr;
 
-        asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
+        asm("btl %2,%1" CC_SET(c) : CC_OUT(c) (v) : "m" (*p), "Ir" (nr));
         return v;
 }
 
diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
index e98522ea6f09..1458b1700fc7 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -34,74 +34,13 @@ static void setup_boot_services##bits(struct efi_config *c)		\
                                                                         \
         table = (typeof(table))sys_table;                               \
                                                                         \
-        c->runtime_services = table->runtime;                           \
-        c->boot_services = table->boottime;                             \
-        c->text_output = table->con_out;                                \
+        c->runtime_services     = table->runtime;                       \
+        c->boot_services        = table->boottime;                      \
+        c->text_output          = table->con_out;                       \
 }
 BOOT_SERVICES(32);
 BOOT_SERVICES(64);
 
-static inline efi_status_t __open_volume32(void *__image, void **__fh)
-{
-        efi_file_io_interface_t *io;
-        efi_loaded_image_32_t *image = __image;
-        efi_file_handle_32_t *fh;
-        efi_guid_t fs_proto = EFI_FILE_SYSTEM_GUID;
-        efi_status_t status;
-        void *handle = (void *)(unsigned long)image->device_handle;
-        unsigned long func;
-
-        status = efi_call_early(handle_protocol, handle,
-                                &fs_proto, (void **)&io);
-        if (status != EFI_SUCCESS) {
-                efi_printk(sys_table, "Failed to handle fs_proto\n");
-                return status;
-        }
-
-        func = (unsigned long)io->open_volume;
-        status = efi_early->call(func, io, &fh);
-        if (status != EFI_SUCCESS)
-                efi_printk(sys_table, "Failed to open volume\n");
-
-        *__fh = fh;
-        return status;
-}
-
-static inline efi_status_t __open_volume64(void *__image, void **__fh)
-{
-        efi_file_io_interface_t *io;
-        efi_loaded_image_64_t *image = __image;
-        efi_file_handle_64_t *fh;
-        efi_guid_t fs_proto = EFI_FILE_SYSTEM_GUID;
-        efi_status_t status;
-        void *handle = (void *)(unsigned long)image->device_handle;
-        unsigned long func;
-
-        status = efi_call_early(handle_protocol, handle,
-                                &fs_proto, (void **)&io);
-        if (status != EFI_SUCCESS) {
-                efi_printk(sys_table, "Failed to handle fs_proto\n");
-                return status;
-        }
-
-        func = (unsigned long)io->open_volume;
-        status = efi_early->call(func, io, &fh);
-        if (status != EFI_SUCCESS)
-                efi_printk(sys_table, "Failed to open volume\n");
-
-        *__fh = fh;
-        return status;
-}
-
-efi_status_t
-efi_open_volume(efi_system_table_t *sys_table, void *__image, void **__fh)
-{
-        if (efi_early->is64)
-                return __open_volume64(__image, __fh);
-
-        return __open_volume32(__image, __fh);
-}
-
 void efi_char16_printk(efi_system_table_t *table, efi_char16_t *str)
 {
         efi_call_proto(efi_simple_text_output_protocol, output_string,
@@ -109,7 +48,7 @@ void efi_char16_printk(efi_system_table_t *table, efi_char16_t *str)
 }
 
 static efi_status_t
-__setup_efi_pci(efi_pci_io_protocol_t *pci, struct pci_setup_rom **__rom)
+preserve_pci_rom_image(efi_pci_io_protocol_t *pci, struct pci_setup_rom **__rom)
 {
         struct pci_setup_rom *rom = NULL;
         efi_status_t status;
@@ -134,16 +73,16 @@ __setup_efi_pci(efi_pci_io_protocol_t *pci, struct pci_setup_rom **__rom)
 
         status = efi_call_early(allocate_pool, EFI_LOADER_DATA, size, &rom);
         if (status != EFI_SUCCESS) {
-                efi_printk(sys_table, "Failed to alloc mem for rom\n");
+                efi_printk(sys_table, "Failed to allocate memory for 'rom'\n");
                 return status;
         }
 
         memset(rom, 0, sizeof(*rom));
 
-        rom->data.type = SETUP_PCI;
-        rom->data.len = size - sizeof(struct setup_data);
-        rom->data.next = 0;
-        rom->pcilen = pci->romsize;
+        rom->data.type  = SETUP_PCI;
+        rom->data.len   = size - sizeof(struct setup_data);
+        rom->data.next  = 0;
+        rom->pcilen     = pci->romsize;
         *__rom = rom;
 
         status = efi_call_proto(efi_pci_io_protocol, pci.read, pci,
@@ -179,96 +118,6 @@ free_struct:
         return status;
 }
 
-static void
-setup_efi_pci32(struct boot_params *params, void **pci_handle,
-                unsigned long size)
-{
-        efi_pci_io_protocol_t *pci = NULL;
-        efi_guid_t pci_proto = EFI_PCI_IO_PROTOCOL_GUID;
-        u32 *handles = (u32 *)(unsigned long)pci_handle;
-        efi_status_t status;
-        unsigned long nr_pci;
-        struct setup_data *data;
-        int i;
-
-        data = (struct setup_data *)(unsigned long)params->hdr.setup_data;
-
-        while (data && data->next)
-                data = (struct setup_data *)(unsigned long)data->next;
-
-        nr_pci = size / sizeof(u32);
-        for (i = 0; i < nr_pci; i++) {
-                struct pci_setup_rom *rom = NULL;
-                u32 h = handles[i];
-
-                status = efi_call_early(handle_protocol, h,
-                                        &pci_proto, (void **)&pci);
-
-                if (status != EFI_SUCCESS)
-                        continue;
-
-                if (!pci)
-                        continue;
-
-                status = __setup_efi_pci(pci, &rom);
-                if (status != EFI_SUCCESS)
-                        continue;
-
-                if (data)
-                        data->next = (unsigned long)rom;
-                else
-                        params->hdr.setup_data = (unsigned long)rom;
-
-                data = (struct setup_data *)rom;
-
-        }
-}
-
-static void
-setup_efi_pci64(struct boot_params *params, void **pci_handle,
-                unsigned long size)
-{
-        efi_pci_io_protocol_t *pci = NULL;
-        efi_guid_t pci_proto = EFI_PCI_IO_PROTOCOL_GUID;
-        u64 *handles = (u64 *)(unsigned long)pci_handle;
-        efi_status_t status;
-        unsigned long nr_pci;
-        struct setup_data *data;
-        int i;
-
-        data = (struct setup_data *)(unsigned long)params->hdr.setup_data;
-
-        while (data && data->next)
-                data = (struct setup_data *)(unsigned long)data->next;
-
-        nr_pci = size / sizeof(u64);
-        for (i = 0; i < nr_pci; i++) {
-                struct pci_setup_rom *rom = NULL;
-                u64 h = handles[i];
-
-                status = efi_call_early(handle_protocol, h,
-                                        &pci_proto, (void **)&pci);
-
-                if (status != EFI_SUCCESS)
-                        continue;
-
-                if (!pci)
-                        continue;
-
-                status = __setup_efi_pci(pci, &rom);
-                if (status != EFI_SUCCESS)
-                        continue;
-
-                if (data)
-                        data->next = (unsigned long)rom;
-                else
-                        params->hdr.setup_data = (unsigned long)rom;
-
-                data = (struct setup_data *)rom;
-
-        }
-}
-
 /*
  * There's no way to return an informative status from this function,
  * because any analysis (and printing of error messages) needs to be
@@ -284,6 +133,9 @@ static void setup_efi_pci(struct boot_params *params)
         void **pci_handle = NULL;
         efi_guid_t pci_proto = EFI_PCI_IO_PROTOCOL_GUID;
         unsigned long size = 0;
+        unsigned long nr_pci;
+        struct setup_data *data;
+        int i;
 
         status = efi_call_early(locate_handle,
                                 EFI_LOCATE_BY_PROTOCOL,
@@ -295,7 +147,7 @@ static void setup_efi_pci(struct boot_params *params)
                                         size, (void **)&pci_handle);
 
                 if (status != EFI_SUCCESS) {
-                        efi_printk(sys_table, "Failed to alloc mem for pci_handle\n");
+                        efi_printk(sys_table, "Failed to allocate memory for 'pci_handle'\n");
                         return;
                 }
 
@@ -307,10 +159,34 @@ static void setup_efi_pci(struct boot_params *params)
         if (status != EFI_SUCCESS)
                 goto free_handle;
 
-        if (efi_early->is64)
-                setup_efi_pci64(params, pci_handle, size);
-        else
-                setup_efi_pci32(params, pci_handle, size);
+        data = (struct setup_data *)(unsigned long)params->hdr.setup_data;
+
+        while (data && data->next)
+                data = (struct setup_data *)(unsigned long)data->next;
+
+        nr_pci = size / (efi_is_64bit() ? sizeof(u64) : sizeof(u32));
+        for (i = 0; i < nr_pci; i++) {
+                efi_pci_io_protocol_t *pci = NULL;
+                struct pci_setup_rom *rom;
+
+                status = efi_call_early(handle_protocol,
+                                        efi_is_64bit() ? ((u64 *)pci_handle)[i]
+                                                       : ((u32 *)pci_handle)[i],
+                                        &pci_proto, (void **)&pci);
+                if (status != EFI_SUCCESS || !pci)
+                        continue;
+
+                status = preserve_pci_rom_image(pci, &rom);
+                if (status != EFI_SUCCESS)
+                        continue;
+
+                if (data)
+                        data->next = (unsigned long)rom;
+                else
+                        params->hdr.setup_data = (unsigned long)rom;
+
+                data = (struct setup_data *)rom;
+        }
 
 free_handle:
         efi_call_early(free_pool, pci_handle);
@@ -341,8 +217,7 @@ static void retrieve_apple_device_properties(struct boot_params *boot_params)
                 status = efi_call_early(allocate_pool, EFI_LOADER_DATA,
                                         size + sizeof(struct setup_data), &new);
                 if (status != EFI_SUCCESS) {
-                        efi_printk(sys_table,
-                                        "Failed to alloc mem for properties\n");
+                        efi_printk(sys_table, "Failed to allocate memory for 'properties'\n");
                         return;
                 }
 
@@ -358,9 +233,9 @@ static void retrieve_apple_device_properties(struct boot_params *boot_params)
         new->next = 0;
 
         data = (struct setup_data *)(unsigned long)boot_params->hdr.setup_data;
-        if (!data)
+        if (!data) {
                 boot_params->hdr.setup_data = (unsigned long)new;
-        else {
+        } else {
                 while (data->next)
                         data = (struct setup_data *)(unsigned long)data->next;
                 data->next = (unsigned long)new;
@@ -380,81 +255,55 @@ static void setup_quirks(struct boot_params *boot_params)
         }
 }
 
+/*
+ * See if we have Universal Graphics Adapter (UGA) protocol
+ */
 static efi_status_t
-setup_uga32(void **uga_handle, unsigned long size, u32 *width, u32 *height)
+setup_uga(struct screen_info *si, efi_guid_t *uga_proto, unsigned long size)
 {
-        struct efi_uga_draw_protocol *uga = NULL, *first_uga;
-        efi_guid_t uga_proto = EFI_UGA_PROTOCOL_GUID;
+        efi_status_t status;
+        u32 width, height;
+        void **uga_handle = NULL;
+        efi_uga_draw_protocol_t *uga = NULL, *first_uga;
         unsigned long nr_ugas;
-        u32 *handles = (u32 *)uga_handle;
-        efi_status_t status = EFI_INVALID_PARAMETER;
         int i;
 
-        first_uga = NULL;
-        nr_ugas = size / sizeof(u32);
-        for (i = 0; i < nr_ugas; i++) {
-                efi_guid_t pciio_proto = EFI_PCI_IO_PROTOCOL_GUID;
-                u32 w, h, depth, refresh;
-                void *pciio;
-                u32 handle = handles[i];
-
-                status = efi_call_early(handle_protocol, handle,
-                                        &uga_proto, (void **)&uga);
-                if (status != EFI_SUCCESS)
-                        continue;
-
-                efi_call_early(handle_protocol, handle, &pciio_proto, &pciio);
-
-                status = efi_early->call((unsigned long)uga->get_mode, uga,
-                                         &w, &h, &depth, &refresh);
-                if (status == EFI_SUCCESS && (!first_uga || pciio)) {
-                        *width = w;
-                        *height = h;
-
-                        /*
-                         * Once we've found a UGA supporting PCIIO,
-                         * don't bother looking any further.
-                         */
-                        if (pciio)
-                                break;
-
-                        first_uga = uga;
-                }
-        }
+        status = efi_call_early(allocate_pool, EFI_LOADER_DATA,
+                                size, (void **)&uga_handle);
+        if (status != EFI_SUCCESS)
+                return status;
 
-        return status;
-}
+        status = efi_call_early(locate_handle,
+                                EFI_LOCATE_BY_PROTOCOL,
+                                uga_proto, NULL, &size, uga_handle);
+        if (status != EFI_SUCCESS)
+                goto free_handle;
 
-static efi_status_t
-setup_uga64(void **uga_handle, unsigned long size, u32 *width, u32 *height)
-{
-        struct efi_uga_draw_protocol *uga = NULL, *first_uga;
-        efi_guid_t uga_proto = EFI_UGA_PROTOCOL_GUID;
-        unsigned long nr_ugas;
-        u64 *handles = (u64 *)uga_handle;
-        efi_status_t status = EFI_INVALID_PARAMETER;
-        int i;
+        height = 0;
+        width = 0;
 
         first_uga = NULL;
-        nr_ugas = size / sizeof(u64);
+        nr_ugas = size / (efi_is_64bit() ? sizeof(u64) : sizeof(u32));
         for (i = 0; i < nr_ugas; i++) {
                 efi_guid_t pciio_proto = EFI_PCI_IO_PROTOCOL_GUID;
                 u32 w, h, depth, refresh;
                 void *pciio;
-                u64 handle = handles[i];
+                unsigned long handle = efi_is_64bit() ? ((u64 *)uga_handle)[i]
+                                                      : ((u32 *)uga_handle)[i];
 
                 status = efi_call_early(handle_protocol, handle,
-                                        &uga_proto, (void **)&uga);
+                                        uga_proto, (void **)&uga);
                 if (status != EFI_SUCCESS)
                         continue;
 
+                pciio = NULL;
                 efi_call_early(handle_protocol, handle, &pciio_proto, &pciio);
 
-                status = efi_early->call((unsigned long)uga->get_mode, uga,
-                                         &w, &h, &depth, &refresh);
+                status = efi_call_proto(efi_uga_draw_protocol, get_mode, uga,
+                                        &w, &h, &depth, &refresh);
                 if (status == EFI_SUCCESS && (!first_uga || pciio)) {
-                        *width = w;
-                        *height = h;
+                        width = w;
+                        height = h;
 
                         /*
                          * Once we've found a UGA supporting PCIIO,
@@ -467,59 +316,28 @@ setup_uga64(void **uga_handle, unsigned long size, u32 *width, u32 *height)
                 }
         }
 
-        return status;
-}
-
-/*
- * See if we have Universal Graphics Adapter (UGA) protocol
- */
-static efi_status_t setup_uga(struct screen_info *si, efi_guid_t *uga_proto,
-                              unsigned long size)
-{
-        efi_status_t status;
-        u32 width, height;
-        void **uga_handle = NULL;
-
-        status = efi_call_early(allocate_pool, EFI_LOADER_DATA,
-                                size, (void **)&uga_handle);
-        if (status != EFI_SUCCESS)
-                return status;
-
-        status = efi_call_early(locate_handle,
-                                EFI_LOCATE_BY_PROTOCOL,
-                                uga_proto, NULL, &size, uga_handle);
-        if (status != EFI_SUCCESS)
-                goto free_handle;
-
-        height = 0;
-        width = 0;
-
-        if (efi_early->is64)
-                status = setup_uga64(uga_handle, size, &width, &height);
-        else
-                status = setup_uga32(uga_handle, size, &width, &height);
-
         if (!width && !height)
                 goto free_handle;
 
         /* EFI framebuffer */
-        si->orig_video_isVGA = VIDEO_TYPE_EFI;
+        si->orig_video_isVGA    = VIDEO_TYPE_EFI;
 
-        si->lfb_depth = 32;
-        si->lfb_width = width;
-        si->lfb_height = height;
+        si->lfb_depth           = 32;
+        si->lfb_width           = width;
+        si->lfb_height          = height;
 
-        si->red_size = 8;
-        si->red_pos = 16;
-        si->green_size = 8;
-        si->green_pos = 8;
-        si->blue_size = 8;
-        si->blue_pos = 0;
-        si->rsvd_size = 8;
-        si->rsvd_pos = 24;
+        si->red_size            = 8;
+        si->red_pos             = 16;
+        si->green_size          = 8;
+        si->green_pos           = 8;
+        si->blue_size           = 8;
+        si->blue_pos            = 0;
+        si->rsvd_size           = 8;
+        si->rsvd_pos            = 24;
 
 free_handle:
         efi_call_early(free_pool, uga_handle);
+
         return status;
 }
 
@@ -586,7 +404,7 @@ struct boot_params *make_boot_params(struct efi_config *c)
         if (sys_table->hdr.signature != EFI_SYSTEM_TABLE_SIGNATURE)
                 return NULL;
 
-        if (efi_early->is64)
+        if (efi_is_64bit())
                 setup_boot_services64(efi_early);
         else
                 setup_boot_services32(efi_early);
@@ -601,7 +419,7 @@ struct boot_params *make_boot_params(struct efi_config *c)
         status = efi_low_alloc(sys_table, 0x4000, 1,
                                (unsigned long *)&boot_params);
         if (status != EFI_SUCCESS) {
-                efi_printk(sys_table, "Failed to alloc lowmem for boot params\n");
+                efi_printk(sys_table, "Failed to allocate lowmem for boot params\n");
                 return NULL;
         }
 
@@ -617,9 +435,9 @@ struct boot_params *make_boot_params(struct efi_config *c)
          * Fill out some of the header fields ourselves because the
          * EFI firmware loader doesn't load the first sector.
          */
-        hdr->root_flags = 1;
-        hdr->vid_mode = 0xffff;
-        hdr->boot_flag = 0xAA55;
+        hdr->root_flags = 1;
+        hdr->vid_mode   = 0xffff;
+        hdr->boot_flag  = 0xAA55;
 
         hdr->type_of_loader = 0x21;
 
@@ -627,6 +445,7 @@ struct boot_params *make_boot_params(struct efi_config *c)
         cmdline_ptr = efi_convert_cmdline(sys_table, image, &options_size);
         if (!cmdline_ptr)
                 goto fail;
+
         hdr->cmd_line_ptr = (unsigned long)cmdline_ptr;
         /* Fill in upper bits of command line address, NOP on 32 bit  */
         boot_params->ext_cmd_line_ptr = (u64)(unsigned long)cmdline_ptr >> 32;
@@ -663,10 +482,12 @@ struct boot_params *make_boot_params(struct efi_config *c)
         boot_params->ext_ramdisk_size  = (u64)ramdisk_size >> 32;
 
         return boot_params;
+
 fail2:
         efi_free(sys_table, options_size, hdr->cmd_line_ptr);
 fail:
         efi_free(sys_table, 0x4000, (unsigned long)boot_params);
+
         return NULL;
 }
 
@@ -678,7 +499,7 @@ static void add_e820ext(struct boot_params *params,
         unsigned long size;
 
         e820ext->type = SETUP_E820_EXT;
-        e820ext->len = nr_entries * sizeof(struct boot_e820_entry);
+        e820ext->len  = nr_entries * sizeof(struct boot_e820_entry);
         e820ext->next = 0;
 
         data = (struct setup_data *)(unsigned long)params->hdr.setup_data;
@@ -692,8 +513,8 @@ static void add_e820ext(struct boot_params *params,
                 params->hdr.setup_data = (unsigned long)e820ext;
 }
 
-static efi_status_t setup_e820(struct boot_params *params,
-                               struct setup_data *e820ext, u32 e820ext_size)
+static efi_status_t
+setup_e820(struct boot_params *params, struct setup_data *e820ext, u32 e820ext_size)
 {
         struct boot_e820_entry *entry = params->e820_table;
         struct efi_info *efi = &params->efi_info;
@@ -814,11 +635,10 @@ static efi_status_t alloc_e820ext(u32 nr_desc, struct setup_data **e820ext,
 }
 
 struct exit_boot_struct {
-        struct boot_params *boot_params;
-        struct efi_info *efi;
-        struct setup_data *e820ext;
-        __u32 e820ext_size;
-        bool is64;
+        struct boot_params      *boot_params;
+        struct efi_info         *efi;
+        struct setup_data       *e820ext;
+        __u32                   e820ext_size;
 };
 
 static efi_status_t exit_boot_func(efi_system_table_t *sys_table_arg,
@@ -845,25 +665,25 @@ static efi_status_t exit_boot_func(efi_system_table_t *sys_table_arg,
                 first = false;
         }
 
-        signature = p->is64 ? EFI64_LOADER_SIGNATURE : EFI32_LOADER_SIGNATURE;
+        signature = efi_is_64bit() ? EFI64_LOADER_SIGNATURE
+                                   : EFI32_LOADER_SIGNATURE;
         memcpy(&p->efi->efi_loader_signature, signature, sizeof(__u32));
 
-        p->efi->efi_systab = (unsigned long)sys_table_arg;
-        p->efi->efi_memdesc_size = *map->desc_size;
-        p->efi->efi_memdesc_version = *map->desc_ver;
-        p->efi->efi_memmap = (unsigned long)*map->map;
-        p->efi->efi_memmap_size = *map->map_size;
+        p->efi->efi_systab              = (unsigned long)sys_table_arg;
+        p->efi->efi_memdesc_size        = *map->desc_size;
+        p->efi->efi_memdesc_version     = *map->desc_ver;
+        p->efi->efi_memmap              = (unsigned long)*map->map;
+        p->efi->efi_memmap_size         = *map->map_size;
 
 #ifdef CONFIG_X86_64
-        p->efi->efi_systab_hi = (unsigned long)sys_table_arg >> 32;
-        p->efi->efi_memmap_hi = (unsigned long)*map->map >> 32;
+        p->efi->efi_systab_hi           = (unsigned long)sys_table_arg >> 32;
+        p->efi->efi_memmap_hi           = (unsigned long)*map->map >> 32;
 #endif
 
         return EFI_SUCCESS;
 }
 
-static efi_status_t exit_boot(struct boot_params *boot_params,
-                              void *handle, bool is64)
+static efi_status_t exit_boot(struct boot_params *boot_params, void *handle)
 {
         unsigned long map_sz, key, desc_size, buff_size;
         efi_memory_desc_t *mem_map;
@@ -874,17 +694,16 @@ static efi_status_t exit_boot(struct boot_params *boot_params,
         struct efi_boot_memmap map;
         struct exit_boot_struct priv;
 
-        map.map =               &mem_map;
-        map.map_size =          &map_sz;
-        map.desc_size =         &desc_size;
-        map.desc_ver =          &desc_version;
-        map.key_ptr =           &key;
-        map.buff_size =         &buff_size;
-        priv.boot_params =      boot_params;
-        priv.efi =              &boot_params->efi_info;
-        priv.e820ext =          NULL;
-        priv.e820ext_size =     0;
-        priv.is64 =             is64;
+        map.map                 = &mem_map;
+        map.map_size            = &map_sz;
+        map.desc_size           = &desc_size;
+        map.desc_ver            = &desc_version;
+        map.key_ptr             = &key;
+        map.buff_size           = &buff_size;
+        priv.boot_params        = boot_params;
+        priv.efi                = &boot_params->efi_info;
+        priv.e820ext            = NULL;
+        priv.e820ext_size       = 0;
 
         /* Might as well exit boot services now */
         status = efi_exit_boot_services(sys_table, handle, &map, &priv,
@@ -892,10 +711,11 @@ static efi_status_t exit_boot(struct boot_params *boot_params,
         if (status != EFI_SUCCESS)
                 return status;
 
-        e820ext = priv.e820ext;
-        e820ext_size = priv.e820ext_size;
+        e820ext                 = priv.e820ext;
+        e820ext_size            = priv.e820ext_size;
+
         /* Historic? */
-        boot_params->alt_mem_k = 32 * 1024;
+        boot_params->alt_mem_k  = 32 * 1024;
 
         status = setup_e820(boot_params, e820ext, e820ext_size);
         if (status != EFI_SUCCESS)
@@ -908,8 +728,8 @@ static efi_status_t exit_boot(struct boot_params *boot_params,
  * On success we return a pointer to a boot_params structure, and NULL
  * on failure.
  */
-struct boot_params *efi_main(struct efi_config *c,
-                             struct boot_params *boot_params)
+struct boot_params *
+efi_main(struct efi_config *c, struct boot_params *boot_params)
 {
         struct desc_ptr *gdt = NULL;
         efi_loaded_image_t *image;
@@ -918,13 +738,11 @@ struct boot_params *efi_main(struct efi_config *c,
         struct desc_struct *desc;
         void *handle;
         efi_system_table_t *_table;
-        bool is64;
 
         efi_early = c;
 
         _table = (efi_system_table_t *)(unsigned long)efi_early->table;
         handle = (void *)(unsigned long)efi_early->image_handle;
-        is64 = efi_early->is64;
 
         sys_table = _table;
 
@@ -932,7 +750,7 @@ struct boot_params *efi_main(struct efi_config *c,
         if (sys_table->hdr.signature != EFI_SYSTEM_TABLE_SIGNATURE)
                 goto fail;
 
-        if (is64)
+        if (efi_is_64bit())
                 setup_boot_services64(efi_early);
         else
                 setup_boot_services32(efi_early);
@@ -957,7 +775,7 @@ struct boot_params *efi_main(struct efi_config *c,
         status = efi_call_early(allocate_pool, EFI_LOADER_DATA,
                                 sizeof(*gdt), (void **)&gdt);
         if (status != EFI_SUCCESS) {
-                efi_printk(sys_table, "Failed to alloc mem for gdt structure\n");
+                efi_printk(sys_table, "Failed to allocate memory for 'gdt' structure\n");
                 goto fail;
         }
 
@@ -965,7 +783,7 @@ struct boot_params *efi_main(struct efi_config *c,
         status = efi_low_alloc(sys_table, gdt->size, 8,
                            (unsigned long *)&gdt->address);
         if (status != EFI_SUCCESS) {
-                efi_printk(sys_table, "Failed to alloc mem for gdt\n");
+                efi_printk(sys_table, "Failed to allocate memory for 'gdt'\n");
                 goto fail;
         }
 
@@ -988,7 +806,7 @@ struct boot_params *efi_main(struct efi_config *c,
                 hdr->code32_start = bzimage_addr;
         }
 
-        status = exit_boot(boot_params, handle, is64);
+        status = exit_boot(boot_params, handle);
         if (status != EFI_SUCCESS) {
                 efi_printk(sys_table, "exit_boot() failed!\n");
                 goto fail;
@@ -1002,19 +820,20 @@ struct boot_params *efi_main(struct efi_config *c,
 
         if (IS_ENABLED(CONFIG_X86_64)) {
                 /* __KERNEL32_CS */
-                desc->limit0 = 0xffff;
-                desc->base0 = 0x0000;
-                desc->base1 = 0x0000;
-                desc->type = SEG_TYPE_CODE | SEG_TYPE_EXEC_READ;
-                desc->s = DESC_TYPE_CODE_DATA;
-                desc->dpl = 0;
-                desc->p = 1;
-                desc->limit1 = 0xf;
-                desc->avl = 0;
-                desc->l = 0;
-                desc->d = SEG_OP_SIZE_32BIT;
-                desc->g = SEG_GRANULARITY_4KB;
-                desc->base2 = 0x00;
+                desc->limit0    = 0xffff;
+                desc->base0     = 0x0000;
+                desc->base1     = 0x0000;
+                desc->type      = SEG_TYPE_CODE | SEG_TYPE_EXEC_READ;
+                desc->s         = DESC_TYPE_CODE_DATA;
+                desc->dpl       = 0;
+                desc->p         = 1;
+                desc->limit1    = 0xf;
+                desc->avl       = 0;
+                desc->l         = 0;
+                desc->d         = SEG_OP_SIZE_32BIT;
+                desc->g         = SEG_GRANULARITY_4KB;
+                desc->base2     = 0x00;
+
                 desc++;
         } else {
                 /* Second entry is unused on 32-bit */
@@ -1022,15 +841,16 @@ struct boot_params *efi_main(struct efi_config *c,
         }
 
         /* __KERNEL_CS */
-        desc->limit0 = 0xffff;
-        desc->base0 = 0x0000;
-        desc->base1 = 0x0000;
-        desc->type = SEG_TYPE_CODE | SEG_TYPE_EXEC_READ;
-        desc->s = DESC_TYPE_CODE_DATA;
-        desc->dpl = 0;
-        desc->p = 1;
-        desc->limit1 = 0xf;
-        desc->avl = 0;
+        desc->limit0    = 0xffff;
+        desc->base0     = 0x0000;
+        desc->base1     = 0x0000;
+        desc->type      = SEG_TYPE_CODE | SEG_TYPE_EXEC_READ;
+        desc->s         = DESC_TYPE_CODE_DATA;
+        desc->dpl       = 0;
+        desc->p         = 1;
+        desc->limit1    = 0xf;
+        desc->avl       = 0;
+
         if (IS_ENABLED(CONFIG_X86_64)) {
                 desc->l = 1;
                 desc->d = 0;
@@ -1038,41 +858,41 @@ struct boot_params *efi_main(struct efi_config *c,
                 desc->l = 0;
                 desc->d = SEG_OP_SIZE_32BIT;
         }
-        desc->g = SEG_GRANULARITY_4KB;
-        desc->base2 = 0x00;
+        desc->g         = SEG_GRANULARITY_4KB;
+        desc->base2     = 0x00;
         desc++;
 
         /* __KERNEL_DS */
-        desc->limit0 = 0xffff;
-        desc->base0 = 0x0000;
-        desc->base1 = 0x0000;
-        desc->type = SEG_TYPE_DATA | SEG_TYPE_READ_WRITE;
-        desc->s = DESC_TYPE_CODE_DATA;
-        desc->dpl = 0;
-        desc->p = 1;
-        desc->limit1 = 0xf;
-        desc->avl = 0;
-        desc->l = 0;
-        desc->d = SEG_OP_SIZE_32BIT;
-        desc->g = SEG_GRANULARITY_4KB;
-        desc->base2 = 0x00;
+        desc->limit0    = 0xffff;
+        desc->base0     = 0x0000;
+        desc->base1     = 0x0000;
+        desc->type      = SEG_TYPE_DATA | SEG_TYPE_READ_WRITE;
+        desc->s         = DESC_TYPE_CODE_DATA;
+        desc->dpl       = 0;
+        desc->p         = 1;
+        desc->limit1    = 0xf;
+        desc->avl       = 0;
+        desc->l         = 0;
+        desc->d         = SEG_OP_SIZE_32BIT;
+        desc->g         = SEG_GRANULARITY_4KB;
+        desc->base2     = 0x00;
         desc++;
 
         if (IS_ENABLED(CONFIG_X86_64)) {
                 /* Task segment value */
-                desc->limit0 = 0x0000;
-                desc->base0 = 0x0000;
-                desc->base1 = 0x0000;
-                desc->type = SEG_TYPE_TSS;
-                desc->s = 0;
-                desc->dpl = 0;
-                desc->p = 1;
-                desc->limit1 = 0x0;
-                desc->avl = 0;
-                desc->l = 0;
-                desc->d = 0;
-                desc->g = SEG_GRANULARITY_4KB;
-                desc->base2 = 0x00;
+                desc->limit0    = 0x0000;
+                desc->base0     = 0x0000;
+                desc->base1     = 0x0000;
+                desc->type      = SEG_TYPE_TSS;
+                desc->s         = 0;
+                desc->dpl       = 0;
+                desc->p         = 1;
+                desc->limit1    = 0x0;
+                desc->avl       = 0;
+                desc->l         = 0;
+                desc->d         = 0;
+                desc->g         = SEG_GRANULARITY_4KB;
+                desc->base2     = 0x00;
                 desc++;
         }
 
@@ -1082,5 +902,6 @@ struct boot_params *efi_main(struct efi_config *c,
         return boot_params;
 fail:
         efi_printk(sys_table, "efi_main() failed!\n");
+
         return NULL;
 }
diff --git a/arch/x86/boot/compressed/eboot.h b/arch/x86/boot/compressed/eboot.h
index e799dc5c6448..8297387c4676 100644
--- a/arch/x86/boot/compressed/eboot.h
+++ b/arch/x86/boot/compressed/eboot.h
@@ -12,22 +12,22 @@
 
 #define DESC_TYPE_CODE_DATA     (1 << 0)
 
-struct efi_uga_draw_protocol_32 {
+typedef struct {
         u32 get_mode;
         u32 set_mode;
         u32 blt;
-};
+} efi_uga_draw_protocol_32_t;
 
-struct efi_uga_draw_protocol_64 {
+typedef struct {
         u64 get_mode;
         u64 set_mode;
         u64 blt;
-};
+} efi_uga_draw_protocol_64_t;
 
-struct efi_uga_draw_protocol {
+typedef struct {
         void *get_mode;
         void *set_mode;
         void *blt;
-};
+} efi_uga_draw_protocol_t;
 
 #endif /* BOOT_COMPRESSED_EBOOT_H */
diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c
index b87a7582853d..302517929932 100644
--- a/arch/x86/boot/compressed/kaslr.c
+++ b/arch/x86/boot/compressed/kaslr.c
@@ -102,7 +102,7 @@ static bool memmap_too_large;
 
 
 /* Store memory limit specified by "mem=nn[KMG]" or "memmap=nn[KMG]" */
-unsigned long long mem_limit = ULLONG_MAX;
+static unsigned long long mem_limit = ULLONG_MAX;
 
 
 enum mem_avoid_index {
@@ -215,7 +215,36 @@ static void mem_avoid_memmap(char *str)
                 memmap_too_large = true;
 }
 
-static int handle_mem_memmap(void)
+/* Store the number of 1GB huge pages which users specified: */
+static unsigned long max_gb_huge_pages;
+
+static void parse_gb_huge_pages(char *param, char *val)
+{
+        static bool gbpage_sz;
+        char *p;
+
+        if (!strcmp(param, "hugepagesz")) {
+                p = val;
+                if (memparse(p, &p) != PUD_SIZE) {
+                        gbpage_sz = false;
+                        return;
+                }
+
+                if (gbpage_sz)
+                        warn("Repeatedly set hugeTLB page size of 1G!\n");
+                gbpage_sz = true;
+                return;
+        }
+
+        if (!strcmp(param, "hugepages") && gbpage_sz) {
+                p = val;
+                max_gb_huge_pages = simple_strtoull(p, &p, 0);
+                return;
+        }
+}
+
+
+static int handle_mem_options(void)
 {
         char *args = (char *)get_cmd_line_ptr();
         size_t len = strlen((char *)args);
@@ -223,7 +252,8 @@ static int handle_mem_memmap(void)
         char *param, *val;
         u64 mem_size;
 
-        if (!strstr(args, "memmap=") && !strstr(args, "mem="))
+        if (!strstr(args, "memmap=") && !strstr(args, "mem=") &&
+                !strstr(args, "hugepages"))
                 return 0;
 
         tmp_cmdline = malloc(len + 1);
@@ -248,6 +278,8 @@ static int handle_mem_memmap(void)
 
                 if (!strcmp(param, "memmap")) {
                         mem_avoid_memmap(val);
+                } else if (strstr(param, "hugepages")) {
+                        parse_gb_huge_pages(param, val);
                 } else if (!strcmp(param, "mem")) {
                         char *p = val;
 
@@ -387,7 +419,7 @@ static void mem_avoid_init(unsigned long input, unsigned long input_size,
         /* We don't need to set a mapping for setup_data. */
 
         /* Mark the memmap regions we need to avoid */
-        handle_mem_memmap();
+        handle_mem_options();
 
 #ifdef CONFIG_X86_VERBOSE_BOOTUP
         /* Make sure video RAM can be used. */
@@ -466,6 +498,60 @@ static void store_slot_info(struct mem_vector *region, unsigned long image_size)
         }
 }
 
+/*
+ * Skip as many 1GB huge pages as possible in the passed region
+ * according to the number which users specified:
+ */
+static void
+process_gb_huge_pages(struct mem_vector *region, unsigned long image_size)
+{
+        unsigned long addr, size = 0;
+        struct mem_vector tmp;
+        int i = 0;
+
+        if (!max_gb_huge_pages) {
+                store_slot_info(region, image_size);
+                return;
+        }
+
+        addr = ALIGN(region->start, PUD_SIZE);
+        /* Did we raise the address above the passed in memory entry? */
+        if (addr < region->start + region->size)
+                size = region->size - (addr - region->start);
+
+        /* Check how many 1GB huge pages can be filtered out: */
+        while (size > PUD_SIZE && max_gb_huge_pages) {
+                size -= PUD_SIZE;
+                max_gb_huge_pages--;
+                i++;
+        }
+
+        /* No good 1GB huge pages found: */
+        if (!i) {
+                store_slot_info(region, image_size);
+                return;
+        }
+
+        /*
+         * Skip those 'i'*1GB good huge pages, and continue checking and
+         * processing the remaining head or tail part of the passed region
+         * if available.
+         */
+
+        if (addr >= region->start + image_size) {
+                tmp.start = region->start;
+                tmp.size = addr - region->start;
+                store_slot_info(&tmp, image_size);
+        }
+
+        size  = region->size - (addr - region->start) - i * PUD_SIZE;
+        if (size >= image_size) {
+                tmp.start = addr + i * PUD_SIZE;
+                tmp.size = size;
+                store_slot_info(&tmp, image_size);
+        }
+}
+
 static unsigned long slots_fetch_random(void)
 {
         unsigned long slot;
@@ -546,7 +632,7 @@ static void process_mem_region(struct mem_vector *entry,
 
                 /* If nothing overlaps, store the region and return. */
                 if (!mem_avoid_overlap(&region, &overlap)) {
-                        store_slot_info(&region, image_size);
+                        process_gb_huge_pages(&region, image_size);
                         return;
                 }
 
@@ -556,7 +642,7 @@ static void process_mem_region(struct mem_vector *entry,
 
                         beginning.start = region.start;
                         beginning.size = overlap.start - region.start;
-                        store_slot_info(&beginning, image_size);
+                        process_gb_huge_pages(&beginning, image_size);
                 }
 
                 /* Return if overlap extends to or past end of region. */
diff --git a/arch/x86/boot/compressed/pgtable_64.c b/arch/x86/boot/compressed/pgtable_64.c
index 8c5107545251..9e2157371491 100644
--- a/arch/x86/boot/compressed/pgtable_64.c
+++ b/arch/x86/boot/compressed/pgtable_64.c
@@ -1,3 +1,4 @@
+#include <asm/e820/types.h>
 #include <asm/processor.h>
 #include "pgtable.h"
 #include "../string.h"
@@ -34,10 +35,62 @@ unsigned long *trampoline_32bit __section(.data);
 extern struct boot_params *boot_params;
 int cmdline_find_option_bool(const char *option);
 
+static unsigned long find_trampoline_placement(void)
+{
+        unsigned long bios_start, ebda_start;
+        unsigned long trampoline_start;
+        struct boot_e820_entry *entry;
+        int i;
+
+        /*
+         * Find a suitable spot for the trampoline.
+         * This code is based on reserve_bios_regions().
+         */
+
+        ebda_start = *(unsigned short *)0x40e << 4;
+        bios_start = *(unsigned short *)0x413 << 10;
+
+        if (bios_start < BIOS_START_MIN || bios_start > BIOS_START_MAX)
+                bios_start = BIOS_START_MAX;
+
+        if (ebda_start > BIOS_START_MIN && ebda_start < bios_start)
+                bios_start = ebda_start;
+
+        bios_start = round_down(bios_start, PAGE_SIZE);
+
+        /* Find the first usable memory region under bios_start. */
+        for (i = boot_params->e820_entries - 1; i >= 0; i--) {
+                entry = &boot_params->e820_table[i];
+
+                /* Skip all entries above bios_start. */
+                if (bios_start <= entry->addr)
+                        continue;
+
+                /* Skip non-RAM entries. */
+                if (entry->type != E820_TYPE_RAM)
+                        continue;
+
+                /* Adjust bios_start to the end of the entry if needed. */
+                if (bios_start > entry->addr + entry->size)
+                        bios_start = entry->addr + entry->size;
+
+                /* Keep bios_start page-aligned. */
+                bios_start = round_down(bios_start, PAGE_SIZE);
+
+                /* Skip the entry if it's too small. */
+                if (bios_start - TRAMPOLINE_32BIT_SIZE < entry->addr)
+                        continue;
+
+                break;
+        }
+
+        /* Place the trampoline just below the end of low memory */
+        return bios_start - TRAMPOLINE_32BIT_SIZE;
+}
+
 struct paging_config paging_prepare(void *rmode)
 {
         struct paging_config paging_config = {};
-        unsigned long bios_start, ebda_start;
 
         /* Initialize boot_params. Required for cmdline_find_option_bool(). */
         boot_params = rmode;
@@ -61,23 +114,7 @@ struct paging_config paging_prepare(void *rmode)
                 paging_config.l5_required = 1;
         }
 
-        /*
-         * Find a suitable spot for the trampoline.
-         * This code is based on reserve_bios_regions().
-         */
-
-        ebda_start = *(unsigned short *)0x40e << 4;
-        bios_start = *(unsigned short *)0x413 << 10;
-
-        if (bios_start < BIOS_START_MIN || bios_start > BIOS_START_MAX)
-                bios_start = BIOS_START_MAX;
-
-        if (ebda_start > BIOS_START_MIN && ebda_start < bios_start)
-                bios_start = ebda_start;
-
-        /* Place the trampoline just below the end of low memory, aligned to 4k */
-        paging_config.trampoline_start = bios_start - TRAMPOLINE_32BIT_SIZE;
-        paging_config.trampoline_start = round_down(paging_config.trampoline_start, PAGE_SIZE);
+        paging_config.trampoline_start = find_trampoline_placement();
 
         trampoline_32bit = (unsigned long *)paging_config.trampoline_start;
 
diff --git a/arch/x86/boot/string.c b/arch/x86/boot/string.c
index 16f49123d747..c4428a176973 100644
--- a/arch/x86/boot/string.c
+++ b/arch/x86/boot/string.c
@@ -13,6 +13,7 @@
  */
 
 #include <linux/types.h>
+#include <asm/asm.h>
 #include "ctype.h"
 #include "string.h"
 
@@ -28,8 +29,8 @@
 int memcmp(const void *s1, const void *s2, size_t len)
 {
         bool diff;
-        asm("repe; cmpsb; setnz %0"
-            : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
+        asm("repe; cmpsb" CC_SET(nz)
+            : CC_OUT(nz) (diff), "+D" (s1), "+S" (s2), "+c" (len));
         return diff;
 }
 
diff --git a/arch/x86/crypto/aegis128-aesni-asm.S b/arch/x86/crypto/aegis128-aesni-asm.S
index 717bf0776421..5f7e43d4f64a 100644
--- a/arch/x86/crypto/aegis128-aesni-asm.S
+++ b/arch/x86/crypto/aegis128-aesni-asm.S
@@ -75,7 +75,7 @@
  *   %r9
  */
 __load_partial:
-        xor %r9, %r9
+        xor %r9d, %r9d
         pxor MSG, MSG
 
         mov LEN, %r8
diff --git a/arch/x86/crypto/aegis128-aesni-glue.c b/arch/x86/crypto/aegis128-aesni-glue.c
index 5de7c0d46edf..acd11b3bf639 100644
--- a/arch/x86/crypto/aegis128-aesni-glue.c
+++ b/arch/x86/crypto/aegis128-aesni-glue.c
@@ -375,16 +375,12 @@ static struct aead_alg crypto_aegis128_aesni_alg[] = {
         }
 };
 
-static const struct x86_cpu_id aesni_cpu_id[] = {
-        X86_FEATURE_MATCH(X86_FEATURE_AES),
-        X86_FEATURE_MATCH(X86_FEATURE_XMM2),
-        {}
-};
-MODULE_DEVICE_TABLE(x86cpu, aesni_cpu_id);
-
 static int __init crypto_aegis128_aesni_module_init(void)
 {
-        if (!x86_match_cpu(aesni_cpu_id))
+        if (!boot_cpu_has(X86_FEATURE_XMM2) ||
+            !boot_cpu_has(X86_FEATURE_AES) ||
+            !boot_cpu_has(X86_FEATURE_OSXSAVE) ||
+            !cpu_has_xfeatures(XFEATURE_MASK_SSE, NULL))
                 return -ENODEV;
 
         return crypto_register_aeads(crypto_aegis128_aesni_alg,
diff --git a/arch/x86/crypto/aegis128l-aesni-asm.S b/arch/x86/crypto/aegis128l-aesni-asm.S
index 4eda2b8db9e1..491dd61c845c 100644
--- a/arch/x86/crypto/aegis128l-aesni-asm.S
+++ b/arch/x86/crypto/aegis128l-aesni-asm.S
@@ -66,7 +66,7 @@
  *   %r9
  */
 __load_partial:
-        xor %r9, %r9
+        xor %r9d, %r9d
         pxor MSG0, MSG0
         pxor MSG1, MSG1
 
diff --git a/arch/x86/crypto/aegis128l-aesni-glue.c b/arch/x86/crypto/aegis128l-aesni-glue.c
index 876e4866e633..2071c3d1ae07 100644
--- a/arch/x86/crypto/aegis128l-aesni-glue.c
+++ b/arch/x86/crypto/aegis128l-aesni-glue.c
@@ -375,16 +375,12 @@ static struct aead_alg crypto_aegis128l_aesni_alg[] = {
         }
 };
 
-static const struct x86_cpu_id aesni_cpu_id[] = {
-        X86_FEATURE_MATCH(X86_FEATURE_AES),
-        X86_FEATURE_MATCH(X86_FEATURE_XMM2),
-        {}
-};
-MODULE_DEVICE_TABLE(x86cpu, aesni_cpu_id);
-
 static int __init crypto_aegis128l_aesni_module_init(void)
 {
-        if (!x86_match_cpu(aesni_cpu_id))
+        if (!boot_cpu_has(X86_FEATURE_XMM2) ||
+            !boot_cpu_has(X86_FEATURE_AES) ||
+            !boot_cpu_has(X86_FEATURE_OSXSAVE) ||
+            !cpu_has_xfeatures(XFEATURE_MASK_SSE, NULL))
                 return -ENODEV;
 
         return crypto_register_aeads(crypto_aegis128l_aesni_alg,
diff --git a/arch/x86/crypto/aegis256-aesni-asm.S b/arch/x86/crypto/aegis256-aesni-asm.S
index 32aae8397268..8870c7c5d9a4 100644
--- a/arch/x86/crypto/aegis256-aesni-asm.S
+++ b/arch/x86/crypto/aegis256-aesni-asm.S
@@ -59,7 +59,7 @@
  *   %r9
  */
 __load_partial:
-        xor %r9, %r9
+        xor %r9d, %r9d
         pxor MSG, MSG
 
         mov LEN, %r8
diff --git a/arch/x86/crypto/aegis256-aesni-glue.c b/arch/x86/crypto/aegis256-aesni-glue.c
index 2b5dd3af8f4d..b5f2a8fd5a71 100644
--- a/arch/x86/crypto/aegis256-aesni-glue.c
+++ b/arch/x86/crypto/aegis256-aesni-glue.c
@@ -375,16 +375,12 @@ static struct aead_alg crypto_aegis256_aesni_alg[] = {
         }
 };
 
-static const struct x86_cpu_id aesni_cpu_id[] = {
-        X86_FEATURE_MATCH(X86_FEATURE_AES),
-        X86_FEATURE_MATCH(X86_FEATURE_XMM2),
-        {}
-};
-MODULE_DEVICE_TABLE(x86cpu, aesni_cpu_id);
-
 static int __init crypto_aegis256_aesni_module_init(void)
 {
-        if (!x86_match_cpu(aesni_cpu_id))
+        if (!boot_cpu_has(X86_FEATURE_XMM2) ||
+            !boot_cpu_has(X86_FEATURE_AES) ||
+            !boot_cpu_has(X86_FEATURE_OSXSAVE) ||
+            !cpu_has_xfeatures(XFEATURE_MASK_SSE, NULL))
                 return -ENODEV;
 
         return crypto_register_aeads(crypto_aegis256_aesni_alg,
diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
index e762ef417562..9bd139569b41 100644
--- a/arch/x86/crypto/aesni-intel_asm.S
+++ b/arch/x86/crypto/aesni-intel_asm.S
@@ -258,7 +258,7 @@ ALL_F:      .octa 0xffffffffffffffffffffffffffffffff
 .macro GCM_INIT Iv SUBKEY AAD AADLEN
         mov \AADLEN, %r11
         mov %r11, AadLen(%arg2) # ctx_data.aad_length = aad_length
-        xor %r11, %r11
+        xor %r11d, %r11d
         mov %r11, InLen(%arg2) # ctx_data.in_length = 0
         mov %r11, PBlockLen(%arg2) # ctx_data.partial_block_length = 0
         mov %r11, PBlockEncKey(%arg2) # ctx_data.partial_block_enc_key = 0
@@ -286,7 +286,7 @@ ALL_F:      .octa 0xffffffffffffffffffffffffffffffff
         movdqu HashKey(%arg2), %xmm13
         add %arg5, InLen(%arg2)
 
-        xor %r11, %r11 # initialise the data pointer offset as zero
+        xor %r11d, %r11d # initialise the data pointer offset as zero
         PARTIAL_BLOCK %arg3 %arg4 %arg5 %r11 %xmm8 \operation
 
         sub %r11, %arg5         # sub partial block data used
@@ -702,7 +702,7 @@ _no_extra_mask_1_\@:
 
         # GHASH computation for the last <16 Byte block
         GHASH_MUL \AAD_HASH, %xmm13, %xmm0, %xmm10, %xmm11, %xmm5, %xmm6
-        xor     %rax,%rax
+        xor     %eax, %eax
 
         mov     %rax, PBlockLen(%arg2)
         jmp     _dec_done_\@
@@ -737,7 +737,7 @@ _no_extra_mask_2_\@:
 
         # GHASH computation for the last <16 Byte block
         GHASH_MUL \AAD_HASH, %xmm13, %xmm0, %xmm10, %xmm11, %xmm5, %xmm6
-        xor     %rax,%rax
+        xor     %eax, %eax
 
         mov     %rax, PBlockLen(%arg2)
         jmp     _encode_done_\@
diff --git a/arch/x86/crypto/aesni-intel_avx-x86_64.S b/arch/x86/crypto/aesni-intel_avx-x86_64.S
index faecb1518bf8..1985ea0b551b 100644
--- a/arch/x86/crypto/aesni-intel_avx-x86_64.S
+++ b/arch/x86/crypto/aesni-intel_avx-x86_64.S
@@ -463,7 +463,7 @@ _get_AAD_rest_final\@:
 
 _get_AAD_done\@:
         # initialize the data pointer offset as zero
-        xor     %r11, %r11
+        xor     %r11d, %r11d
 
         # start AES for num_initial_blocks blocks
         mov     arg5, %rax                     # rax = *Y0
@@ -1770,7 +1770,7 @@ _get_AAD_rest_final\@:
 
 _get_AAD_done\@:
         # initialize the data pointer offset as zero
-        xor     %r11, %r11
+        xor     %r11d, %r11d
 
         # start AES for num_initial_blocks blocks
         mov     arg5, %rax                     # rax = *Y0
diff --git a/arch/x86/crypto/morus1280-avx2-asm.S b/arch/x86/crypto/morus1280-avx2-asm.S
index 07653d4582a6..de182c460f82 100644
--- a/arch/x86/crypto/morus1280-avx2-asm.S
+++ b/arch/x86/crypto/morus1280-avx2-asm.S
@@ -113,7 +113,7 @@ ENDPROC(__morus1280_update_zero)
  *   %r9
  */
 __load_partial:
-        xor %r9, %r9
+        xor %r9d, %r9d
         vpxor MSG, MSG, MSG
 
         mov %rcx, %r8
diff --git a/arch/x86/crypto/morus1280-avx2-glue.c b/arch/x86/crypto/morus1280-avx2-glue.c
index f111f36d26dc..6634907d6ccd 100644
--- a/arch/x86/crypto/morus1280-avx2-glue.c
+++ b/arch/x86/crypto/morus1280-avx2-glue.c
@@ -37,15 +37,11 @@ asmlinkage void crypto_morus1280_avx2_final(void *state, void *tag_xor,
 
 MORUS1280_DECLARE_ALGS(avx2, "morus1280-avx2", 400);
 
-static const struct x86_cpu_id avx2_cpu_id[] = {
-    X86_FEATURE_MATCH(X86_FEATURE_AVX2),
-    {}
-};
-MODULE_DEVICE_TABLE(x86cpu, avx2_cpu_id);
-
 static int __init crypto_morus1280_avx2_module_init(void)
 {
-        if (!x86_match_cpu(avx2_cpu_id))
+        if (!boot_cpu_has(X86_FEATURE_AVX2) ||
+            !boot_cpu_has(X86_FEATURE_OSXSAVE) ||
+            !cpu_has_xfeatures(XFEATURE_MASK_SSE | XFEATURE_MASK_YMM, NULL))
                 return -ENODEV;
 
         return crypto_register_aeads(crypto_morus1280_avx2_algs,
diff --git a/arch/x86/crypto/morus1280-sse2-asm.S b/arch/x86/crypto/morus1280-sse2-asm.S
index bd1aa1b60869..da5d2905db60 100644
--- a/arch/x86/crypto/morus1280-sse2-asm.S
+++ b/arch/x86/crypto/morus1280-sse2-asm.S
@@ -235,7 +235,7 @@ ENDPROC(__morus1280_update_zero)
  *   %r9
  */
 __load_partial:
-        xor %r9, %r9
+        xor %r9d, %r9d
         pxor MSG_LO, MSG_LO
         pxor MSG_HI, MSG_HI
 
diff --git a/arch/x86/crypto/morus1280-sse2-glue.c b/arch/x86/crypto/morus1280-sse2-glue.c
index 839270aa713c..95cf857d2cbb 100644
--- a/arch/x86/crypto/morus1280-sse2-glue.c
+++ b/arch/x86/crypto/morus1280-sse2-glue.c
@@ -37,15 +37,11 @@ asmlinkage void crypto_morus1280_sse2_final(void *state, void *tag_xor,
 
 MORUS1280_DECLARE_ALGS(sse2, "morus1280-sse2", 350);
 
-static const struct x86_cpu_id sse2_cpu_id[] = {
-    X86_FEATURE_MATCH(X86_FEATURE_XMM2),
-    {}
-};
-MODULE_DEVICE_TABLE(x86cpu, sse2_cpu_id);
-
 static int __init crypto_morus1280_sse2_module_init(void)
 {
-        if (!x86_match_cpu(sse2_cpu_id))
+        if (!boot_cpu_has(X86_FEATURE_XMM2) ||
+            !boot_cpu_has(X86_FEATURE_OSXSAVE) ||
+            !cpu_has_xfeatures(XFEATURE_MASK_SSE, NULL))
                 return -ENODEV;
 
         return crypto_register_aeads(crypto_morus1280_sse2_algs,
diff --git a/arch/x86/crypto/morus640-sse2-asm.S b/arch/x86/crypto/morus640-sse2-asm.S
index efa02816d921..414db480250e 100644
--- a/arch/x86/crypto/morus640-sse2-asm.S
+++ b/arch/x86/crypto/morus640-sse2-asm.S
@@ -113,7 +113,7 @@ ENDPROC(__morus640_update_zero)
  *   %r9
  */
 __load_partial:
-        xor %r9, %r9
+        xor %r9d, %r9d
         pxor MSG, MSG
 
         mov %rcx, %r8
diff --git a/arch/x86/crypto/morus640-sse2-glue.c b/arch/x86/crypto/morus640-sse2-glue.c
index 26b47e2db8d2..615fb7bc9a32 100644
--- a/arch/x86/crypto/morus640-sse2-glue.c
+++ b/arch/x86/crypto/morus640-sse2-glue.c
@@ -37,15 +37,11 @@ asmlinkage void crypto_morus640_sse2_final(void *state, void *tag_xor,
 
 MORUS640_DECLARE_ALGS(sse2, "morus640-sse2", 400);
 
-static const struct x86_cpu_id sse2_cpu_id[] = {
-    X86_FEATURE_MATCH(X86_FEATURE_XMM2),
-    {}
-};
-MODULE_DEVICE_TABLE(x86cpu, sse2_cpu_id);
-
 static int __init crypto_morus640_sse2_module_init(void)
 {
-        if (!x86_match_cpu(sse2_cpu_id))
+        if (!boot_cpu_has(X86_FEATURE_XMM2) ||
+            !boot_cpu_has(X86_FEATURE_OSXSAVE) ||
+            !cpu_has_xfeatures(XFEATURE_MASK_SSE, NULL))
                 return -ENODEV;
 
         return crypto_register_aeads(crypto_morus640_sse2_algs,
diff --git a/arch/x86/crypto/sha1_ssse3_asm.S b/arch/x86/crypto/sha1_ssse3_asm.S
index 6204bd53528c..613d0bfc3d84 100644
--- a/arch/x86/crypto/sha1_ssse3_asm.S
+++ b/arch/x86/crypto/sha1_ssse3_asm.S
@@ -96,7 +96,7 @@
         # cleanup workspace
         mov     $8, %ecx
         mov     %rsp, %rdi
-        xor     %rax, %rax
+        xor     %eax, %eax
         rep stosq
 
         mov     %rbp, %rsp              # deallocate workspace
diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
index c371bfee137a..2767c625a52c 100644
--- a/arch/x86/entry/entry_32.S
+++ b/arch/x86/entry/entry_32.S
@@ -65,7 +65,7 @@
 # define preempt_stop(clobbers) DISABLE_INTERRUPTS(clobbers); TRACE_IRQS_OFF
 #else
 # define preempt_stop(clobbers)
-# define resume_kernel          restore_all
+# define resume_kernel          restore_all_kernel
 #endif
 
 .macro TRACE_IRQS_IRET
@@ -77,6 +77,8 @@
 #endif
 .endm
 
+#define PTI_SWITCH_MASK         (1 << PAGE_SHIFT)
+
 /*
  * User gs save/restore
  *
@@ -154,7 +156,52 @@
 
 #endif /* CONFIG_X86_32_LAZY_GS */
 
-.macro SAVE_ALL pt_regs_ax=%eax
+/* Unconditionally switch to user cr3 */
+.macro SWITCH_TO_USER_CR3 scratch_reg:req
+        ALTERNATIVE "jmp .Lend_\@", "", X86_FEATURE_PTI
+
+        movl    %cr3, \scratch_reg
+        orl     $PTI_SWITCH_MASK, \scratch_reg
+        movl    \scratch_reg, %cr3
+.Lend_\@:
+.endm
+
+.macro BUG_IF_WRONG_CR3 no_user_check=0
+#ifdef CONFIG_DEBUG_ENTRY
+        ALTERNATIVE "jmp .Lend_\@", "", X86_FEATURE_PTI
+        .if \no_user_check == 0
+        /* coming from usermode? */
+        testl   $SEGMENT_RPL_MASK, PT_CS(%esp)
+        jz      .Lend_\@
+        .endif
+        /* On user-cr3? */
+        movl    %cr3, %eax
+        testl   $PTI_SWITCH_MASK, %eax
+        jnz     .Lend_\@
+        /* From userspace with kernel cr3 - BUG */
+        ud2
+.Lend_\@:
+#endif
+.endm
+
+/*
+ * Switch to kernel cr3 if not already loaded and return current cr3 in
+ * \scratch_reg
+ */
+.macro SWITCH_TO_KERNEL_CR3 scratch_reg:req
+        ALTERNATIVE "jmp .Lend_\@", "", X86_FEATURE_PTI
+        movl    %cr3, \scratch_reg
+        /* Test if we are already on kernel CR3 */
+        testl   $PTI_SWITCH_MASK, \scratch_reg
+        jz      .Lend_\@
+        andl    $(~PTI_SWITCH_MASK), \scratch_reg
+        movl    \scratch_reg, %cr3
+        /* Return original CR3 in \scratch_reg */
+        orl     $PTI_SWITCH_MASK, \scratch_reg
+.Lend_\@:
+.endm
+
+.macro SAVE_ALL pt_regs_ax=%eax switch_stacks=0
         cld
         PUSH_GS
         pushl   %fs
@@ -173,6 +220,29 @@
         movl    $(__KERNEL_PERCPU), %edx
         movl    %edx, %fs
         SET_KERNEL_GS %edx
+
+        /* Switch to kernel stack if necessary */
+.if \switch_stacks > 0
+        SWITCH_TO_KERNEL_STACK
+.endif
+
+.endm
+
+.macro SAVE_ALL_NMI cr3_reg:req
+        SAVE_ALL
+
+        BUG_IF_WRONG_CR3
+
+        /*
+         * Now switch the CR3 when PTI is enabled.
+         *
+         * We can enter with either user or kernel cr3, the code will
+         * store the old cr3 in \cr3_reg and switches to the kernel cr3
+         * if necessary.
+         */
+        SWITCH_TO_KERNEL_CR3 scratch_reg=\cr3_reg
+
+.Lend_\@:
 .endm
 
 /*
@@ -221,6 +291,349 @@
         POP_GS_EX
 .endm
 
+.macro RESTORE_ALL_NMI cr3_reg:req pop=0
+        /*
+         * Now switch the CR3 when PTI is enabled.
+         *
+         * We enter with kernel cr3 and switch the cr3 to the value
+         * stored on \cr3_reg, which is either a user or a kernel cr3.
+         */
+        ALTERNATIVE "jmp .Lswitched_\@", "", X86_FEATURE_PTI
+
+        testl   $PTI_SWITCH_MASK, \cr3_reg
+        jz      .Lswitched_\@
+
+        /* User cr3 in \cr3_reg - write it to hardware cr3 */
+        movl    \cr3_reg, %cr3
+
+.Lswitched_\@:
+
+        BUG_IF_WRONG_CR3
+
+        RESTORE_REGS pop=\pop
+.endm
+
+.macro CHECK_AND_APPLY_ESPFIX
+#ifdef CONFIG_X86_ESPFIX32
+#define GDT_ESPFIX_SS PER_CPU_VAR(gdt_page) + (GDT_ENTRY_ESPFIX_SS * 8)
+
+        ALTERNATIVE     "jmp .Lend_\@", "", X86_BUG_ESPFIX
+
+        movl    PT_EFLAGS(%esp), %eax           # mix EFLAGS, SS and CS
+        /*
+         * Warning: PT_OLDSS(%esp) contains the wrong/random values if we
+         * are returning to the kernel.
+         * See comments in process.c:copy_thread() for details.
+         */
+        movb    PT_OLDSS(%esp), %ah
+        movb    PT_CS(%esp), %al
+        andl    $(X86_EFLAGS_VM | (SEGMENT_TI_MASK << 8) | SEGMENT_RPL_MASK), %eax
+        cmpl    $((SEGMENT_LDT << 8) | USER_RPL), %eax
+        jne     .Lend_\@        # returning to user-space with LDT SS
+
+        /*
+         * Setup and switch to ESPFIX stack
+         *
+         * We're returning to userspace with a 16 bit stack. The CPU will not
+         * restore the high word of ESP for us on executing iret... This is an
+         * "official" bug of all the x86-compatible CPUs, which we can work
+         * around to make dosemu and wine happy. We do this by preloading the
+         * high word of ESP with the high word of the userspace ESP while
+         * compensating for the offset by changing to the ESPFIX segment with
+         * a base address that matches for the difference.
+         */
+        mov     %esp, %edx                      /* load kernel esp */
+        mov     PT_OLDESP(%esp), %eax           /* load userspace esp */
+        mov     %dx, %ax                        /* eax: new kernel esp */
+        sub     %eax, %edx                      /* offset (low word is 0) */
+        shr     $16, %edx
+        mov     %dl, GDT_ESPFIX_SS + 4          /* bits 16..23 */
+        mov     %dh, GDT_ESPFIX_SS + 7          /* bits 24..31 */
+        pushl   $__ESPFIX_SS
+        pushl   %eax                            /* new kernel esp */
+        /*
+         * Disable interrupts, but do not irqtrace this section: we
+         * will soon execute iret and the tracer was already set to
+         * the irqstate after the IRET:
+         */
+        DISABLE_INTERRUPTS(CLBR_ANY)
+        lss     (%esp), %esp                    /* switch to espfix segment */
+.Lend_\@:
+#endif /* CONFIG_X86_ESPFIX32 */
+.endm
+
+/*
+ * Called with pt_regs fully populated and kernel segments loaded,
+ * so we can access PER_CPU and use the integer registers.
+ *
+ * We need to be very careful here with the %esp switch, because an NMI
+ * can happen everywhere. If the NMI handler finds itself on the
+ * entry-stack, it will overwrite the task-stack and everything we
+ * copied there. So allocate the stack-frame on the task-stack and
+ * switch to it before we do any copying.
+ */
+
+#define CS_FROM_ENTRY_STACK     (1 << 31)
+#define CS_FROM_USER_CR3        (1 << 30)
+
+.macro SWITCH_TO_KERNEL_STACK
+
+        ALTERNATIVE     "", "jmp .Lend_\@", X86_FEATURE_XENPV
+
+        BUG_IF_WRONG_CR3
+
+        SWITCH_TO_KERNEL_CR3 scratch_reg=%eax
+
+        /*
+         * %eax now contains the entry cr3 and we carry it forward in
+         * that register for the time this macro runs
+         */
+
+        /* Are we on the entry stack? Bail out if not! */
+        movl    PER_CPU_VAR(cpu_entry_area), %ecx
+        addl    $CPU_ENTRY_AREA_entry_stack + SIZEOF_entry_stack, %ecx
+        subl    %esp, %ecx      /* ecx = (end of entry_stack) - esp */
+        cmpl    $SIZEOF_entry_stack, %ecx
+        jae     .Lend_\@
+
+        /* Load stack pointer into %esi and %edi */
+        movl    %esp, %esi
+        movl    %esi, %edi
+
+        /* Move %edi to the top of the entry stack */
+        andl    $(MASK_entry_stack), %edi
+        addl    $(SIZEOF_entry_stack), %edi
+
+        /* Load top of task-stack into %edi */
+        movl    TSS_entry2task_stack(%edi), %edi
+
+        /*
+         * Clear unused upper bits of the dword containing the word-sized CS
+         * slot in pt_regs in case hardware didn't clear it for us.
+         */
+        andl    $(0x0000ffff), PT_CS(%esp)
+
+        /* Special case - entry from kernel mode via entry stack */
+#ifdef CONFIG_VM86
+        movl    PT_EFLAGS(%esp), %ecx           # mix EFLAGS and CS
+        movb    PT_CS(%esp), %cl
+        andl    $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %ecx
+#else
+        movl    PT_CS(%esp), %ecx
+        andl    $SEGMENT_RPL_MASK, %ecx
+#endif
+        cmpl    $USER_RPL, %ecx
+        jb      .Lentry_from_kernel_\@
+
+        /* Bytes to copy */
+        movl    $PTREGS_SIZE, %ecx
+
+#ifdef CONFIG_VM86
+        testl   $X86_EFLAGS_VM, PT_EFLAGS(%esi)
+        jz      .Lcopy_pt_regs_\@
+
+        /*
+         * Stack-frame contains 4 additional segment registers when
+         * coming from VM86 mode
+         */
+        addl    $(4 * 4), %ecx
+
+#endif
+.Lcopy_pt_regs_\@:
+
+        /* Allocate frame on task-stack */
+        subl    %ecx, %edi
+
+        /* Switch to task-stack */
+        movl    %edi, %esp
+
+        /*
+         * We are now on the task-stack and can safely copy over the
+         * stack-frame
+         */
+        shrl    $2, %ecx
+        cld
+        rep movsl
+
+        jmp .Lend_\@
+
+.Lentry_from_kernel_\@:
+
+        /*
+         * This handles the case when we enter the kernel from
+         * kernel-mode and %esp points to the entry-stack. When this
+         * happens we need to switch to the task-stack to run C code,
+         * but switch back to the entry-stack again when we approach
+         * iret and return to the interrupted code-path. This usually
+         * happens when we hit an exception while restoring user-space
+         * segment registers on the way back to user-space or when the
+         * sysenter handler runs with eflags.tf set.
+         *
+         * When we switch to the task-stack here, we can't trust the
+         * contents of the entry-stack anymore, as the exception handler
+         * might be scheduled out or moved to another CPU. Therefore we
+         * copy the complete entry-stack to the task-stack and set a
+         * marker in the iret-frame (bit 31 of the CS dword) to detect
+         * what we've done on the iret path.
+         *
+         * On the iret path we copy everything back and switch to the
+         * entry-stack, so that the interrupted kernel code-path
+         * continues on the same stack it was interrupted with.
+         *
+         * Be aware that an NMI can happen anytime in this code.
+         *
+         * %esi: Entry-Stack pointer (same as %esp)
+         * %edi: Top of the task stack
+         * %eax: CR3 on kernel entry
+         */
+
+        /* Calculate number of bytes on the entry stack in %ecx */
+        movl    %esi, %ecx
+
+        /* %ecx to the top of entry-stack */
+        andl    $(MASK_entry_stack), %ecx
+        addl    $(SIZEOF_entry_stack), %ecx
+
+        /* Number of bytes on the entry stack to %ecx */
+        sub     %esi, %ecx
+
+        /* Mark stackframe as coming from entry stack */
+        orl     $CS_FROM_ENTRY_STACK, PT_CS(%esp)
+
+        /*
+         * Test the cr3 used to enter the kernel and add a marker
+         * so that we can switch back to it before iret.
+         */
+        testl   $PTI_SWITCH_MASK, %eax
+        jz      .Lcopy_pt_regs_\@
+        orl     $CS_FROM_USER_CR3, PT_CS(%esp)
+
+        /*
+         * %esi and %edi are unchanged, %ecx contains the number of
+         * bytes to copy. The code at .Lcopy_pt_regs_\@ will allocate
+         * the stack-frame on task-stack and copy everything over
+         */
+        jmp .Lcopy_pt_regs_\@
+
+.Lend_\@:
+.endm
+
+/*
+ * Switch back from the kernel stack to the entry stack.
+ *
+ * The %esp register must point to pt_regs on the task stack. It will
+ * first calculate the size of the stack-frame to copy, depending on
+ * whether we return to VM86 mode or not. With that it uses 'rep movsl'
+ * to copy the contents of the stack over to the entry stack.
+ *
+ * We must be very careful here, as we can't trust the contents of the
+ * task-stack once we switched to the entry-stack. When an NMI happens
+ * while on the entry-stack, the NMI handler will switch back to the top
+ * of the task stack, overwriting our stack-frame we are about to copy.
+ * Therefore we switch the stack only after everything is copied over.
+ */
+.macro SWITCH_TO_ENTRY_STACK
+
+        ALTERNATIVE     "", "jmp .Lend_\@", X86_FEATURE_XENPV
+
+        /* Bytes to copy */
+        movl    $PTREGS_SIZE, %ecx
+
+#ifdef CONFIG_VM86
+        testl   $(X86_EFLAGS_VM), PT_EFLAGS(%esp)
+        jz      .Lcopy_pt_regs_\@
+
+        /* Additional 4 registers to copy when returning to VM86 mode */
+        addl    $(4 * 4), %ecx
+
+.Lcopy_pt_regs_\@:
+#endif
+
+        /* Initialize source and destination for movsl */
+        movl    PER_CPU_VAR(cpu_tss_rw + TSS_sp0), %edi
+        subl    %ecx, %edi
+        movl    %esp, %esi
+
+        /* Save future stack pointer in %ebx */
+        movl    %edi, %ebx
+
+        /* Copy over the stack-frame */
+        shrl    $2, %ecx
+        cld
+        rep movsl
+
+        /*
+         * Switch to entry-stack - needs to happen after everything is
+         * copied because the NMI handler will overwrite the task-stack
+         * when on entry-stack
+         */
+        movl    %ebx, %esp
+
+.Lend_\@:
+.endm
+
+/*
+ * This macro handles the case when we return to kernel-mode on the iret
+ * path and have to switch back to the entry stack and/or user-cr3
+ *
+ * See the comments below the .Lentry_from_kernel_\@ label in the
+ * SWITCH_TO_KERNEL_STACK macro for more details.
+ */
+.macro PARANOID_EXIT_TO_KERNEL_MODE
+
+        /*
+         * Test if we entered the kernel with the entry-stack. Most
+         * likely we did not, because this code only runs on the
+         * return-to-kernel path.
+         */
+        testl   $CS_FROM_ENTRY_STACK, PT_CS(%esp)
+        jz      .Lend_\@
+
+        /* Unlikely slow-path */
+
+        /* Clear marker from stack-frame */
+        andl    $(~CS_FROM_ENTRY_STACK), PT_CS(%esp)
+
+        /* Copy the remaining task-stack contents to entry-stack */
+        movl    %esp, %esi
+        movl    PER_CPU_VAR(cpu_tss_rw + TSS_sp0), %edi
+
+        /* Bytes on the task-stack to ecx */
+        movl    PER_CPU_VAR(cpu_tss_rw + TSS_sp1), %ecx
+        subl    %esi, %ecx
+
+        /* Allocate stack-frame on entry-stack */
+        subl    %ecx, %edi
+
+        /*
+         * Save future stack-pointer, we must not switch until the
+         * copy is done, otherwise the NMI handler could destroy the
+         * contents of the task-stack we are about to copy.
+         */
+        movl    %edi, %ebx
+
+        /* Do the copy */
+        shrl    $2, %ecx
+        cld
+        rep movsl
+
+        /* Safe to switch to entry-stack now */
+        movl    %ebx, %esp
+
+        /*
+         * We came from entry-stack and need to check if we also need to
+         * switch back to user cr3.
+         */
+        testl   $CS_FROM_USER_CR3, PT_CS(%esp)
+        jz      .Lend_\@
+
+        /* Clear marker from stack-frame */
+        andl    $(~CS_FROM_USER_CR3), PT_CS(%esp)
+
+        SWITCH_TO_USER_CR3 scratch_reg=%eax
+
+.Lend_\@:
+.endm
 /*
  * %eax: prev task
  * %edx: next task
@@ -351,9 +764,9 @@ ENTRY(resume_kernel)
         DISABLE_INTERRUPTS(CLBR_ANY)
 .Lneed_resched:
         cmpl    $0, PER_CPU_VAR(__preempt_count)
-        jnz     restore_all
+        jnz     restore_all_kernel
         testl   $X86_EFLAGS_IF, PT_EFLAGS(%esp) # interrupts off (exception path) ?
-        jz      restore_all
+        jz      restore_all_kernel
         call    preempt_schedule_irq
         jmp     .Lneed_resched
 END(resume_kernel)
@@ -412,7 +825,21 @@ ENTRY(xen_sysenter_target)
  * 0(%ebp) arg6
  */
 ENTRY(entry_SYSENTER_32)
-        movl    TSS_sysenter_sp0(%esp), %esp
+        /*
+         * On entry-stack with all userspace-regs live - save and
+         * restore eflags and %eax to use it as scratch-reg for the cr3
+         * switch.
+         */
+        pushfl
+        pushl   %eax
+        BUG_IF_WRONG_CR3 no_user_check=1
+        SWITCH_TO_KERNEL_CR3 scratch_reg=%eax
+        popl    %eax
+        popfl
+
+        /* Stack empty again, switch to task stack */
+        movl    TSS_entry2task_stack(%esp), %esp
+
 .Lsysenter_past_esp:
         pushl   $__USER_DS              /* pt_regs->ss */
         pushl   %ebp                    /* pt_regs->sp (stashed in bp) */
@@ -421,7 +848,7 @@ ENTRY(entry_SYSENTER_32)
         pushl   $__USER_CS              /* pt_regs->cs */
         pushl   $0                      /* pt_regs->ip = 0 (placeholder) */
         pushl   %eax                    /* pt_regs->orig_ax */
-        SAVE_ALL pt_regs_ax=$-ENOSYS    /* save rest */
+        SAVE_ALL pt_regs_ax=$-ENOSYS    /* save rest, stack already switched */
 
         /*
          * SYSENTER doesn't filter flags, so we need to clear NT, AC
@@ -460,25 +887,49 @@ ENTRY(entry_SYSENTER_32)
 
 /* Opportunistic SYSEXIT */
         TRACE_IRQS_ON                   /* User mode traces as IRQs on. */
+
+        /*
+         * Setup entry stack - we keep the pointer in %eax and do the
+         * switch after almost all user-state is restored.
+         */
+
+        /* Load entry stack pointer and allocate frame for eflags/eax */
+        movl    PER_CPU_VAR(cpu_tss_rw + TSS_sp0), %eax
+        subl    $(2*4), %eax
+
+        /* Copy eflags and eax to entry stack */
+        movl    PT_EFLAGS(%esp), %edi
+        movl    PT_EAX(%esp), %esi
+        movl    %edi, (%eax)
+        movl    %esi, 4(%eax)
+
+        /* Restore user registers and segments */
         movl    PT_EIP(%esp), %edx      /* pt_regs->ip */
         movl    PT_OLDESP(%esp), %ecx   /* pt_regs->sp */
 1:      mov     PT_FS(%esp), %fs
         PTGS_TO_GS
+
         popl    %ebx                    /* pt_regs->bx */
         addl    $2*4, %esp              /* skip pt_regs->cx and pt_regs->dx */
         popl    %esi                    /* pt_regs->si */
         popl    %edi                    /* pt_regs->di */
         popl    %ebp                    /* pt_regs->bp */
-        popl    %eax                    /* pt_regs->ax */
+
+        /* Switch to entry stack */
+        movl    %eax, %esp
+
+        /* Now ready to switch the cr3 */
+        SWITCH_TO_USER_CR3 scratch_reg=%eax
 
         /*
          * Restore all flags except IF. (We restore IF separately because
          * STI gives a one-instruction window in which we won't be interrupted,
          * whereas POPF does not.)
          */
-        addl    $PT_EFLAGS-PT_DS, %esp  /* point esp at pt_regs->flags */
         btrl    $X86_EFLAGS_IF_BIT, (%esp)
+        BUG_IF_WRONG_CR3 no_user_check=1
         popfl
+        popl    %eax
 
         /*
          * Return back to the vDSO, which will pop ecx and edx.
@@ -532,7 +983,8 @@ ENDPROC(entry_SYSENTER_32)
 ENTRY(entry_INT80_32)
         ASM_CLAC
         pushl   %eax                    /* pt_regs->orig_ax */
-        SAVE_ALL pt_regs_ax=$-ENOSYS    /* save rest */
+
+        SAVE_ALL pt_regs_ax=$-ENOSYS switch_stacks=1    /* save rest */
 
         /*
          * User mode is traced as though IRQs are on, and the interrupt gate
@@ -546,24 +998,17 @@ ENTRY(entry_INT80_32)
 
 restore_all:
         TRACE_IRQS_IRET
+        SWITCH_TO_ENTRY_STACK
 .Lrestore_all_notrace:
-#ifdef CONFIG_X86_ESPFIX32
-        ALTERNATIVE     "jmp .Lrestore_nocheck", "", X86_BUG_ESPFIX
-
-        movl    PT_EFLAGS(%esp), %eax           # mix EFLAGS, SS and CS
-        /*
-         * Warning: PT_OLDSS(%esp) contains the wrong/random values if we
-         * are returning to the kernel.
-         * See comments in process.c:copy_thread() for details.
-         */
-        movb    PT_OLDSS(%esp), %ah
-        movb    PT_CS(%esp), %al
-        andl    $(X86_EFLAGS_VM | (SEGMENT_TI_MASK << 8) | SEGMENT_RPL_MASK), %eax
-        cmpl    $((SEGMENT_LDT << 8) | USER_RPL), %eax
-        je .Lldt_ss                             # returning to user-space with LDT SS
-#endif
+        CHECK_AND_APPLY_ESPFIX
 .Lrestore_nocheck:
-        RESTORE_REGS 4                          # skip orig_eax/error_code
+        /* Switch back to user CR3 */
+        SWITCH_TO_USER_CR3 scratch_reg=%eax
+
+        BUG_IF_WRONG_CR3
+
+        /* Restore user state */
+        RESTORE_REGS pop=4                      # skip orig_eax/error_code
 .Lirq_return:
         /*
          * ARCH_HAS_MEMBARRIER_SYNC_CORE rely on IRET core serialization
@@ -572,46 +1017,33 @@ restore_all:
          */
         INTERRUPT_RETURN
 
+restore_all_kernel:
+        TRACE_IRQS_IRET
+        PARANOID_EXIT_TO_KERNEL_MODE
+        BUG_IF_WRONG_CR3
+        RESTORE_REGS 4
+        jmp     .Lirq_return
+
 .section .fixup, "ax"
 ENTRY(iret_exc  )
         pushl   $0                              # no error code
         pushl   $do_iret_error
-        jmp     common_exception
-.previous
-        _ASM_EXTABLE(.Lirq_return, iret_exc)
 
-#ifdef CONFIG_X86_ESPFIX32
-.Lldt_ss:
-/*
- * Setup and switch to ESPFIX stack
- *
- * We're returning to userspace with a 16 bit stack. The CPU will not
- * restore the high word of ESP for us on executing iret... This is an
- * "official" bug of all the x86-compatible CPUs, which we can work
- * around to make dosemu and wine happy. We do this by preloading the
- * high word of ESP with the high word of the userspace ESP while
- * compensating for the offset by changing to the ESPFIX segment with
- * a base address that matches for the difference.
- */
-#define GDT_ESPFIX_SS PER_CPU_VAR(gdt_page) + (GDT_ENTRY_ESPFIX_SS * 8)
-        mov     %esp, %edx                      /* load kernel esp */
-        mov     PT_OLDESP(%esp), %eax           /* load userspace esp */
-        mov     %dx, %ax                        /* eax: new kernel esp */
-        sub     %eax, %edx                      /* offset (low word is 0) */
-        shr     $16, %edx
-        mov     %dl, GDT_ESPFIX_SS + 4          /* bits 16..23 */
-        mov     %dh, GDT_ESPFIX_SS + 7          /* bits 24..31 */
-        pushl   $__ESPFIX_SS
-        pushl   %eax                            /* new kernel esp */
+#ifdef CONFIG_DEBUG_ENTRY
         /*
-         * Disable interrupts, but do not irqtrace this section: we
-         * will soon execute iret and the tracer was already set to
-         * the irqstate after the IRET:
+         * The stack-frame here is the one that iret faulted on, so its a
+         * return-to-user frame. We are on kernel-cr3 because we come here from
+         * the fixup code. This confuses the CR3 checker, so switch to user-cr3
+         * as the checker expects it.
          */
-        DISABLE_INTERRUPTS(CLBR_ANY)
-        lss     (%esp), %esp                    /* switch to espfix segment */
-        jmp     .Lrestore_nocheck
+        pushl   %eax
+        SWITCH_TO_USER_CR3 scratch_reg=%eax
+        popl    %eax
 #endif
+
+        jmp     common_exception
+.previous
+        _ASM_EXTABLE(.Lirq_return, iret_exc)
 ENDPROC(entry_INT80_32)
 
 .macro FIXUP_ESPFIX_STACK
@@ -671,7 +1103,8 @@ END(irq_entries_start)
 common_interrupt:
         ASM_CLAC
         addl    $-0x80, (%esp)                  /* Adjust vector into the [-256, -1] range */
-        SAVE_ALL
+
+        SAVE_ALL switch_stacks=1
         ENCODE_FRAME_POINTER
         TRACE_IRQS_OFF
         movl    %esp, %eax
@@ -679,16 +1112,16 @@ common_interrupt:
         jmp     ret_from_intr
 ENDPROC(common_interrupt)
 
-#define BUILD_INTERRUPT3(name, nr, fn)  \
-ENTRY(name)                             \
-        ASM_CLAC;                       \
-        pushl   $~(nr);                 \
-        SAVE_ALL;                       \
-        ENCODE_FRAME_POINTER;           \
-        TRACE_IRQS_OFF                  \
-        movl    %esp, %eax;             \
-        call    fn;                     \
-        jmp     ret_from_intr;          \
+#define BUILD_INTERRUPT3(name, nr, fn)                  \
+ENTRY(name)                                             \
+        ASM_CLAC;                                       \
+        pushl   $~(nr);                                 \
+        SAVE_ALL switch_stacks=1;                       \
+        ENCODE_FRAME_POINTER;                           \
+        TRACE_IRQS_OFF                                  \
+        movl    %esp, %eax;                             \
+        call    fn;                                     \
+        jmp     ret_from_intr;                          \
 ENDPROC(name)
 
 #define BUILD_INTERRUPT(name, nr)               \
@@ -920,16 +1353,20 @@ common_exception:
         pushl   %es
         pushl   %ds
         pushl   %eax
+        movl    $(__USER_DS), %eax
+        movl    %eax, %ds
+        movl    %eax, %es
+        movl    $(__KERNEL_PERCPU), %eax
+        movl    %eax, %fs
         pushl   %ebp
         pushl   %edi
         pushl   %esi
         pushl   %edx
         pushl   %ecx
         pushl   %ebx
+        SWITCH_TO_KERNEL_STACK
         ENCODE_FRAME_POINTER
         cld
-        movl    $(__KERNEL_PERCPU), %ecx
-        movl    %ecx, %fs
         UNWIND_ESPFIX_STACK
         GS_TO_REG %ecx
         movl    PT_GS(%esp), %edi               # get the function address
@@ -937,9 +1374,6 @@ common_exception:
         movl    $-1, PT_ORIG_EAX(%esp)          # no syscall to restart
         REG_TO_PTGS %ecx
         SET_KERNEL_GS %ecx
-        movl    $(__USER_DS), %ecx
-        movl    %ecx, %ds
-        movl    %ecx, %es
         TRACE_IRQS_OFF
         movl    %esp, %eax                      # pt_regs pointer
         CALL_NOSPEC %edi
@@ -948,40 +1382,12 @@ END(common_exception)
 
 ENTRY(debug)
         /*
-         * #DB can happen at the first instruction of
-         * entry_SYSENTER_32 or in Xen's SYSENTER prologue.  If this
-         * happens, then we will be running on a very small stack.  We
-         * need to detect this condition and switch to the thread
-         * stack before calling any C code at all.
-         *
-         * If you edit this code, keep in mind that NMIs can happen in here.
+         * Entry from sysenter is now handled in common_exception
          */
         ASM_CLAC
         pushl   $-1                             # mark this as an int
-        SAVE_ALL
-        ENCODE_FRAME_POINTER
-        xorl    %edx, %edx                      # error code 0
-        movl    %esp, %eax                      # pt_regs pointer
-
-        /* Are we currently on the SYSENTER stack? */
-        movl    PER_CPU_VAR(cpu_entry_area), %ecx
-        addl    $CPU_ENTRY_AREA_entry_stack + SIZEOF_entry_stack, %ecx
-        subl    %eax, %ecx      /* ecx = (end of entry_stack) - esp */
-        cmpl    $SIZEOF_entry_stack, %ecx
-        jb      .Ldebug_from_sysenter_stack
-
-        TRACE_IRQS_OFF
-        call    do_debug
-        jmp     ret_from_exception
-
-.Ldebug_from_sysenter_stack:
-        /* We're on the SYSENTER stack.  Switch off. */
-        movl    %esp, %ebx
-        movl    PER_CPU_VAR(cpu_current_top_of_stack), %esp
-        TRACE_IRQS_OFF
-        call    do_debug
-        movl    %ebx, %esp
-        jmp     ret_from_exception
+        pushl   $do_debug
+        jmp     common_exception
 END(debug)
 
 /*
@@ -993,6 +1399,7 @@ END(debug)
  */
 ENTRY(nmi)
         ASM_CLAC
+
 #ifdef CONFIG_X86_ESPFIX32
         pushl   %eax
         movl    %ss, %eax
@@ -1002,7 +1409,7 @@ ENTRY(nmi)
 #endif
 
         pushl   %eax                            # pt_regs->orig_ax
-        SAVE_ALL
+        SAVE_ALL_NMI cr3_reg=%edi
         ENCODE_FRAME_POINTER
         xorl    %edx, %edx                      # zero error code
         movl    %esp, %eax                      # pt_regs pointer
@@ -1016,7 +1423,7 @@ ENTRY(nmi)
 
         /* Not on SYSENTER stack. */
         call    do_nmi
-        jmp     .Lrestore_all_notrace
+        jmp     .Lnmi_return
 
 .Lnmi_from_sysenter_stack:
         /*
@@ -1027,7 +1434,11 @@ ENTRY(nmi)
         movl    PER_CPU_VAR(cpu_current_top_of_stack), %esp
         call    do_nmi
         movl    %ebx, %esp
-        jmp     .Lrestore_all_notrace
+
+.Lnmi_return:
+        CHECK_AND_APPLY_ESPFIX
+        RESTORE_ALL_NMI cr3_reg=%edi pop=4
+        jmp     .Lirq_return
 
 #ifdef CONFIG_X86_ESPFIX32
 .Lnmi_espfix_stack:
@@ -1042,12 +1453,12 @@ ENTRY(nmi)
         pushl   16(%esp)
         .endr
         pushl   %eax
-        SAVE_ALL
+        SAVE_ALL_NMI cr3_reg=%edi
         ENCODE_FRAME_POINTER
         FIXUP_ESPFIX_STACK                      # %eax == %esp
         xorl    %edx, %edx                      # zero error code
         call    do_nmi
-        RESTORE_REGS
+        RESTORE_ALL_NMI cr3_reg=%edi
         lss     12+4(%esp), %esp                # back to espfix stack
         jmp     .Lirq_return
 #endif
@@ -1056,7 +1467,8 @@ END(nmi)
 ENTRY(int3)
         ASM_CLAC
         pushl   $-1                             # mark this as an int
-        SAVE_ALL
+
+        SAVE_ALL switch_stacks=1
         ENCODE_FRAME_POINTER
         TRACE_IRQS_OFF
         xorl    %edx, %edx                      # zero error code
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 8ae7ffda8f98..957dfb693ecc 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -92,7 +92,7 @@ END(native_usergs_sysret64)
 .endm
 
 .macro TRACE_IRQS_IRETQ_DEBUG
-        bt      $9, EFLAGS(%rsp)                /* interrupts off? */
+        btl     $9, EFLAGS(%rsp)                /* interrupts off? */
         jnc     1f
         TRACE_IRQS_ON_DEBUG
 1:
@@ -408,6 +408,7 @@ ENTRY(ret_from_fork)
 
 1:
         /* kernel thread */
+        UNWIND_HINT_EMPTY
         movq    %r12, %rdi
         CALL_NOSPEC %rbx
         /*
@@ -701,7 +702,7 @@ retint_kernel:
 #ifdef CONFIG_PREEMPT
         /* Interrupts are off */
         /* Check if we need preemption */
-        bt      $9, EFLAGS(%rsp)                /* were interrupts off? */
+        btl     $9, EFLAGS(%rsp)                /* were interrupts off? */
         jnc     1f
 0:      cmpl    $0, PER_CPU_VAR(__preempt_count)
         jnz     1f
diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile
index 261802b1cc50..9f695f517747 100644
--- a/arch/x86/entry/vdso/Makefile
+++ b/arch/x86/entry/vdso/Makefile
@@ -46,10 +46,8 @@ targets += $(vdso_img_sodbg) $(vdso_img-y:%=vdso%.so)
 
 CPPFLAGS_vdso.lds += -P -C
 
-VDSO_LDFLAGS_vdso.lds = -m64 -Wl,-soname=linux-vdso.so.1 \
-                        -Wl,--no-undefined \
-                        -Wl,-z,max-page-size=4096 -Wl,-z,common-page-size=4096 \
-                        $(DISABLE_LTO)
+VDSO_LDFLAGS_vdso.lds = -m elf_x86_64 -soname linux-vdso.so.1 --no-undefined \
+                        -z max-page-size=4096 -z common-page-size=4096
 
 $(obj)/vdso64.so.dbg: $(obj)/vdso.lds $(vobjs) FORCE
         $(call if_changed,vdso)
@@ -58,9 +56,7 @@ HOST_EXTRACFLAGS += -I$(srctree)/tools/include -I$(srctree)/include/uapi -I$(src
 hostprogs-y                     += vdso2c
 
 quiet_cmd_vdso2c = VDSO2C  $@
-define cmd_vdso2c
-        $(obj)/vdso2c $< $(<:%.dbg=%) $@
-endef
+      cmd_vdso2c = $(obj)/vdso2c $< $(<:%.dbg=%) $@
 
 $(obj)/vdso-image-%.c: $(obj)/vdso%.so.dbg $(obj)/vdso%.so $(obj)/vdso2c FORCE
         $(call if_changed,vdso2c)
@@ -95,10 +91,8 @@ CFLAGS_REMOVE_vvar.o = -pg
 #
 
 CPPFLAGS_vdsox32.lds = $(CPPFLAGS_vdso.lds)
-VDSO_LDFLAGS_vdsox32.lds = -Wl,-m,elf32_x86_64 \
-                           -Wl,-soname=linux-vdso.so.1 \
-                           -Wl,-z,max-page-size=4096 \
-                           -Wl,-z,common-page-size=4096
+VDSO_LDFLAGS_vdsox32.lds = -m elf32_x86_64 -soname linux-vdso.so.1 \
+                           -z max-page-size=4096 -z common-page-size=4096
 
 # x32-rebranded versions
 vobjx32s-y := $(vobjs-y:.o=-x32.o)
@@ -123,7 +117,7 @@ $(obj)/vdsox32.so.dbg: $(obj)/vdsox32.lds $(vobjx32s) FORCE
         $(call if_changed,vdso)
 
 CPPFLAGS_vdso32.lds = $(CPPFLAGS_vdso.lds)
-VDSO_LDFLAGS_vdso32.lds = -m32 -Wl,-m,elf_i386 -Wl,-soname=linux-gate.so.1
+VDSO_LDFLAGS_vdso32.lds = -m elf_i386 -soname linux-gate.so.1
 
 targets += vdso32/vdso32.lds
 targets += vdso32/note.o vdso32/system_call.o vdso32/sigreturn.o
@@ -157,13 +151,13 @@ $(obj)/vdso32.so.dbg: FORCE \
 # The DSO images are built using a special linker script.
 #
 quiet_cmd_vdso = VDSO    $@
-      cmd_vdso = $(CC) -nostdlib -o $@ \
+      cmd_vdso = $(LD) -nostdlib -o $@ \
                        $(VDSO_LDFLAGS) $(VDSO_LDFLAGS_$(filter %.lds,$(^F))) \
-                       -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \
+                       -T $(filter %.lds,$^) $(filter %.o,$^) && \
                  sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
 
-VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=both) \
-        $(call cc-ldoption, -Wl$(comma)--build-id) -Wl,-Bsymbolic $(LTO_CFLAGS)
+VDSO_LDFLAGS = -shared $(call ld-option, --hash-style=both) \
+        $(call ld-option, --build-id) -Bsymbolic
 GCOV_PROFILE := n
 
 #
diff --git a/arch/x86/hyperv/hv_apic.c b/arch/x86/hyperv/hv_apic.c
index 402338365651..5b0f613428c2 100644
--- a/arch/x86/hyperv/hv_apic.c
+++ b/arch/x86/hyperv/hv_apic.c
@@ -31,6 +31,8 @@
 #include <asm/mshyperv.h>
 #include <asm/apic.h>
 
+#include <asm/trace/hyperv.h>
+
 static struct apic orig_apic;
 
 static u64 hv_apic_icr_read(void)
@@ -99,6 +101,9 @@ static bool __send_ipi_mask_ex(const struct cpumask *mask, int vector)
         int nr_bank = 0;
         int ret = 1;
 
+        if (!(ms_hyperv.hints & HV_X64_EX_PROCESSOR_MASKS_RECOMMENDED))
+                return false;
+
         local_irq_save(flags);
         arg = (struct ipi_arg_ex **)this_cpu_ptr(hyperv_pcpu_input_arg);
 
@@ -130,10 +135,10 @@ ipi_mask_ex_done:
 static bool __send_ipi_mask(const struct cpumask *mask, int vector)
 {
         int cur_cpu, vcpu;
-        struct ipi_arg_non_ex **arg;
-        struct ipi_arg_non_ex *ipi_arg;
+        struct ipi_arg_non_ex ipi_arg;
         int ret = 1;
-        unsigned long flags;
+
+        trace_hyperv_send_ipi_mask(mask, vector);
 
         if (cpumask_empty(mask))
                 return true;
@@ -144,40 +149,43 @@ static bool __send_ipi_mask(const struct cpumask *mask, int vector)
         if ((vector < HV_IPI_LOW_VECTOR) || (vector > HV_IPI_HIGH_VECTOR))
                 return false;
 
-        if ((ms_hyperv.hints & HV_X64_EX_PROCESSOR_MASKS_RECOMMENDED))
-                return __send_ipi_mask_ex(mask, vector);
-
-        local_irq_save(flags);
-        arg = (struct ipi_arg_non_ex **)this_cpu_ptr(hyperv_pcpu_input_arg);
-
-        ipi_arg = *arg;
-        if (unlikely(!ipi_arg))
-                goto ipi_mask_done;
-
-        ipi_arg->vector = vector;
-        ipi_arg->reserved = 0;
-        ipi_arg->cpu_mask = 0;
+        /*
+         * From the supplied CPU set we need to figure out if we can get away
+         * with cheaper HVCALL_SEND_IPI hypercall. This is possible when the
+         * highest VP number in the set is < 64. As VP numbers are usually in
+         * ascending order and match Linux CPU ids, here is an optimization:
+         * we check the VP number for the highest bit in the supplied set first
+         * so we can quickly find out if using HVCALL_SEND_IPI_EX hypercall is
+         * a must. We will also check all VP numbers when walking the supplied
+         * CPU set to remain correct in all cases.
+         */
+        if (hv_cpu_number_to_vp_number(cpumask_last(mask)) >= 64)
+                goto do_ex_hypercall;
+
+        ipi_arg.vector = vector;
+        ipi_arg.cpu_mask = 0;
 
         for_each_cpu(cur_cpu, mask) {
                 vcpu = hv_cpu_number_to_vp_number(cur_cpu);
                 if (vcpu == VP_INVAL)
-                        goto ipi_mask_done;
+                        return false;
 
                 /*
                  * This particular version of the IPI hypercall can
                  * only target upto 64 CPUs.
                  */
                 if (vcpu >= 64)
-                        goto ipi_mask_done;
+                        goto do_ex_hypercall;
 
-                __set_bit(vcpu, (unsigned long *)&ipi_arg->cpu_mask);
+                __set_bit(vcpu, (unsigned long *)&ipi_arg.cpu_mask);
         }
 
-        ret = hv_do_hypercall(HVCALL_SEND_IPI, ipi_arg, NULL);
-
-ipi_mask_done:
-        local_irq_restore(flags);
+        ret = hv_do_fast_hypercall16(HVCALL_SEND_IPI, ipi_arg.vector,
+                                     ipi_arg.cpu_mask);
         return ((ret == 0) ? true : false);
+
+do_ex_hypercall:
+        return __send_ipi_mask_ex(mask, vector);
 }
 
 static bool __send_ipi_one(int cpu, int vector)
@@ -233,10 +241,7 @@ static void hv_send_ipi_self(int vector)
 void __init hv_apic_init(void)
 {
         if (ms_hyperv.hints & HV_X64_CLUSTER_IPI_RECOMMENDED) {
-                if ((ms_hyperv.hints & HV_X64_EX_PROCESSOR_MASKS_RECOMMENDED))
-                        pr_info("Hyper-V: Using ext hypercalls for IPI\n");
-                else
-                        pr_info("Hyper-V: Using IPI hypercalls\n");
+                pr_info("Hyper-V: Using IPI hypercalls\n");
                 /*
                  * Set the IPI entry points.
                  */
diff --git a/arch/x86/hyperv/mmu.c b/arch/x86/hyperv/mmu.c
index de27615c51ea..1147e1fed7ff 100644
--- a/arch/x86/hyperv/mmu.c
+++ b/arch/x86/hyperv/mmu.c
@@ -16,6 +16,8 @@
 /* Each gva in gva_list encodes up to 4096 pages to flush */
 #define HV_TLB_FLUSH_UNIT (4096 * PAGE_SIZE)
 
+static u64 hyperv_flush_tlb_others_ex(const struct cpumask *cpus,
+                                      const struct flush_tlb_info *info);
 
 /*
  * Fills in gva_list starting from offset. Returns the number of items added.
@@ -93,10 +95,29 @@ static void hyperv_flush_tlb_others(const struct cpumask *cpus,
         if (cpumask_equal(cpus, cpu_present_mask)) {
                 flush->flags |= HV_FLUSH_ALL_PROCESSORS;
         } else {
+                /*
+                 * From the supplied CPU set we need to figure out if we can get
+                 * away with cheaper HVCALL_FLUSH_VIRTUAL_ADDRESS_{LIST,SPACE}
+                 * hypercalls. This is possible when the highest VP number in
+                 * the set is < 64. As VP numbers are usually in ascending order
+                 * and match Linux CPU ids, here is an optimization: we check
+                 * the VP number for the highest bit in the supplied set first
+                 * so we can quickly find out if using *_EX hypercalls is a
+                 * must. We will also check all VP numbers when walking the
+                 * supplied CPU set to remain correct in all cases.
+                 */
+                if (hv_cpu_number_to_vp_number(cpumask_last(cpus)) >= 64)
+                        goto do_ex_hypercall;
+
                 for_each_cpu(cpu, cpus) {
                         vcpu = hv_cpu_number_to_vp_number(cpu);
-                        if (vcpu >= 64)
+                        if (vcpu == VP_INVAL) {
+                                local_irq_restore(flags);
                                 goto do_native;
+                        }
+
+                        if (vcpu >= 64)
+                                goto do_ex_hypercall;
 
                         __set_bit(vcpu, (unsigned long *)
                                   &flush->processor_mask);
@@ -123,7 +144,12 @@ static void hyperv_flush_tlb_others(const struct cpumask *cpus,
                 status = hv_do_rep_hypercall(HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST,
                                              gva_n, 0, flush, NULL);
         }
+        goto check_status;
+
+do_ex_hypercall:
+        status = hyperv_flush_tlb_others_ex(cpus, info);
 
+check_status:
         local_irq_restore(flags);
 
         if (!(status & HV_HYPERCALL_RESULT_MASK))
@@ -132,35 +158,22 @@ do_native:
         native_flush_tlb_others(cpus, info);
 }
 
-static void hyperv_flush_tlb_others_ex(const struct cpumask *cpus,
-                                       const struct flush_tlb_info *info)
+static u64 hyperv_flush_tlb_others_ex(const struct cpumask *cpus,
+                                      const struct flush_tlb_info *info)
 {
         int nr_bank = 0, max_gvas, gva_n;
         struct hv_tlb_flush_ex **flush_pcpu;
         struct hv_tlb_flush_ex *flush;
-        u64 status = U64_MAX;
-        unsigned long flags;
+        u64 status;
 
-        trace_hyperv_mmu_flush_tlb_others(cpus, info);
-
-        if (!hv_hypercall_pg)
-                goto do_native;
-
-        if (cpumask_empty(cpus))
-                return;
-
-        local_irq_save(flags);
+        if (!(ms_hyperv.hints & HV_X64_EX_PROCESSOR_MASKS_RECOMMENDED))
+                return U64_MAX;
 
         flush_pcpu = (struct hv_tlb_flush_ex **)
                      this_cpu_ptr(hyperv_pcpu_input_arg);
 
         flush = *flush_pcpu;
 
-        if (unlikely(!flush)) {
-                local_irq_restore(flags);
-                goto do_native;
-        }
-
         if (info->mm) {
                 /*
                  * AddressSpace argument must match the CR3 with PCID bits
@@ -176,15 +189,10 @@ static void hyperv_flush_tlb_others_ex(const struct cpumask *cpus,
 
         flush->hv_vp_set.valid_bank_mask = 0;
 
-        if (!cpumask_equal(cpus, cpu_present_mask)) {
-                flush->hv_vp_set.format = HV_GENERIC_SET_SPARSE_4K;
-                nr_bank = cpumask_to_vpset(&(flush->hv_vp_set), cpus);
-        }
-
-        if (!nr_bank) {
-                flush->hv_vp_set.format = HV_GENERIC_SET_ALL;
-                flush->flags |= HV_FLUSH_ALL_PROCESSORS;
-        }
+        flush->hv_vp_set.format = HV_GENERIC_SET_SPARSE_4K;
+        nr_bank = cpumask_to_vpset(&(flush->hv_vp_set), cpus);
+        if (nr_bank < 0)
+                return U64_MAX;
 
         /*
          * We can flush not more than max_gvas with one hypercall. Flush the
@@ -213,12 +221,7 @@ static void hyperv_flush_tlb_others_ex(const struct cpumask *cpus,
                         gva_n, nr_bank, flush, NULL);
         }
 
-        local_irq_restore(flags);
-
-        if (!(status & HV_HYPERCALL_RESULT_MASK))
-                return;
-do_native:
-        native_flush_tlb_others(cpus, info);
+        return status;
 }
 
 void hyperv_setup_mmu_ops(void)
@@ -226,11 +229,6 @@ void hyperv_setup_mmu_ops(void)
         if (!(ms_hyperv.hints & HV_X64_REMOTE_TLB_FLUSH_RECOMMENDED))
                 return;
 
-        if (!(ms_hyperv.hints & HV_X64_EX_PROCESSOR_MASKS_RECOMMENDED)) {
-                pr_info("Using hypercall for remote TLB flush\n");
-                pv_mmu_ops.flush_tlb_others = hyperv_flush_tlb_others;
-        } else {
-                pr_info("Using ext hypercall for remote TLB flush\n");
-                pv_mmu_ops.flush_tlb_others = hyperv_flush_tlb_others_ex;
-        }
+        pr_info("Using hypercall for remote TLB flush\n");
+        pv_mmu_ops.flush_tlb_others = hyperv_flush_tlb_others;
 }
diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h
index 0db6bec95489..b143717b92b3 100644
--- a/arch/x86/include/asm/atomic.h
+++ b/arch/x86/include/asm/atomic.h
@@ -80,6 +80,7 @@ static __always_inline void arch_atomic_sub(int i, atomic_t *v)
  * true if the result is zero, or false for all
  * other cases.
  */
+#define arch_atomic_sub_and_test arch_atomic_sub_and_test
 static __always_inline bool arch_atomic_sub_and_test(int i, atomic_t *v)
 {
         GEN_BINARY_RMWcc(LOCK_PREFIX "subl", v->counter, "er", i, "%0", e);
@@ -91,6 +92,7 @@ static __always_inline bool arch_atomic_sub_and_test(int i, atomic_t *v)
  *
  * Atomically increments @v by 1.
  */
+#define arch_atomic_inc arch_atomic_inc
 static __always_inline void arch_atomic_inc(atomic_t *v)
 {
         asm volatile(LOCK_PREFIX "incl %0"
@@ -103,6 +105,7 @@ static __always_inline void arch_atomic_inc(atomic_t *v)
  *
  * Atomically decrements @v by 1.
  */
+#define arch_atomic_dec arch_atomic_dec
 static __always_inline void arch_atomic_dec(atomic_t *v)
 {
         asm volatile(LOCK_PREFIX "decl %0"
@@ -117,6 +120,7 @@ static __always_inline void arch_atomic_dec(atomic_t *v)
  * returns true if the result is 0, or false for all other
  * cases.
  */
+#define arch_atomic_dec_and_test arch_atomic_dec_and_test
 static __always_inline bool arch_atomic_dec_and_test(atomic_t *v)
 {
         GEN_UNARY_RMWcc(LOCK_PREFIX "decl", v->counter, "%0", e);
@@ -130,6 +134,7 @@ static __always_inline bool arch_atomic_dec_and_test(atomic_t *v)
  * and returns true if the result is zero, or false for all
  * other cases.
  */
+#define arch_atomic_inc_and_test arch_atomic_inc_and_test
 static __always_inline bool arch_atomic_inc_and_test(atomic_t *v)
 {
         GEN_UNARY_RMWcc(LOCK_PREFIX "incl", v->counter, "%0", e);
@@ -144,6 +149,7 @@ static __always_inline bool arch_atomic_inc_and_test(atomic_t *v)
  * if the result is negative, or false when
  * result is greater than or equal to zero.
  */
+#define arch_atomic_add_negative arch_atomic_add_negative
 static __always_inline bool arch_atomic_add_negative(int i, atomic_t *v)
 {
         GEN_BINARY_RMWcc(LOCK_PREFIX "addl", v->counter, "er", i, "%0", s);
@@ -173,9 +179,6 @@ static __always_inline int arch_atomic_sub_return(int i, atomic_t *v)
         return arch_atomic_add_return(-i, v);
 }
 
-#define arch_atomic_inc_return(v)  (arch_atomic_add_return(1, v))
-#define arch_atomic_dec_return(v)  (arch_atomic_sub_return(1, v))
-
 static __always_inline int arch_atomic_fetch_add(int i, atomic_t *v)
 {
         return xadd(&v->counter, i);
@@ -199,7 +202,7 @@ static __always_inline bool arch_atomic_try_cmpxchg(atomic_t *v, int *old, int n
 
 static inline int arch_atomic_xchg(atomic_t *v, int new)
 {
-        return xchg(&v->counter, new);
+        return arch_xchg(&v->counter, new);
 }
 
 static inline void arch_atomic_and(int i, atomic_t *v)
@@ -253,27 +256,6 @@ static inline int arch_atomic_fetch_xor(int i, atomic_t *v)
         return val;
 }
 
-/**
- * __arch_atomic_add_unless - add unless the number is already a given value
- * @v: pointer of type atomic_t
- * @a: the amount to add to v...
- * @u: ...unless v is equal to u.
- *
- * Atomically adds @a to @v, so long as @v was not already @u.
- * Returns the old value of @v.
- */
-static __always_inline int __arch_atomic_add_unless(atomic_t *v, int a, int u)
-{
-        int c = arch_atomic_read(v);
-
-        do {
-                if (unlikely(c == u))
-                        break;
-        } while (!arch_atomic_try_cmpxchg(v, &c, c + a));
-
-        return c;
-}
-
 #ifdef CONFIG_X86_32
 # include <asm/atomic64_32.h>
 #else
diff --git a/arch/x86/include/asm/atomic64_32.h b/arch/x86/include/asm/atomic64_32.h
index 92212bf0484f..ef959f02d070 100644
--- a/arch/x86/include/asm/atomic64_32.h
+++ b/arch/x86/include/asm/atomic64_32.h
@@ -158,6 +158,7 @@ static inline long long arch_atomic64_inc_return(atomic64_t *v)
                              "S" (v) : "memory", "ecx");
         return a;
 }
+#define arch_atomic64_inc_return arch_atomic64_inc_return
 
 static inline long long arch_atomic64_dec_return(atomic64_t *v)
 {
@@ -166,6 +167,7 @@ static inline long long arch_atomic64_dec_return(atomic64_t *v)
                              "S" (v) : "memory", "ecx");
         return a;
 }
+#define arch_atomic64_dec_return arch_atomic64_dec_return
 
 /**
  * arch_atomic64_add - add integer to atomic64 variable
@@ -198,25 +200,12 @@ static inline long long arch_atomic64_sub(long long i, atomic64_t *v)
 }
 
 /**
- * arch_atomic64_sub_and_test - subtract value from variable and test result
- * @i: integer value to subtract
- * @v: pointer to type atomic64_t
- *
- * Atomically subtracts @i from @v and returns
- * true if the result is zero, or false for all
- * other cases.
- */
-static inline int arch_atomic64_sub_and_test(long long i, atomic64_t *v)
-{
-        return arch_atomic64_sub_return(i, v) == 0;
-}
-
-/**
  * arch_atomic64_inc - increment atomic64 variable
  * @v: pointer to type atomic64_t
  *
  * Atomically increments @v by 1.
  */
+#define arch_atomic64_inc arch_atomic64_inc
 static inline void arch_atomic64_inc(atomic64_t *v)
 {
         __alternative_atomic64(inc, inc_return, /* no output */,
@@ -229,6 +218,7 @@ static inline void arch_atomic64_inc(atomic64_t *v)
  *
  * Atomically decrements @v by 1.
  */
+#define arch_atomic64_dec arch_atomic64_dec
 static inline void arch_atomic64_dec(atomic64_t *v)
 {
         __alternative_atomic64(dec, dec_return, /* no output */,
@@ -236,46 +226,6 @@ static inline void arch_atomic64_dec(atomic64_t *v)
 }
 
 /**
- * arch_atomic64_dec_and_test - decrement and test
- * @v: pointer to type atomic64_t
- *
- * Atomically decrements @v by 1 and
- * returns true if the result is 0, or false for all other
- * cases.
- */
-static inline int arch_atomic64_dec_and_test(atomic64_t *v)
-{
-        return arch_atomic64_dec_return(v) == 0;
-}
-
-/**
- * atomic64_inc_and_test - increment and test
- * @v: pointer to type atomic64_t
- *
- * Atomically increments @v by 1
- * and returns true if the result is zero, or false for all
- * other cases.
- */
-static inline int arch_atomic64_inc_and_test(atomic64_t *v)
-{
-        return arch_atomic64_inc_return(v) == 0;
-}
-
-/**
- * arch_atomic64_add_negative - add and test if negative
- * @i: integer value to add
- * @v: pointer to type atomic64_t
- *
- * Atomically adds @i to @v and returns true
- * if the result is negative, or false when
- * result is greater than or equal to zero.
- */
-static inline int arch_atomic64_add_negative(long long i, atomic64_t *v)
-{
-        return arch_atomic64_add_return(i, v) < 0;
-}
-
-/**
  * arch_atomic64_add_unless - add unless the number is a given value
  * @v: pointer of type atomic64_t
  * @a: the amount to add to v...
@@ -295,7 +245,7 @@ static inline int arch_atomic64_add_unless(atomic64_t *v, long long a,
         return (int)a;
 }
 
-
+#define arch_atomic64_inc_not_zero arch_atomic64_inc_not_zero
 static inline int arch_atomic64_inc_not_zero(atomic64_t *v)
 {
         int r;
@@ -304,6 +254,7 @@ static inline int arch_atomic64_inc_not_zero(atomic64_t *v)
         return r;
 }
 
+#define arch_atomic64_dec_if_positive arch_atomic64_dec_if_positive
 static inline long long arch_atomic64_dec_if_positive(atomic64_t *v)
 {
         long long r;
diff --git a/arch/x86/include/asm/atomic64_64.h b/arch/x86/include/asm/atomic64_64.h
index 6106b59d3260..4343d9b4f30e 100644
--- a/arch/x86/include/asm/atomic64_64.h
+++ b/arch/x86/include/asm/atomic64_64.h
@@ -71,6 +71,7 @@ static inline void arch_atomic64_sub(long i, atomic64_t *v)
  * true if the result is zero, or false for all
  * other cases.
  */
+#define arch_atomic64_sub_and_test arch_atomic64_sub_and_test
 static inline bool arch_atomic64_sub_and_test(long i, atomic64_t *v)
 {
         GEN_BINARY_RMWcc(LOCK_PREFIX "subq", v->counter, "er", i, "%0", e);
@@ -82,6 +83,7 @@ static inline bool arch_atomic64_sub_and_test(long i, atomic64_t *v)
  *
  * Atomically increments @v by 1.
  */
+#define arch_atomic64_inc arch_atomic64_inc
 static __always_inline void arch_atomic64_inc(atomic64_t *v)
 {
         asm volatile(LOCK_PREFIX "incq %0"
@@ -95,6 +97,7 @@ static __always_inline void arch_atomic64_inc(atomic64_t *v)
  *
  * Atomically decrements @v by 1.
  */
+#define arch_atomic64_dec arch_atomic64_dec
 static __always_inline void arch_atomic64_dec(atomic64_t *v)
 {
         asm volatile(LOCK_PREFIX "decq %0"
@@ -110,6 +113,7 @@ static __always_inline void arch_atomic64_dec(atomic64_t *v)
  * returns true if the result is 0, or false for all other
  * cases.
  */
+#define arch_atomic64_dec_and_test arch_atomic64_dec_and_test
 static inline bool arch_atomic64_dec_and_test(atomic64_t *v)
 {
         GEN_UNARY_RMWcc(LOCK_PREFIX "decq", v->counter, "%0", e);
@@ -123,6 +127,7 @@ static inline bool arch_atomic64_dec_and_test(atomic64_t *v)
  * and returns true if the result is zero, or false for all
  * other cases.
  */
+#define arch_atomic64_inc_and_test arch_atomic64_inc_and_test
 static inline bool arch_atomic64_inc_and_test(atomic64_t *v)
 {
         GEN_UNARY_RMWcc(LOCK_PREFIX "incq", v->counter, "%0", e);
@@ -137,6 +142,7 @@ static inline bool arch_atomic64_inc_and_test(atomic64_t *v)
  * if the result is negative, or false when
  * result is greater than or equal to zero.
  */
+#define arch_atomic64_add_negative arch_atomic64_add_negative
 static inline bool arch_atomic64_add_negative(long i, atomic64_t *v)
 {
         GEN_BINARY_RMWcc(LOCK_PREFIX "addq", v->counter, "er", i, "%0", s);
@@ -169,9 +175,6 @@ static inline long arch_atomic64_fetch_sub(long i, atomic64_t *v)
         return xadd(&v->counter, -i);
 }
 
-#define arch_atomic64_inc_return(v)  (arch_atomic64_add_return(1, (v)))
-#define arch_atomic64_dec_return(v)  (arch_atomic64_sub_return(1, (v)))
-
 static inline long arch_atomic64_cmpxchg(atomic64_t *v, long old, long new)
 {
         return arch_cmpxchg(&v->counter, old, new);
@@ -185,46 +188,7 @@ static __always_inline bool arch_atomic64_try_cmpxchg(atomic64_t *v, s64 *old, l
 
 static inline long arch_atomic64_xchg(atomic64_t *v, long new)
 {
-        return xchg(&v->counter, new);
-}
-
-/**
- * arch_atomic64_add_unless - add unless the number is a given value
- * @v: pointer of type atomic64_t
- * @a: the amount to add to v...
- * @u: ...unless v is equal to u.
- *
- * Atomically adds @a to @v, so long as it was not @u.
- * Returns the old value of @v.
- */
-static inline bool arch_atomic64_add_unless(atomic64_t *v, long a, long u)
-{
-        s64 c = arch_atomic64_read(v);
-        do {
-                if (unlikely(c == u))
-                        return false;
-        } while (!arch_atomic64_try_cmpxchg(v, &c, c + a));
-        return true;
-}
-
-#define arch_atomic64_inc_not_zero(v) arch_atomic64_add_unless((v), 1, 0)
-
-/*
- * arch_atomic64_dec_if_positive - decrement by 1 if old value positive
- * @v: pointer of type atomic_t
- *
- * The function returns the old value of *v minus 1, even if
- * the atomic variable, v, was not decremented.
- */
-static inline long arch_atomic64_dec_if_positive(atomic64_t *v)
-{
-        s64 dec, c = arch_atomic64_read(v);
-        do {
-                dec = c - 1;
-                if (unlikely(dec < 0))
-                        break;
-        } while (!arch_atomic64_try_cmpxchg(v, &c, dec));
-        return dec;
+        return arch_xchg(&v->counter, new);
 }
 
 static inline void arch_atomic64_and(long i, atomic64_t *v)
diff --git a/arch/x86/include/asm/cmpxchg.h b/arch/x86/include/asm/cmpxchg.h
index e3efd8a06066..a55d79b233d3 100644
--- a/arch/x86/include/asm/cmpxchg.h
+++ b/arch/x86/include/asm/cmpxchg.h
@@ -75,7 +75,7 @@ extern void __add_wrong_size(void)
  * use "asm volatile" and "memory" clobbers to prevent gcc from moving
  * information around.
  */
-#define xchg(ptr, v)    __xchg_op((ptr), (v), xchg, "")
+#define arch_xchg(ptr, v)       __xchg_op((ptr), (v), xchg, "")
 
 /*
  * Atomic compare and exchange.  Compare OLD with MEM, if identical,
diff --git a/arch/x86/include/asm/cmpxchg_64.h b/arch/x86/include/asm/cmpxchg_64.h
index bfca3b346c74..072e5459fe2f 100644
--- a/arch/x86/include/asm/cmpxchg_64.h
+++ b/arch/x86/include/asm/cmpxchg_64.h
@@ -10,13 +10,13 @@ static inline void set_64bit(volatile u64 *ptr, u64 val)
 #define arch_cmpxchg64(ptr, o, n)                                       \
 ({                                                                      \
         BUILD_BUG_ON(sizeof(*(ptr)) != 8);                              \
-        cmpxchg((ptr), (o), (n));                                       \
+        arch_cmpxchg((ptr), (o), (n));                                  \
 })
 
 #define arch_cmpxchg64_local(ptr, o, n)                                 \
 ({                                                                      \
         BUILD_BUG_ON(sizeof(*(ptr)) != 8);                              \
-        cmpxchg_local((ptr), (o), (n));                                 \
+        arch_cmpxchg_local((ptr), (o), (n));                            \
 })
 
 #define system_has_cmpxchg_double() boot_cpu_has(X86_FEATURE_CX16)
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index 5701f5cecd31..b5c60faf8429 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -219,6 +219,7 @@
 #define X86_FEATURE_IBPB                ( 7*32+26) /* Indirect Branch Prediction Barrier */
 #define X86_FEATURE_STIBP               ( 7*32+27) /* Single Thread Indirect Branch Predictors */
 #define X86_FEATURE_ZEN                 ( 7*32+28) /* "" CPU is AMD family 0x17 (Zen) */
+#define X86_FEATURE_IBRS_ENHANCED       ( 7*32+29) /* Enhanced IBRS */
 
 /* Virtualization flags: Linux defined, word 8 */
 #define X86_FEATURE_TPR_SHADOW          ( 8*32+ 0) /* Intel TPR Shadow */
@@ -229,7 +230,7 @@
 
 #define X86_FEATURE_VMMCALL             ( 8*32+15) /* Prefer VMMCALL to VMCALL */
 #define X86_FEATURE_XENPV               ( 8*32+16) /* "" Xen paravirtual guest */
-
+#define X86_FEATURE_EPT_AD              ( 8*32+17) /* Intel Extended Page Table access-dirty bit */
 
 /* Intel-defined CPU features, CPUID level 0x00000007:0 (EBX), word 9 */
 #define X86_FEATURE_FSGSBASE            ( 9*32+ 0) /* RDFSBASE, WRFSBASE, RDGSBASE, WRGSBASE instructions*/
diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
index cf090e584202..7ed08a7c3398 100644
--- a/arch/x86/include/asm/intel-family.h
+++ b/arch/x86/include/asm/intel-family.h
@@ -76,4 +76,17 @@
 #define INTEL_FAM6_XEON_PHI_KNL         0x57 /* Knights Landing */
 #define INTEL_FAM6_XEON_PHI_KNM         0x85 /* Knights Mill */
 
+/* Useful macros */
+#define INTEL_CPU_FAM_ANY(_family, _model, _driver_data)        \
+{                                                               \
+        .vendor         = X86_VENDOR_INTEL,                     \
+        .family         = _family,                              \
+        .model          = _model,                               \
+        .feature        = X86_FEATURE_ANY,                      \
+        .driver_data    = (kernel_ulong_t)&_driver_data         \
+}
+
+#define INTEL_CPU_FAM6(_model, _driver_data)                    \
+        INTEL_CPU_FAM_ANY(6, INTEL_FAM6_##_model, _driver_data)
+
 #endif /* _ASM_X86_INTEL_FAMILY_H */
diff --git a/arch/x86/include/asm/intel-mid.h b/arch/x86/include/asm/intel-mid.h
index fe04491130ae..52f815a80539 100644
--- a/arch/x86/include/asm/intel-mid.h
+++ b/arch/x86/include/asm/intel-mid.h
@@ -80,35 +80,6 @@ enum intel_mid_cpu_type {
 
 extern enum intel_mid_cpu_type __intel_mid_cpu_chip;
 
-/**
- * struct intel_mid_ops - Interface between intel-mid & sub archs
- * @arch_setup: arch_setup function to re-initialize platform
- *              structures (x86_init, x86_platform_init)
- *
- * This structure can be extended if any new interface is required
- * between intel-mid & its sub arch files.
- */
-struct intel_mid_ops {
-        void (*arch_setup)(void);
-};
-
-/* Helper API's for INTEL_MID_OPS_INIT */
-#define DECLARE_INTEL_MID_OPS_INIT(cpuname, cpuid)                              \
-        [cpuid] = get_##cpuname##_ops
-
-/* Maximum number of CPU ops */
-#define MAX_CPU_OPS(a)                  (sizeof(a)/sizeof(void *))
-
-/*
- * For every new cpu addition, a weak get_<cpuname>_ops() function needs be
- * declared in arch/x86/platform/intel_mid/intel_mid_weak_decls.h.
- */
-#define INTEL_MID_OPS_INIT {                                                    \
-        DECLARE_INTEL_MID_OPS_INIT(penwell, INTEL_MID_CPU_CHIP_PENWELL),        \
-        DECLARE_INTEL_MID_OPS_INIT(cloverview, INTEL_MID_CPU_CHIP_CLOVERVIEW),  \
-        DECLARE_INTEL_MID_OPS_INIT(tangier, INTEL_MID_CPU_CHIP_TANGIER)         \
-};
-
 #ifdef CONFIG_X86_INTEL_MID
 
 static inline enum intel_mid_cpu_type intel_mid_identify_cpu(void)
@@ -136,20 +107,6 @@ enum intel_mid_timer_options {
 
 extern enum intel_mid_timer_options intel_mid_timer_options;
 
-/*
- * Penwell uses spread spectrum clock, so the freq number is not exactly
- * the same as reported by MSR based on SDM.
- */
-#define FSB_FREQ_83SKU                  83200
-#define FSB_FREQ_100SKU                 99840
-#define FSB_FREQ_133SKU                 133000
-
-#define FSB_FREQ_167SKU                 167000
-#define FSB_FREQ_200SKU                 200000
-#define FSB_FREQ_267SKU                 267000
-#define FSB_FREQ_333SKU                 333000
-#define FSB_FREQ_400SKU                 400000
-
 /* Bus Select SoC Fuse value */
 #define BSEL_SOC_FUSE_MASK              0x7
 /* FSB 133MHz */
diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
index c4fc17220df9..c14f2a74b2be 100644
--- a/arch/x86/include/asm/irqflags.h
+++ b/arch/x86/include/asm/irqflags.h
@@ -13,6 +13,8 @@
  * Interrupt control:
  */
 
+/* Declaration required for gcc < 4.9 to prevent -Werror=missing-prototypes */
+extern inline unsigned long native_save_fl(void);
 extern inline unsigned long native_save_fl(void)
 {
         unsigned long flags;
diff --git a/arch/x86/include/asm/kvm_guest.h b/arch/x86/include/asm/kvm_guest.h
deleted file mode 100644
index 46185263d9c2..000000000000
--- a/arch/x86/include/asm/kvm_guest.h
+++ /dev/null
@@ -1,7 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef _ASM_X86_KVM_GUEST_H
-#define _ASM_X86_KVM_GUEST_H
-
-int kvm_setup_vsyscall_timeinfo(void);
-
-#endif /* _ASM_X86_KVM_GUEST_H */
diff --git a/arch/x86/include/asm/kvm_para.h b/arch/x86/include/asm/kvm_para.h
index 3aea2658323a..4c723632c036 100644
--- a/arch/x86/include/asm/kvm_para.h
+++ b/arch/x86/include/asm/kvm_para.h
@@ -7,7 +7,6 @@
 #include <uapi/asm/kvm_para.h>
 
 extern void kvmclock_init(void);
-extern int kvm_register_clock(char *txt);
 
 #ifdef CONFIG_KVM_GUEST
 bool kvm_check_and_clear_guest_paused(void);
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
index bbc796eb0a3b..eeeb9289c764 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -71,12 +71,7 @@ struct ldt_struct {
 
 static inline void *ldt_slot_va(int slot)
 {
-#ifdef CONFIG_X86_64
         return (void *)(LDT_BASE_ADDR + LDT_SLOT_STRIDE * slot);
-#else
-        BUG();
-        return (void *)fix_to_virt(FIX_HOLE);
-#endif
 }
 
 /*
diff --git a/arch/x86/include/asm/mshyperv.h b/arch/x86/include/asm/mshyperv.h
index 5a7375ed5f7c..19886fef1dfc 100644
--- a/arch/x86/include/asm/mshyperv.h
+++ b/arch/x86/include/asm/mshyperv.h
@@ -194,6 +194,40 @@ static inline u64 hv_do_fast_hypercall8(u16 code, u64 input1)
                 return hv_status;
 }
 
+/* Fast hypercall with 16 bytes of input */
+static inline u64 hv_do_fast_hypercall16(u16 code, u64 input1, u64 input2)
+{
+        u64 hv_status, control = (u64)code | HV_HYPERCALL_FAST_BIT;
+
+#ifdef CONFIG_X86_64
+        {
+                __asm__ __volatile__("mov %4, %%r8\n"
+                                     CALL_NOSPEC
+                                     : "=a" (hv_status), ASM_CALL_CONSTRAINT,
+                                       "+c" (control), "+d" (input1)
+                                     : "r" (input2),
+                                       THUNK_TARGET(hv_hypercall_pg)
+                                     : "cc", "r8", "r9", "r10", "r11");
+        }
+#else
+        {
+                u32 input1_hi = upper_32_bits(input1);
+                u32 input1_lo = lower_32_bits(input1);
+                u32 input2_hi = upper_32_bits(input2);
+                u32 input2_lo = lower_32_bits(input2);
+
+                __asm__ __volatile__ (CALL_NOSPEC
+                                      : "=A"(hv_status),
+                                        "+c"(input1_lo), ASM_CALL_CONSTRAINT
+                                      : "A" (control), "b" (input1_hi),
+                                        "D"(input2_hi), "S"(input2_lo),
+                                        THUNK_TARGET(hv_hypercall_pg)
+                                      : "cc");
+        }
+#endif
+                return hv_status;
+}
+
 /*
  * Rep hypercalls. Callers of this functions are supposed to ensure that
  * rep_count and varhead_size comply with Hyper-V hypercall definition.
diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
index f6f6c63da62f..fd2a8c1b88bc 100644
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -214,7 +214,7 @@ enum spectre_v2_mitigation {
         SPECTRE_V2_RETPOLINE_MINIMAL_AMD,
         SPECTRE_V2_RETPOLINE_GENERIC,
         SPECTRE_V2_RETPOLINE_AMD,
-        SPECTRE_V2_IBRS,
+        SPECTRE_V2_IBRS_ENHANCED,
 };
 
 /* The Speculative Store Bypass disable variants */
diff --git a/arch/x86/include/asm/orc_types.h b/arch/x86/include/asm/orc_types.h
index 9c9dc579bd7d..46f516dd80ce 100644
--- a/arch/x86/include/asm/orc_types.h
+++ b/arch/x86/include/asm/orc_types.h
@@ -88,6 +88,7 @@ struct orc_entry {
         unsigned        sp_reg:4;
         unsigned        bp_reg:4;
         unsigned        type:2;
+        unsigned        end:1;
 } __packed;
 
 /*
@@ -101,6 +102,7 @@ struct unwind_hint {
         s16             sp_offset;
         u8              sp_reg;
         u8              type;
+        u8              end;
 };
 #endif /* __ASSEMBLY__ */
 
diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
index a06b07399d17..e9202a0de8f0 100644
--- a/arch/x86/include/asm/percpu.h
+++ b/arch/x86/include/asm/percpu.h
@@ -450,9 +450,10 @@ do {									\
         bool __ret;                                                     \
         typeof(pcp1) __o1 = (o1), __n1 = (n1);                          \
         typeof(pcp2) __o2 = (o2), __n2 = (n2);                          \
-        asm volatile("cmpxchg8b "__percpu_arg(1)"\n\tsetz %0\n\t"       \
-                    : "=a" (__ret), "+m" (pcp1), "+m" (pcp2), "+d" (__o2) \
-                    :  "b" (__n1), "c" (__n2), "a" (__o1));             \
+        asm volatile("cmpxchg8b "__percpu_arg(1)                        \
+                     CC_SET(z)                                          \
+                     : CC_OUT(z) (__ret), "+m" (pcp1), "+m" (pcp2), "+a" (__o1), "+d" (__o2) \
+                     : "b" (__n1), "c" (__n2));                         \
         __ret;                                                          \
 })
 
diff --git a/arch/x86/include/asm/pgtable-2level.h b/arch/x86/include/asm/pgtable-2level.h
index 685ffe8a0eaf..c399ea5eea41 100644
--- a/arch/x86/include/asm/pgtable-2level.h
+++ b/arch/x86/include/asm/pgtable-2level.h
@@ -19,6 +19,9 @@ static inline void native_set_pte(pte_t *ptep , pte_t pte)
 
 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
 {
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+        pmd.pud.p4d.pgd = pti_set_user_pgtbl(&pmdp->pud.p4d.pgd, pmd.pud.p4d.pgd);
+#endif
         *pmdp = pmd;
 }
 
@@ -58,6 +61,9 @@ static inline pte_t native_ptep_get_and_clear(pte_t *xp)
 #ifdef CONFIG_SMP
 static inline pmd_t native_pmdp_get_and_clear(pmd_t *xp)
 {
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+        pti_set_user_pgtbl(&xp->pud.p4d.pgd, __pgd(0));
+#endif
         return __pmd(xchg((pmdval_t *)xp, 0));
 }
 #else
@@ -67,6 +73,9 @@ static inline pmd_t native_pmdp_get_and_clear(pmd_t *xp)
 #ifdef CONFIG_SMP
 static inline pud_t native_pudp_get_and_clear(pud_t *xp)
 {
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+        pti_set_user_pgtbl(&xp->p4d.pgd, __pgd(0));
+#endif
         return __pud(xchg((pudval_t *)xp, 0));
 }
 #else
diff --git a/arch/x86/include/asm/pgtable-2level_types.h b/arch/x86/include/asm/pgtable-2level_types.h
index f982ef808e7e..6deb6cd236e3 100644
--- a/arch/x86/include/asm/pgtable-2level_types.h
+++ b/arch/x86/include/asm/pgtable-2level_types.h
@@ -35,4 +35,7 @@ typedef union {
 
 #define PTRS_PER_PTE    1024
 
+/* This covers all VMSPLIT_* and VMSPLIT_*_OPT variants */
+#define PGD_KERNEL_START        (CONFIG_PAGE_OFFSET >> PGDIR_SHIFT)
+
 #endif /* _ASM_X86_PGTABLE_2LEVEL_DEFS_H */
diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
index f24df59c40b2..f2ca3139ca22 100644
--- a/arch/x86/include/asm/pgtable-3level.h
+++ b/arch/x86/include/asm/pgtable-3level.h
@@ -98,6 +98,9 @@ static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
 
 static inline void native_set_pud(pud_t *pudp, pud_t pud)
 {
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+        pud.p4d.pgd = pti_set_user_pgtbl(&pudp->p4d.pgd, pud.p4d.pgd);
+#endif
         set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
 }
 
@@ -229,6 +232,10 @@ static inline pud_t native_pudp_get_and_clear(pud_t *pudp)
 {
         union split_pud res, *orig = (union split_pud *)pudp;
 
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+        pti_set_user_pgtbl(&pudp->p4d.pgd, __pgd(0));
+#endif
+
         /* xchg acts as a barrier before setting of the high bits */
         res.pud_low = xchg(&orig->pud_low, 0);
         res.pud_high = orig->pud_high;
diff --git a/arch/x86/include/asm/pgtable-3level_types.h b/arch/x86/include/asm/pgtable-3level_types.h
index 6a59a6d0cc50..858358a82b14 100644
--- a/arch/x86/include/asm/pgtable-3level_types.h
+++ b/arch/x86/include/asm/pgtable-3level_types.h
@@ -21,9 +21,10 @@ typedef union {
 #endif  /* !__ASSEMBLY__ */
 
 #ifdef CONFIG_PARAVIRT
-#define SHARED_KERNEL_PMD       (pv_info.shared_kernel_pmd)
+#define SHARED_KERNEL_PMD       ((!static_cpu_has(X86_FEATURE_PTI) &&   \
+                                 (pv_info.shared_kernel_pmd)))
 #else
-#define SHARED_KERNEL_PMD       1
+#define SHARED_KERNEL_PMD       (!static_cpu_has(X86_FEATURE_PTI))
 #endif
 
 /*
@@ -45,5 +46,6 @@ typedef union {
 #define PTRS_PER_PTE    512
 
 #define MAX_POSSIBLE_PHYSMEM_BITS       36
+#define PGD_KERNEL_START        (CONFIG_PAGE_OFFSET >> PGDIR_SHIFT)
 
 #endif /* _ASM_X86_PGTABLE_3LEVEL_DEFS_H */
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index 5715647fc4fe..a1cb3339da8d 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -30,11 +30,14 @@ int __init __early_make_pgtable(unsigned long address, pmdval_t pmd);
 void ptdump_walk_pgd_level(struct seq_file *m, pgd_t *pgd);
 void ptdump_walk_pgd_level_debugfs(struct seq_file *m, pgd_t *pgd, bool user);
 void ptdump_walk_pgd_level_checkwx(void);
+void ptdump_walk_user_pgd_level_checkwx(void);
 
 #ifdef CONFIG_DEBUG_WX
-#define debug_checkwx() ptdump_walk_pgd_level_checkwx()
+#define debug_checkwx()         ptdump_walk_pgd_level_checkwx()
+#define debug_checkwx_user()    ptdump_walk_user_pgd_level_checkwx()
 #else
-#define debug_checkwx() do { } while (0)
+#define debug_checkwx()         do { } while (0)
+#define debug_checkwx_user()    do { } while (0)
 #endif
 
 /*
@@ -640,8 +643,31 @@ static inline int is_new_memtype_allowed(u64 paddr, unsigned long size,
 
 pmd_t *populate_extra_pmd(unsigned long vaddr);
 pte_t *populate_extra_pte(unsigned long vaddr);
+
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+pgd_t __pti_set_user_pgtbl(pgd_t *pgdp, pgd_t pgd);
+
+/*
+ * Take a PGD location (pgdp) and a pgd value that needs to be set there.
+ * Populates the user and returns the resulting PGD that must be set in
+ * the kernel copy of the page tables.
+ */
+static inline pgd_t pti_set_user_pgtbl(pgd_t *pgdp, pgd_t pgd)
+{
+        if (!static_cpu_has(X86_FEATURE_PTI))
+                return pgd;
+        return __pti_set_user_pgtbl(pgdp, pgd);
+}
+#else   /* CONFIG_PAGE_TABLE_ISOLATION */
+static inline pgd_t pti_set_user_pgtbl(pgd_t *pgdp, pgd_t pgd)
+{
+        return pgd;
+}
+#endif  /* CONFIG_PAGE_TABLE_ISOLATION */
+
 #endif  /* __ASSEMBLY__ */
 
+
 #ifdef CONFIG_X86_32
 # include <asm/pgtable_32.h>
 #else
@@ -1154,6 +1180,70 @@ static inline pmd_t pmdp_establish(struct vm_area_struct *vma,
         }
 }
 #endif
+/*
+ * Page table pages are page-aligned.  The lower half of the top
+ * level is used for userspace and the top half for the kernel.
+ *
+ * Returns true for parts of the PGD that map userspace and
+ * false for the parts that map the kernel.
+ */
+static inline bool pgdp_maps_userspace(void *__ptr)
+{
+        unsigned long ptr = (unsigned long)__ptr;
+
+        return (((ptr & ~PAGE_MASK) / sizeof(pgd_t)) < PGD_KERNEL_START);
+}
+
+static inline int pgd_large(pgd_t pgd) { return 0; }
+
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+/*
+ * All top-level PAGE_TABLE_ISOLATION page tables are order-1 pages
+ * (8k-aligned and 8k in size).  The kernel one is at the beginning 4k and
+ * the user one is in the last 4k.  To switch between them, you
+ * just need to flip the 12th bit in their addresses.
+ */
+#define PTI_PGTABLE_SWITCH_BIT  PAGE_SHIFT
+
+/*
+ * This generates better code than the inline assembly in
+ * __set_bit().
+ */
+static inline void *ptr_set_bit(void *ptr, int bit)
+{
+        unsigned long __ptr = (unsigned long)ptr;
+
+        __ptr |= BIT(bit);
+        return (void *)__ptr;
+}
+static inline void *ptr_clear_bit(void *ptr, int bit)
+{
+        unsigned long __ptr = (unsigned long)ptr;
+
+        __ptr &= ~BIT(bit);
+        return (void *)__ptr;
+}
+
+static inline pgd_t *kernel_to_user_pgdp(pgd_t *pgdp)
+{
+        return ptr_set_bit(pgdp, PTI_PGTABLE_SWITCH_BIT);
+}
+
+static inline pgd_t *user_to_kernel_pgdp(pgd_t *pgdp)
+{
+        return ptr_clear_bit(pgdp, PTI_PGTABLE_SWITCH_BIT);
+}
+
+static inline p4d_t *kernel_to_user_p4dp(p4d_t *p4dp)
+{
+        return ptr_set_bit(p4dp, PTI_PGTABLE_SWITCH_BIT);
+}
+
+static inline p4d_t *user_to_kernel_p4dp(p4d_t *p4dp)
+{
+        return ptr_clear_bit(p4dp, PTI_PGTABLE_SWITCH_BIT);
+}
+#endif /* CONFIG_PAGE_TABLE_ISOLATION */
 
 /*
  * clone_pgd_range(pgd_t *dst, pgd_t *src, int count);
diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
index 88a056b01db4..b3ec519e3982 100644
--- a/arch/x86/include/asm/pgtable_32.h
+++ b/arch/x86/include/asm/pgtable_32.h
@@ -34,8 +34,6 @@ static inline void check_pgt_cache(void) { }
 void paging_init(void);
 void sync_initial_page_table(void);
 
-static inline int pgd_large(pgd_t pgd) { return 0; }
-
 /*
  * Define this if things work differently on an i386 and an i486:
  * it will (on an i486) warn about kernel memory accesses that are
diff --git a/arch/x86/include/asm/pgtable_32_types.h b/arch/x86/include/asm/pgtable_32_types.h
index d9a001a4a872..b0bc0fff5f1f 100644
--- a/arch/x86/include/asm/pgtable_32_types.h
+++ b/arch/x86/include/asm/pgtable_32_types.h
@@ -50,13 +50,18 @@ extern bool __vmalloc_start_set; /* set once high_memory is set */
         ((FIXADDR_TOT_START - PAGE_SIZE * (CPU_ENTRY_AREA_PAGES + 1))   \
          & PMD_MASK)
 
-#define PKMAP_BASE              \
+#define LDT_BASE_ADDR           \
         ((CPU_ENTRY_AREA_BASE - PAGE_SIZE) & PMD_MASK)
 
+#define LDT_END_ADDR            (LDT_BASE_ADDR + PMD_SIZE)
+
+#define PKMAP_BASE              \
+        ((LDT_BASE_ADDR - PAGE_SIZE) & PMD_MASK)
+
 #ifdef CONFIG_HIGHMEM
 # define VMALLOC_END    (PKMAP_BASE - 2 * PAGE_SIZE)
 #else
-# define VMALLOC_END    (CPU_ENTRY_AREA_BASE - 2 * PAGE_SIZE)
+# define VMALLOC_END    (LDT_BASE_ADDR - 2 * PAGE_SIZE)
 #endif
 
 #define MODULES_VADDR   VMALLOC_START
diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
index 3c5385f9a88f..acb6970e7bcf 100644
--- a/arch/x86/include/asm/pgtable_64.h
+++ b/arch/x86/include/asm/pgtable_64.h
@@ -132,90 +132,6 @@ static inline pud_t native_pudp_get_and_clear(pud_t *xp)
 #endif
 }
 
-#ifdef CONFIG_PAGE_TABLE_ISOLATION
-/*
- * All top-level PAGE_TABLE_ISOLATION page tables are order-1 pages
- * (8k-aligned and 8k in size).  The kernel one is at the beginning 4k and
- * the user one is in the last 4k.  To switch between them, you
- * just need to flip the 12th bit in their addresses.
- */
-#define PTI_PGTABLE_SWITCH_BIT  PAGE_SHIFT
-
-/*
- * This generates better code than the inline assembly in
- * __set_bit().
- */
-static inline void *ptr_set_bit(void *ptr, int bit)
-{
-        unsigned long __ptr = (unsigned long)ptr;
-
-        __ptr |= BIT(bit);
-        return (void *)__ptr;
-}
-static inline void *ptr_clear_bit(void *ptr, int bit)
-{
-        unsigned long __ptr = (unsigned long)ptr;
-
-        __ptr &= ~BIT(bit);
-        return (void *)__ptr;
-}
-
-static inline pgd_t *kernel_to_user_pgdp(pgd_t *pgdp)
-{
-        return ptr_set_bit(pgdp, PTI_PGTABLE_SWITCH_BIT);
-}
-
-static inline pgd_t *user_to_kernel_pgdp(pgd_t *pgdp)
-{
-        return ptr_clear_bit(pgdp, PTI_PGTABLE_SWITCH_BIT);
-}
-
-static inline p4d_t *kernel_to_user_p4dp(p4d_t *p4dp)
-{
-        return ptr_set_bit(p4dp, PTI_PGTABLE_SWITCH_BIT);
-}
-
-static inline p4d_t *user_to_kernel_p4dp(p4d_t *p4dp)
-{
-        return ptr_clear_bit(p4dp, PTI_PGTABLE_SWITCH_BIT);
-}
-#endif /* CONFIG_PAGE_TABLE_ISOLATION */
-
-/*
- * Page table pages are page-aligned.  The lower half of the top
- * level is used for userspace and the top half for the kernel.
- *
- * Returns true for parts of the PGD that map userspace and
- * false for the parts that map the kernel.
- */
-static inline bool pgdp_maps_userspace(void *__ptr)
-{
-        unsigned long ptr = (unsigned long)__ptr;
-
-        return (ptr & ~PAGE_MASK) < (PAGE_SIZE / 2);
-}
-
-#ifdef CONFIG_PAGE_TABLE_ISOLATION
-pgd_t __pti_set_user_pgd(pgd_t *pgdp, pgd_t pgd);
-
-/*
- * Take a PGD location (pgdp) and a pgd value that needs to be set there.
- * Populates the user and returns the resulting PGD that must be set in
- * the kernel copy of the page tables.
- */
-static inline pgd_t pti_set_user_pgd(pgd_t *pgdp, pgd_t pgd)
-{
-        if (!static_cpu_has(X86_FEATURE_PTI))
-                return pgd;
-        return __pti_set_user_pgd(pgdp, pgd);
-}
-#else
-static inline pgd_t pti_set_user_pgd(pgd_t *pgdp, pgd_t pgd)
-{
-        return pgd;
-}
-#endif
-
 static inline void native_set_p4d(p4d_t *p4dp, p4d_t p4d)
 {
         pgd_t pgd;
@@ -226,7 +142,7 @@ static inline void native_set_p4d(p4d_t *p4dp, p4d_t p4d)
         }
 
         pgd = native_make_pgd(native_p4d_val(p4d));
-        pgd = pti_set_user_pgd((pgd_t *)p4dp, pgd);
+        pgd = pti_set_user_pgtbl((pgd_t *)p4dp, pgd);
         *p4dp = native_make_p4d(native_pgd_val(pgd));
 }
 
@@ -237,7 +153,7 @@ static inline void native_p4d_clear(p4d_t *p4d)
 
 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
 {
-        *pgdp = pti_set_user_pgd(pgdp, pgd);
+        *pgdp = pti_set_user_pgtbl(pgdp, pgd);
 }
 
 static inline void native_pgd_clear(pgd_t *pgd)
@@ -255,7 +171,6 @@ extern void sync_global_pgds(unsigned long start, unsigned long end);
 /*
  * Level 4 access.
  */
-static inline int pgd_large(pgd_t pgd) { return 0; }
 #define mk_kernel_pgd(address) __pgd((address) | _KERNPG_TABLE)
 
 /* PUD - Level3 access */
diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
index 054765ab2da2..04edd2d58211 100644
--- a/arch/x86/include/asm/pgtable_64_types.h
+++ b/arch/x86/include/asm/pgtable_64_types.h
@@ -115,6 +115,7 @@ extern unsigned int ptrs_per_p4d;
 #define LDT_PGD_ENTRY_L5        -112UL
 #define LDT_PGD_ENTRY           (pgtable_l5_enabled() ? LDT_PGD_ENTRY_L5 : LDT_PGD_ENTRY_L4)
 #define LDT_BASE_ADDR           (LDT_PGD_ENTRY << PGDIR_SHIFT)
+#define LDT_END_ADDR            (LDT_BASE_ADDR + PGDIR_SIZE)
 
 #define __VMALLOC_BASE_L4       0xffffc90000000000UL
 #define __VMALLOC_BASE_L5       0xffa0000000000000UL
@@ -153,4 +154,6 @@ extern unsigned int ptrs_per_p4d;
 
 #define EARLY_DYNAMIC_PAGE_TABLES       64
 
+#define PGD_KERNEL_START        ((PAGE_SIZE / 2) / sizeof(pgd_t))
+
 #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
index 99fff853c944..b64acb08a62b 100644
--- a/arch/x86/include/asm/pgtable_types.h
+++ b/arch/x86/include/asm/pgtable_types.h
@@ -50,6 +50,7 @@
 #define _PAGE_GLOBAL    (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
 #define _PAGE_SOFTW1    (_AT(pteval_t, 1) << _PAGE_BIT_SOFTW1)
 #define _PAGE_SOFTW2    (_AT(pteval_t, 1) << _PAGE_BIT_SOFTW2)
+#define _PAGE_SOFTW3    (_AT(pteval_t, 1) << _PAGE_BIT_SOFTW3)
 #define _PAGE_PAT       (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
 #define _PAGE_SPECIAL   (_AT(pteval_t, 1) << _PAGE_BIT_SPECIAL)
@@ -266,14 +267,37 @@ typedef struct pgprot { pgprotval_t pgprot; } pgprot_t;
 
 typedef struct { pgdval_t pgd; } pgd_t;
 
+#ifdef CONFIG_X86_PAE
+
+/*
+ * PHYSICAL_PAGE_MASK might be non-constant when SME is compiled in, so we can't
+ * use it here.
+ */
+
+#define PGD_PAE_PAGE_MASK       ((signed long)PAGE_MASK)
+#define PGD_PAE_PHYS_MASK       (((1ULL << __PHYSICAL_MASK_SHIFT)-1) & PGD_PAE_PAGE_MASK)
+
+/*
+ * PAE allows Base Address, P, PWT, PCD and AVL bits to be set in PGD entries.
+ * All other bits are Reserved MBZ
+ */
+#define PGD_ALLOWED_BITS        (PGD_PAE_PHYS_MASK | _PAGE_PRESENT | \
+                                 _PAGE_PWT | _PAGE_PCD | \
+                                 _PAGE_SOFTW1 | _PAGE_SOFTW2 | _PAGE_SOFTW3)
+
+#else
+/* No need to mask any bits for !PAE */
+#define PGD_ALLOWED_BITS        (~0ULL)
+#endif
+
 static inline pgd_t native_make_pgd(pgdval_t val)
 {
-        return (pgd_t) { val };
+        return (pgd_t) { val & PGD_ALLOWED_BITS };
 }
 
 static inline pgdval_t native_pgd_val(pgd_t pgd)
 {
-        return pgd.pgd;
+        return pgd.pgd & PGD_ALLOWED_BITS;
 }
 
 static inline pgdval_t pgd_flags(pgd_t pgd)
diff --git a/arch/x86/include/asm/processor-flags.h b/arch/x86/include/asm/processor-flags.h
index 625a52a5594f..02c2cbda4a74 100644
--- a/arch/x86/include/asm/processor-flags.h
+++ b/arch/x86/include/asm/processor-flags.h
@@ -39,10 +39,6 @@
 #define CR3_PCID_MASK   0xFFFull
 #define CR3_NOFLUSH     BIT_ULL(63)
 
-#ifdef CONFIG_PAGE_TABLE_ISOLATION
-# define X86_CR3_PTI_PCID_USER_BIT      11
-#endif
-
 #else
 /*
  * CR3_ADDR_MASK needs at least bits 31:5 set on PAE systems, and we save
@@ -53,4 +49,8 @@
 #define CR3_NOFLUSH     0
 #endif
 
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+# define X86_CR3_PTI_PCID_USER_BIT      11
+#endif
+
 #endif /* _ASM_X86_PROCESSOR_FLAGS_H */
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index cfd29ee8c3da..59663c08c949 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -966,6 +966,7 @@ static inline uint32_t hypervisor_cpuid_base(const char *sig, uint32_t leaves)
 
 extern unsigned long arch_align_stack(unsigned long sp);
 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
+extern void free_kernel_image_pages(void *begin, void *end);
 
 void default_idle(void);
 #ifdef  CONFIG_XEN
diff --git a/arch/x86/include/asm/pti.h b/arch/x86/include/asm/pti.h
index 38a17f1d5c9d..5df09a0b80b8 100644
--- a/arch/x86/include/asm/pti.h
+++ b/arch/x86/include/asm/pti.h
@@ -6,10 +6,9 @@
 #ifdef CONFIG_PAGE_TABLE_ISOLATION
 extern void pti_init(void);
 extern void pti_check_boottime_disable(void);
-extern void pti_clone_kernel_text(void);
+extern void pti_finalize(void);
 #else
 static inline void pti_check_boottime_disable(void) { }
-static inline void pti_clone_kernel_text(void) { }
 #endif
 
 #endif /* __ASSEMBLY__ */
diff --git a/arch/x86/include/asm/refcount.h b/arch/x86/include/asm/refcount.h
index 4cf11d88d3b3..19b90521954c 100644
--- a/arch/x86/include/asm/refcount.h
+++ b/arch/x86/include/asm/refcount.h
@@ -5,6 +5,7 @@
  * PaX/grsecurity.
  */
 #include <linux/refcount.h>
+#include <asm/bug.h>
 
 /*
  * This is the first portion of the refcount error handling, which lives in
diff --git a/arch/x86/include/asm/sections.h b/arch/x86/include/asm/sections.h
index 5c019d23d06b..4a911a382ade 100644
--- a/arch/x86/include/asm/sections.h
+++ b/arch/x86/include/asm/sections.h
@@ -7,6 +7,7 @@
 
 extern char __brk_base[], __brk_limit[];
 extern struct exception_table_entry __stop___ex_table[];
+extern char __end_rodata_aligned[];
 
 #if defined(CONFIG_X86_64)
 extern char __end_rodata_hpage_align[];
diff --git a/arch/x86/include/asm/set_memory.h b/arch/x86/include/asm/set_memory.h
index bd090367236c..34cffcef7375 100644
--- a/arch/x86/include/asm/set_memory.h
+++ b/arch/x86/include/asm/set_memory.h
@@ -46,6 +46,7 @@ int set_memory_np(unsigned long addr, int numpages);
 int set_memory_4k(unsigned long addr, int numpages);
 int set_memory_encrypted(unsigned long addr, int numpages);
 int set_memory_decrypted(unsigned long addr, int numpages);
+int set_memory_np_noalias(unsigned long addr, int numpages);
 
 int set_memory_array_uc(unsigned long *addr, int addrinarray);
 int set_memory_array_wc(unsigned long *addr, int addrinarray);
diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h
index eb5f7999a893..36bd243843d6 100644
--- a/arch/x86/include/asm/switch_to.h
+++ b/arch/x86/include/asm/switch_to.h
@@ -87,15 +87,25 @@ static inline void refresh_sysenter_cs(struct thread_struct *thread)
 #endif
 
 /* This is used when switching tasks or entering/exiting vm86 mode. */
-static inline void update_sp0(struct task_struct *task)
+static inline void update_task_stack(struct task_struct *task)
 {
-        /* On x86_64, sp0 always points to the entry trampoline stack, which is constant: */
+        /* sp0 always points to the entry trampoline stack, which is constant: */
 #ifdef CONFIG_X86_32
-        load_sp0(task->thread.sp0);
+        if (static_cpu_has(X86_FEATURE_XENPV))
+                load_sp0(task->thread.sp0);
+        else
+                this_cpu_write(cpu_tss_rw.x86_tss.sp1, task->thread.sp0);
 #else
+        /*
+         * x86-64 updates x86_tss.sp1 via cpu_current_top_of_stack. That
+         * doesn't work on x86-32 because sp1 and
+         * cpu_current_top_of_stack have different values (because of
+         * the non-zero stack-padding on 32bit).
+         */
         if (static_cpu_has(X86_FEATURE_XENPV))
                 load_sp0(task_top_of_stack(task));
 #endif
+
 }
 
 #endif /* _ASM_X86_SWITCH_TO_H */
diff --git a/arch/x86/include/asm/text-patching.h b/arch/x86/include/asm/text-patching.h
index 2ecd34e2d46c..e85ff65c43c3 100644
--- a/arch/x86/include/asm/text-patching.h
+++ b/arch/x86/include/asm/text-patching.h
@@ -37,5 +37,6 @@ extern void *text_poke_early(void *addr, const void *opcode, size_t len);
 extern void *text_poke(void *addr, const void *opcode, size_t len);
 extern int poke_int3_handler(struct pt_regs *regs);
 extern void *text_poke_bp(void *addr, const void *opcode, size_t len, void *handler);
+extern int after_bootmem;
 
 #endif /* _ASM_X86_TEXT_PATCHING_H */
diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
index 6690cd3fc8b1..511bf5fae8b8 100644
--- a/arch/x86/include/asm/tlbflush.h
+++ b/arch/x86/include/asm/tlbflush.h
@@ -148,22 +148,6 @@ static inline unsigned long build_cr3_noflush(pgd_t *pgd, u16 asid)
 #define __flush_tlb_one_user(addr) __native_flush_tlb_one_user(addr)
 #endif
 
-static inline bool tlb_defer_switch_to_init_mm(void)
-{
-        /*
-         * If we have PCID, then switching to init_mm is reasonably
-         * fast.  If we don't have PCID, then switching to init_mm is
-         * quite slow, so we try to defer it in the hopes that we can
-         * avoid it entirely.  The latter approach runs the risk of
-         * receiving otherwise unnecessary IPIs.
-         *
-         * This choice is just a heuristic.  The tlb code can handle this
-         * function returning true or false regardless of whether we have
-         * PCID.
-         */
-        return !static_cpu_has(X86_FEATURE_PCID);
-}
-
 struct tlb_context {
         u64 ctx_id;
         u64 tlb_gen;
@@ -554,4 +538,9 @@ extern void arch_tlbbatch_flush(struct arch_tlbflush_unmap_batch *batch);
         native_flush_tlb_others(mask, info)
 #endif
 
+extern void tlb_flush_remove_tables(struct mm_struct *mm);
+extern void tlb_flush_remove_tables_local(void *arg);
+
+#define HAVE_TLB_FLUSH_REMOVE_TABLES
+
 #endif /* _ASM_X86_TLBFLUSH_H */
diff --git a/arch/x86/include/asm/trace/hyperv.h b/arch/x86/include/asm/trace/hyperv.h
index 4253bca99989..9c0d4b588e3f 100644
--- a/arch/x86/include/asm/trace/hyperv.h
+++ b/arch/x86/include/asm/trace/hyperv.h
@@ -28,6 +28,21 @@ TRACE_EVENT(hyperv_mmu_flush_tlb_others,
                       __entry->addr, __entry->end)
         );
 
+TRACE_EVENT(hyperv_send_ipi_mask,
+            TP_PROTO(const struct cpumask *cpus,
+                     int vector),
+            TP_ARGS(cpus, vector),
+            TP_STRUCT__entry(
+                    __field(unsigned int, ncpus)
+                    __field(int, vector)
+                    ),
+            TP_fast_assign(__entry->ncpus = cpumask_weight(cpus);
+                           __entry->vector = vector;
+                    ),
+            TP_printk("ncpus %d vector %x",
+                      __entry->ncpus, __entry->vector)
+        );
+
 #endif /* CONFIG_HYPERV */
 
 #undef TRACE_INCLUDE_PATH
diff --git a/arch/x86/include/asm/tsc.h b/arch/x86/include/asm/tsc.h
index 2701d221583a..eb5bbfeccb66 100644
--- a/arch/x86/include/asm/tsc.h
+++ b/arch/x86/include/asm/tsc.h
@@ -33,13 +33,13 @@ static inline cycles_t get_cycles(void)
 extern struct system_counterval_t convert_art_to_tsc(u64 art);
 extern struct system_counterval_t convert_art_ns_to_tsc(u64 art_ns);
 
-extern void tsc_early_delay_calibrate(void);
+extern void tsc_early_init(void);
 extern void tsc_init(void);
 extern void mark_tsc_unstable(char *reason);
 extern int unsynchronized_tsc(void);
 extern int check_tsc_unstable(void);
 extern void mark_tsc_async_resets(char *reason);
-extern unsigned long native_calibrate_cpu(void);
+extern unsigned long native_calibrate_cpu_early(void);
 extern unsigned long native_calibrate_tsc(void);
 extern unsigned long long native_sched_clock_from_tsc(u64 tsc);
 
diff --git a/arch/x86/include/asm/unwind_hints.h b/arch/x86/include/asm/unwind_hints.h
index bae46fc6b9de..0bcdb1279361 100644
--- a/arch/x86/include/asm/unwind_hints.h
+++ b/arch/x86/include/asm/unwind_hints.h
@@ -26,7 +26,7 @@
  * the debuginfo as necessary.  It will also warn if it sees any
  * inconsistencies.
  */
-.macro UNWIND_HINT sp_reg=ORC_REG_SP sp_offset=0 type=ORC_TYPE_CALL
+.macro UNWIND_HINT sp_reg=ORC_REG_SP sp_offset=0 type=ORC_TYPE_CALL end=0
 #ifdef CONFIG_STACK_VALIDATION
 .Lunwind_hint_ip_\@:
         .pushsection .discard.unwind_hints
@@ -35,12 +35,14 @@
                 .short \sp_offset
                 .byte \sp_reg
                 .byte \type
+                .byte \end
+                .balign 4
         .popsection
 #endif
 .endm
 
 .macro UNWIND_HINT_EMPTY
-        UNWIND_HINT sp_reg=ORC_REG_UNDEFINED
+        UNWIND_HINT sp_reg=ORC_REG_UNDEFINED end=1
 .endm
 
 .macro UNWIND_HINT_REGS base=%rsp offset=0 indirect=0 extra=1 iret=0
@@ -86,19 +88,21 @@
 
 #else /* !__ASSEMBLY__ */
 
-#define UNWIND_HINT(sp_reg, sp_offset, type)                    \
+#define UNWIND_HINT(sp_reg, sp_offset, type, end)               \
         "987: \n\t"                                             \
         ".pushsection .discard.unwind_hints\n\t"                \
         /* struct unwind_hint */                                \
         ".long 987b - .\n\t"                                    \
-        ".short " __stringify(sp_offset) "\n\t"         \
+        ".short " __stringify(sp_offset) "\n\t"                 \
         ".byte " __stringify(sp_reg) "\n\t"                     \
         ".byte " __stringify(type) "\n\t"                       \
+        ".byte " __stringify(end) "\n\t"                        \
+        ".balign 4 \n\t"                                        \
         ".popsection\n\t"
 
-#define UNWIND_HINT_SAVE UNWIND_HINT(0, 0, UNWIND_HINT_TYPE_SAVE)
+#define UNWIND_HINT_SAVE UNWIND_HINT(0, 0, UNWIND_HINT_TYPE_SAVE, 0)
 
-#define UNWIND_HINT_RESTORE UNWIND_HINT(0, 0, UNWIND_HINT_TYPE_RESTORE)
+#define UNWIND_HINT_RESTORE UNWIND_HINT(0, 0, UNWIND_HINT_TYPE_RESTORE, 0)
 
 #endif /* __ASSEMBLY__ */
 
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index a481763a3776..014f214da581 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -668,6 +668,7 @@ void *__init_or_module text_poke_early(void *addr, const void *opcode,
         local_irq_save(flags);
         memcpy(addr, opcode, len);
         local_irq_restore(flags);
+        sync_core();
         /* Could also do a CLFLUSH here to speed up CPU recovery; but
            that causes hangs on some VIA CPUs. */
         return addr;
@@ -693,6 +694,12 @@ void *text_poke(void *addr, const void *opcode, size_t len)
         struct page *pages[2];
         int i;
 
+        /*
+         * While boot memory allocator is runnig we cannot use struct
+         * pages as they are not yet initialized.
+         */
+        BUG_ON(!after_bootmem);
+
         if (!core_kernel_text((unsigned long)addr)) {
                 pages[0] = vmalloc_to_page(addr);
                 pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index adbda5847b14..07fa222f0c52 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -940,7 +940,7 @@ static int __init calibrate_APIC_clock(void)
 
         if (levt->features & CLOCK_EVT_FEAT_DUMMY) {
                 pr_warning("APIC timer disabled due to verification failure\n");
-                        return -1;
+                return -1;
         }
 
         return 0;
diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
index 35aaee4fc028..0954315842c0 100644
--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -218,7 +218,8 @@ static int reserve_irq_vector(struct irq_data *irqd)
         return 0;
 }
 
-static int allocate_vector(struct irq_data *irqd, const struct cpumask *dest)
+static int
+assign_vector_locked(struct irq_data *irqd, const struct cpumask *dest)
 {
         struct apic_chip_data *apicd = apic_chip_data(irqd);
         bool resvd = apicd->has_reserved;
@@ -245,22 +246,12 @@ static int allocate_vector(struct irq_data *irqd, const struct cpumask *dest)
                 return -EBUSY;
 
         vector = irq_matrix_alloc(vector_matrix, dest, resvd, &cpu);
-        if (vector > 0)
-                apic_update_vector(irqd, vector, cpu);
         trace_vector_alloc(irqd->irq, vector, resvd, vector);
-        return vector;
-}
-
-static int assign_vector_locked(struct irq_data *irqd,
-                                const struct cpumask *dest)
-{
-        struct apic_chip_data *apicd = apic_chip_data(irqd);
-        int vector = allocate_vector(irqd, dest);
-
         if (vector < 0)
                 return vector;
+        apic_update_vector(irqd, vector, cpu);
+        apic_update_irq_cfg(irqd, vector, cpu);
 
-        apic_update_irq_cfg(irqd, apicd->vector, apicd->cpu);
         return 0;
 }
 
@@ -433,7 +424,7 @@ static int activate_managed(struct irq_data *irqd)
                 pr_err("Managed startup irq %u, no vector available\n",
                        irqd->irq);
         }
-       return ret;
+        return ret;
 }
 
 static int x86_vector_activate(struct irq_domain *dom, struct irq_data *irqd,
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index d492752f79e1..391f358ebb4c 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -394,10 +394,10 @@ extern int uv_hub_info_version(void)
 EXPORT_SYMBOL(uv_hub_info_version);
 
 /* Default UV memory block size is 2GB */
-static unsigned long mem_block_size = (2UL << 30);
+static unsigned long mem_block_size __initdata = (2UL << 30);
 
 /* Kernel parameter to specify UV mem block size */
-static int parse_mem_block_size(char *ptr)
+static int __init parse_mem_block_size(char *ptr)
 {
         unsigned long size = memparse(ptr, NULL);
 
diff --git a/arch/x86/kernel/asm-offsets.c b/arch/x86/kernel/asm-offsets.c
index dcb008c320fe..01de31db300d 100644
--- a/arch/x86/kernel/asm-offsets.c
+++ b/arch/x86/kernel/asm-offsets.c
@@ -103,4 +103,9 @@ void common(void) {
         OFFSET(CPU_ENTRY_AREA_entry_trampoline, cpu_entry_area, entry_trampoline);
         OFFSET(CPU_ENTRY_AREA_entry_stack, cpu_entry_area, entry_stack_page);
         DEFINE(SIZEOF_entry_stack, sizeof(struct entry_stack));
+        DEFINE(MASK_entry_stack, (~(sizeof(struct entry_stack) - 1)));
+
+        /* Offset for sp0 and sp1 into the tss_struct */
+        OFFSET(TSS_sp0, tss_struct, x86_tss.sp0);
+        OFFSET(TSS_sp1, tss_struct, x86_tss.sp1);
 }
diff --git a/arch/x86/kernel/asm-offsets_32.c b/arch/x86/kernel/asm-offsets_32.c
index a4a3be399f4b..82826f2275cc 100644
--- a/arch/x86/kernel/asm-offsets_32.c
+++ b/arch/x86/kernel/asm-offsets_32.c
@@ -46,8 +46,14 @@ void foo(void)
         OFFSET(saved_context_gdt_desc, saved_context, gdt_desc);
         BLANK();
 
-        /* Offset from the sysenter stack to tss.sp0 */
-        DEFINE(TSS_sysenter_sp0, offsetof(struct cpu_entry_area, tss.x86_tss.sp0) -
+        /*
+         * Offset from the entry stack to task stack stored in TSS. Kernel entry
+         * happens on the per-cpu entry-stack, and the asm code switches to the
+         * task-stack pointer stored in x86_tss.sp1, which is a copy of
+         * task->thread.sp0 where entry code can find it.
+         */
+        DEFINE(TSS_entry2task_stack,
+               offsetof(struct cpu_entry_area, tss.x86_tss.sp1) -
                offsetofend(struct cpu_entry_area, entry_stack_page.stack));
 
 #ifdef CONFIG_STACKPROTECTOR
diff --git a/arch/x86/kernel/asm-offsets_64.c b/arch/x86/kernel/asm-offsets_64.c
index b2dcd161f514..3b9405e7ba2b 100644
--- a/arch/x86/kernel/asm-offsets_64.c
+++ b/arch/x86/kernel/asm-offsets_64.c
@@ -65,8 +65,6 @@ int main(void)
 #undef ENTRY
 
         OFFSET(TSS_ist, tss_struct, x86_tss.ist);
-        OFFSET(TSS_sp0, tss_struct, x86_tss.sp0);
-        OFFSET(TSS_sp1, tss_struct, x86_tss.sp1);
         BLANK();
 
 #ifdef CONFIG_STACKPROTECTOR
diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
index 7a40196967cb..347137e80bf5 100644
--- a/arch/x86/kernel/cpu/Makefile
+++ b/arch/x86/kernel/cpu/Makefile
@@ -35,7 +35,9 @@ obj-$(CONFIG_CPU_SUP_CENTAUR)		+= centaur.o
 obj-$(CONFIG_CPU_SUP_TRANSMETA_32)      += transmeta.o
 obj-$(CONFIG_CPU_SUP_UMC_32)            += umc.o
 
-obj-$(CONFIG_INTEL_RDT) += intel_rdt.o intel_rdt_rdtgroup.o intel_rdt_monitor.o intel_rdt_ctrlmondata.o
+obj-$(CONFIG_INTEL_RDT) += intel_rdt.o intel_rdt_rdtgroup.o intel_rdt_monitor.o
+obj-$(CONFIG_INTEL_RDT) += intel_rdt_ctrlmondata.o intel_rdt_pseudo_lock.o
+CFLAGS_intel_rdt_pseudo_lock.o = -I$(src)
 
 obj-$(CONFIG_X86_MCE)                   += mcheck/
 obj-$(CONFIG_MTRR)                      += mtrr/
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 38915fbfae73..b732438c1a1e 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -232,8 +232,6 @@ static void init_amd_k7(struct cpuinfo_x86 *c)
                 }
         }
 
-        set_cpu_cap(c, X86_FEATURE_K7);
-
         /* calling is from identify_secondary_cpu() ? */
         if (!c->cpu_index)
                 return;
@@ -617,6 +615,14 @@ static void early_init_amd(struct cpuinfo_x86 *c)
 
         early_init_amd_mc(c);
 
+#ifdef CONFIG_X86_32
+        if (c->x86 == 6)
+                set_cpu_cap(c, X86_FEATURE_K7);
+#endif
+
+        if (c->x86 >= 0xf)
+                set_cpu_cap(c, X86_FEATURE_K8);
+
         rdmsr_safe(MSR_AMD64_PATCH_LEVEL, &c->microcode, &dummy);
 
         /*
@@ -863,9 +869,6 @@ static void init_amd(struct cpuinfo_x86 *c)
 
         init_amd_cacheinfo(c);
 
-        if (c->x86 >= 0xf)
-                set_cpu_cap(c, X86_FEATURE_K8);
-
         if (cpu_has(c, X86_FEATURE_XMM2)) {
                 unsigned long long val;
                 int ret;
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 5c0ea39311fe..405a9a61bb89 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -130,6 +130,7 @@ static const char *spectre_v2_strings[] = {
         [SPECTRE_V2_RETPOLINE_MINIMAL_AMD]      = "Vulnerable: Minimal AMD ASM retpoline",
         [SPECTRE_V2_RETPOLINE_GENERIC]          = "Mitigation: Full generic retpoline",
         [SPECTRE_V2_RETPOLINE_AMD]              = "Mitigation: Full AMD retpoline",
+        [SPECTRE_V2_IBRS_ENHANCED]              = "Mitigation: Enhanced IBRS",
 };
 
 #undef pr_fmt
@@ -313,23 +314,6 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
         return cmd;
 }
 
-/* Check for Skylake-like CPUs (for RSB handling) */
-static bool __init is_skylake_era(void)
-{
-        if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
-            boot_cpu_data.x86 == 6) {
-                switch (boot_cpu_data.x86_model) {
-                case INTEL_FAM6_SKYLAKE_MOBILE:
-                case INTEL_FAM6_SKYLAKE_DESKTOP:
-                case INTEL_FAM6_SKYLAKE_X:
-                case INTEL_FAM6_KABYLAKE_MOBILE:
-                case INTEL_FAM6_KABYLAKE_DESKTOP:
-                        return true;
-                }
-        }
-        return false;
-}
-
 static void __init spectre_v2_select_mitigation(void)
 {
         enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
@@ -349,6 +333,13 @@ static void __init spectre_v2_select_mitigation(void)
 
         case SPECTRE_V2_CMD_FORCE:
         case SPECTRE_V2_CMD_AUTO:
+                if (boot_cpu_has(X86_FEATURE_IBRS_ENHANCED)) {
+                        mode = SPECTRE_V2_IBRS_ENHANCED;
+                        /* Force it so VMEXIT will restore correctly */
+                        x86_spec_ctrl_base |= SPEC_CTRL_IBRS;
+                        wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+                        goto specv2_set_mode;
+                }
                 if (IS_ENABLED(CONFIG_RETPOLINE))
                         goto retpoline_auto;
                 break;
@@ -386,26 +377,20 @@ retpoline_auto:
                 setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
         }
 
+specv2_set_mode:
         spectre_v2_enabled = mode;
         pr_info("%s\n", spectre_v2_strings[mode]);
 
         /*
-         * If neither SMEP nor PTI are available, there is a risk of
-         * hitting userspace addresses in the RSB after a context switch
-         * from a shallow call stack to a deeper one. To prevent this fill
-         * the entire RSB, even when using IBRS.
+         * If spectre v2 protection has been enabled, unconditionally fill
+         * RSB during a context switch; this protects against two independent
+         * issues:
          *
-         * Skylake era CPUs have a separate issue with *underflow* of the
-         * RSB, when they will predict 'ret' targets from the generic BTB.
-         * The proper mitigation for this is IBRS. If IBRS is not supported
-         * or deactivated in favour of retpolines the RSB fill on context
-         * switch is required.
+         *      - RSB underflow (and switch to BTB) on Skylake+
+         *      - SpectreRSB variant of spectre v2 on X86_BUG_SPECTRE_V2 CPUs
          */
-        if ((!boot_cpu_has(X86_FEATURE_PTI) &&
-             !boot_cpu_has(X86_FEATURE_SMEP)) || is_skylake_era()) {
-                setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
-                pr_info("Spectre v2 mitigation: Filling RSB on context switch\n");
-        }
+        setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
+        pr_info("Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch\n");
 
         /* Initialize Indirect Branch Prediction Barrier if supported */
         if (boot_cpu_has(X86_FEATURE_IBPB)) {
@@ -415,9 +400,16 @@ retpoline_auto:
 
         /*
          * Retpoline means the kernel is safe because it has no indirect
-         * branches. But firmware isn't, so use IBRS to protect that.
+         * branches. Enhanced IBRS protects firmware too, so, enable restricted
+         * speculation around firmware calls only when Enhanced IBRS isn't
+         * supported.
+         *
+         * Use "mode" to check Enhanced IBRS instead of boot_cpu_has(), because
+         * the user might select retpoline on the kernel command line and if
+         * the CPU supports Enhanced IBRS, kernel might un-intentionally not
+         * enable IBRS around firmware calls.
          */
-        if (boot_cpu_has(X86_FEATURE_IBRS)) {
+        if (boot_cpu_has(X86_FEATURE_IBRS) && mode != SPECTRE_V2_IBRS_ENHANCED) {
                 setup_force_cpu_cap(X86_FEATURE_USE_IBRS_FW);
                 pr_info("Enabling Restricted Speculation for firmware calls\n");
         }
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index eb4cb3efd20e..ba6b8bb1c036 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1005,6 +1005,9 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
            !cpu_has(c, X86_FEATURE_AMD_SSB_NO))
                 setup_force_cpu_bug(X86_BUG_SPEC_STORE_BYPASS);
 
+        if (ia32_cap & ARCH_CAP_IBRS_ALL)
+                setup_force_cpu_cap(X86_FEATURE_IBRS_ENHANCED);
+
         if (x86_match_cpu(cpu_no_meltdown))
                 return;
 
@@ -1016,6 +1019,24 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
 }
 
 /*
+ * The NOPL instruction is supposed to exist on all CPUs of family >= 6;
+ * unfortunately, that's not true in practice because of early VIA
+ * chips and (more importantly) broken virtualizers that are not easy
+ * to detect. In the latter case it doesn't even *fail* reliably, so
+ * probing for it doesn't even work. Disable it completely on 32-bit
+ * unless we can find a reliable way to detect all the broken cases.
+ * Enable it explicitly on 64-bit for non-constant inputs of cpu_has().
+ */
+static void detect_nopl(void)
+{
+#ifdef CONFIG_X86_32
+        setup_clear_cpu_cap(X86_FEATURE_NOPL);
+#else
+        setup_force_cpu_cap(X86_FEATURE_NOPL);
+#endif
+}
+
+/*
  * Do minimum CPU detection early.
  * Fields really needed: vendor, cpuid_level, family, model, mask,
  * cache alignment.
@@ -1089,6 +1110,8 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
          */
         if (!pgtable_l5_enabled())
                 setup_clear_cpu_cap(X86_FEATURE_LA57);
+
+        detect_nopl();
 }
 
 void __init early_cpu_init(void)
@@ -1124,24 +1147,6 @@ void __init early_cpu_init(void)
         early_identify_cpu(&boot_cpu_data);
 }
 
-/*
- * The NOPL instruction is supposed to exist on all CPUs of family >= 6;
- * unfortunately, that's not true in practice because of early VIA
- * chips and (more importantly) broken virtualizers that are not easy
- * to detect. In the latter case it doesn't even *fail* reliably, so
- * probing for it doesn't even work. Disable it completely on 32-bit
- * unless we can find a reliable way to detect all the broken cases.
- * Enable it explicitly on 64-bit for non-constant inputs of cpu_has().
- */
-static void detect_nopl(struct cpuinfo_x86 *c)
-{
-#ifdef CONFIG_X86_32
-        clear_cpu_cap(c, X86_FEATURE_NOPL);
-#else
-        set_cpu_cap(c, X86_FEATURE_NOPL);
-#endif
-}
-
 static void detect_null_seg_behavior(struct cpuinfo_x86 *c)
 {
 #ifdef CONFIG_X86_64
@@ -1204,8 +1209,6 @@ static void generic_identify(struct cpuinfo_x86 *c)
 
         get_model_name(c); /* Default name */
 
-        detect_nopl(c);
-
         detect_null_seg_behavior(c);
 
         /*
@@ -1804,11 +1807,12 @@ void cpu_init(void)
         enter_lazy_tlb(&init_mm, curr);
 
         /*
-         * Initialize the TSS.  Don't bother initializing sp0, as the initial
-         * task never enters user mode.
+         * Initialize the TSS.  sp0 points to the entry trampoline stack
+         * regardless of what task is running.
          */
         set_tss_desc(cpu, &get_cpu_entry_area(cpu)->tss.x86_tss);
         load_TR_desc();
+        load_sp0((unsigned long)(cpu_entry_stack(cpu) + 1));
 
         load_mm_ldt(&init_mm);
 
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index eb75564f2d25..c050cd6066af 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -465,14 +465,17 @@ static void detect_vmx_virtcap(struct cpuinfo_x86 *c)
 #define X86_VMX_FEATURE_PROC_CTLS2_VIRT_APIC    0x00000001
 #define X86_VMX_FEATURE_PROC_CTLS2_EPT          0x00000002
 #define X86_VMX_FEATURE_PROC_CTLS2_VPID         0x00000020
+#define x86_VMX_FEATURE_EPT_CAP_AD              0x00200000
 
         u32 vmx_msr_low, vmx_msr_high, msr_ctl, msr_ctl2;
+        u32 msr_vpid_cap, msr_ept_cap;
 
         clear_cpu_cap(c, X86_FEATURE_TPR_SHADOW);
         clear_cpu_cap(c, X86_FEATURE_VNMI);
         clear_cpu_cap(c, X86_FEATURE_FLEXPRIORITY);
         clear_cpu_cap(c, X86_FEATURE_EPT);
         clear_cpu_cap(c, X86_FEATURE_VPID);
+        clear_cpu_cap(c, X86_FEATURE_EPT_AD);
 
         rdmsr(MSR_IA32_VMX_PROCBASED_CTLS, vmx_msr_low, vmx_msr_high);
         msr_ctl = vmx_msr_high | vmx_msr_low;
@@ -487,8 +490,13 @@ static void detect_vmx_virtcap(struct cpuinfo_x86 *c)
                 if ((msr_ctl2 & X86_VMX_FEATURE_PROC_CTLS2_VIRT_APIC) &&
                     (msr_ctl & X86_VMX_FEATURE_PROC_CTLS_TPR_SHADOW))
                         set_cpu_cap(c, X86_FEATURE_FLEXPRIORITY);
-                if (msr_ctl2 & X86_VMX_FEATURE_PROC_CTLS2_EPT)
+                if (msr_ctl2 & X86_VMX_FEATURE_PROC_CTLS2_EPT) {
                         set_cpu_cap(c, X86_FEATURE_EPT);
+                        rdmsr(MSR_IA32_VMX_EPT_VPID_CAP,
+                              msr_ept_cap, msr_vpid_cap);
+                        if (msr_ept_cap & x86_VMX_FEATURE_EPT_CAP_AD)
+                                set_cpu_cap(c, X86_FEATURE_EPT_AD);
+                }
                 if (msr_ctl2 & X86_VMX_FEATURE_PROC_CTLS2_VPID)
                         set_cpu_cap(c, X86_FEATURE_VPID);
         }
diff --git a/arch/x86/kernel/cpu/intel_rdt.c b/arch/x86/kernel/cpu/intel_rdt.c
index ec4754f81cbd..abb71ac70443 100644
--- a/arch/x86/kernel/cpu/intel_rdt.c
+++ b/arch/x86/kernel/cpu/intel_rdt.c
@@ -859,6 +859,8 @@ static __init bool get_rdt_resources(void)
         return (rdt_mon_capable || rdt_alloc_capable);
 }
 
+static enum cpuhp_state rdt_online;
+
 static int __init intel_rdt_late_init(void)
 {
         struct rdt_resource *r;
@@ -880,6 +882,7 @@ static int __init intel_rdt_late_init(void)
                 cpuhp_remove_state(state);
                 return ret;
         }
+        rdt_online = state;
 
         for_each_alloc_capable_rdt_resource(r)
                 pr_info("Intel RDT %s allocation detected\n", r->name);
@@ -891,3 +894,11 @@ static int __init intel_rdt_late_init(void)
 }
 
 late_initcall(intel_rdt_late_init);
+
+static void __exit intel_rdt_exit(void)
+{
+        cpuhp_remove_state(rdt_online);
+        rdtgroup_exit();
+}
+
+__exitcall(intel_rdt_exit);
diff --git a/arch/x86/kernel/cpu/intel_rdt.h b/arch/x86/kernel/cpu/intel_rdt.h
index 39752825e376..4e588f36228f 100644
--- a/arch/x86/kernel/cpu/intel_rdt.h
+++ b/arch/x86/kernel/cpu/intel_rdt.h
@@ -81,6 +81,34 @@ enum rdt_group_type {
 };
 
 /**
+ * enum rdtgrp_mode - Mode of a RDT resource group
+ * @RDT_MODE_SHAREABLE: This resource group allows sharing of its allocations
+ * @RDT_MODE_EXCLUSIVE: No sharing of this resource group's allocations allowed
+ * @RDT_MODE_PSEUDO_LOCKSETUP: Resource group will be used for Pseudo-Locking
+ * @RDT_MODE_PSEUDO_LOCKED: No sharing of this resource group's allocations
+ *                          allowed AND the allocations are Cache Pseudo-Locked
+ *
+ * The mode of a resource group enables control over the allowed overlap
+ * between allocations associated with different resource groups (classes
+ * of service). User is able to modify the mode of a resource group by
+ * writing to the "mode" resctrl file associated with the resource group.
+ *
+ * The "shareable", "exclusive", and "pseudo-locksetup" modes are set by
+ * writing the appropriate text to the "mode" file. A resource group enters
+ * "pseudo-locked" mode after the schemata is written while the resource
+ * group is in "pseudo-locksetup" mode.
+ */
+enum rdtgrp_mode {
+        RDT_MODE_SHAREABLE = 0,
+        RDT_MODE_EXCLUSIVE,
+        RDT_MODE_PSEUDO_LOCKSETUP,
+        RDT_MODE_PSEUDO_LOCKED,
+
+        /* Must be last */
+        RDT_NUM_MODES,
+};
+
+/**
  * struct mongroup - store mon group's data in resctrl fs.
  * @mon_data_kn         kernlfs node for the mon_data directory
  * @parent:                     parent rdtgrp
@@ -95,6 +123,43 @@ struct mongroup {
 };
 
 /**
+ * struct pseudo_lock_region - pseudo-lock region information
+ * @r:                  RDT resource to which this pseudo-locked region
+ *                      belongs
+ * @d:                  RDT domain to which this pseudo-locked region
+ *                      belongs
+ * @cbm:                bitmask of the pseudo-locked region
+ * @lock_thread_wq:     waitqueue used to wait on the pseudo-locking thread
+ *                      completion
+ * @thread_done:        variable used by waitqueue to test if pseudo-locking
+ *                      thread completed
+ * @cpu:                core associated with the cache on which the setup code
+ *                      will be run
+ * @line_size:          size of the cache lines
+ * @size:               size of pseudo-locked region in bytes
+ * @kmem:               the kernel memory associated with pseudo-locked region
+ * @minor:              minor number of character device associated with this
+ *                      region
+ * @debugfs_dir:        pointer to this region's directory in the debugfs
+ *                      filesystem
+ * @pm_reqs:            Power management QoS requests related to this region
+ */
+struct pseudo_lock_region {
+        struct rdt_resource     *r;
+        struct rdt_domain       *d;
+        u32                     cbm;
+        wait_queue_head_t       lock_thread_wq;
+        int                     thread_done;
+        int                     cpu;
+        unsigned int            line_size;
+        unsigned int            size;
+        void                    *kmem;
+        unsigned int            minor;
+        struct dentry           *debugfs_dir;
+        struct list_head        pm_reqs;
+};
+
+/**
  * struct rdtgroup - store rdtgroup's data in resctrl file system.
  * @kn:                         kernfs node
  * @rdtgroup_list:              linked list for all rdtgroups
@@ -106,16 +171,20 @@ struct mongroup {
  * @type:                       indicates type of this rdtgroup - either
  *                              monitor only or ctrl_mon group
  * @mon:                        mongroup related data
+ * @mode:                       mode of resource group
+ * @plr:                        pseudo-locked region
  */
 struct rdtgroup {
-        struct kernfs_node      *kn;
-        struct list_head        rdtgroup_list;
-        u32                     closid;
-        struct cpumask          cpu_mask;
-        int                     flags;
-        atomic_t                waitcount;
-        enum rdt_group_type     type;
-        struct mongroup         mon;
+        struct kernfs_node              *kn;
+        struct list_head                rdtgroup_list;
+        u32                             closid;
+        struct cpumask                  cpu_mask;
+        int                             flags;
+        atomic_t                        waitcount;
+        enum rdt_group_type             type;
+        struct mongroup                 mon;
+        enum rdtgrp_mode                mode;
+        struct pseudo_lock_region       *plr;
 };
 
 /* rdtgroup.flags */
@@ -148,6 +217,7 @@ extern struct list_head rdt_all_groups;
 extern int max_name_width, max_data_width;
 
 int __init rdtgroup_init(void);
+void __exit rdtgroup_exit(void);
 
 /**
  * struct rftype - describe each file in the resctrl file system
@@ -216,22 +286,24 @@ struct mbm_state {
  * @mbps_val:   When mba_sc is enabled, this holds the bandwidth in MBps
  * @new_ctrl:   new ctrl value to be loaded
  * @have_new_ctrl: did user provide new_ctrl for this domain
+ * @plr:        pseudo-locked region (if any) associated with domain
  */
 struct rdt_domain {
-        struct list_head        list;
-        int                     id;
-        struct cpumask          cpu_mask;
-        unsigned long           *rmid_busy_llc;
-        struct mbm_state        *mbm_total;
-        struct mbm_state        *mbm_local;
-        struct delayed_work     mbm_over;
-        struct delayed_work     cqm_limbo;
-        int                     mbm_work_cpu;
-        int                     cqm_work_cpu;
-        u32                     *ctrl_val;
-        u32                     *mbps_val;
-        u32                     new_ctrl;
-        bool                    have_new_ctrl;
+        struct list_head                list;
+        int                             id;
+        struct cpumask                  cpu_mask;
+        unsigned long                   *rmid_busy_llc;
+        struct mbm_state                *mbm_total;
+        struct mbm_state                *mbm_local;
+        struct delayed_work             mbm_over;
+        struct delayed_work             cqm_limbo;
+        int                             mbm_work_cpu;
+        int                             cqm_work_cpu;
+        u32                             *ctrl_val;
+        u32                             *mbps_val;
+        u32                             new_ctrl;
+        bool                            have_new_ctrl;
+        struct pseudo_lock_region       *plr;
 };
 
 /**
@@ -351,7 +423,7 @@ struct rdt_resource {
         struct rdt_cache        cache;
         struct rdt_membw        membw;
         const char              *format_str;
-        int (*parse_ctrlval)    (char *buf, struct rdt_resource *r,
+        int (*parse_ctrlval)    (void *data, struct rdt_resource *r,
                                  struct rdt_domain *d);
         struct list_head        evt_list;
         int                     num_rmid;
@@ -359,8 +431,8 @@ struct rdt_resource {
         unsigned long           fflags;
 };
 
-int parse_cbm(char *buf, struct rdt_resource *r, struct rdt_domain *d);
-int parse_bw(char *buf, struct rdt_resource *r,  struct rdt_domain *d);
+int parse_cbm(void *_data, struct rdt_resource *r, struct rdt_domain *d);
+int parse_bw(void *_buf, struct rdt_resource *r,  struct rdt_domain *d);
 
 extern struct mutex rdtgroup_mutex;
 
@@ -368,7 +440,7 @@ extern struct rdt_resource rdt_resources_all[];
 extern struct rdtgroup rdtgroup_default;
 DECLARE_STATIC_KEY_FALSE(rdt_alloc_enable_key);
 
-int __init rdtgroup_init(void);
+extern struct dentry *debugfs_resctrl;
 
 enum {
         RDT_RESOURCE_L3,
@@ -439,13 +511,32 @@ void rdt_last_cmd_printf(const char *fmt, ...);
 void rdt_ctrl_update(void *arg);
 struct rdtgroup *rdtgroup_kn_lock_live(struct kernfs_node *kn);
 void rdtgroup_kn_unlock(struct kernfs_node *kn);
+int rdtgroup_kn_mode_restrict(struct rdtgroup *r, const char *name);
+int rdtgroup_kn_mode_restore(struct rdtgroup *r, const char *name,
+                             umode_t mask);
 struct rdt_domain *rdt_find_domain(struct rdt_resource *r, int id,
                                    struct list_head **pos);
 ssize_t rdtgroup_schemata_write(struct kernfs_open_file *of,
                                 char *buf, size_t nbytes, loff_t off);
 int rdtgroup_schemata_show(struct kernfs_open_file *of,
                            struct seq_file *s, void *v);
+bool rdtgroup_cbm_overlaps(struct rdt_resource *r, struct rdt_domain *d,
+                           u32 _cbm, int closid, bool exclusive);
+unsigned int rdtgroup_cbm_to_size(struct rdt_resource *r, struct rdt_domain *d,
+                                  u32 cbm);
+enum rdtgrp_mode rdtgroup_mode_by_closid(int closid);
+int rdtgroup_tasks_assigned(struct rdtgroup *r);
+int rdtgroup_locksetup_enter(struct rdtgroup *rdtgrp);
+int rdtgroup_locksetup_exit(struct rdtgroup *rdtgrp);
+bool rdtgroup_cbm_overlaps_pseudo_locked(struct rdt_domain *d, u32 _cbm);
+bool rdtgroup_pseudo_locked_in_hierarchy(struct rdt_domain *d);
+int rdt_pseudo_lock_init(void);
+void rdt_pseudo_lock_release(void);
+int rdtgroup_pseudo_lock_create(struct rdtgroup *rdtgrp);
+void rdtgroup_pseudo_lock_remove(struct rdtgroup *rdtgrp);
 struct rdt_domain *get_domain_from_cpu(int cpu, struct rdt_resource *r);
+int update_domains(struct rdt_resource *r, int closid);
+void closid_free(int closid);
 int alloc_rmid(void);
 void free_rmid(u32 rmid);
 int rdt_get_mon_l3_config(struct rdt_resource *r);
diff --git a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
index 116d57b248d3..af358ca05160 100644
--- a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
+++ b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
@@ -64,9 +64,10 @@ static bool bw_validate(char *buf, unsigned long *data, struct rdt_resource *r)
         return true;
 }
 
-int parse_bw(char *buf, struct rdt_resource *r, struct rdt_domain *d)
+int parse_bw(void *_buf, struct rdt_resource *r, struct rdt_domain *d)
 {
         unsigned long data;
+        char *buf = _buf;
 
         if (d->have_new_ctrl) {
                 rdt_last_cmd_printf("duplicate domain %d\n", d->id);
@@ -87,7 +88,7 @@ int parse_bw(char *buf, struct rdt_resource *r, struct rdt_domain *d)
  *      are allowed (e.g. FFFFH, 0FF0H, 003CH, etc.).
  * Additionally Haswell requires at least two bits set.
  */
-static bool cbm_validate(char *buf, unsigned long *data, struct rdt_resource *r)
+static bool cbm_validate(char *buf, u32 *data, struct rdt_resource *r)
 {
         unsigned long first_bit, zero_bit, val;
         unsigned int cbm_len = r->cache.cbm_len;
@@ -122,22 +123,64 @@ static bool cbm_validate(char *buf, unsigned long *data, struct rdt_resource *r)
         return true;
 }
 
+struct rdt_cbm_parse_data {
+        struct rdtgroup         *rdtgrp;
+        char                    *buf;
+};
+
 /*
  * Read one cache bit mask (hex). Check that it is valid for the current
  * resource type.
  */
-int parse_cbm(char *buf, struct rdt_resource *r, struct rdt_domain *d)
+int parse_cbm(void *_data, struct rdt_resource *r, struct rdt_domain *d)
 {
-        unsigned long data;
+        struct rdt_cbm_parse_data *data = _data;
+        struct rdtgroup *rdtgrp = data->rdtgrp;
+        u32 cbm_val;
 
         if (d->have_new_ctrl) {
                 rdt_last_cmd_printf("duplicate domain %d\n", d->id);
                 return -EINVAL;
         }
 
-        if(!cbm_validate(buf, &data, r))
+        /*
+         * Cannot set up more than one pseudo-locked region in a cache
+         * hierarchy.
+         */
+        if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP &&
+            rdtgroup_pseudo_locked_in_hierarchy(d)) {
+                rdt_last_cmd_printf("pseudo-locked region in hierarchy\n");
                 return -EINVAL;
-        d->new_ctrl = data;
+        }
+
+        if (!cbm_validate(data->buf, &cbm_val, r))
+                return -EINVAL;
+
+        if ((rdtgrp->mode == RDT_MODE_EXCLUSIVE ||
+             rdtgrp->mode == RDT_MODE_SHAREABLE) &&
+            rdtgroup_cbm_overlaps_pseudo_locked(d, cbm_val)) {
+                rdt_last_cmd_printf("CBM overlaps with pseudo-locked region\n");
+                return -EINVAL;
+        }
+
+        /*
+         * The CBM may not overlap with the CBM of another closid if
+         * either is exclusive.
+         */
+        if (rdtgroup_cbm_overlaps(r, d, cbm_val, rdtgrp->closid, true)) {
+                rdt_last_cmd_printf("overlaps with exclusive group\n");
+                return -EINVAL;
+        }
+
+        if (rdtgroup_cbm_overlaps(r, d, cbm_val, rdtgrp->closid, false)) {
+                if (rdtgrp->mode == RDT_MODE_EXCLUSIVE ||
+                    rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) {
+                        rdt_last_cmd_printf("overlaps with other group\n");
+                        return -EINVAL;
+                }
+        }
+
+        d->new_ctrl = cbm_val;
         d->have_new_ctrl = true;
 
         return 0;
@@ -149,8 +192,10 @@ int parse_cbm(char *buf, struct rdt_resource *r, struct rdt_domain *d)
  * separated by ";". The "id" is in decimal, and must match one of
  * the "id"s for this resource.
  */
-static int parse_line(char *line, struct rdt_resource *r)
+static int parse_line(char *line, struct rdt_resource *r,
+                      struct rdtgroup *rdtgrp)
 {
+        struct rdt_cbm_parse_data data;
         char *dom = NULL, *id;
         struct rdt_domain *d;
         unsigned long dom_id;
@@ -167,15 +212,32 @@ next:
         dom = strim(dom);
         list_for_each_entry(d, &r->domains, list) {
                 if (d->id == dom_id) {
-                        if (r->parse_ctrlval(dom, r, d))
+                        data.buf = dom;
+                        data.rdtgrp = rdtgrp;
+                        if (r->parse_ctrlval(&data, r, d))
                                 return -EINVAL;
+                        if (rdtgrp->mode ==  RDT_MODE_PSEUDO_LOCKSETUP) {
+                                /*
+                                 * In pseudo-locking setup mode and just
+                                 * parsed a valid CBM that should be
+                                 * pseudo-locked. Only one locked region per
+                                 * resource group and domain so just do
+                                 * the required initialization for single
+                                 * region and return.
+                                 */
+                                rdtgrp->plr->r = r;
+                                rdtgrp->plr->d = d;
+                                rdtgrp->plr->cbm = d->new_ctrl;
+                                d->plr = rdtgrp->plr;
+                                return 0;
+                        }
                         goto next;
                 }
         }
         return -EINVAL;
 }
 
-static int update_domains(struct rdt_resource *r, int closid)
+int update_domains(struct rdt_resource *r, int closid)
 {
         struct msr_param msr_param;
         cpumask_var_t cpu_mask;
@@ -220,13 +282,14 @@ done:
         return 0;
 }
 
-static int rdtgroup_parse_resource(char *resname, char *tok, int closid)
+static int rdtgroup_parse_resource(char *resname, char *tok,
+                                   struct rdtgroup *rdtgrp)
 {
         struct rdt_resource *r;
 
         for_each_alloc_enabled_rdt_resource(r) {
-                if (!strcmp(resname, r->name) && closid < r->num_closid)
-                        return parse_line(tok, r);
+                if (!strcmp(resname, r->name) && rdtgrp->closid < r->num_closid)
+                        return parse_line(tok, r, rdtgrp);
         }
         rdt_last_cmd_printf("unknown/unsupported resource name '%s'\n", resname);
         return -EINVAL;
@@ -239,7 +302,7 @@ ssize_t rdtgroup_schemata_write(struct kernfs_open_file *of,
         struct rdt_domain *dom;
         struct rdt_resource *r;
         char *tok, *resname;
-        int closid, ret = 0;
+        int ret = 0;
 
         /* Valid input requires a trailing newline */
         if (nbytes == 0 || buf[nbytes - 1] != '\n')
@@ -253,7 +316,15 @@ ssize_t rdtgroup_schemata_write(struct kernfs_open_file *of,
         }
         rdt_last_cmd_clear();
 
-        closid = rdtgrp->closid;
+        /*
+         * No changes to pseudo-locked region allowed. It has to be removed
+         * and re-created instead.
+         */
+        if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED) {
+                ret = -EINVAL;
+                rdt_last_cmd_puts("resource group is pseudo-locked\n");
+                goto out;
+        }
 
         for_each_alloc_enabled_rdt_resource(r) {
                 list_for_each_entry(dom, &r->domains, list)
@@ -272,17 +343,27 @@ ssize_t rdtgroup_schemata_write(struct kernfs_open_file *of,
                         ret = -EINVAL;
                         goto out;
                 }
-                ret = rdtgroup_parse_resource(resname, tok, closid);
+                ret = rdtgroup_parse_resource(resname, tok, rdtgrp);
                 if (ret)
                         goto out;
         }
 
         for_each_alloc_enabled_rdt_resource(r) {
-                ret = update_domains(r, closid);
+                ret = update_domains(r, rdtgrp->closid);
                 if (ret)
                         goto out;
         }
 
+        if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) {
+                /*
+                 * If pseudo-locking fails we keep the resource group in
+                 * mode RDT_MODE_PSEUDO_LOCKSETUP with its class of service
+                 * active and updated for just the domain the pseudo-locked
+                 * region was requested for.
+                 */
+                ret = rdtgroup_pseudo_lock_create(rdtgrp);
+        }
+
 out:
         rdtgroup_kn_unlock(of->kn);
         return ret ?: nbytes;
@@ -318,10 +399,18 @@ int rdtgroup_schemata_show(struct kernfs_open_file *of,
 
         rdtgrp = rdtgroup_kn_lock_live(of->kn);
         if (rdtgrp) {
-                closid = rdtgrp->closid;
-                for_each_alloc_enabled_rdt_resource(r) {
-                        if (closid < r->num_closid)
-                                show_doms(s, r, closid);
+                if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) {
+                        for_each_alloc_enabled_rdt_resource(r)
+                                seq_printf(s, "%s:uninitialized\n", r->name);
+                } else if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED) {
+                        seq_printf(s, "%s:%d=%x\n", rdtgrp->plr->r->name,
+                                   rdtgrp->plr->d->id, rdtgrp->plr->cbm);
+                } else {
+                        closid = rdtgrp->closid;
+                        for_each_alloc_enabled_rdt_resource(r) {
+                                if (closid < r->num_closid)
+                                        show_doms(s, r, closid);
+                        }
                 }
         } else {
                 ret = -ENOENT;
diff --git a/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c b/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c
new file mode 100644
index 000000000000..40f3903ae5d9
--- /dev/null
+++ b/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c
@@ -0,0 +1,1522 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Resource Director Technology (RDT)
+ *
+ * Pseudo-locking support built on top of Cache Allocation Technology (CAT)
+ *
+ * Copyright (C) 2018 Intel Corporation
+ *
+ * Author: Reinette Chatre <reinette.chatre@intel.com>
+ */
+
+#define pr_fmt(fmt)     KBUILD_MODNAME ": " fmt
+
+#include <linux/cacheinfo.h>
+#include <linux/cpu.h>
+#include <linux/cpumask.h>
+#include <linux/debugfs.h>
+#include <linux/kthread.h>
+#include <linux/mman.h>
+#include <linux/pm_qos.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+
+#include <asm/cacheflush.h>
+#include <asm/intel-family.h>
+#include <asm/intel_rdt_sched.h>
+#include <asm/perf_event.h>
+
+#include "intel_rdt.h"
+
+#define CREATE_TRACE_POINTS
+#include "intel_rdt_pseudo_lock_event.h"
+
+/*
+ * MSR_MISC_FEATURE_CONTROL register enables the modification of hardware
+ * prefetcher state. Details about this register can be found in the MSR
+ * tables for specific platforms found in Intel's SDM.
+ */
+#define MSR_MISC_FEATURE_CONTROL        0x000001a4
+
+/*
+ * The bits needed to disable hardware prefetching varies based on the
+ * platform. During initialization we will discover which bits to use.
+ */
+static u64 prefetch_disable_bits;
+
+/*
+ * Major number assigned to and shared by all devices exposing
+ * pseudo-locked regions.
+ */
+static unsigned int pseudo_lock_major;
+static unsigned long pseudo_lock_minor_avail = GENMASK(MINORBITS, 0);
+static struct class *pseudo_lock_class;
+
+/**
+ * get_prefetch_disable_bits - prefetch disable bits of supported platforms
+ *
+ * Capture the list of platforms that have been validated to support
+ * pseudo-locking. This includes testing to ensure pseudo-locked regions
+ * with low cache miss rates can be created under variety of load conditions
+ * as well as that these pseudo-locked regions can maintain their low cache
+ * miss rates under variety of load conditions for significant lengths of time.
+ *
+ * After a platform has been validated to support pseudo-locking its
+ * hardware prefetch disable bits are included here as they are documented
+ * in the SDM.
+ *
+ * When adding a platform here also add support for its cache events to
+ * measure_cycles_perf_fn()
+ *
+ * Return:
+ * If platform is supported, the bits to disable hardware prefetchers, 0
+ * if platform is not supported.
+ */
+static u64 get_prefetch_disable_bits(void)
+{
+        if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL ||
+            boot_cpu_data.x86 != 6)
+                return 0;
+
+        switch (boot_cpu_data.x86_model) {
+        case INTEL_FAM6_BROADWELL_X:
+                /*
+                 * SDM defines bits of MSR_MISC_FEATURE_CONTROL register
+                 * as:
+                 * 0    L2 Hardware Prefetcher Disable (R/W)
+                 * 1    L2 Adjacent Cache Line Prefetcher Disable (R/W)
+                 * 2    DCU Hardware Prefetcher Disable (R/W)
+                 * 3    DCU IP Prefetcher Disable (R/W)
+                 * 63:4 Reserved
+                 */
+                return 0xF;
+        case INTEL_FAM6_ATOM_GOLDMONT:
+        case INTEL_FAM6_ATOM_GEMINI_LAKE:
+                /*
+                 * SDM defines bits of MSR_MISC_FEATURE_CONTROL register
+                 * as:
+                 * 0     L2 Hardware Prefetcher Disable (R/W)
+                 * 1     Reserved
+                 * 2     DCU Hardware Prefetcher Disable (R/W)
+                 * 63:3  Reserved
+                 */
+                return 0x5;
+        }
+
+        return 0;
+}
+
+/*
+ * Helper to write 64bit value to MSR without tracing. Used when
+ * use of the cache should be restricted and use of registers used
+ * for local variables avoided.
+ */
+static inline void pseudo_wrmsrl_notrace(unsigned int msr, u64 val)
+{
+        __wrmsr(msr, (u32)(val & 0xffffffffULL), (u32)(val >> 32));
+}
+
+/**
+ * pseudo_lock_minor_get - Obtain available minor number
+ * @minor: Pointer to where new minor number will be stored
+ *
+ * A bitmask is used to track available minor numbers. Here the next free
+ * minor number is marked as unavailable and returned.
+ *
+ * Return: 0 on success, <0 on failure.
+ */
+static int pseudo_lock_minor_get(unsigned int *minor)
+{
+        unsigned long first_bit;
+
+        first_bit = find_first_bit(&pseudo_lock_minor_avail, MINORBITS);
+
+        if (first_bit == MINORBITS)
+                return -ENOSPC;
+
+        __clear_bit(first_bit, &pseudo_lock_minor_avail);
+        *minor = first_bit;
+
+        return 0;
+}
+
+/**
+ * pseudo_lock_minor_release - Return minor number to available
+ * @minor: The minor number made available
+ */
+static void pseudo_lock_minor_release(unsigned int minor)
+{
+        __set_bit(minor, &pseudo_lock_minor_avail);
+}
+
+/**
+ * region_find_by_minor - Locate a pseudo-lock region by inode minor number
+ * @minor: The minor number of the device representing pseudo-locked region
+ *
+ * When the character device is accessed we need to determine which
+ * pseudo-locked region it belongs to. This is done by matching the minor
+ * number of the device to the pseudo-locked region it belongs.
+ *
+ * Minor numbers are assigned at the time a pseudo-locked region is associated
+ * with a cache instance.
+ *
+ * Return: On success return pointer to resource group owning the pseudo-locked
+ *         region, NULL on failure.
+ */
+static struct rdtgroup *region_find_by_minor(unsigned int minor)
+{
+        struct rdtgroup *rdtgrp, *rdtgrp_match = NULL;
+
+        list_for_each_entry(rdtgrp, &rdt_all_groups, rdtgroup_list) {
+                if (rdtgrp->plr && rdtgrp->plr->minor == minor) {
+                        rdtgrp_match = rdtgrp;
+                        break;
+                }
+        }
+        return rdtgrp_match;
+}
+
+/**
+ * pseudo_lock_pm_req - A power management QoS request list entry
+ * @list:       Entry within the @pm_reqs list for a pseudo-locked region
+ * @req:        PM QoS request
+ */
+struct pseudo_lock_pm_req {
+        struct list_head list;
+        struct dev_pm_qos_request req;
+};
+
+static void pseudo_lock_cstates_relax(struct pseudo_lock_region *plr)
+{
+        struct pseudo_lock_pm_req *pm_req, *next;
+
+        list_for_each_entry_safe(pm_req, next, &plr->pm_reqs, list) {
+                dev_pm_qos_remove_request(&pm_req->req);
+                list_del(&pm_req->list);
+                kfree(pm_req);
+        }
+}
+
+/**
+ * pseudo_lock_cstates_constrain - Restrict cores from entering C6
+ *
+ * To prevent the cache from being affected by power management entering
+ * C6 has to be avoided. This is accomplished by requesting a latency
+ * requirement lower than lowest C6 exit latency of all supported
+ * platforms as found in the cpuidle state tables in the intel_idle driver.
+ * At this time it is possible to do so with a single latency requirement
+ * for all supported platforms.
+ *
+ * Since Goldmont is supported, which is affected by X86_BUG_MONITOR,
+ * the ACPI latencies need to be considered while keeping in mind that C2
+ * may be set to map to deeper sleep states. In this case the latency
+ * requirement needs to prevent entering C2 also.
+ */
+static int pseudo_lock_cstates_constrain(struct pseudo_lock_region *plr)
+{
+        struct pseudo_lock_pm_req *pm_req;
+        int cpu;
+        int ret;
+
+        for_each_cpu(cpu, &plr->d->cpu_mask) {
+                pm_req = kzalloc(sizeof(*pm_req), GFP_KERNEL);
+                if (!pm_req) {
+                        rdt_last_cmd_puts("fail allocating mem for PM QoS\n");
+                        ret = -ENOMEM;
+                        goto out_err;
+                }
+                ret = dev_pm_qos_add_request(get_cpu_device(cpu),
+                                             &pm_req->req,
+                                             DEV_PM_QOS_RESUME_LATENCY,
+                                             30);
+                if (ret < 0) {
+                        rdt_last_cmd_printf("fail to add latency req cpu%d\n",
+                                            cpu);
+                        kfree(pm_req);
+                        ret = -1;
+                        goto out_err;
+                }
+                list_add(&pm_req->list, &plr->pm_reqs);
+        }
+
+        return 0;
+
+out_err:
+        pseudo_lock_cstates_relax(plr);
+        return ret;
+}
+
+/**
+ * pseudo_lock_region_clear - Reset pseudo-lock region data
+ * @plr: pseudo-lock region
+ *
+ * All content of the pseudo-locked region is reset - any memory allocated
+ * freed.
+ *
+ * Return: void
+ */
+static void pseudo_lock_region_clear(struct pseudo_lock_region *plr)
+{
+        plr->size = 0;
+        plr->line_size = 0;
+        kfree(plr->kmem);
+        plr->kmem = NULL;
+        plr->r = NULL;
+        if (plr->d)
+                plr->d->plr = NULL;
+        plr->d = NULL;
+        plr->cbm = 0;
+        plr->debugfs_dir = NULL;
+}
+
+/**
+ * pseudo_lock_region_init - Initialize pseudo-lock region information
+ * @plr: pseudo-lock region
+ *
+ * Called after user provided a schemata to be pseudo-locked. From the
+ * schemata the &struct pseudo_lock_region is on entry already initialized
+ * with the resource, domain, and capacity bitmask. Here the information
+ * required for pseudo-locking is deduced from this data and &struct
+ * pseudo_lock_region initialized further. This information includes:
+ * - size in bytes of the region to be pseudo-locked
+ * - cache line size to know the stride with which data needs to be accessed
+ *   to be pseudo-locked
+ * - a cpu associated with the cache instance on which the pseudo-locking
+ *   flow can be executed
+ *
+ * Return: 0 on success, <0 on failure. Descriptive error will be written
+ * to last_cmd_status buffer.
+ */
+static int pseudo_lock_region_init(struct pseudo_lock_region *plr)
+{
+        struct cpu_cacheinfo *ci;
+        int ret;
+        int i;
+
+        /* Pick the first cpu we find that is associated with the cache. */
+        plr->cpu = cpumask_first(&plr->d->cpu_mask);
+
+        if (!cpu_online(plr->cpu)) {
+                rdt_last_cmd_printf("cpu %u associated with cache not online\n",
+                                    plr->cpu);
+                ret = -ENODEV;
+                goto out_region;
+        }
+
+        ci = get_cpu_cacheinfo(plr->cpu);
+
+        plr->size = rdtgroup_cbm_to_size(plr->r, plr->d, plr->cbm);
+
+        for (i = 0; i < ci->num_leaves; i++) {
+                if (ci->info_list[i].level == plr->r->cache_level) {
+                        plr->line_size = ci->info_list[i].coherency_line_size;
+                        return 0;
+                }
+        }
+
+        ret = -1;
+        rdt_last_cmd_puts("unable to determine cache line size\n");
+out_region:
+        pseudo_lock_region_clear(plr);
+        return ret;
+}
+
+/**
+ * pseudo_lock_init - Initialize a pseudo-lock region
+ * @rdtgrp: resource group to which new pseudo-locked region will belong
+ *
+ * A pseudo-locked region is associated with a resource group. When this
+ * association is created the pseudo-locked region is initialized. The
+ * details of the pseudo-locked region are not known at this time so only
+ * allocation is done and association established.
+ *
+ * Return: 0 on success, <0 on failure
+ */
+static int pseudo_lock_init(struct rdtgroup *rdtgrp)
+{
+        struct pseudo_lock_region *plr;
+
+        plr = kzalloc(sizeof(*plr), GFP_KERNEL);
+        if (!plr)
+                return -ENOMEM;
+
+        init_waitqueue_head(&plr->lock_thread_wq);
+        INIT_LIST_HEAD(&plr->pm_reqs);
+        rdtgrp->plr = plr;
+        return 0;
+}
+
+/**
+ * pseudo_lock_region_alloc - Allocate kernel memory that will be pseudo-locked
+ * @plr: pseudo-lock region
+ *
+ * Initialize the details required to set up the pseudo-locked region and
+ * allocate the contiguous memory that will be pseudo-locked to the cache.
+ *
+ * Return: 0 on success, <0 on failure.  Descriptive error will be written
+ * to last_cmd_status buffer.
+ */
+static int pseudo_lock_region_alloc(struct pseudo_lock_region *plr)
+{
+        int ret;
+
+        ret = pseudo_lock_region_init(plr);
+        if (ret < 0)
+                return ret;
+
+        /*
+         * We do not yet support contiguous regions larger than
+         * KMALLOC_MAX_SIZE.
+         */
+        if (plr->size > KMALLOC_MAX_SIZE) {
+                rdt_last_cmd_puts("requested region exceeds maximum size\n");
+                ret = -E2BIG;
+                goto out_region;
+        }
+
+        plr->kmem = kzalloc(plr->size, GFP_KERNEL);
+        if (!plr->kmem) {
+                rdt_last_cmd_puts("unable to allocate memory\n");
+                ret = -ENOMEM;
+                goto out_region;
+        }
+
+        ret = 0;
+        goto out;
+out_region:
+        pseudo_lock_region_clear(plr);
+out:
+        return ret;
+}
+
+/**
+ * pseudo_lock_free - Free a pseudo-locked region
+ * @rdtgrp: resource group to which pseudo-locked region belonged
+ *
+ * The pseudo-locked region's resources have already been released, or not
+ * yet created at this point. Now it can be freed and disassociated from the
+ * resource group.
+ *
+ * Return: void
+ */
+static void pseudo_lock_free(struct rdtgroup *rdtgrp)
+{
+        pseudo_lock_region_clear(rdtgrp->plr);
+        kfree(rdtgrp->plr);
+        rdtgrp->plr = NULL;
+}
+
+/**
+ * pseudo_lock_fn - Load kernel memory into cache
+ * @_rdtgrp: resource group to which pseudo-lock region belongs
+ *
+ * This is the core pseudo-locking flow.
+ *
+ * First we ensure that the kernel memory cannot be found in the cache.
+ * Then, while taking care that there will be as little interference as
+ * possible, the memory to be loaded is accessed while core is running
+ * with class of service set to the bitmask of the pseudo-locked region.
+ * After this is complete no future CAT allocations will be allowed to
+ * overlap with this bitmask.
+ *
+ * Local register variables are utilized to ensure that the memory region
+ * to be locked is the only memory access made during the critical locking
+ * loop.
+ *
+ * Return: 0. Waiter on waitqueue will be woken on completion.
+ */
+static int pseudo_lock_fn(void *_rdtgrp)
+{
+        struct rdtgroup *rdtgrp = _rdtgrp;
+        struct pseudo_lock_region *plr = rdtgrp->plr;
+        u32 rmid_p, closid_p;
+        unsigned long i;
+#ifdef CONFIG_KASAN
+        /*
+         * The registers used for local register variables are also used
+         * when KASAN is active. When KASAN is active we use a regular
+         * variable to ensure we always use a valid pointer, but the cost
+         * is that this variable will enter the cache through evicting the
+         * memory we are trying to lock into the cache. Thus expect lower
+         * pseudo-locking success rate when KASAN is active.
+         */
+        unsigned int line_size;
+        unsigned int size;
+        void *mem_r;
+#else
+        register unsigned int line_size asm("esi");
+        register unsigned int size asm("edi");
+#ifdef CONFIG_X86_64
+        register void *mem_r asm("rbx");
+#else
+        register void *mem_r asm("ebx");
+#endif /* CONFIG_X86_64 */
+#endif /* CONFIG_KASAN */
+
+        /*
+         * Make sure none of the allocated memory is cached. If it is we
+         * will get a cache hit in below loop from outside of pseudo-locked
+         * region.
+         * wbinvd (as opposed to clflush/clflushopt) is required to
+         * increase likelihood that allocated cache portion will be filled
+         * with associated memory.
+         */
+        native_wbinvd();
+
+        /*
+         * Always called with interrupts enabled. By disabling interrupts
+         * ensure that we will not be preempted during this critical section.
+         */
+        local_irq_disable();
+
+        /*
+         * Call wrmsr and rdmsr as directly as possible to avoid tracing
+         * clobbering local register variables or affecting cache accesses.
+         *
+         * Disable the hardware prefetcher so that when the end of the memory
+         * being pseudo-locked is reached the hardware will not read beyond
+         * the buffer and evict pseudo-locked memory read earlier from the
+         * cache.
+         */
+        __wrmsr(MSR_MISC_FEATURE_CONTROL, prefetch_disable_bits, 0x0);
+        closid_p = this_cpu_read(pqr_state.cur_closid);
+        rmid_p = this_cpu_read(pqr_state.cur_rmid);
+        mem_r = plr->kmem;
+        size = plr->size;
+        line_size = plr->line_size;
+        /*
+         * Critical section begin: start by writing the closid associated
+         * with the capacity bitmask of the cache region being
+         * pseudo-locked followed by reading of kernel memory to load it
+         * into the cache.
+         */
+        __wrmsr(IA32_PQR_ASSOC, rmid_p, rdtgrp->closid);
+        /*
+         * Cache was flushed earlier. Now access kernel memory to read it
+         * into cache region associated with just activated plr->closid.
+         * Loop over data twice:
+         * - In first loop the cache region is shared with the page walker
+         *   as it populates the paging structure caches (including TLB).
+         * - In the second loop the paging structure caches are used and
+         *   cache region is populated with the memory being referenced.
+         */
+        for (i = 0; i < size; i += PAGE_SIZE) {
+                /*
+                 * Add a barrier to prevent speculative execution of this
+                 * loop reading beyond the end of the buffer.
+                 */
+                rmb();
+                asm volatile("mov (%0,%1,1), %%eax\n\t"
+                        :
+                        : "r" (mem_r), "r" (i)
+                        : "%eax", "memory");
+        }
+        for (i = 0; i < size; i += line_size) {
+                /*
+                 * Add a barrier to prevent speculative execution of this
+                 * loop reading beyond the end of the buffer.
+                 */
+                rmb();
+                asm volatile("mov (%0,%1,1), %%eax\n\t"
+                        :
+                        : "r" (mem_r), "r" (i)
+                        : "%eax", "memory");
+        }
+        /*
+         * Critical section end: restore closid with capacity bitmask that
+         * does not overlap with pseudo-locked region.
+         */
+        __wrmsr(IA32_PQR_ASSOC, rmid_p, closid_p);
+
+        /* Re-enable the hardware prefetcher(s) */
+        wrmsr(MSR_MISC_FEATURE_CONTROL, 0x0, 0x0);
+        local_irq_enable();
+
+        plr->thread_done = 1;
+        wake_up_interruptible(&plr->lock_thread_wq);
+        return 0;
+}
+
+/**
+ * rdtgroup_monitor_in_progress - Test if monitoring in progress
+ * @r: resource group being queried
+ *
+ * Return: 1 if monitor groups have been created for this resource
+ * group, 0 otherwise.
+ */
+static int rdtgroup_monitor_in_progress(struct rdtgroup *rdtgrp)
+{
+        return !list_empty(&rdtgrp->mon.crdtgrp_list);
+}
+
+/**
+ * rdtgroup_locksetup_user_restrict - Restrict user access to group
+ * @rdtgrp: resource group needing access restricted
+ *
+ * A resource group used for cache pseudo-locking cannot have cpus or tasks
+ * assigned to it. This is communicated to the user by restricting access
+ * to all the files that can be used to make such changes.
+ *
+ * Permissions restored with rdtgroup_locksetup_user_restore()
+ *
+ * Return: 0 on success, <0 on failure. If a failure occurs during the
+ * restriction of access an attempt will be made to restore permissions but
+ * the state of the mode of these files will be uncertain when a failure
+ * occurs.
+ */
+static int rdtgroup_locksetup_user_restrict(struct rdtgroup *rdtgrp)
+{
+        int ret;
+
+        ret = rdtgroup_kn_mode_restrict(rdtgrp, "tasks");
+        if (ret)
+                return ret;
+
+        ret = rdtgroup_kn_mode_restrict(rdtgrp, "cpus");
+        if (ret)
+                goto err_tasks;
+
+        ret = rdtgroup_kn_mode_restrict(rdtgrp, "cpus_list");
+        if (ret)
+                goto err_cpus;
+
+        if (rdt_mon_capable) {
+                ret = rdtgroup_kn_mode_restrict(rdtgrp, "mon_groups");
+                if (ret)
+                        goto err_cpus_list;
+        }
+
+        ret = 0;
+        goto out;
+
+err_cpus_list:
+        rdtgroup_kn_mode_restore(rdtgrp, "cpus_list", 0777);
+err_cpus:
+        rdtgroup_kn_mode_restore(rdtgrp, "cpus", 0777);
+err_tasks:
+        rdtgroup_kn_mode_restore(rdtgrp, "tasks", 0777);
+out:
+        return ret;
+}
+
+/**
+ * rdtgroup_locksetup_user_restore - Restore user access to group
+ * @rdtgrp: resource group needing access restored
+ *
+ * Restore all file access previously removed using
+ * rdtgroup_locksetup_user_restrict()
+ *
+ * Return: 0 on success, <0 on failure.  If a failure occurs during the
+ * restoration of access an attempt will be made to restrict permissions
+ * again but the state of the mode of these files will be uncertain when
+ * a failure occurs.
+ */
+static int rdtgroup_locksetup_user_restore(struct rdtgroup *rdtgrp)
+{
+        int ret;
+
+        ret = rdtgroup_kn_mode_restore(rdtgrp, "tasks", 0777);
+        if (ret)
+                return ret;
+
+        ret = rdtgroup_kn_mode_restore(rdtgrp, "cpus", 0777);
+        if (ret)
+                goto err_tasks;
+
+        ret = rdtgroup_kn_mode_restore(rdtgrp, "cpus_list", 0777);
+        if (ret)
+                goto err_cpus;
+
+        if (rdt_mon_capable) {
+                ret = rdtgroup_kn_mode_restore(rdtgrp, "mon_groups", 0777);
+                if (ret)
+                        goto err_cpus_list;
+        }
+
+        ret = 0;
+        goto out;
+
+err_cpus_list:
+        rdtgroup_kn_mode_restrict(rdtgrp, "cpus_list");
+err_cpus:
+        rdtgroup_kn_mode_restrict(rdtgrp, "cpus");
+err_tasks:
+        rdtgroup_kn_mode_restrict(rdtgrp, "tasks");
+out:
+        return ret;
+}
+
+/**
+ * rdtgroup_locksetup_enter - Resource group enters locksetup mode
+ * @rdtgrp: resource group requested to enter locksetup mode
+ *
+ * A resource group enters locksetup mode to reflect that it would be used
+ * to represent a pseudo-locked region and is in the process of being set
+ * up to do so. A resource group used for a pseudo-locked region would
+ * lose the closid associated with it so we cannot allow it to have any
+ * tasks or cpus assigned nor permit tasks or cpus to be assigned in the
+ * future. Monitoring of a pseudo-locked region is not allowed either.
+ *
+ * The above and more restrictions on a pseudo-locked region are checked
+ * for and enforced before the resource group enters the locksetup mode.
+ *
+ * Returns: 0 if the resource group successfully entered locksetup mode, <0
+ * on failure. On failure the last_cmd_status buffer is updated with text to
+ * communicate details of failure to the user.
+ */
+int rdtgroup_locksetup_enter(struct rdtgroup *rdtgrp)
+{
+        int ret;
+
+        /*
+         * The default resource group can neither be removed nor lose the
+         * default closid associated with it.
+         */
+        if (rdtgrp == &rdtgroup_default) {
+                rdt_last_cmd_puts("cannot pseudo-lock default group\n");
+                return -EINVAL;
+        }
+
+        /*
+         * Cache Pseudo-locking not supported when CDP is enabled.
+         *
+         * Some things to consider if you would like to enable this
+         * support (using L3 CDP as example):
+         * - When CDP is enabled two separate resources are exposed,
+         *   L3DATA and L3CODE, but they are actually on the same cache.
+         *   The implication for pseudo-locking is that if a
+         *   pseudo-locked region is created on a domain of one
+         *   resource (eg. L3CODE), then a pseudo-locked region cannot
+         *   be created on that same domain of the other resource
+         *   (eg. L3DATA). This is because the creation of a
+         *   pseudo-locked region involves a call to wbinvd that will
+         *   affect all cache allocations on particular domain.
+         * - Considering the previous, it may be possible to only
+         *   expose one of the CDP resources to pseudo-locking and
+         *   hide the other. For example, we could consider to only
+         *   expose L3DATA and since the L3 cache is unified it is
+         *   still possible to place instructions there are execute it.
+         * - If only one region is exposed to pseudo-locking we should
+         *   still keep in mind that availability of a portion of cache
+         *   for pseudo-locking should take into account both resources.
+         *   Similarly, if a pseudo-locked region is created in one
+         *   resource, the portion of cache used by it should be made
+         *   unavailable to all future allocations from both resources.
+         */
+        if (rdt_resources_all[RDT_RESOURCE_L3DATA].alloc_enabled ||
+            rdt_resources_all[RDT_RESOURCE_L2DATA].alloc_enabled) {
+                rdt_last_cmd_puts("CDP enabled\n");
+                return -EINVAL;
+        }
+
+        /*
+         * Not knowing the bits to disable prefetching implies that this
+         * platform does not support Cache Pseudo-Locking.
+         */
+        prefetch_disable_bits = get_prefetch_disable_bits();
+        if (prefetch_disable_bits == 0) {
+                rdt_last_cmd_puts("pseudo-locking not supported\n");
+                return -EINVAL;
+        }
+
+        if (rdtgroup_monitor_in_progress(rdtgrp)) {
+                rdt_last_cmd_puts("monitoring in progress\n");
+                return -EINVAL;
+        }
+
+        if (rdtgroup_tasks_assigned(rdtgrp)) {
+                rdt_last_cmd_puts("tasks assigned to resource group\n");
+                return -EINVAL;
+        }
+
+        if (!cpumask_empty(&rdtgrp->cpu_mask)) {
+                rdt_last_cmd_puts("CPUs assigned to resource group\n");
+                return -EINVAL;
+        }
+
+        if (rdtgroup_locksetup_user_restrict(rdtgrp)) {
+                rdt_last_cmd_puts("unable to modify resctrl permissions\n");
+                return -EIO;
+        }
+
+        ret = pseudo_lock_init(rdtgrp);
+        if (ret) {
+                rdt_last_cmd_puts("unable to init pseudo-lock region\n");
+                goto out_release;
+        }
+
+        /*
+         * If this system is capable of monitoring a rmid would have been
+         * allocated when the control group was created. This is not needed
+         * anymore when this group would be used for pseudo-locking. This
+         * is safe to call on platforms not capable of monitoring.
+         */
+        free_rmid(rdtgrp->mon.rmid);
+
+        ret = 0;
+        goto out;
+
+out_release:
+        rdtgroup_locksetup_user_restore(rdtgrp);
+out:
+        return ret;
+}
+
+/**
+ * rdtgroup_locksetup_exit - resource group exist locksetup mode
+ * @rdtgrp: resource group
+ *
+ * When a resource group exits locksetup mode the earlier restrictions are
+ * lifted.
+ *
+ * Return: 0 on success, <0 on failure
+ */
+int rdtgroup_locksetup_exit(struct rdtgroup *rdtgrp)
+{
+        int ret;
+
+        if (rdt_mon_capable) {
+                ret = alloc_rmid();
+                if (ret < 0) {
+                        rdt_last_cmd_puts("out of RMIDs\n");
+                        return ret;
+                }
+                rdtgrp->mon.rmid = ret;
+        }
+
+        ret = rdtgroup_locksetup_user_restore(rdtgrp);
+        if (ret) {
+                free_rmid(rdtgrp->mon.rmid);
+                return ret;
+        }
+
+        pseudo_lock_free(rdtgrp);
+        return 0;
+}
+
+/**
+ * rdtgroup_cbm_overlaps_pseudo_locked - Test if CBM or portion is pseudo-locked
+ * @d: RDT domain
+ * @_cbm: CBM to test
+ *
+ * @d represents a cache instance and @_cbm a capacity bitmask that is
+ * considered for it. Determine if @_cbm overlaps with any existing
+ * pseudo-locked region on @d.
+ *
+ * Return: true if @_cbm overlaps with pseudo-locked region on @d, false
+ * otherwise.
+ */
+bool rdtgroup_cbm_overlaps_pseudo_locked(struct rdt_domain *d, u32 _cbm)
+{
+        unsigned long *cbm = (unsigned long *)&_cbm;
+        unsigned long *cbm_b;
+        unsigned int cbm_len;
+
+        if (d->plr) {
+                cbm_len = d->plr->r->cache.cbm_len;
+                cbm_b = (unsigned long *)&d->plr->cbm;
+                if (bitmap_intersects(cbm, cbm_b, cbm_len))
+                        return true;
+        }
+        return false;
+}
+
+/**
+ * rdtgroup_pseudo_locked_in_hierarchy - Pseudo-locked region in cache hierarchy
+ * @d: RDT domain under test
+ *
+ * The setup of a pseudo-locked region affects all cache instances within
+ * the hierarchy of the region. It is thus essential to know if any
+ * pseudo-locked regions exist within a cache hierarchy to prevent any
+ * attempts to create new pseudo-locked regions in the same hierarchy.
+ *
+ * Return: true if a pseudo-locked region exists in the hierarchy of @d or
+ *         if it is not possible to test due to memory allocation issue,
+ *         false otherwise.
+ */
+bool rdtgroup_pseudo_locked_in_hierarchy(struct rdt_domain *d)
+{
+        cpumask_var_t cpu_with_psl;
+        struct rdt_resource *r;
+        struct rdt_domain *d_i;
+        bool ret = false;
+
+        if (!zalloc_cpumask_var(&cpu_with_psl, GFP_KERNEL))
+                return true;
+
+        /*
+         * First determine which cpus have pseudo-locked regions
+         * associated with them.
+         */
+        for_each_alloc_enabled_rdt_resource(r) {
+                list_for_each_entry(d_i, &r->domains, list) {
+                        if (d_i->plr)
+                                cpumask_or(cpu_with_psl, cpu_with_psl,
+                                           &d_i->cpu_mask);
+                }
+        }
+
+        /*
+         * Next test if new pseudo-locked region would intersect with
+         * existing region.
+         */
+        if (cpumask_intersects(&d->cpu_mask, cpu_with_psl))
+                ret = true;
+
+        free_cpumask_var(cpu_with_psl);
+        return ret;
+}
+
+/**
+ * measure_cycles_lat_fn - Measure cycle latency to read pseudo-locked memory
+ * @_plr: pseudo-lock region to measure
+ *
+ * There is no deterministic way to test if a memory region is cached. One
+ * way is to measure how long it takes to read the memory, the speed of
+ * access is a good way to learn how close to the cpu the data was. Even
+ * more, if the prefetcher is disabled and the memory is read at a stride
+ * of half the cache line, then a cache miss will be easy to spot since the
+ * read of the first half would be significantly slower than the read of
+ * the second half.
+ *
+ * Return: 0. Waiter on waitqueue will be woken on completion.
+ */
+static int measure_cycles_lat_fn(void *_plr)
+{
+        struct pseudo_lock_region *plr = _plr;
+        unsigned long i;
+        u64 start, end;
+#ifdef CONFIG_KASAN
+        /*
+         * The registers used for local register variables are also used
+         * when KASAN is active. When KASAN is active we use a regular
+         * variable to ensure we always use a valid pointer to access memory.
+         * The cost is that accessing this pointer, which could be in
+         * cache, will be included in the measurement of memory read latency.
+         */
+        void *mem_r;
+#else
+#ifdef CONFIG_X86_64
+        register void *mem_r asm("rbx");
+#else
+        register void *mem_r asm("ebx");
+#endif /* CONFIG_X86_64 */
+#endif /* CONFIG_KASAN */
+
+        local_irq_disable();
+        /*
+         * The wrmsr call may be reordered with the assignment below it.
+         * Call wrmsr as directly as possible to avoid tracing clobbering
+         * local register variable used for memory pointer.
+         */
+        __wrmsr(MSR_MISC_FEATURE_CONTROL, prefetch_disable_bits, 0x0);
+        mem_r = plr->kmem;
+        /*
+         * Dummy execute of the time measurement to load the needed
+         * instructions into the L1 instruction cache.
+         */
+        start = rdtsc_ordered();
+        for (i = 0; i < plr->size; i += 32) {
+                start = rdtsc_ordered();
+                asm volatile("mov (%0,%1,1), %%eax\n\t"
+                             :
+                             : "r" (mem_r), "r" (i)
+                             : "%eax", "memory");
+                end = rdtsc_ordered();
+                trace_pseudo_lock_mem_latency((u32)(end - start));
+        }
+        wrmsr(MSR_MISC_FEATURE_CONTROL, 0x0, 0x0);
+        local_irq_enable();
+        plr->thread_done = 1;
+        wake_up_interruptible(&plr->lock_thread_wq);
+        return 0;
+}
+
+static int measure_cycles_perf_fn(void *_plr)
+{
+        unsigned long long l3_hits = 0, l3_miss = 0;
+        u64 l3_hit_bits = 0, l3_miss_bits = 0;
+        struct pseudo_lock_region *plr = _plr;
+        unsigned long long l2_hits, l2_miss;
+        u64 l2_hit_bits, l2_miss_bits;
+        unsigned long i;
+#ifdef CONFIG_KASAN
+        /*
+         * The registers used for local register variables are also used
+         * when KASAN is active. When KASAN is active we use regular variables
+         * at the cost of including cache access latency to these variables
+         * in the measurements.
+         */
+        unsigned int line_size;
+        unsigned int size;
+        void *mem_r;
+#else
+        register unsigned int line_size asm("esi");
+        register unsigned int size asm("edi");
+#ifdef CONFIG_X86_64
+        register void *mem_r asm("rbx");
+#else
+        register void *mem_r asm("ebx");
+#endif /* CONFIG_X86_64 */
+#endif /* CONFIG_KASAN */
+
+        /*
+         * Non-architectural event for the Goldmont Microarchitecture
+         * from Intel x86 Architecture Software Developer Manual (SDM):
+         * MEM_LOAD_UOPS_RETIRED D1H (event number)
+         * Umask values:
+         *     L1_HIT   01H
+         *     L2_HIT   02H
+         *     L1_MISS  08H
+         *     L2_MISS  10H
+         *
+         * On Broadwell Microarchitecture the MEM_LOAD_UOPS_RETIRED event
+         * has two "no fix" errata associated with it: BDM35 and BDM100. On
+         * this platform we use the following events instead:
+         *  L2_RQSTS 24H (Documented in https://download.01.org/perfmon/BDW/)
+         *       REFERENCES FFH
+         *       MISS       3FH
+         *  LONGEST_LAT_CACHE 2EH (Documented in SDM)
+         *       REFERENCE 4FH
+         *       MISS      41H
+         */
+
+        /*
+         * Start by setting flags for IA32_PERFEVTSELx:
+         *     OS  (Operating system mode)  0x2
+         *     INT (APIC interrupt enable)  0x10
+         *     EN  (Enable counter)         0x40
+         *
+         * Then add the Umask value and event number to select performance
+         * event.
+         */
+
+        switch (boot_cpu_data.x86_model) {
+        case INTEL_FAM6_ATOM_GOLDMONT:
+        case INTEL_FAM6_ATOM_GEMINI_LAKE:
+                l2_hit_bits = (0x52ULL << 16) | (0x2 << 8) | 0xd1;
+                l2_miss_bits = (0x52ULL << 16) | (0x10 << 8) | 0xd1;
+                break;
+        case INTEL_FAM6_BROADWELL_X:
+                /* On BDW the l2_hit_bits count references, not hits */
+                l2_hit_bits = (0x52ULL << 16) | (0xff << 8) | 0x24;
+                l2_miss_bits = (0x52ULL << 16) | (0x3f << 8) | 0x24;
+                /* On BDW the l3_hit_bits count references, not hits */
+                l3_hit_bits = (0x52ULL << 16) | (0x4f << 8) | 0x2e;
+                l3_miss_bits = (0x52ULL << 16) | (0x41 << 8) | 0x2e;
+                break;
+        default:
+                goto out;
+        }
+
+        local_irq_disable();
+        /*
+         * Call wrmsr direcly to avoid the local register variables from
+         * being overwritten due to reordering of their assignment with
+         * the wrmsr calls.
+         */
+        __wrmsr(MSR_MISC_FEATURE_CONTROL, prefetch_disable_bits, 0x0);
+        /* Disable events and reset counters */
+        pseudo_wrmsrl_notrace(MSR_ARCH_PERFMON_EVENTSEL0, 0x0);
+        pseudo_wrmsrl_notrace(MSR_ARCH_PERFMON_EVENTSEL0 + 1, 0x0);
+        pseudo_wrmsrl_notrace(MSR_ARCH_PERFMON_PERFCTR0, 0x0);
+        pseudo_wrmsrl_notrace(MSR_ARCH_PERFMON_PERFCTR0 + 1, 0x0);
+        if (l3_hit_bits > 0) {
+                pseudo_wrmsrl_notrace(MSR_ARCH_PERFMON_EVENTSEL0 + 2, 0x0);
+                pseudo_wrmsrl_notrace(MSR_ARCH_PERFMON_EVENTSEL0 + 3, 0x0);
+                pseudo_wrmsrl_notrace(MSR_ARCH_PERFMON_PERFCTR0 + 2, 0x0);
+                pseudo_wrmsrl_notrace(MSR_ARCH_PERFMON_PERFCTR0 + 3, 0x0);
+        }
+        /* Set and enable the L2 counters */
+        pseudo_wrmsrl_notrace(MSR_ARCH_PERFMON_EVENTSEL0, l2_hit_bits);
+        pseudo_wrmsrl_notrace(MSR_ARCH_PERFMON_EVENTSEL0 + 1, l2_miss_bits);
+        if (l3_hit_bits > 0) {
+                pseudo_wrmsrl_notrace(MSR_ARCH_PERFMON_EVENTSEL0 + 2,
+                                      l3_hit_bits);
+                pseudo_wrmsrl_notrace(MSR_ARCH_PERFMON_EVENTSEL0 + 3,
+                                      l3_miss_bits);
+        }
+        mem_r = plr->kmem;
+        size = plr->size;
+        line_size = plr->line_size;
+        for (i = 0; i < size; i += line_size) {
+                asm volatile("mov (%0,%1,1), %%eax\n\t"
+                             :
+                             : "r" (mem_r), "r" (i)
+                             : "%eax", "memory");
+        }
+        /*
+         * Call wrmsr directly (no tracing) to not influence
+         * the cache access counters as they are disabled.
+         */
+        pseudo_wrmsrl_notrace(MSR_ARCH_PERFMON_EVENTSEL0,
+                              l2_hit_bits & ~(0x40ULL << 16));
+        pseudo_wrmsrl_notrace(MSR_ARCH_PERFMON_EVENTSEL0 + 1,
+                              l2_miss_bits & ~(0x40ULL << 16));
+        if (l3_hit_bits > 0) {
+                pseudo_wrmsrl_notrace(MSR_ARCH_PERFMON_EVENTSEL0 + 2,
+                                      l3_hit_bits & ~(0x40ULL << 16));
+                pseudo_wrmsrl_notrace(MSR_ARCH_PERFMON_EVENTSEL0 + 3,
+                                      l3_miss_bits & ~(0x40ULL << 16));
+        }
+        l2_hits = native_read_pmc(0);
+        l2_miss = native_read_pmc(1);
+        if (l3_hit_bits > 0) {
+                l3_hits = native_read_pmc(2);
+                l3_miss = native_read_pmc(3);
+        }
+        wrmsr(MSR_MISC_FEATURE_CONTROL, 0x0, 0x0);
+        local_irq_enable();
+        /*
+         * On BDW we count references and misses, need to adjust. Sometimes
+         * the "hits" counter is a bit more than the references, for
+         * example, x references but x + 1 hits. To not report invalid
+         * hit values in this case we treat that as misses eaqual to
+         * references.
+         */
+        if (boot_cpu_data.x86_model == INTEL_FAM6_BROADWELL_X)
+                l2_hits -= (l2_miss > l2_hits ? l2_hits : l2_miss);
+        trace_pseudo_lock_l2(l2_hits, l2_miss);
+        if (l3_hit_bits > 0) {
+                if (boot_cpu_data.x86_model == INTEL_FAM6_BROADWELL_X)
+                        l3_hits -= (l3_miss > l3_hits ? l3_hits : l3_miss);
+                trace_pseudo_lock_l3(l3_hits, l3_miss);
+        }
+
+out:
+        plr->thread_done = 1;
+        wake_up_interruptible(&plr->lock_thread_wq);
+        return 0;
+}
+
+/**
+ * pseudo_lock_measure_cycles - Trigger latency measure to pseudo-locked region
+ *
+ * The measurement of latency to access a pseudo-locked region should be
+ * done from a cpu that is associated with that pseudo-locked region.
+ * Determine which cpu is associated with this region and start a thread on
+ * that cpu to perform the measurement, wait for that thread to complete.
+ *
+ * Return: 0 on success, <0 on failure
+ */
+static int pseudo_lock_measure_cycles(struct rdtgroup *rdtgrp, int sel)
+{
+        struct pseudo_lock_region *plr = rdtgrp->plr;
+        struct task_struct *thread;
+        unsigned int cpu;
+        int ret = -1;
+
+        cpus_read_lock();
+        mutex_lock(&rdtgroup_mutex);
+
+        if (rdtgrp->flags & RDT_DELETED) {
+                ret = -ENODEV;
+                goto out;
+        }
+
+        plr->thread_done = 0;
+        cpu = cpumask_first(&plr->d->cpu_mask);
+        if (!cpu_online(cpu)) {
+                ret = -ENODEV;
+                goto out;
+        }
+
+        if (sel == 1)
+                thread = kthread_create_on_node(measure_cycles_lat_fn, plr,
+                                                cpu_to_node(cpu),
+                                                "pseudo_lock_measure/%u",
+                                                cpu);
+        else if (sel == 2)
+                thread = kthread_create_on_node(measure_cycles_perf_fn, plr,
+                                                cpu_to_node(cpu),
+                                                "pseudo_lock_measure/%u",
+                                                cpu);
+        else
+                goto out;
+
+        if (IS_ERR(thread)) {
+                ret = PTR_ERR(thread);
+                goto out;
+        }
+        kthread_bind(thread, cpu);
+        wake_up_process(thread);
+
+        ret = wait_event_interruptible(plr->lock_thread_wq,
+                                       plr->thread_done == 1);
+        if (ret < 0)
+                goto out;
+
+        ret = 0;
+
+out:
+        mutex_unlock(&rdtgroup_mutex);
+        cpus_read_unlock();
+        return ret;
+}
+
+static ssize_t pseudo_lock_measure_trigger(struct file *file,
+                                           const char __user *user_buf,
+                                           size_t count, loff_t *ppos)
+{
+        struct rdtgroup *rdtgrp = file->private_data;
+        size_t buf_size;
+        char buf[32];
+        int ret;
+        int sel;
+
+        buf_size = min(count, (sizeof(buf) - 1));
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+
+        buf[buf_size] = '\0';
+        ret = kstrtoint(buf, 10, &sel);
+        if (ret == 0) {
+                if (sel != 1)
+                        return -EINVAL;
+                ret = debugfs_file_get(file->f_path.dentry);
+                if (ret)
+                        return ret;
+                ret = pseudo_lock_measure_cycles(rdtgrp, sel);
+                if (ret == 0)
+                        ret = count;
+                debugfs_file_put(file->f_path.dentry);
+        }
+
+        return ret;
+}
+
+static const struct file_operations pseudo_measure_fops = {
+        .write = pseudo_lock_measure_trigger,
+        .open = simple_open,
+        .llseek = default_llseek,
+};
+
+/**
+ * rdtgroup_pseudo_lock_create - Create a pseudo-locked region
+ * @rdtgrp: resource group to which pseudo-lock region belongs
+ *
+ * Called when a resource group in the pseudo-locksetup mode receives a
+ * valid schemata that should be pseudo-locked. Since the resource group is
+ * in pseudo-locksetup mode the &struct pseudo_lock_region has already been
+ * allocated and initialized with the essential information. If a failure
+ * occurs the resource group remains in the pseudo-locksetup mode with the
+ * &struct pseudo_lock_region associated with it, but cleared from all
+ * information and ready for the user to re-attempt pseudo-locking by
+ * writing the schemata again.
+ *
+ * Return: 0 if the pseudo-locked region was successfully pseudo-locked, <0
+ * on failure. Descriptive error will be written to last_cmd_status buffer.
+ */
+int rdtgroup_pseudo_lock_create(struct rdtgroup *rdtgrp)
+{
+        struct pseudo_lock_region *plr = rdtgrp->plr;
+        struct task_struct *thread;
+        unsigned int new_minor;
+        struct device *dev;
+        int ret;
+
+        ret = pseudo_lock_region_alloc(plr);
+        if (ret < 0)
+                return ret;
+
+        ret = pseudo_lock_cstates_constrain(plr);
+        if (ret < 0) {
+                ret = -EINVAL;
+                goto out_region;
+        }
+
+        plr->thread_done = 0;
+
+        thread = kthread_create_on_node(pseudo_lock_fn, rdtgrp,
+                                        cpu_to_node(plr->cpu),
+                                        "pseudo_lock/%u", plr->cpu);
+        if (IS_ERR(thread)) {
+                ret = PTR_ERR(thread);
+                rdt_last_cmd_printf("locking thread returned error %d\n", ret);
+                goto out_cstates;
+        }
+
+        kthread_bind(thread, plr->cpu);
+        wake_up_process(thread);
+
+        ret = wait_event_interruptible(plr->lock_thread_wq,
+                                       plr->thread_done == 1);
+        if (ret < 0) {
+                /*
+                 * If the thread does not get on the CPU for whatever
+                 * reason and the process which sets up the region is
+                 * interrupted then this will leave the thread in runnable
+                 * state and once it gets on the CPU it will derefence
+                 * the cleared, but not freed, plr struct resulting in an
+                 * empty pseudo-locking loop.
+                 */
+                rdt_last_cmd_puts("locking thread interrupted\n");
+                goto out_cstates;
+        }
+
+        ret = pseudo_lock_minor_get(&new_minor);
+        if (ret < 0) {
+                rdt_last_cmd_puts("unable to obtain a new minor number\n");
+                goto out_cstates;
+        }
+
+        /*
+         * Unlock access but do not release the reference. The
+         * pseudo-locked region will still be here on return.
+         *
+         * The mutex has to be released temporarily to avoid a potential
+         * deadlock with the mm->mmap_sem semaphore which is obtained in
+         * the device_create() and debugfs_create_dir() callpath below
+         * as well as before the mmap() callback is called.
+         */
+        mutex_unlock(&rdtgroup_mutex);
+
+        if (!IS_ERR_OR_NULL(debugfs_resctrl)) {
+                plr->debugfs_dir = debugfs_create_dir(rdtgrp->kn->name,
+                                                      debugfs_resctrl);
+                if (!IS_ERR_OR_NULL(plr->debugfs_dir))
+                        debugfs_create_file("pseudo_lock_measure", 0200,
+                                            plr->debugfs_dir, rdtgrp,
+                                            &pseudo_measure_fops);
+        }
+
+        dev = device_create(pseudo_lock_class, NULL,
+                            MKDEV(pseudo_lock_major, new_minor),
+                            rdtgrp, "%s", rdtgrp->kn->name);
+
+        mutex_lock(&rdtgroup_mutex);
+
+        if (IS_ERR(dev)) {
+                ret = PTR_ERR(dev);
+                rdt_last_cmd_printf("failed to create character device: %d\n",
+                                    ret);
+                goto out_debugfs;
+        }
+
+        /* We released the mutex - check if group was removed while we did so */
+        if (rdtgrp->flags & RDT_DELETED) {
+                ret = -ENODEV;
+                goto out_device;
+        }
+
+        plr->minor = new_minor;
+
+        rdtgrp->mode = RDT_MODE_PSEUDO_LOCKED;
+        closid_free(rdtgrp->closid);
+        rdtgroup_kn_mode_restore(rdtgrp, "cpus", 0444);
+        rdtgroup_kn_mode_restore(rdtgrp, "cpus_list", 0444);
+
+        ret = 0;
+        goto out;
+
+out_device:
+        device_destroy(pseudo_lock_class, MKDEV(pseudo_lock_major, new_minor));
+out_debugfs:
+        debugfs_remove_recursive(plr->debugfs_dir);
+        pseudo_lock_minor_release(new_minor);
+out_cstates:
+        pseudo_lock_cstates_relax(plr);
+out_region:
+        pseudo_lock_region_clear(plr);
+out:
+        return ret;
+}
+
+/**
+ * rdtgroup_pseudo_lock_remove - Remove a pseudo-locked region
+ * @rdtgrp: resource group to which the pseudo-locked region belongs
+ *
+ * The removal of a pseudo-locked region can be initiated when the resource
+ * group is removed from user space via a "rmdir" from userspace or the
+ * unmount of the resctrl filesystem. On removal the resource group does
+ * not go back to pseudo-locksetup mode before it is removed, instead it is
+ * removed directly. There is thus assymmetry with the creation where the
+ * &struct pseudo_lock_region is removed here while it was not created in
+ * rdtgroup_pseudo_lock_create().
+ *
+ * Return: void
+ */
+void rdtgroup_pseudo_lock_remove(struct rdtgroup *rdtgrp)
+{
+        struct pseudo_lock_region *plr = rdtgrp->plr;
+
+        if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) {
+                /*
+                 * Default group cannot be a pseudo-locked region so we can
+                 * free closid here.
+                 */
+                closid_free(rdtgrp->closid);
+                goto free;
+        }
+
+        pseudo_lock_cstates_relax(plr);
+        debugfs_remove_recursive(rdtgrp->plr->debugfs_dir);
+        device_destroy(pseudo_lock_class, MKDEV(pseudo_lock_major, plr->minor));
+        pseudo_lock_minor_release(plr->minor);
+
+free:
+        pseudo_lock_free(rdtgrp);
+}
+
+static int pseudo_lock_dev_open(struct inode *inode, struct file *filp)
+{
+        struct rdtgroup *rdtgrp;
+
+        mutex_lock(&rdtgroup_mutex);
+
+        rdtgrp = region_find_by_minor(iminor(inode));
+        if (!rdtgrp) {
+                mutex_unlock(&rdtgroup_mutex);
+                return -ENODEV;
+        }
+
+        filp->private_data = rdtgrp;
+        atomic_inc(&rdtgrp->waitcount);
+        /* Perform a non-seekable open - llseek is not supported */
+        filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE);
+
+        mutex_unlock(&rdtgroup_mutex);
+
+        return 0;
+}
+
+static int pseudo_lock_dev_release(struct inode *inode, struct file *filp)
+{
+        struct rdtgroup *rdtgrp;
+
+        mutex_lock(&rdtgroup_mutex);
+        rdtgrp = filp->private_data;
+        WARN_ON(!rdtgrp);
+        if (!rdtgrp) {
+                mutex_unlock(&rdtgroup_mutex);
+                return -ENODEV;
+        }
+        filp->private_data = NULL;
+        atomic_dec(&rdtgrp->waitcount);
+        mutex_unlock(&rdtgroup_mutex);
+        return 0;
+}
+
+static int pseudo_lock_dev_mremap(struct vm_area_struct *area)
+{
+        /* Not supported */
+        return -EINVAL;
+}
+
+static const struct vm_operations_struct pseudo_mmap_ops = {
+        .mremap = pseudo_lock_dev_mremap,
+};
+
+static int pseudo_lock_dev_mmap(struct file *filp, struct vm_area_struct *vma)
+{
+        unsigned long vsize = vma->vm_end - vma->vm_start;
+        unsigned long off = vma->vm_pgoff << PAGE_SHIFT;
+        struct pseudo_lock_region *plr;
+        struct rdtgroup *rdtgrp;
+        unsigned long physical;
+        unsigned long psize;
+
+        mutex_lock(&rdtgroup_mutex);
+
+        rdtgrp = filp->private_data;
+        WARN_ON(!rdtgrp);
+        if (!rdtgrp) {
+                mutex_unlock(&rdtgroup_mutex);
+                return -ENODEV;
+        }
+
+        plr = rdtgrp->plr;
+
+        /*
+         * Task is required to run with affinity to the cpus associated
+         * with the pseudo-locked region. If this is not the case the task
+         * may be scheduled elsewhere and invalidate entries in the
+         * pseudo-locked region.
+         */
+        if (!cpumask_subset(&current->cpus_allowed, &plr->d->cpu_mask)) {
+                mutex_unlock(&rdtgroup_mutex);
+                return -EINVAL;
+        }
+
+        physical = __pa(plr->kmem) >> PAGE_SHIFT;
+        psize = plr->size - off;
+
+        if (off > plr->size) {
+                mutex_unlock(&rdtgroup_mutex);
+                return -ENOSPC;
+        }
+
+        /*
+         * Ensure changes are carried directly to the memory being mapped,
+         * do not allow copy-on-write mapping.
+         */
+        if (!(vma->vm_flags & VM_SHARED)) {
+                mutex_unlock(&rdtgroup_mutex);
+                return -EINVAL;
+        }
+
+        if (vsize > psize) {
+                mutex_unlock(&rdtgroup_mutex);
+                return -ENOSPC;
+        }
+
+        memset(plr->kmem + off, 0, vsize);
+
+        if (remap_pfn_range(vma, vma->vm_start, physical + vma->vm_pgoff,
+                            vsize, vma->vm_page_prot)) {
+                mutex_unlock(&rdtgroup_mutex);
+                return -EAGAIN;
+        }
+        vma->vm_ops = &pseudo_mmap_ops;
+        mutex_unlock(&rdtgroup_mutex);
+        return 0;
+}
+
+static const struct file_operations pseudo_lock_dev_fops = {
+        .owner =        THIS_MODULE,
+        .llseek =       no_llseek,
+        .read =         NULL,
+        .write =        NULL,
+        .open =         pseudo_lock_dev_open,
+        .release =      pseudo_lock_dev_release,
+        .mmap =         pseudo_lock_dev_mmap,
+};
+
+static char *pseudo_lock_devnode(struct device *dev, umode_t *mode)
+{
+        struct rdtgroup *rdtgrp;
+
+        rdtgrp = dev_get_drvdata(dev);
+        if (mode)
+                *mode = 0600;
+        return kasprintf(GFP_KERNEL, "pseudo_lock/%s", rdtgrp->kn->name);
+}
+
+int rdt_pseudo_lock_init(void)
+{
+        int ret;
+
+        ret = register_chrdev(0, "pseudo_lock", &pseudo_lock_dev_fops);
+        if (ret < 0)
+                return ret;
+
+        pseudo_lock_major = ret;
+
+        pseudo_lock_class = class_create(THIS_MODULE, "pseudo_lock");
+        if (IS_ERR(pseudo_lock_class)) {
+                ret = PTR_ERR(pseudo_lock_class);
+                unregister_chrdev(pseudo_lock_major, "pseudo_lock");
+                return ret;
+        }
+
+        pseudo_lock_class->devnode = pseudo_lock_devnode;
+        return 0;
+}
+
+void rdt_pseudo_lock_release(void)
+{
+        class_destroy(pseudo_lock_class);
+        pseudo_lock_class = NULL;
+        unregister_chrdev(pseudo_lock_major, "pseudo_lock");
+        pseudo_lock_major = 0;
+}
diff --git a/arch/x86/kernel/cpu/intel_rdt_pseudo_lock_event.h b/arch/x86/kernel/cpu/intel_rdt_pseudo_lock_event.h
new file mode 100644
index 000000000000..2c041e6d9f05
--- /dev/null
+++ b/arch/x86/kernel/cpu/intel_rdt_pseudo_lock_event.h
@@ -0,0 +1,43 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM resctrl
+
+#if !defined(_TRACE_PSEUDO_LOCK_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_PSEUDO_LOCK_H
+
+#include <linux/tracepoint.h>
+
+TRACE_EVENT(pseudo_lock_mem_latency,
+            TP_PROTO(u32 latency),
+            TP_ARGS(latency),
+            TP_STRUCT__entry(__field(u32, latency)),
+            TP_fast_assign(__entry->latency = latency),
+            TP_printk("latency=%u", __entry->latency)
+           );
+
+TRACE_EVENT(pseudo_lock_l2,
+            TP_PROTO(u64 l2_hits, u64 l2_miss),
+            TP_ARGS(l2_hits, l2_miss),
+            TP_STRUCT__entry(__field(u64, l2_hits)
+                             __field(u64, l2_miss)),
+            TP_fast_assign(__entry->l2_hits = l2_hits;
+                           __entry->l2_miss = l2_miss;),
+            TP_printk("hits=%llu miss=%llu",
+                      __entry->l2_hits, __entry->l2_miss));
+
+TRACE_EVENT(pseudo_lock_l3,
+            TP_PROTO(u64 l3_hits, u64 l3_miss),
+            TP_ARGS(l3_hits, l3_miss),
+            TP_STRUCT__entry(__field(u64, l3_hits)
+                             __field(u64, l3_miss)),
+            TP_fast_assign(__entry->l3_hits = l3_hits;
+                           __entry->l3_miss = l3_miss;),
+            TP_printk("hits=%llu miss=%llu",
+                      __entry->l3_hits, __entry->l3_miss));
+
+#endif /* _TRACE_PSEUDO_LOCK_H */
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#define TRACE_INCLUDE_FILE intel_rdt_pseudo_lock_event
+#include <trace/define_trace.h>
diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
index 749856a2e736..d6d7ea7349d0 100644
--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
@@ -20,7 +20,9 @@
 
 #define pr_fmt(fmt)     KBUILD_MODNAME ": " fmt
 
+#include <linux/cacheinfo.h>
 #include <linux/cpu.h>
+#include <linux/debugfs.h>
 #include <linux/fs.h>
 #include <linux/sysfs.h>
 #include <linux/kernfs.h>
@@ -55,6 +57,8 @@ static struct kernfs_node *kn_mondata;
 static struct seq_buf last_cmd_status;
 static char last_cmd_status_buf[512];
 
+struct dentry *debugfs_resctrl;
+
 void rdt_last_cmd_clear(void)
 {
         lockdep_assert_held(&rdtgroup_mutex);
@@ -121,11 +125,65 @@ static int closid_alloc(void)
         return closid;
 }
 
-static void closid_free(int closid)
+void closid_free(int closid)
 {
         closid_free_map |= 1 << closid;
 }
 
+/**
+ * closid_allocated - test if provided closid is in use
+ * @closid: closid to be tested
+ *
+ * Return: true if @closid is currently associated with a resource group,
+ * false if @closid is free
+ */
+static bool closid_allocated(unsigned int closid)
+{
+        return (closid_free_map & (1 << closid)) == 0;
+}
+
+/**
+ * rdtgroup_mode_by_closid - Return mode of resource group with closid
+ * @closid: closid if the resource group
+ *
+ * Each resource group is associated with a @closid. Here the mode
+ * of a resource group can be queried by searching for it using its closid.
+ *
+ * Return: mode as &enum rdtgrp_mode of resource group with closid @closid
+ */
+enum rdtgrp_mode rdtgroup_mode_by_closid(int closid)
+{
+        struct rdtgroup *rdtgrp;
+
+        list_for_each_entry(rdtgrp, &rdt_all_groups, rdtgroup_list) {
+                if (rdtgrp->closid == closid)
+                        return rdtgrp->mode;
+        }
+
+        return RDT_NUM_MODES;
+}
+
+static const char * const rdt_mode_str[] = {
+        [RDT_MODE_SHAREABLE]            = "shareable",
+        [RDT_MODE_EXCLUSIVE]            = "exclusive",
+        [RDT_MODE_PSEUDO_LOCKSETUP]     = "pseudo-locksetup",
+        [RDT_MODE_PSEUDO_LOCKED]        = "pseudo-locked",
+};
+
+/**
+ * rdtgroup_mode_str - Return the string representation of mode
+ * @mode: the resource group mode as &enum rdtgroup_mode
+ *
+ * Return: string representation of valid mode, "unknown" otherwise
+ */
+static const char *rdtgroup_mode_str(enum rdtgrp_mode mode)
+{
+        if (mode < RDT_MODE_SHAREABLE || mode >= RDT_NUM_MODES)
+                return "unknown";
+
+        return rdt_mode_str[mode];
+}
+
 /* set uid and gid of rdtgroup dirs and files to that of the creator */
 static int rdtgroup_kn_set_ugid(struct kernfs_node *kn)
 {
@@ -207,8 +265,12 @@ static int rdtgroup_cpus_show(struct kernfs_open_file *of,
         rdtgrp = rdtgroup_kn_lock_live(of->kn);
 
         if (rdtgrp) {
-                seq_printf(s, is_cpu_list(of) ? "%*pbl\n" : "%*pb\n",
-                           cpumask_pr_args(&rdtgrp->cpu_mask));
+                if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED)
+                        seq_printf(s, is_cpu_list(of) ? "%*pbl\n" : "%*pb\n",
+                                   cpumask_pr_args(&rdtgrp->plr->d->cpu_mask));
+                else
+                        seq_printf(s, is_cpu_list(of) ? "%*pbl\n" : "%*pb\n",
+                                   cpumask_pr_args(&rdtgrp->cpu_mask));
         } else {
                 ret = -ENOENT;
         }
@@ -394,6 +456,13 @@ static ssize_t rdtgroup_cpus_write(struct kernfs_open_file *of,
                 goto unlock;
         }
 
+        if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED ||
+            rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) {
+                ret = -EINVAL;
+                rdt_last_cmd_puts("pseudo-locking in progress\n");
+                goto unlock;
+        }
+
         if (is_cpu_list(of))
                 ret = cpulist_parse(buf, newmask);
         else
@@ -509,6 +578,32 @@ static int __rdtgroup_move_task(struct task_struct *tsk,
         return ret;
 }
 
+/**
+ * rdtgroup_tasks_assigned - Test if tasks have been assigned to resource group
+ * @r: Resource group
+ *
+ * Return: 1 if tasks have been assigned to @r, 0 otherwise
+ */
+int rdtgroup_tasks_assigned(struct rdtgroup *r)
+{
+        struct task_struct *p, *t;
+        int ret = 0;
+
+        lockdep_assert_held(&rdtgroup_mutex);
+
+        rcu_read_lock();
+        for_each_process_thread(p, t) {
+                if ((r->type == RDTCTRL_GROUP && t->closid == r->closid) ||
+                    (r->type == RDTMON_GROUP && t->rmid == r->mon.rmid)) {
+                        ret = 1;
+                        break;
+                }
+        }
+        rcu_read_unlock();
+
+        return ret;
+}
+
 static int rdtgroup_task_write_permission(struct task_struct *task,
                                           struct kernfs_open_file *of)
 {
@@ -570,13 +665,22 @@ static ssize_t rdtgroup_tasks_write(struct kernfs_open_file *of,
         if (kstrtoint(strstrip(buf), 0, &pid) || pid < 0)
                 return -EINVAL;
         rdtgrp = rdtgroup_kn_lock_live(of->kn);
+        if (!rdtgrp) {
+                rdtgroup_kn_unlock(of->kn);
+                return -ENOENT;
+        }
         rdt_last_cmd_clear();
 
-        if (rdtgrp)
-                ret = rdtgroup_move_task(pid, rdtgrp, of);
-        else
-                ret = -ENOENT;
+        if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED ||
+            rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) {
+                ret = -EINVAL;
+                rdt_last_cmd_puts("pseudo-locking in progress\n");
+                goto unlock;
+        }
 
+        ret = rdtgroup_move_task(pid, rdtgrp, of);
+
+unlock:
         rdtgroup_kn_unlock(of->kn);
 
         return ret ?: nbytes;
@@ -662,6 +766,94 @@ static int rdt_shareable_bits_show(struct kernfs_open_file *of,
         return 0;
 }
 
+/**
+ * rdt_bit_usage_show - Display current usage of resources
+ *
+ * A domain is a shared resource that can now be allocated differently. Here
+ * we display the current regions of the domain as an annotated bitmask.
+ * For each domain of this resource its allocation bitmask
+ * is annotated as below to indicate the current usage of the corresponding bit:
+ *   0 - currently unused
+ *   X - currently available for sharing and used by software and hardware
+ *   H - currently used by hardware only but available for software use
+ *   S - currently used and shareable by software only
+ *   E - currently used exclusively by one resource group
+ *   P - currently pseudo-locked by one resource group
+ */
+static int rdt_bit_usage_show(struct kernfs_open_file *of,
+                              struct seq_file *seq, void *v)
+{
+        struct rdt_resource *r = of->kn->parent->priv;
+        u32 sw_shareable = 0, hw_shareable = 0;
+        u32 exclusive = 0, pseudo_locked = 0;
+        struct rdt_domain *dom;
+        int i, hwb, swb, excl, psl;
+        enum rdtgrp_mode mode;
+        bool sep = false;
+        u32 *ctrl;
+
+        mutex_lock(&rdtgroup_mutex);
+        hw_shareable = r->cache.shareable_bits;
+        list_for_each_entry(dom, &r->domains, list) {
+                if (sep)
+                        seq_putc(seq, ';');
+                ctrl = dom->ctrl_val;
+                sw_shareable = 0;
+                exclusive = 0;
+                seq_printf(seq, "%d=", dom->id);
+                for (i = 0; i < r->num_closid; i++, ctrl++) {
+                        if (!closid_allocated(i))
+                                continue;
+                        mode = rdtgroup_mode_by_closid(i);
+                        switch (mode) {
+                        case RDT_MODE_SHAREABLE:
+                                sw_shareable |= *ctrl;
+                                break;
+                        case RDT_MODE_EXCLUSIVE:
+                                exclusive |= *ctrl;
+                                break;
+                        case RDT_MODE_PSEUDO_LOCKSETUP:
+                        /*
+                         * RDT_MODE_PSEUDO_LOCKSETUP is possible
+                         * here but not included since the CBM
+                         * associated with this CLOSID in this mode
+                         * is not initialized and no task or cpu can be
+                         * assigned this CLOSID.
+                         */
+                                break;
+                        case RDT_MODE_PSEUDO_LOCKED:
+                        case RDT_NUM_MODES:
+                                WARN(1,
+                                     "invalid mode for closid %d\n", i);
+                                break;
+                        }
+                }
+                for (i = r->cache.cbm_len - 1; i >= 0; i--) {
+                        pseudo_locked = dom->plr ? dom->plr->cbm : 0;
+                        hwb = test_bit(i, (unsigned long *)&hw_shareable);
+                        swb = test_bit(i, (unsigned long *)&sw_shareable);
+                        excl = test_bit(i, (unsigned long *)&exclusive);
+                        psl = test_bit(i, (unsigned long *)&pseudo_locked);
+                        if (hwb && swb)
+                                seq_putc(seq, 'X');
+                        else if (hwb && !swb)
+                                seq_putc(seq, 'H');
+                        else if (!hwb && swb)
+                                seq_putc(seq, 'S');
+                        else if (excl)
+                                seq_putc(seq, 'E');
+                        else if (psl)
+                                seq_putc(seq, 'P');
+                        else /* Unused bits remain */
+                                seq_putc(seq, '0');
+                }
+                sep = true;
+        }
+        seq_putc(seq, '\n');
+        mutex_unlock(&rdtgroup_mutex);
+        return 0;
+}
+
 static int rdt_min_bw_show(struct kernfs_open_file *of,
                              struct seq_file *seq, void *v)
 {
@@ -740,6 +932,269 @@ static ssize_t max_threshold_occ_write(struct kernfs_open_file *of,
         return nbytes;
 }
 
+/*
+ * rdtgroup_mode_show - Display mode of this resource group
+ */
+static int rdtgroup_mode_show(struct kernfs_open_file *of,
+                              struct seq_file *s, void *v)
+{
+        struct rdtgroup *rdtgrp;
+
+        rdtgrp = rdtgroup_kn_lock_live(of->kn);
+        if (!rdtgrp) {
+                rdtgroup_kn_unlock(of->kn);
+                return -ENOENT;
+        }
+
+        seq_printf(s, "%s\n", rdtgroup_mode_str(rdtgrp->mode));
+
+        rdtgroup_kn_unlock(of->kn);
+        return 0;
+}
+
+/**
+ * rdtgroup_cbm_overlaps - Does CBM for intended closid overlap with other
+ * @r: Resource to which domain instance @d belongs.
+ * @d: The domain instance for which @closid is being tested.
+ * @cbm: Capacity bitmask being tested.
+ * @closid: Intended closid for @cbm.
+ * @exclusive: Only check if overlaps with exclusive resource groups
+ *
+ * Checks if provided @cbm intended to be used for @closid on domain
+ * @d overlaps with any other closids or other hardware usage associated
+ * with this domain. If @exclusive is true then only overlaps with
+ * resource groups in exclusive mode will be considered. If @exclusive
+ * is false then overlaps with any resource group or hardware entities
+ * will be considered.
+ *
+ * Return: false if CBM does not overlap, true if it does.
+ */
+bool rdtgroup_cbm_overlaps(struct rdt_resource *r, struct rdt_domain *d,
+                           u32 _cbm, int closid, bool exclusive)
+{
+        unsigned long *cbm = (unsigned long *)&_cbm;
+        unsigned long *ctrl_b;
+        enum rdtgrp_mode mode;
+        u32 *ctrl;
+        int i;
+
+        /* Check for any overlap with regions used by hardware directly */
+        if (!exclusive) {
+                if (bitmap_intersects(cbm,
+                                      (unsigned long *)&r->cache.shareable_bits,
+                                      r->cache.cbm_len))
+                        return true;
+        }
+
+        /* Check for overlap with other resource groups */
+        ctrl = d->ctrl_val;
+        for (i = 0; i < r->num_closid; i++, ctrl++) {
+                ctrl_b = (unsigned long *)ctrl;
+                mode = rdtgroup_mode_by_closid(i);
+                if (closid_allocated(i) && i != closid &&
+                    mode != RDT_MODE_PSEUDO_LOCKSETUP) {
+                        if (bitmap_intersects(cbm, ctrl_b, r->cache.cbm_len)) {
+                                if (exclusive) {
+                                        if (mode == RDT_MODE_EXCLUSIVE)
+                                                return true;
+                                        continue;
+                                }
+                                return true;
+                        }
+                }
+        }
+
+        return false;
+}
+
+/**
+ * rdtgroup_mode_test_exclusive - Test if this resource group can be exclusive
+ *
+ * An exclusive resource group implies that there should be no sharing of
+ * its allocated resources. At the time this group is considered to be
+ * exclusive this test can determine if its current schemata supports this
+ * setting by testing for overlap with all other resource groups.
+ *
+ * Return: true if resource group can be exclusive, false if there is overlap
+ * with allocations of other resource groups and thus this resource group
+ * cannot be exclusive.
+ */
+static bool rdtgroup_mode_test_exclusive(struct rdtgroup *rdtgrp)
+{
+        int closid = rdtgrp->closid;
+        struct rdt_resource *r;
+        struct rdt_domain *d;
+
+        for_each_alloc_enabled_rdt_resource(r) {
+                list_for_each_entry(d, &r->domains, list) {
+                        if (rdtgroup_cbm_overlaps(r, d, d->ctrl_val[closid],
+                                                  rdtgrp->closid, false))
+                                return false;
+                }
+        }
+
+        return true;
+}
+
+/**
+ * rdtgroup_mode_write - Modify the resource group's mode
+ *
+ */
+static ssize_t rdtgroup_mode_write(struct kernfs_open_file *of,
+                                   char *buf, size_t nbytes, loff_t off)
+{
+        struct rdtgroup *rdtgrp;
+        enum rdtgrp_mode mode;
+        int ret = 0;
+
+        /* Valid input requires a trailing newline */
+        if (nbytes == 0 || buf[nbytes - 1] != '\n')
+                return -EINVAL;
+        buf[nbytes - 1] = '\0';
+
+        rdtgrp = rdtgroup_kn_lock_live(of->kn);
+        if (!rdtgrp) {
+                rdtgroup_kn_unlock(of->kn);
+                return -ENOENT;
+        }
+
+        rdt_last_cmd_clear();
+
+        mode = rdtgrp->mode;
+
+        if ((!strcmp(buf, "shareable") && mode == RDT_MODE_SHAREABLE) ||
+            (!strcmp(buf, "exclusive") && mode == RDT_MODE_EXCLUSIVE) ||
+            (!strcmp(buf, "pseudo-locksetup") &&
+             mode == RDT_MODE_PSEUDO_LOCKSETUP) ||
+            (!strcmp(buf, "pseudo-locked") && mode == RDT_MODE_PSEUDO_LOCKED))
+                goto out;
+
+        if (mode == RDT_MODE_PSEUDO_LOCKED) {
+                rdt_last_cmd_printf("cannot change pseudo-locked group\n");
+                ret = -EINVAL;
+                goto out;
+        }
+
+        if (!strcmp(buf, "shareable")) {
+                if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) {
+                        ret = rdtgroup_locksetup_exit(rdtgrp);
+                        if (ret)
+                                goto out;
+                }
+                rdtgrp->mode = RDT_MODE_SHAREABLE;
+        } else if (!strcmp(buf, "exclusive")) {
+                if (!rdtgroup_mode_test_exclusive(rdtgrp)) {
+                        rdt_last_cmd_printf("schemata overlaps\n");
+                        ret = -EINVAL;
+                        goto out;
+                }
+                if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) {
+                        ret = rdtgroup_locksetup_exit(rdtgrp);
+                        if (ret)
+                                goto out;
+                }
+                rdtgrp->mode = RDT_MODE_EXCLUSIVE;
+        } else if (!strcmp(buf, "pseudo-locksetup")) {
+                ret = rdtgroup_locksetup_enter(rdtgrp);
+                if (ret)
+                        goto out;
+                rdtgrp->mode = RDT_MODE_PSEUDO_LOCKSETUP;
+        } else {
+                rdt_last_cmd_printf("unknown/unsupported mode\n");
+                ret = -EINVAL;
+        }
+
+out:
+        rdtgroup_kn_unlock(of->kn);
+        return ret ?: nbytes;
+}
+
+/**
+ * rdtgroup_cbm_to_size - Translate CBM to size in bytes
+ * @r: RDT resource to which @d belongs.
+ * @d: RDT domain instance.
+ * @cbm: bitmask for which the size should be computed.
+ *
+ * The bitmask provided associated with the RDT domain instance @d will be
+ * translated into how many bytes it represents. The size in bytes is
+ * computed by first dividing the total cache size by the CBM length to
+ * determine how many bytes each bit in the bitmask represents. The result
+ * is multiplied with the number of bits set in the bitmask.
+ */
+unsigned int rdtgroup_cbm_to_size(struct rdt_resource *r,
+                                  struct rdt_domain *d, u32 cbm)
+{
+        struct cpu_cacheinfo *ci;
+        unsigned int size = 0;
+        int num_b, i;
+
+        num_b = bitmap_weight((unsigned long *)&cbm, r->cache.cbm_len);
+        ci = get_cpu_cacheinfo(cpumask_any(&d->cpu_mask));
+        for (i = 0; i < ci->num_leaves; i++) {
+                if (ci->info_list[i].level == r->cache_level) {
+                        size = ci->info_list[i].size / r->cache.cbm_len * num_b;
+                        break;
+                }
+        }
+
+        return size;
+}
+
+/**
+ * rdtgroup_size_show - Display size in bytes of allocated regions
+ *
+ * The "size" file mirrors the layout of the "schemata" file, printing the
+ * size in bytes of each region instead of the capacity bitmask.
+ *
+ */
+static int rdtgroup_size_show(struct kernfs_open_file *of,
+                              struct seq_file *s, void *v)
+{
+        struct rdtgroup *rdtgrp;
+        struct rdt_resource *r;
+        struct rdt_domain *d;
+        unsigned int size;
+        bool sep = false;
+        u32 cbm;
+
+        rdtgrp = rdtgroup_kn_lock_live(of->kn);
+        if (!rdtgrp) {
+                rdtgroup_kn_unlock(of->kn);
+                return -ENOENT;
+        }
+
+        if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED) {
+                seq_printf(s, "%*s:", max_name_width, rdtgrp->plr->r->name);
+                size = rdtgroup_cbm_to_size(rdtgrp->plr->r,
+                                            rdtgrp->plr->d,
+                                            rdtgrp->plr->cbm);
+                seq_printf(s, "%d=%u\n", rdtgrp->plr->d->id, size);
+                goto out;
+        }
+
+        for_each_alloc_enabled_rdt_resource(r) {
+                seq_printf(s, "%*s:", max_name_width, r->name);
+                list_for_each_entry(d, &r->domains, list) {
+                        if (sep)
+                                seq_putc(s, ';');
+                        if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) {
+                                size = 0;
+                        } else {
+                                cbm = d->ctrl_val[rdtgrp->closid];
+                                size = rdtgroup_cbm_to_size(r, d, cbm);
+                        }
+                        seq_printf(s, "%d=%u", d->id, size);
+                        sep = true;
+                }
+                seq_putc(s, '\n');
+        }
+
+out:
+        rdtgroup_kn_unlock(of->kn);
+
+        return 0;
+}
+
 /* rdtgroup information files for one cache resource. */
 static struct rftype res_common_files[] = {
         {
@@ -792,6 +1247,13 @@ static struct rftype res_common_files[] = {
                 .fflags         = RF_CTRL_INFO | RFTYPE_RES_CACHE,
         },
         {
+                .name           = "bit_usage",
+                .mode           = 0444,
+                .kf_ops         = &rdtgroup_kf_single_ops,
+                .seq_show       = rdt_bit_usage_show,
+                .fflags         = RF_CTRL_INFO | RFTYPE_RES_CACHE,
+        },
+        {
                 .name           = "min_bandwidth",
                 .mode           = 0444,
                 .kf_ops         = &rdtgroup_kf_single_ops,
@@ -853,6 +1315,22 @@ static struct rftype res_common_files[] = {
                 .seq_show       = rdtgroup_schemata_show,
                 .fflags         = RF_CTRL_BASE,
         },
+        {
+                .name           = "mode",
+                .mode           = 0644,
+                .kf_ops         = &rdtgroup_kf_single_ops,
+                .write          = rdtgroup_mode_write,
+                .seq_show       = rdtgroup_mode_show,
+                .fflags         = RF_CTRL_BASE,
+        },
+        {
+                .name           = "size",
+                .mode           = 0444,
+                .kf_ops         = &rdtgroup_kf_single_ops,
+                .seq_show       = rdtgroup_size_show,
+                .fflags         = RF_CTRL_BASE,
+        },
+
 };
 
 static int rdtgroup_add_files(struct kernfs_node *kn, unsigned long fflags)
@@ -883,6 +1361,103 @@ error:
         return ret;
 }
 
+/**
+ * rdtgroup_kn_mode_restrict - Restrict user access to named resctrl file
+ * @r: The resource group with which the file is associated.
+ * @name: Name of the file
+ *
+ * The permissions of named resctrl file, directory, or link are modified
+ * to not allow read, write, or execute by any user.
+ *
+ * WARNING: This function is intended to communicate to the user that the
+ * resctrl file has been locked down - that it is not relevant to the
+ * particular state the system finds itself in. It should not be relied
+ * on to protect from user access because after the file's permissions
+ * are restricted the user can still change the permissions using chmod
+ * from the command line.
+ *
+ * Return: 0 on success, <0 on failure.
+ */
+int rdtgroup_kn_mode_restrict(struct rdtgroup *r, const char *name)
+{
+        struct iattr iattr = {.ia_valid = ATTR_MODE,};
+        struct kernfs_node *kn;
+        int ret = 0;
+
+        kn = kernfs_find_and_get_ns(r->kn, name, NULL);
+        if (!kn)
+                return -ENOENT;
+
+        switch (kernfs_type(kn)) {
+        case KERNFS_DIR:
+                iattr.ia_mode = S_IFDIR;
+                break;
+        case KERNFS_FILE:
+                iattr.ia_mode = S_IFREG;
+                break;
+        case KERNFS_LINK:
+                iattr.ia_mode = S_IFLNK;
+                break;
+        }
+
+        ret = kernfs_setattr(kn, &iattr);
+        kernfs_put(kn);
+        return ret;
+}
+
+/**
+ * rdtgroup_kn_mode_restore - Restore user access to named resctrl file
+ * @r: The resource group with which the file is associated.
+ * @name: Name of the file
+ * @mask: Mask of permissions that should be restored
+ *
+ * Restore the permissions of the named file. If @name is a directory the
+ * permissions of its parent will be used.
+ *
+ * Return: 0 on success, <0 on failure.
+ */
+int rdtgroup_kn_mode_restore(struct rdtgroup *r, const char *name,
+                             umode_t mask)
+{
+        struct iattr iattr = {.ia_valid = ATTR_MODE,};
+        struct kernfs_node *kn, *parent;
+        struct rftype *rfts, *rft;
+        int ret, len;
+
+        rfts = res_common_files;
+        len = ARRAY_SIZE(res_common_files);
+
+        for (rft = rfts; rft < rfts + len; rft++) {
+                if (!strcmp(rft->name, name))
+                        iattr.ia_mode = rft->mode & mask;
+        }
+
+        kn = kernfs_find_and_get_ns(r->kn, name, NULL);
+        if (!kn)
+                return -ENOENT;
+
+        switch (kernfs_type(kn)) {
+        case KERNFS_DIR:
+                parent = kernfs_get_parent(kn);
+                if (parent) {
+                        iattr.ia_mode |= parent->mode;
+                        kernfs_put(parent);
+                }
+                iattr.ia_mode |= S_IFDIR;
+                break;
+        case KERNFS_FILE:
+                iattr.ia_mode |= S_IFREG;
+                break;
+        case KERNFS_LINK:
+                iattr.ia_mode |= S_IFLNK;
+                break;
+        }
+
+        ret = kernfs_setattr(kn, &iattr);
+        kernfs_put(kn);
+        return ret;
+}
+
 static int rdtgroup_mkdir_info_resdir(struct rdt_resource *r, char *name,
                                       unsigned long fflags)
 {
@@ -1224,6 +1799,9 @@ void rdtgroup_kn_unlock(struct kernfs_node *kn)
 
         if (atomic_dec_and_test(&rdtgrp->waitcount) &&
             (rdtgrp->flags & RDT_DELETED)) {
+                if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP ||
+                    rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED)
+                        rdtgroup_pseudo_lock_remove(rdtgrp);
                 kernfs_unbreak_active_protection(kn);
                 kernfs_put(rdtgrp->kn);
                 kfree(rdtgrp);
@@ -1289,10 +1867,16 @@ static struct dentry *rdt_mount(struct file_system_type *fs_type,
                 rdtgroup_default.mon.mon_data_kn = kn_mondata;
         }
 
+        ret = rdt_pseudo_lock_init();
+        if (ret) {
+                dentry = ERR_PTR(ret);
+                goto out_mondata;
+        }
+
         dentry = kernfs_mount(fs_type, flags, rdt_root,
                               RDTGROUP_SUPER_MAGIC, NULL);
         if (IS_ERR(dentry))
-                goto out_mondata;
+                goto out_psl;
 
         if (rdt_alloc_capable)
                 static_branch_enable_cpuslocked(&rdt_alloc_enable_key);
@@ -1310,6 +1894,8 @@ static struct dentry *rdt_mount(struct file_system_type *fs_type,
 
         goto out;
 
+out_psl:
+        rdt_pseudo_lock_release();
 out_mondata:
         if (rdt_mon_capable)
                 kernfs_remove(kn_mondata);
@@ -1447,6 +2033,10 @@ static void rmdir_all_sub(void)
                 if (rdtgrp == &rdtgroup_default)
                         continue;
 
+                if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP ||
+                    rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED)
+                        rdtgroup_pseudo_lock_remove(rdtgrp);
+
                 /*
                  * Give any CPUs back to the default group. We cannot copy
                  * cpu_online_mask because a CPU might have executed the
@@ -1483,6 +2073,8 @@ static void rdt_kill_sb(struct super_block *sb)
                 reset_all_ctrls(r);
         cdp_disable_all();
         rmdir_all_sub();
+        rdt_pseudo_lock_release();
+        rdtgroup_default.mode = RDT_MODE_SHAREABLE;
         static_branch_disable_cpuslocked(&rdt_alloc_enable_key);
         static_branch_disable_cpuslocked(&rdt_mon_enable_key);
         static_branch_disable_cpuslocked(&rdt_enable_key);
@@ -1682,6 +2274,114 @@ out_destroy:
         return ret;
 }
 
+/**
+ * cbm_ensure_valid - Enforce validity on provided CBM
+ * @_val:       Candidate CBM
+ * @r:          RDT resource to which the CBM belongs
+ *
+ * The provided CBM represents all cache portions available for use. This
+ * may be represented by a bitmap that does not consist of contiguous ones
+ * and thus be an invalid CBM.
+ * Here the provided CBM is forced to be a valid CBM by only considering
+ * the first set of contiguous bits as valid and clearing all bits.
+ * The intention here is to provide a valid default CBM with which a new
+ * resource group is initialized. The user can follow this with a
+ * modification to the CBM if the default does not satisfy the
+ * requirements.
+ */
+static void cbm_ensure_valid(u32 *_val, struct rdt_resource *r)
+{
+        /*
+         * Convert the u32 _val to an unsigned long required by all the bit
+         * operations within this function. No more than 32 bits of this
+         * converted value can be accessed because all bit operations are
+         * additionally provided with cbm_len that is initialized during
+         * hardware enumeration using five bits from the EAX register and
+         * thus never can exceed 32 bits.
+         */
+        unsigned long *val = (unsigned long *)_val;
+        unsigned int cbm_len = r->cache.cbm_len;
+        unsigned long first_bit, zero_bit;
+
+        if (*val == 0)
+                return;
+
+        first_bit = find_first_bit(val, cbm_len);
+        zero_bit = find_next_zero_bit(val, cbm_len, first_bit);
+
+        /* Clear any remaining bits to ensure contiguous region */
+        bitmap_clear(val, zero_bit, cbm_len - zero_bit);
+}
+
+/**
+ * rdtgroup_init_alloc - Initialize the new RDT group's allocations
+ *
+ * A new RDT group is being created on an allocation capable (CAT)
+ * supporting system. Set this group up to start off with all usable
+ * allocations. That is, all shareable and unused bits.
+ *
+ * All-zero CBM is invalid. If there are no more shareable bits available
+ * on any domain then the entire allocation will fail.
+ */
+static int rdtgroup_init_alloc(struct rdtgroup *rdtgrp)
+{
+        u32 used_b = 0, unused_b = 0;
+        u32 closid = rdtgrp->closid;
+        struct rdt_resource *r;
+        enum rdtgrp_mode mode;
+        struct rdt_domain *d;
+        int i, ret;
+        u32 *ctrl;
+
+        for_each_alloc_enabled_rdt_resource(r) {
+                list_for_each_entry(d, &r->domains, list) {
+                        d->have_new_ctrl = false;
+                        d->new_ctrl = r->cache.shareable_bits;
+                        used_b = r->cache.shareable_bits;
+                        ctrl = d->ctrl_val;
+                        for (i = 0; i < r->num_closid; i++, ctrl++) {
+                                if (closid_allocated(i) && i != closid) {
+                                        mode = rdtgroup_mode_by_closid(i);
+                                        if (mode == RDT_MODE_PSEUDO_LOCKSETUP)
+                                                break;
+                                        used_b |= *ctrl;
+                                        if (mode == RDT_MODE_SHAREABLE)
+                                                d->new_ctrl |= *ctrl;
+                                }
+                        }
+                        if (d->plr && d->plr->cbm > 0)
+                                used_b |= d->plr->cbm;
+                        unused_b = used_b ^ (BIT_MASK(r->cache.cbm_len) - 1);
+                        unused_b &= BIT_MASK(r->cache.cbm_len) - 1;
+                        d->new_ctrl |= unused_b;
+                        /*
+                         * Force the initial CBM to be valid, user can
+                         * modify the CBM based on system availability.
+                         */
+                        cbm_ensure_valid(&d->new_ctrl, r);
+                        if (bitmap_weight((unsigned long *) &d->new_ctrl,
+                                          r->cache.cbm_len) <
+                                        r->cache.min_cbm_bits) {
+                                rdt_last_cmd_printf("no space on %s:%d\n",
+                                                    r->name, d->id);
+                                return -ENOSPC;
+                        }
+                        d->have_new_ctrl = true;
+                }
+        }
+
+        for_each_alloc_enabled_rdt_resource(r) {
+                ret = update_domains(r, rdtgrp->closid);
+                if (ret < 0) {
+                        rdt_last_cmd_puts("failed to initialize allocations\n");
+                        return ret;
+                }
+                rdtgrp->mode = RDT_MODE_SHAREABLE;
+        }
+
+        return 0;
+}
+
 static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,
                              struct kernfs_node *prgrp_kn,
                              const char *name, umode_t mode,
@@ -1700,6 +2400,14 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,
                 goto out_unlock;
         }
 
+        if (rtype == RDTMON_GROUP &&
+            (prdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP ||
+             prdtgrp->mode == RDT_MODE_PSEUDO_LOCKED)) {
+                ret = -EINVAL;
+                rdt_last_cmd_puts("pseudo-locking in progress\n");
+                goto out_unlock;
+        }
+
         /* allocate the rdtgroup. */
         rdtgrp = kzalloc(sizeof(*rdtgrp), GFP_KERNEL);
         if (!rdtgrp) {
@@ -1840,6 +2548,10 @@ static int rdtgroup_mkdir_ctrl_mon(struct kernfs_node *parent_kn,
         ret = 0;
 
         rdtgrp->closid = closid;
+        ret = rdtgroup_init_alloc(rdtgrp);
+        if (ret < 0)
+                goto out_id_free;
+
         list_add(&rdtgrp->rdtgroup_list, &rdt_all_groups);
 
         if (rdt_mon_capable) {
@@ -1850,15 +2562,16 @@ static int rdtgroup_mkdir_ctrl_mon(struct kernfs_node *parent_kn,
                 ret = mongroup_create_dir(kn, NULL, "mon_groups", NULL);
                 if (ret) {
                         rdt_last_cmd_puts("kernfs subdir error\n");
-                        goto out_id_free;
+                        goto out_del_list;
                 }
         }
 
         goto out_unlock;
 
+out_del_list:
+        list_del(&rdtgrp->rdtgroup_list);
 out_id_free:
         closid_free(closid);
-        list_del(&rdtgrp->rdtgroup_list);
 out_common_fail:
         mkdir_rdt_prepare_clean(rdtgrp);
 out_unlock:
@@ -1945,6 +2658,21 @@ static int rdtgroup_rmdir_mon(struct kernfs_node *kn, struct rdtgroup *rdtgrp,
         return 0;
 }
 
+static int rdtgroup_ctrl_remove(struct kernfs_node *kn,
+                                struct rdtgroup *rdtgrp)
+{
+        rdtgrp->flags = RDT_DELETED;
+        list_del(&rdtgrp->rdtgroup_list);
+
+        /*
+         * one extra hold on this, will drop when we kfree(rdtgrp)
+         * in rdtgroup_kn_unlock()
+         */
+        kernfs_get(kn);
+        kernfs_remove(rdtgrp->kn);
+        return 0;
+}
+
 static int rdtgroup_rmdir_ctrl(struct kernfs_node *kn, struct rdtgroup *rdtgrp,
                                cpumask_var_t tmpmask)
 {
@@ -1970,7 +2698,6 @@ static int rdtgroup_rmdir_ctrl(struct kernfs_node *kn, struct rdtgroup *rdtgrp,
         cpumask_or(tmpmask, tmpmask, &rdtgrp->cpu_mask);
         update_closid_rmid(tmpmask, NULL);
 
-        rdtgrp->flags = RDT_DELETED;
         closid_free(rdtgrp->closid);
         free_rmid(rdtgrp->mon.rmid);
 
@@ -1979,14 +2706,7 @@ static int rdtgroup_rmdir_ctrl(struct kernfs_node *kn, struct rdtgroup *rdtgrp,
          */
         free_all_child_rdtgrp(rdtgrp);
 
-        list_del(&rdtgrp->rdtgroup_list);
-
-        /*
-         * one extra hold on this, will drop when we kfree(rdtgrp)
-         * in rdtgroup_kn_unlock()
-         */
-        kernfs_get(kn);
-        kernfs_remove(rdtgrp->kn);
+        rdtgroup_ctrl_remove(kn, rdtgrp);
 
         return 0;
 }
@@ -2014,13 +2734,19 @@ static int rdtgroup_rmdir(struct kernfs_node *kn)
          * If the rdtgroup is a mon group and parent directory
          * is a valid "mon_groups" directory, remove the mon group.
          */
-        if (rdtgrp->type == RDTCTRL_GROUP && parent_kn == rdtgroup_default.kn)
-                ret = rdtgroup_rmdir_ctrl(kn, rdtgrp, tmpmask);
-        else if (rdtgrp->type == RDTMON_GROUP &&
-                 is_mon_groups(parent_kn, kn->name))
+        if (rdtgrp->type == RDTCTRL_GROUP && parent_kn == rdtgroup_default.kn) {
+                if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP ||
+                    rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED) {
+                        ret = rdtgroup_ctrl_remove(kn, rdtgrp);
+                } else {
+                        ret = rdtgroup_rmdir_ctrl(kn, rdtgrp, tmpmask);
+                }
+        } else if (rdtgrp->type == RDTMON_GROUP &&
+                 is_mon_groups(parent_kn, kn->name)) {
                 ret = rdtgroup_rmdir_mon(kn, rdtgrp, tmpmask);
-        else
+        } else {
                 ret = -EPERM;
+        }
 
 out:
         rdtgroup_kn_unlock(kn);
@@ -2046,7 +2772,8 @@ static int __init rdtgroup_setup_root(void)
         int ret;
 
         rdt_root = kernfs_create_root(&rdtgroup_kf_syscall_ops,
-                                      KERNFS_ROOT_CREATE_DEACTIVATED,
+                                      KERNFS_ROOT_CREATE_DEACTIVATED |
+                                      KERNFS_ROOT_EXTRA_OPEN_PERM_CHECK,
                                       &rdtgroup_default);
         if (IS_ERR(rdt_root))
                 return PTR_ERR(rdt_root);
@@ -2102,6 +2829,29 @@ int __init rdtgroup_init(void)
         if (ret)
                 goto cleanup_mountpoint;
 
+        /*
+         * Adding the resctrl debugfs directory here may not be ideal since
+         * it would let the resctrl debugfs directory appear on the debugfs
+         * filesystem before the resctrl filesystem is mounted.
+         * It may also be ok since that would enable debugging of RDT before
+         * resctrl is mounted.
+         * The reason why the debugfs directory is created here and not in
+         * rdt_mount() is because rdt_mount() takes rdtgroup_mutex and
+         * during the debugfs directory creation also &sb->s_type->i_mutex_key
+         * (the lockdep class of inode->i_rwsem). Other filesystem
+         * interactions (eg. SyS_getdents) have the lock ordering:
+         * &sb->s_type->i_mutex_key --> &mm->mmap_sem
+         * During mmap(), called with &mm->mmap_sem, the rdtgroup_mutex
+         * is taken, thus creating dependency:
+         * &mm->mmap_sem --> rdtgroup_mutex for the latter that can cause
+         * issues considering the other two lock dependencies.
+         * By creating the debugfs directory here we avoid a dependency
+         * that may cause deadlock (even though file operations cannot
+         * occur until the filesystem is mounted, but I do not know how to
+         * tell lockdep that).
+         */
+        debugfs_resctrl = debugfs_create_dir("resctrl", NULL);
+
         return 0;
 
 cleanup_mountpoint:
@@ -2111,3 +2861,11 @@ cleanup_root:
 
         return ret;
 }
+
+void __exit rdtgroup_exit(void)
+{
+        debugfs_remove_recursive(debugfs_resctrl);
+        unregister_filesystem(&rdt_fs_type);
+        sysfs_remove_mount_point(fs_kobj, "resctrl");
+        kernfs_destroy_root(rdt_root);
+}
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 8c50754c09c1..4b767284b7f5 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -123,8 +123,8 @@ void mce_setup(struct mce *m)
 {
         memset(m, 0, sizeof(struct mce));
         m->cpu = m->extcpu = smp_processor_id();
-        /* We hope get_seconds stays lockless */
-        m->time = get_seconds();
+        /* need the internal __ version to avoid deadlocks */
+        m->time = __ktime_get_real_seconds();
         m->cpuvendor = boot_cpu_data.x86_vendor;
         m->cpuid = cpuid_eax(1);
         m->socketid = cpu_data(m->extcpu).phys_proc_id;
@@ -1104,6 +1104,101 @@ static void mce_unmap_kpfn(unsigned long pfn)
 }
 #endif
 
+
+/*
+ * Cases where we avoid rendezvous handler timeout:
+ * 1) If this CPU is offline.
+ *
+ * 2) If crashing_cpu was set, e.g. we're entering kdump and we need to
+ *  skip those CPUs which remain looping in the 1st kernel - see
+ *  crash_nmi_callback().
+ *
+ * Note: there still is a small window between kexec-ing and the new,
+ * kdump kernel establishing a new #MC handler where a broadcasted MCE
+ * might not get handled properly.
+ */
+static bool __mc_check_crashing_cpu(int cpu)
+{
+        if (cpu_is_offline(cpu) ||
+            (crashing_cpu != -1 && crashing_cpu != cpu)) {
+                u64 mcgstatus;
+
+                mcgstatus = mce_rdmsrl(MSR_IA32_MCG_STATUS);
+                if (mcgstatus & MCG_STATUS_RIPV) {
+                        mce_wrmsrl(MSR_IA32_MCG_STATUS, 0);
+                        return true;
+                }
+        }
+        return false;
+}
+
+static void __mc_scan_banks(struct mce *m, struct mce *final,
+                            unsigned long *toclear, unsigned long *valid_banks,
+                            int no_way_out, int *worst)
+{
+        struct mca_config *cfg = &mca_cfg;
+        int severity, i;
+
+        for (i = 0; i < cfg->banks; i++) {
+                __clear_bit(i, toclear);
+                if (!test_bit(i, valid_banks))
+                        continue;
+
+                if (!mce_banks[i].ctl)
+                        continue;
+
+                m->misc = 0;
+                m->addr = 0;
+                m->bank = i;
+
+                m->status = mce_rdmsrl(msr_ops.status(i));
+                if (!(m->status & MCI_STATUS_VAL))
+                        continue;
+
+                /*
+                 * Corrected or non-signaled errors are handled by
+                 * machine_check_poll(). Leave them alone, unless this panics.
+                 */
+                if (!(m->status & (cfg->ser ? MCI_STATUS_S : MCI_STATUS_UC)) &&
+                        !no_way_out)
+                        continue;
+
+                /* Set taint even when machine check was not enabled. */
+                add_taint(TAINT_MACHINE_CHECK, LOCKDEP_NOW_UNRELIABLE);
+
+                severity = mce_severity(m, cfg->tolerant, NULL, true);
+
+                /*
+                 * When machine check was for corrected/deferred handler don't
+                 * touch, unless we're panicking.
+                 */
+                if ((severity == MCE_KEEP_SEVERITY ||
+                     severity == MCE_UCNA_SEVERITY) && !no_way_out)
+                        continue;
+
+                __set_bit(i, toclear);
+
+                /* Machine check event was not enabled. Clear, but ignore. */
+                if (severity == MCE_NO_SEVERITY)
+                        continue;
+
+                mce_read_aux(m, i);
+
+                /* assuming valid severity level != 0 */
+                m->severity = severity;
+
+                mce_log(m);
+
+                if (severity > *worst) {
+                        *final = *m;
+                        *worst = severity;
+                }
+        }
+
+        /* mce_clear_state will clear *final, save locally for use later */
+        *m = *final;
+}
+
 /*
  * The actual machine check handler. This only handles real
  * exceptions when something got corrupted coming in through int 18.
@@ -1118,68 +1213,45 @@ static void mce_unmap_kpfn(unsigned long pfn)
  */
 void do_machine_check(struct pt_regs *regs, long error_code)
 {
+        DECLARE_BITMAP(valid_banks, MAX_NR_BANKS);
+        DECLARE_BITMAP(toclear, MAX_NR_BANKS);
         struct mca_config *cfg = &mca_cfg;
+        int cpu = smp_processor_id();
+        char *msg = "Unknown";
         struct mce m, *final;
-        int i;
         int worst = 0;
-        int severity;
 
         /*
          * Establish sequential order between the CPUs entering the machine
          * check handler.
          */
         int order = -1;
+
         /*
          * If no_way_out gets set, there is no safe way to recover from this
          * MCE.  If mca_cfg.tolerant is cranked up, we'll try anyway.
          */
         int no_way_out = 0;
+
         /*
          * If kill_it gets set, there might be a way to recover from this
          * error.
          */
         int kill_it = 0;
-        DECLARE_BITMAP(toclear, MAX_NR_BANKS);
-        DECLARE_BITMAP(valid_banks, MAX_NR_BANKS);
-        char *msg = "Unknown";
 
         /*
          * MCEs are always local on AMD. Same is determined by MCG_STATUS_LMCES
          * on Intel.
          */
         int lmce = 1;
-        int cpu = smp_processor_id();
 
-        /*
-         * Cases where we avoid rendezvous handler timeout:
-         * 1) If this CPU is offline.
-         *
-         * 2) If crashing_cpu was set, e.g. we're entering kdump and we need to
-         *  skip those CPUs which remain looping in the 1st kernel - see
-         *  crash_nmi_callback().
-         *
-         * Note: there still is a small window between kexec-ing and the new,
-         * kdump kernel establishing a new #MC handler where a broadcasted MCE
-         * might not get handled properly.
-         */
-        if (cpu_is_offline(cpu) ||
-            (crashing_cpu != -1 && crashing_cpu != cpu)) {
-                u64 mcgstatus;
-
-                mcgstatus = mce_rdmsrl(MSR_IA32_MCG_STATUS);
-                if (mcgstatus & MCG_STATUS_RIPV) {
-                        mce_wrmsrl(MSR_IA32_MCG_STATUS, 0);
-                        return;
-                }
-        }
+        if (__mc_check_crashing_cpu(cpu))
+                return;
 
         ist_enter(regs);
 
         this_cpu_inc(mce_exception_count);
 
-        if (!cfg->banks)
-                goto out;
-
         mce_gather_info(&m, regs);
         m.tsc = rdtsc();
 
@@ -1220,67 +1292,7 @@ void do_machine_check(struct pt_regs *regs, long error_code)
                 order = mce_start(&no_way_out);
         }
 
-        for (i = 0; i < cfg->banks; i++) {
-                __clear_bit(i, toclear);
-                if (!test_bit(i, valid_banks))
-                        continue;
-                if (!mce_banks[i].ctl)
-                        continue;
-
-                m.misc = 0;
-                m.addr = 0;
-                m.bank = i;
-
-                m.status = mce_rdmsrl(msr_ops.status(i));
-                if ((m.status & MCI_STATUS_VAL) == 0)
-                        continue;
-
-                /*
-                 * Non uncorrected or non signaled errors are handled by
-                 * machine_check_poll. Leave them alone, unless this panics.
-                 */
-                if (!(m.status & (cfg->ser ? MCI_STATUS_S : MCI_STATUS_UC)) &&
-                        !no_way_out)
-                        continue;
-
-                /*
-                 * Set taint even when machine check was not enabled.
-                 */
-                add_taint(TAINT_MACHINE_CHECK, LOCKDEP_NOW_UNRELIABLE);
-
-                severity = mce_severity(&m, cfg->tolerant, NULL, true);
-
-                /*
-                 * When machine check was for corrected/deferred handler don't
-                 * touch, unless we're panicing.
-                 */
-                if ((severity == MCE_KEEP_SEVERITY ||
-                     severity == MCE_UCNA_SEVERITY) && !no_way_out)
-                        continue;
-                __set_bit(i, toclear);
-                if (severity == MCE_NO_SEVERITY) {
-                        /*
-                         * Machine check event was not enabled. Clear, but
-                         * ignore.
-                         */
-                        continue;
-                }
-
-                mce_read_aux(&m, i);
-
-                /* assuming valid severity level != 0 */
-                m.severity = severity;
-
-                mce_log(&m);
-
-                if (severity > worst) {
-                        *final = m;
-                        worst = severity;
-                }
-        }
-
-        /* mce_clear_state will clear *final, save locally for use later */
-        m = *final;
+        __mc_scan_banks(&m, final, toclear, valid_banks, no_way_out, &worst);
 
         if (!no_way_out)
                 mce_clear_state(toclear);
@@ -1319,7 +1331,7 @@ void do_machine_check(struct pt_regs *regs, long error_code)
         if (worst > 0)
                 mce_report_event(regs);
         mce_wrmsrl(MSR_IA32_MCG_STATUS, 0);
-out:
+
         sync_core();
 
         if (worst != MCE_AR_SEVERITY && !kill_it)
diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
index 666a284116ac..9c8652974f8e 100644
--- a/arch/x86/kernel/dumpstack.c
+++ b/arch/x86/kernel/dumpstack.c
@@ -22,8 +22,6 @@
 #include <asm/stacktrace.h>
 #include <asm/unwind.h>
 
-#define OPCODE_BUFSIZE 64
-
 int panic_on_unrecovered_nmi;
 int panic_on_io_nmi;
 static int die_counter;
@@ -93,26 +91,18 @@ static void printk_stack_address(unsigned long address, int reliable,
  */
 void show_opcodes(u8 *rip, const char *loglvl)
 {
-        unsigned int code_prologue = OPCODE_BUFSIZE * 2 / 3;
+#define PROLOGUE_SIZE 42
+#define EPILOGUE_SIZE 21
+#define OPCODE_BUFSIZE (PROLOGUE_SIZE + 1 + EPILOGUE_SIZE)
         u8 opcodes[OPCODE_BUFSIZE];
-        u8 *ip;
-        int i;
-
-        printk("%sCode: ", loglvl);
-
-        ip = (u8 *)rip - code_prologue;
-        if (probe_kernel_read(opcodes, ip, OPCODE_BUFSIZE)) {
-                pr_cont("Bad RIP value.\n");
-                return;
-        }
 
-        for (i = 0; i < OPCODE_BUFSIZE; i++, ip++) {
-                if (ip == rip)
-                        pr_cont("<%02x> ", opcodes[i]);
-                else
-                        pr_cont("%02x ", opcodes[i]);
+        if (probe_kernel_read(opcodes, rip - PROLOGUE_SIZE, OPCODE_BUFSIZE)) {
+                printk("%sCode: Bad RIP value.\n", loglvl);
+        } else {
+                printk("%sCode: %" __stringify(PROLOGUE_SIZE) "ph <%02x> %"
+                       __stringify(EPILOGUE_SIZE) "ph\n", loglvl, opcodes,
+                       opcodes[PROLOGUE_SIZE], opcodes + PROLOGUE_SIZE + 1);
         }
-        pr_cont("\n");
 }
 
 void show_ip(struct pt_regs *regs, const char *loglvl)
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index abe6df15a8fb..30f9cb2c0b55 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -512,11 +512,18 @@ ENTRY(initial_code)
 ENTRY(setup_once_ref)
         .long setup_once
 
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+#define PGD_ALIGN       (2 * PAGE_SIZE)
+#define PTI_USER_PGD_FILL       1024
+#else
+#define PGD_ALIGN       (PAGE_SIZE)
+#define PTI_USER_PGD_FILL       0
+#endif
 /*
  * BSS section
  */
 __PAGE_ALIGNED_BSS
-        .align PAGE_SIZE
+        .align PGD_ALIGN
 #ifdef CONFIG_X86_PAE
 .globl initial_pg_pmd
 initial_pg_pmd:
@@ -526,14 +533,17 @@ initial_pg_pmd:
 initial_page_table:
         .fill 1024,4,0
 #endif
+        .align PGD_ALIGN
 initial_pg_fixmap:
         .fill 1024,4,0
-.globl empty_zero_page
-empty_zero_page:
-        .fill 4096,1,0
 .globl swapper_pg_dir
+        .align PGD_ALIGN
 swapper_pg_dir:
         .fill 1024,4,0
+        .fill PTI_USER_PGD_FILL,4,0
+.globl empty_zero_page
+empty_zero_page:
+        .fill 4096,1,0
 EXPORT_SYMBOL(empty_zero_page)
 
 /*
@@ -542,7 +552,7 @@ EXPORT_SYMBOL(empty_zero_page)
 #ifdef CONFIG_X86_PAE
 __PAGE_ALIGNED_DATA
         /* Page-aligned for the benefit of paravirt? */
-        .align PAGE_SIZE
+        .align PGD_ALIGN
 ENTRY(initial_page_table)
         .long   pa(initial_pg_pmd+PGD_IDENT_ATTR),0     /* low identity map */
 # if KPMDS == 3
diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
index 8344dd2f310a..15ebc2fc166e 100644
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -235,7 +235,7 @@ ENTRY(secondary_startup_64)
          *              address given in m16:64.
          */
         pushq   $.Lafter_lret   # put return address on stack for unwinder
-        xorq    %rbp, %rbp      # clear frame pointer
+        xorl    %ebp, %ebp      # clear frame pointer
         movq    initial_code(%rip), %rax
         pushq   $__KERNEL_CS    # set correct cs
         pushq   %rax            # target address in negative space
diff --git a/arch/x86/kernel/jump_label.c b/arch/x86/kernel/jump_label.c
index e56c95be2808..eeea935e9bb5 100644
--- a/arch/x86/kernel/jump_label.c
+++ b/arch/x86/kernel/jump_label.c
@@ -37,15 +37,18 @@ static void bug_at(unsigned char *ip, int line)
         BUG();
 }
 
-static void __jump_label_transform(struct jump_entry *entry,
-                                   enum jump_label_type type,
-                                   void *(*poker)(void *, const void *, size_t),
-                                   int init)
+static void __ref __jump_label_transform(struct jump_entry *entry,
+                                         enum jump_label_type type,
+                                         void *(*poker)(void *, const void *, size_t),
+                                         int init)
 {
         union jump_code_union code;
         const unsigned char default_nop[] = { STATIC_KEY_INIT_NOP };
         const unsigned char *ideal_nop = ideal_nops[NOP_ATOMIC5];
 
+        if (early_boot_irqs_disabled)
+                poker = text_poke_early;
+
         if (type == JUMP_LABEL_JMP) {
                 if (init) {
                         /*
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index 5b2300b818af..09aaabb2bbf1 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -45,7 +45,6 @@
 #include <asm/apic.h>
 #include <asm/apicdef.h>
 #include <asm/hypervisor.h>
-#include <asm/kvm_guest.h>
 
 static int kvmapf = 1;
 
@@ -66,15 +65,6 @@ static int __init parse_no_stealacc(char *arg)
 
 early_param("no-steal-acc", parse_no_stealacc);
 
-static int kvmclock_vsyscall = 1;
-static int __init parse_no_kvmclock_vsyscall(char *arg)
-{
-        kvmclock_vsyscall = 0;
-        return 0;
-}
-
-early_param("no-kvmclock-vsyscall", parse_no_kvmclock_vsyscall);
-
 static DEFINE_PER_CPU_DECRYPTED(struct kvm_vcpu_pv_apf_data, apf_reason) __aligned(64);
 static DEFINE_PER_CPU_DECRYPTED(struct kvm_steal_time, steal_time) __aligned(64);
 static int has_steal_clock = 0;
@@ -154,7 +144,7 @@ void kvm_async_pf_task_wait(u32 token, int interrupt_kernel)
 
         for (;;) {
                 if (!n.halted)
-                        prepare_to_swait(&n.wq, &wait, TASK_UNINTERRUPTIBLE);
+                        prepare_to_swait_exclusive(&n.wq, &wait, TASK_UNINTERRUPTIBLE);
                 if (hlist_unhashed(&n.link))
                         break;
 
@@ -188,7 +178,7 @@ static void apf_task_wake_one(struct kvm_task_sleep_node *n)
         if (n->halted)
                 smp_send_reschedule(n->cpu);
         else if (swq_has_sleeper(&n->wq))
-                swake_up(&n->wq);
+                swake_up_one(&n->wq);
 }
 
 static void apf_task_wake_all(void)
@@ -560,9 +550,6 @@ static void __init kvm_guest_init(void)
         if (kvm_para_has_feature(KVM_FEATURE_PV_EOI))
                 apic_set_eoi_write(kvm_guest_apic_eoi_write);
 
-        if (kvmclock_vsyscall)
-                kvm_setup_vsyscall_timeinfo();
-
 #ifdef CONFIG_SMP
         smp_ops.smp_prepare_cpus = kvm_smp_prepare_cpus;
         smp_ops.smp_prepare_boot_cpu = kvm_smp_prepare_boot_cpu;
@@ -628,6 +615,7 @@ const __initconst struct hypervisor_x86 x86_hyper_kvm = {
         .name                   = "KVM",
         .detect                 = kvm_detect,
         .type                   = X86_HYPER_KVM,
+        .init.init_platform     = kvmclock_init,
         .init.guest_late_init   = kvm_guest_init,
         .init.x2apic_available  = kvm_para_available,
 };
diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
index 3b8e7c13c614..d2edd7e6c294 100644
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c
@@ -23,30 +23,56 @@
 #include <asm/apic.h>
 #include <linux/percpu.h>
 #include <linux/hardirq.h>
-#include <linux/memblock.h>
+#include <linux/cpuhotplug.h>
 #include <linux/sched.h>
 #include <linux/sched/clock.h>
+#include <linux/mm.h>
 
+#include <asm/hypervisor.h>
 #include <asm/mem_encrypt.h>
 #include <asm/x86_init.h>
 #include <asm/reboot.h>
 #include <asm/kvmclock.h>
 
-static int kvmclock __ro_after_init = 1;
-static int msr_kvm_system_time = MSR_KVM_SYSTEM_TIME;
-static int msr_kvm_wall_clock = MSR_KVM_WALL_CLOCK;
-static u64 kvm_sched_clock_offset;
+static int kvmclock __initdata = 1;
+static int kvmclock_vsyscall __initdata = 1;
+static int msr_kvm_system_time __ro_after_init = MSR_KVM_SYSTEM_TIME;
+static int msr_kvm_wall_clock __ro_after_init = MSR_KVM_WALL_CLOCK;
+static u64 kvm_sched_clock_offset __ro_after_init;
 
-static int parse_no_kvmclock(char *arg)
+static int __init parse_no_kvmclock(char *arg)
 {
         kvmclock = 0;
         return 0;
 }
 early_param("no-kvmclock", parse_no_kvmclock);
 
-/* The hypervisor will put information about time periodically here */
-static struct pvclock_vsyscall_time_info *hv_clock;
-static struct pvclock_wall_clock *wall_clock;
+static int __init parse_no_kvmclock_vsyscall(char *arg)
+{
+        kvmclock_vsyscall = 0;
+        return 0;
+}
+early_param("no-kvmclock-vsyscall", parse_no_kvmclock_vsyscall);
+
+/* Aligned to page sizes to match whats mapped via vsyscalls to userspace */
+#define HV_CLOCK_SIZE   (sizeof(struct pvclock_vsyscall_time_info) * NR_CPUS)
+#define HVC_BOOT_ARRAY_SIZE \
+        (PAGE_SIZE / sizeof(struct pvclock_vsyscall_time_info))
+
+static struct pvclock_vsyscall_time_info
+                        hv_clock_boot[HVC_BOOT_ARRAY_SIZE] __aligned(PAGE_SIZE);
+static struct pvclock_wall_clock wall_clock;
+static DEFINE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu);
+
+static inline struct pvclock_vcpu_time_info *this_cpu_pvti(void)
+{
+        return &this_cpu_read(hv_clock_per_cpu)->pvti;
+}
+
+static inline struct pvclock_vsyscall_time_info *this_cpu_hvclock(void)
+{
+        return this_cpu_read(hv_clock_per_cpu);
+}
 
 /*
  * The wallclock is the time of day when we booted. Since then, some time may
@@ -55,21 +81,10 @@ static struct pvclock_wall_clock *wall_clock;
  */
 static void kvm_get_wallclock(struct timespec64 *now)
 {
-        struct pvclock_vcpu_time_info *vcpu_time;
-        int low, high;
-        int cpu;
-
-        low = (int)slow_virt_to_phys(wall_clock);
-        high = ((u64)slow_virt_to_phys(wall_clock) >> 32);
-
-        native_write_msr(msr_kvm_wall_clock, low, high);
-
-        cpu = get_cpu();
-
-        vcpu_time = &hv_clock[cpu].pvti;
-        pvclock_read_wallclock(wall_clock, vcpu_time, now);
-
-        put_cpu();
+        wrmsrl(msr_kvm_wall_clock, slow_virt_to_phys(&wall_clock));
+        preempt_disable();
+        pvclock_read_wallclock(&wall_clock, this_cpu_pvti(), now);
+        preempt_enable();
 }
 
 static int kvm_set_wallclock(const struct timespec64 *now)
@@ -79,14 +94,10 @@ static int kvm_set_wallclock(const struct timespec64 *now)
 
 static u64 kvm_clock_read(void)
 {
-        struct pvclock_vcpu_time_info *src;
         u64 ret;
-        int cpu;
 
         preempt_disable_notrace();
-        cpu = smp_processor_id();
-        src = &hv_clock[cpu].pvti;
-        ret = pvclock_clocksource_read(src);
+        ret = pvclock_clocksource_read(this_cpu_pvti());
         preempt_enable_notrace();
         return ret;
 }
@@ -112,11 +123,11 @@ static inline void kvm_sched_clock_init(bool stable)
         kvm_sched_clock_offset = kvm_clock_read();
         pv_time_ops.sched_clock = kvm_sched_clock_read;
 
-        printk(KERN_INFO "kvm-clock: using sched offset of %llu cycles\n",
-                        kvm_sched_clock_offset);
+        pr_info("kvm-clock: using sched offset of %llu cycles",
+                kvm_sched_clock_offset);
 
         BUILD_BUG_ON(sizeof(kvm_sched_clock_offset) >
-                 sizeof(((struct pvclock_vcpu_time_info *)NULL)->system_time));
+                sizeof(((struct pvclock_vcpu_time_info *)NULL)->system_time));
 }
 
 /*
@@ -130,19 +141,11 @@ static inline void kvm_sched_clock_init(bool stable)
  */
 static unsigned long kvm_get_tsc_khz(void)
 {
-        struct pvclock_vcpu_time_info *src;
-        int cpu;
-        unsigned long tsc_khz;
-
-        cpu = get_cpu();
-        src = &hv_clock[cpu].pvti;
-        tsc_khz = pvclock_tsc_khz(src);
-        put_cpu();
         setup_force_cpu_cap(X86_FEATURE_TSC_KNOWN_FREQ);
-        return tsc_khz;
+        return pvclock_tsc_khz(this_cpu_pvti());
 }
 
-static void kvm_get_preset_lpj(void)
+static void __init kvm_get_preset_lpj(void)
 {
         unsigned long khz;
         u64 lpj;
@@ -156,49 +159,40 @@ static void kvm_get_preset_lpj(void)
 
 bool kvm_check_and_clear_guest_paused(void)
 {
+        struct pvclock_vsyscall_time_info *src = this_cpu_hvclock();
         bool ret = false;
-        struct pvclock_vcpu_time_info *src;
-        int cpu = smp_processor_id();
 
-        if (!hv_clock)
+        if (!src)
                 return ret;
 
-        src = &hv_clock[cpu].pvti;
-        if ((src->flags & PVCLOCK_GUEST_STOPPED) != 0) {
-                src->flags &= ~PVCLOCK_GUEST_STOPPED;
+        if ((src->pvti.flags & PVCLOCK_GUEST_STOPPED) != 0) {
+                src->pvti.flags &= ~PVCLOCK_GUEST_STOPPED;
                 pvclock_touch_watchdogs();
                 ret = true;
         }
-
         return ret;
 }
 
 struct clocksource kvm_clock = {
-        .name = "kvm-clock",
-        .read = kvm_clock_get_cycles,
-        .rating = 400,
-        .mask = CLOCKSOURCE_MASK(64),
-        .flags = CLOCK_SOURCE_IS_CONTINUOUS,
+        .name   = "kvm-clock",
+        .read   = kvm_clock_get_cycles,
+        .rating = 400,
+        .mask   = CLOCKSOURCE_MASK(64),
+        .flags  = CLOCK_SOURCE_IS_CONTINUOUS,
 };
 EXPORT_SYMBOL_GPL(kvm_clock);
 
-int kvm_register_clock(char *txt)
+static void kvm_register_clock(char *txt)
 {
-        int cpu = smp_processor_id();
-        int low, high, ret;
-        struct pvclock_vcpu_time_info *src;
-
-        if (!hv_clock)
-                return 0;
+        struct pvclock_vsyscall_time_info *src = this_cpu_hvclock();
+        u64 pa;
 
-        src = &hv_clock[cpu].pvti;
-        low = (int)slow_virt_to_phys(src) | 1;
-        high = ((u64)slow_virt_to_phys(src) >> 32);
-        ret = native_write_msr_safe(msr_kvm_system_time, low, high);
-        printk(KERN_INFO "kvm-clock: cpu %d, msr %x:%x, %s\n",
-               cpu, high, low, txt);
+        if (!src)
+                return;
 
-        return ret;
+        pa = slow_virt_to_phys(&src->pvti) | 0x01ULL;
+        wrmsrl(msr_kvm_system_time, pa);
+        pr_info("kvm-clock: cpu %d, msr %llx, %s", smp_processor_id(), pa, txt);
 }
 
 static void kvm_save_sched_clock_state(void)
@@ -213,11 +207,7 @@ static void kvm_restore_sched_clock_state(void)
 #ifdef CONFIG_X86_LOCAL_APIC
 static void kvm_setup_secondary_clock(void)
 {
-        /*
-         * Now that the first cpu already had this clocksource initialized,
-         * we shouldn't fail.
-         */
-        WARN_ON(kvm_register_clock("secondary cpu clock"));
+        kvm_register_clock("secondary cpu clock");
 }
 #endif
 
@@ -245,100 +235,84 @@ static void kvm_shutdown(void)
         native_machine_shutdown();
 }
 
-static phys_addr_t __init kvm_memblock_alloc(phys_addr_t size,
-                                             phys_addr_t align)
+static int __init kvm_setup_vsyscall_timeinfo(void)
 {
-        phys_addr_t mem;
+#ifdef CONFIG_X86_64
+        u8 flags;
 
-        mem = memblock_alloc(size, align);
-        if (!mem)
+        if (!per_cpu(hv_clock_per_cpu, 0) || !kvmclock_vsyscall)
                 return 0;
 
-        if (sev_active()) {
-                if (early_set_memory_decrypted((unsigned long)__va(mem), size))
-                        goto e_free;
-        }
+        flags = pvclock_read_flags(&hv_clock_boot[0].pvti);
+        if (!(flags & PVCLOCK_TSC_STABLE_BIT))
+                return 0;
 
-        return mem;
-e_free:
-        memblock_free(mem, size);
+        kvm_clock.archdata.vclock_mode = VCLOCK_PVCLOCK;
+#endif
         return 0;
 }
+early_initcall(kvm_setup_vsyscall_timeinfo);
 
-static void __init kvm_memblock_free(phys_addr_t addr, phys_addr_t size)
+static int kvmclock_setup_percpu(unsigned int cpu)
 {
-        if (sev_active())
-                early_set_memory_encrypted((unsigned long)__va(addr), size);
+        struct pvclock_vsyscall_time_info *p = per_cpu(hv_clock_per_cpu, cpu);
 
-        memblock_free(addr, size);
+        /*
+         * The per cpu area setup replicates CPU0 data to all cpu
+         * pointers. So carefully check. CPU0 has been set up in init
+         * already.
+         */
+        if (!cpu || (p && p != per_cpu(hv_clock_per_cpu, 0)))
+                return 0;
+
+        /* Use the static page for the first CPUs, allocate otherwise */
+        if (cpu < HVC_BOOT_ARRAY_SIZE)
+                p = &hv_clock_boot[cpu];
+        else
+                p = kzalloc(sizeof(*p), GFP_KERNEL);
+
+        per_cpu(hv_clock_per_cpu, cpu) = p;
+        return p ? 0 : -ENOMEM;
 }
 
 void __init kvmclock_init(void)
 {
-        struct pvclock_vcpu_time_info *vcpu_time;
-        unsigned long mem, mem_wall_clock;
-        int size, cpu, wall_clock_size;
         u8 flags;
 
-        size = PAGE_ALIGN(sizeof(struct pvclock_vsyscall_time_info)*NR_CPUS);
-
-        if (!kvm_para_available())
+        if (!kvm_para_available() || !kvmclock)
                 return;
 
-        if (kvmclock && kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE2)) {
+        if (kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE2)) {
                 msr_kvm_system_time = MSR_KVM_SYSTEM_TIME_NEW;
                 msr_kvm_wall_clock = MSR_KVM_WALL_CLOCK_NEW;
-        } else if (!(kvmclock && kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE)))
-                return;
-
-        wall_clock_size = PAGE_ALIGN(sizeof(struct pvclock_wall_clock));
-        mem_wall_clock = kvm_memblock_alloc(wall_clock_size, PAGE_SIZE);
-        if (!mem_wall_clock)
-                return;
-
-        wall_clock = __va(mem_wall_clock);
-        memset(wall_clock, 0, wall_clock_size);
-
-        mem = kvm_memblock_alloc(size, PAGE_SIZE);
-        if (!mem) {
-                kvm_memblock_free(mem_wall_clock, wall_clock_size);
-                wall_clock = NULL;
+        } else if (!kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE)) {
                 return;
         }
 
-        hv_clock = __va(mem);
-        memset(hv_clock, 0, size);
-
-        if (kvm_register_clock("primary cpu clock")) {
-                hv_clock = NULL;
-                kvm_memblock_free(mem, size);
-                kvm_memblock_free(mem_wall_clock, wall_clock_size);
-                wall_clock = NULL;
+        if (cpuhp_setup_state(CPUHP_BP_PREPARE_DYN, "kvmclock:setup_percpu",
+                              kvmclock_setup_percpu, NULL) < 0) {
                 return;
         }
 
-        printk(KERN_INFO "kvm-clock: Using msrs %x and %x",
+        pr_info("kvm-clock: Using msrs %x and %x",
                 msr_kvm_system_time, msr_kvm_wall_clock);
 
-        pvclock_set_pvti_cpu0_va(hv_clock);
+        this_cpu_write(hv_clock_per_cpu, &hv_clock_boot[0]);
+        kvm_register_clock("primary cpu clock");
+        pvclock_set_pvti_cpu0_va(hv_clock_boot);
 
         if (kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE_STABLE_BIT))
                 pvclock_set_flags(PVCLOCK_TSC_STABLE_BIT);
 
-        cpu = get_cpu();
-        vcpu_time = &hv_clock[cpu].pvti;
-        flags = pvclock_read_flags(vcpu_time);
-
+        flags = pvclock_read_flags(&hv_clock_boot[0].pvti);
         kvm_sched_clock_init(flags & PVCLOCK_TSC_STABLE_BIT);
-        put_cpu();
 
         x86_platform.calibrate_tsc = kvm_get_tsc_khz;
         x86_platform.calibrate_cpu = kvm_get_tsc_khz;
         x86_platform.get_wallclock = kvm_get_wallclock;
         x86_platform.set_wallclock = kvm_set_wallclock;
 #ifdef CONFIG_X86_LOCAL_APIC
-        x86_cpuinit.early_percpu_clock_init =
-                kvm_setup_secondary_clock;
+        x86_cpuinit.early_percpu_clock_init = kvm_setup_secondary_clock;
 #endif
         x86_platform.save_sched_clock_state = kvm_save_sched_clock_state;
         x86_platform.restore_sched_clock_state = kvm_restore_sched_clock_state;
@@ -350,31 +324,3 @@ void __init kvmclock_init(void)
         clocksource_register_hz(&kvm_clock, NSEC_PER_SEC);
         pv_info.name = "KVM";
 }
-
-int __init kvm_setup_vsyscall_timeinfo(void)
-{
-#ifdef CONFIG_X86_64
-        int cpu;
-        u8 flags;
-        struct pvclock_vcpu_time_info *vcpu_time;
-        unsigned int size;
-
-        if (!hv_clock)
-                return 0;
-
-        size = PAGE_ALIGN(sizeof(struct pvclock_vsyscall_time_info)*NR_CPUS);
-
-        cpu = get_cpu();
-
-        vcpu_time = &hv_clock[cpu].pvti;
-        flags = pvclock_read_flags(vcpu_time);
-
-        put_cpu();
-
-        if (!(flags & PVCLOCK_TSC_STABLE_BIT))
-                return 1;
-
-        kvm_clock.archdata.vclock_mode = VCLOCK_PVCLOCK;
-#endif
-        return 0;
-}
diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index c9b14020f4dd..733e6ace0fa4 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -100,6 +100,102 @@ static struct ldt_struct *alloc_ldt_struct(unsigned int num_entries)
         return new_ldt;
 }
 
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+
+static void do_sanity_check(struct mm_struct *mm,
+                            bool had_kernel_mapping,
+                            bool had_user_mapping)
+{
+        if (mm->context.ldt) {
+                /*
+                 * We already had an LDT.  The top-level entry should already
+                 * have been allocated and synchronized with the usermode
+                 * tables.
+                 */
+                WARN_ON(!had_kernel_mapping);
+                if (static_cpu_has(X86_FEATURE_PTI))
+                        WARN_ON(!had_user_mapping);
+        } else {
+                /*
+                 * This is the first time we're mapping an LDT for this process.
+                 * Sync the pgd to the usermode tables.
+                 */
+                WARN_ON(had_kernel_mapping);
+                if (static_cpu_has(X86_FEATURE_PTI))
+                        WARN_ON(had_user_mapping);
+        }
+}
+
+#ifdef CONFIG_X86_PAE
+
+static pmd_t *pgd_to_pmd_walk(pgd_t *pgd, unsigned long va)
+{
+        p4d_t *p4d;
+        pud_t *pud;
+
+        if (pgd->pgd == 0)
+                return NULL;
+
+        p4d = p4d_offset(pgd, va);
+        if (p4d_none(*p4d))
+                return NULL;
+
+        pud = pud_offset(p4d, va);
+        if (pud_none(*pud))
+                return NULL;
+
+        return pmd_offset(pud, va);
+}
+
+static void map_ldt_struct_to_user(struct mm_struct *mm)
+{
+        pgd_t *k_pgd = pgd_offset(mm, LDT_BASE_ADDR);
+        pgd_t *u_pgd = kernel_to_user_pgdp(k_pgd);
+        pmd_t *k_pmd, *u_pmd;
+
+        k_pmd = pgd_to_pmd_walk(k_pgd, LDT_BASE_ADDR);
+        u_pmd = pgd_to_pmd_walk(u_pgd, LDT_BASE_ADDR);
+
+        if (static_cpu_has(X86_FEATURE_PTI) && !mm->context.ldt)
+                set_pmd(u_pmd, *k_pmd);
+}
+
+static void sanity_check_ldt_mapping(struct mm_struct *mm)
+{
+        pgd_t *k_pgd = pgd_offset(mm, LDT_BASE_ADDR);
+        pgd_t *u_pgd = kernel_to_user_pgdp(k_pgd);
+        bool had_kernel, had_user;
+        pmd_t *k_pmd, *u_pmd;
+
+        k_pmd      = pgd_to_pmd_walk(k_pgd, LDT_BASE_ADDR);
+        u_pmd      = pgd_to_pmd_walk(u_pgd, LDT_BASE_ADDR);
+        had_kernel = (k_pmd->pmd != 0);
+        had_user   = (u_pmd->pmd != 0);
+
+        do_sanity_check(mm, had_kernel, had_user);
+}
+
+#else /* !CONFIG_X86_PAE */
+
+static void map_ldt_struct_to_user(struct mm_struct *mm)
+{
+        pgd_t *pgd = pgd_offset(mm, LDT_BASE_ADDR);
+
+        if (static_cpu_has(X86_FEATURE_PTI) && !mm->context.ldt)
+                set_pgd(kernel_to_user_pgdp(pgd), *pgd);
+}
+
+static void sanity_check_ldt_mapping(struct mm_struct *mm)
+{
+        pgd_t *pgd = pgd_offset(mm, LDT_BASE_ADDR);
+        bool had_kernel = (pgd->pgd != 0);
+        bool had_user   = (kernel_to_user_pgdp(pgd)->pgd != 0);
+
+        do_sanity_check(mm, had_kernel, had_user);
+}
+
+#endif /* CONFIG_X86_PAE */
+
 /*
  * If PTI is enabled, this maps the LDT into the kernelmode and
  * usermode tables for the given mm.
@@ -115,9 +211,8 @@ static struct ldt_struct *alloc_ldt_struct(unsigned int num_entries)
 static int
 map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
 {
-#ifdef CONFIG_PAGE_TABLE_ISOLATION
-        bool is_vmalloc, had_top_level_entry;
         unsigned long va;
+        bool is_vmalloc;
         spinlock_t *ptl;
         pgd_t *pgd;
         int i;
@@ -131,13 +226,15 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
          */
         WARN_ON(ldt->slot != -1);
 
+        /* Check if the current mappings are sane */
+        sanity_check_ldt_mapping(mm);
+
         /*
          * Did we already have the top level entry allocated?  We can't
          * use pgd_none() for this because it doens't do anything on
          * 4-level page table kernels.
          */
         pgd = pgd_offset(mm, LDT_BASE_ADDR);
-        had_top_level_entry = (pgd->pgd != 0);
 
         is_vmalloc = is_vmalloc_addr(ldt->entries);
 
@@ -172,41 +269,31 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
                 pte_unmap_unlock(ptep, ptl);
         }
 
-        if (mm->context.ldt) {
-                /*
-                 * We already had an LDT.  The top-level entry should already
-                 * have been allocated and synchronized with the usermode
-                 * tables.
-                 */
-                WARN_ON(!had_top_level_entry);
-                if (static_cpu_has(X86_FEATURE_PTI))
-                        WARN_ON(!kernel_to_user_pgdp(pgd)->pgd);
-        } else {
-                /*
-                 * This is the first time we're mapping an LDT for this process.
-                 * Sync the pgd to the usermode tables.
-                 */
-                WARN_ON(had_top_level_entry);
-                if (static_cpu_has(X86_FEATURE_PTI)) {
-                        WARN_ON(kernel_to_user_pgdp(pgd)->pgd);
-                        set_pgd(kernel_to_user_pgdp(pgd), *pgd);
-                }
-        }
+        /* Propagate LDT mapping to the user page-table */
+        map_ldt_struct_to_user(mm);
 
         va = (unsigned long)ldt_slot_va(slot);
         flush_tlb_mm_range(mm, va, va + LDT_SLOT_STRIDE, 0);
 
         ldt->slot = slot;
-#endif
         return 0;
 }
 
+#else /* !CONFIG_PAGE_TABLE_ISOLATION */
+
+static int
+map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
+{
+        return 0;
+}
+#endif /* CONFIG_PAGE_TABLE_ISOLATION */
+
 static void free_ldt_pgtables(struct mm_struct *mm)
 {
 #ifdef CONFIG_PAGE_TABLE_ISOLATION
         struct mmu_gather tlb;
         unsigned long start = LDT_BASE_ADDR;
-        unsigned long end = start + (1UL << PGDIR_SHIFT);
+        unsigned long end = LDT_END_ADDR;
 
         if (!static_cpu_has(X86_FEATURE_PTI))
                 return;
diff --git a/arch/x86/kernel/machine_kexec_32.c b/arch/x86/kernel/machine_kexec_32.c
index d1ab07ec8c9a..5409c2800ab5 100644
--- a/arch/x86/kernel/machine_kexec_32.c
+++ b/arch/x86/kernel/machine_kexec_32.c
@@ -56,7 +56,7 @@ static void load_segments(void)
 
 static void machine_kexec_free_page_tables(struct kimage *image)
 {
-        free_page((unsigned long)image->arch.pgd);
+        free_pages((unsigned long)image->arch.pgd, PGD_ALLOCATION_ORDER);
         image->arch.pgd = NULL;
 #ifdef CONFIG_X86_PAE
         free_page((unsigned long)image->arch.pmd0);
@@ -72,7 +72,8 @@ static void machine_kexec_free_page_tables(struct kimage *image)
 
 static int machine_kexec_alloc_page_tables(struct kimage *image)
 {
-        image->arch.pgd = (pgd_t *)get_zeroed_page(GFP_KERNEL);
+        image->arch.pgd = (pgd_t *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
+                                                    PGD_ALLOCATION_ORDER);
 #ifdef CONFIG_X86_PAE
         image->arch.pmd0 = (pmd_t *)get_zeroed_page(GFP_KERNEL);
         image->arch.pmd1 = (pmd_t *)get_zeroed_page(GFP_KERNEL);
diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
index 99dc79e76bdc..930c88341e4e 100644
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -88,10 +88,12 @@ unsigned paravirt_patch_call(void *insnbuf,
         struct branch *b = insnbuf;
         unsigned long delta = (unsigned long)target - (addr+5);
 
-        if (tgt_clobbers & ~site_clobbers)
-                return len;     /* target would clobber too much for this site */
-        if (len < 5)
+        if (len < 5) {
+#ifdef CONFIG_RETPOLINE
+                WARN_ONCE("Failing to patch indirect CALL in %ps\n", (void *)addr);
+#endif
                 return len;     /* call too long for patch site */
+        }
 
         b->opcode = 0xe8; /* call */
         b->delta = delta;
@@ -106,8 +108,12 @@ unsigned paravirt_patch_jmp(void *insnbuf, const void *target,
         struct branch *b = insnbuf;
         unsigned long delta = (unsigned long)target - (addr+5);
 
-        if (len < 5)
+        if (len < 5) {
+#ifdef CONFIG_RETPOLINE
+                WARN_ONCE("Failing to patch indirect JMP in %ps\n", (void *)addr);
+#endif
                 return len;     /* call too long for patch site */
+        }
 
         b->opcode = 0xe9;       /* jmp */
         b->delta = delta;
diff --git a/arch/x86/kernel/paravirt_patch_64.c b/arch/x86/kernel/paravirt_patch_64.c
index 9edadabf04f6..9cb98f7b07c9 100644
--- a/arch/x86/kernel/paravirt_patch_64.c
+++ b/arch/x86/kernel/paravirt_patch_64.c
@@ -20,7 +20,7 @@ DEF_NATIVE(, mov64, "mov %rdi, %rax");
 
 #if defined(CONFIG_PARAVIRT_SPINLOCKS)
 DEF_NATIVE(pv_lock_ops, queued_spin_unlock, "movb $0, (%rdi)");
-DEF_NATIVE(pv_lock_ops, vcpu_is_preempted, "xor %rax, %rax");
+DEF_NATIVE(pv_lock_ops, vcpu_is_preempted, "xor %eax, %eax");
 #endif
 
 unsigned paravirt_patch_ident_32(void *insnbuf, unsigned len)
diff --git a/arch/x86/kernel/pci-iommu_table.c b/arch/x86/kernel/pci-iommu_table.c
index 4dfd90a75e63..2e9006c1e240 100644
--- a/arch/x86/kernel/pci-iommu_table.c
+++ b/arch/x86/kernel/pci-iommu_table.c
@@ -60,7 +60,7 @@ void __init check_iommu_entries(struct iommu_table_entry *start,
                         printk(KERN_ERR "CYCLIC DEPENDENCY FOUND! %pS depends on %pS and vice-versa. BREAKING IT.\n",
                                p->detect, q->detect);
                         /* Heavy handed way..*/
-                        x->depend = 0;
+                        x->depend = NULL;
                 }
         }
 
diff --git a/arch/x86/kernel/pcspeaker.c b/arch/x86/kernel/pcspeaker.c
index da5190a1ea16..4a710ffffd9a 100644
--- a/arch/x86/kernel/pcspeaker.c
+++ b/arch/x86/kernel/pcspeaker.c
@@ -9,6 +9,6 @@ static __init int add_pcspkr(void)
 
         pd = platform_device_register_simple("pcspkr", -1, NULL, 0);
 
-        return IS_ERR(pd) ? PTR_ERR(pd) : 0;
+        return PTR_ERR_OR_ZERO(pd);
 }
 device_initcall(add_pcspkr);
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 30ca2d1a9231..c93fcfdf1673 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -57,14 +57,12 @@ __visible DEFINE_PER_CPU_PAGE_ALIGNED(struct tss_struct, cpu_tss_rw) = {
                  */
                 .sp0 = (1UL << (BITS_PER_LONG-1)) + 1,
 
-#ifdef CONFIG_X86_64
                 /*
                  * .sp1 is cpu_current_top_of_stack.  The init task never
                  * runs user code, but cpu_current_top_of_stack should still
                  * be well defined before the first context switch.
                  */
                 .sp1 = TOP_OF_INIT_STACK,
-#endif
 
 #ifdef CONFIG_X86_32
                 .ss0 = __KERNEL_DS,
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index 0ae659de21eb..2924fd447e61 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -285,7 +285,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
          * current_thread_info().  Refresh the SYSENTER configuration in
          * case prev or next is vm86.
          */
-        update_sp0(next_p);
+        update_task_stack(next_p);
         refresh_sysenter_cs(next);
         this_cpu_write(cpu_current_top_of_stack,
                        (unsigned long)task_stack_page(next_p) +
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index 12bb445fb98d..476e3ddf8890 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -478,7 +478,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
         this_cpu_write(cpu_current_top_of_stack, task_top_of_stack(next_p));
 
         /* Reload sp0. */
-        update_sp0(next_p);
+        update_task_stack(next_p);
 
         /*
          * Now maybe reload the debug registers and handle I/O bitmaps
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 2f86d883dd95..5d32c55aeb8b 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -866,6 +866,8 @@ void __init setup_arch(char **cmdline_p)
 
         idt_setup_early_traps();
         early_cpu_init();
+        arch_init_ideal_nops();
+        jump_label_init();
         early_ioremap_init();
 
         setup_olpc_ofw_pgd();
@@ -1012,6 +1014,7 @@ void __init setup_arch(char **cmdline_p)
          */
         init_hypervisor_platform();
 
+        tsc_early_init();
         x86_init.resources.probe_roms();
 
         /* after parse_early_param, so could debug it */
@@ -1197,11 +1200,6 @@ void __init setup_arch(char **cmdline_p)
 
         memblock_find_dma_reserve();
 
-#ifdef CONFIG_KVM_GUEST
-        kvmclock_init();
-#endif
-
-        tsc_early_delay_calibrate();
         if (!early_xdbc_setup_hardware())
                 early_xdbc_register_console();
 
@@ -1272,8 +1270,6 @@ void __init setup_arch(char **cmdline_p)
 
         mcheck_init();
 
-        arch_init_ideal_nops();
-
         register_refined_jiffies(CLOCK_TICK_RATE);
 
 #ifdef CONFIG_EFI
diff --git a/arch/x86/kernel/stacktrace.c b/arch/x86/kernel/stacktrace.c
index 093f2ea5dd56..7627455047c2 100644
--- a/arch/x86/kernel/stacktrace.c
+++ b/arch/x86/kernel/stacktrace.c
@@ -81,16 +81,6 @@ EXPORT_SYMBOL_GPL(save_stack_trace_tsk);
 
 #ifdef CONFIG_HAVE_RELIABLE_STACKTRACE
 
-#define STACKTRACE_DUMP_ONCE(task) ({                           \
-        static bool __section(.data.unlikely) __dumped;         \
-                                                                \
-        if (!__dumped) {                                        \
-                __dumped = true;                                \
-                WARN_ON(1);                                     \
-                show_stack(task, NULL);                         \
-        }                                                       \
-})
-
 static int __always_inline
 __save_stack_trace_reliable(struct stack_trace *trace,
                             struct task_struct *task)
@@ -99,30 +89,25 @@ __save_stack_trace_reliable(struct stack_trace *trace,
         struct pt_regs *regs;
         unsigned long addr;
 
-        for (unwind_start(&state, task, NULL, NULL); !unwind_done(&state);
+        for (unwind_start(&state, task, NULL, NULL);
+             !unwind_done(&state) && !unwind_error(&state);
              unwind_next_frame(&state)) {
 
                 regs = unwind_get_entry_regs(&state, NULL);
                 if (regs) {
+                        /* Success path for user tasks */
+                        if (user_mode(regs))
+                                goto success;
+
                         /*
                          * Kernel mode registers on the stack indicate an
                          * in-kernel interrupt or exception (e.g., preemption
                          * or a page fault), which can make frame pointers
                          * unreliable.
                          */
-                        if (!user_mode(regs))
-                                return -EINVAL;
 
-                        /*
-                         * The last frame contains the user mode syscall
-                         * pt_regs.  Skip it and finish the unwind.
-                         */
-                        unwind_next_frame(&state);
-                        if (!unwind_done(&state)) {
-                                STACKTRACE_DUMP_ONCE(task);
+                        if (IS_ENABLED(CONFIG_FRAME_POINTER))
                                 return -EINVAL;
-                        }
-                        break;
                 }
 
                 addr = unwind_get_return_address(&state);
@@ -132,21 +117,22 @@ __save_stack_trace_reliable(struct stack_trace *trace,
                  * generated code which __kernel_text_address() doesn't know
                  * about.
                  */
-                if (!addr) {
-                        STACKTRACE_DUMP_ONCE(task);
+                if (!addr)
                         return -EINVAL;
-                }
 
                 if (save_stack_address(trace, addr, false))
                         return -EINVAL;
         }
 
         /* Check for stack corruption */
-        if (unwind_error(&state)) {
-                STACKTRACE_DUMP_ONCE(task);
+        if (unwind_error(&state))
+                return -EINVAL;
+
+        /* Success path for non-user tasks, i.e. kthreads and idle tasks */
+        if (!(task->flags & (PF_KTHREAD | PF_IDLE)))
                 return -EINVAL;
-        }
 
+success:
         if (trace->nr_entries < trace->max_entries)
                 trace->entries[trace->nr_entries++] = ULONG_MAX;
 
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 74392d9d51e0..1463468ba9a0 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -33,16 +33,13 @@ EXPORT_SYMBOL(cpu_khz);
 unsigned int __read_mostly tsc_khz;
 EXPORT_SYMBOL(tsc_khz);
 
+#define KHZ     1000
+
 /*
  * TSC can be unstable due to cpufreq or due to unsynced TSCs
  */
 static int __read_mostly tsc_unstable;
 
-/* native_sched_clock() is called before tsc_init(), so
-   we must start with the TSC soft disabled to prevent
-   erroneous rdtsc usage on !boot_cpu_has(X86_FEATURE_TSC) processors */
-static int __read_mostly tsc_disabled = -1;
-
 static DEFINE_STATIC_KEY_FALSE(__use_tsc);
 
 int tsc_clocksource_reliable;
@@ -106,23 +103,6 @@ void cyc2ns_read_end(void)
  *                      -johnstul@us.ibm.com "math is hard, lets go shopping!"
  */
 
-static void cyc2ns_data_init(struct cyc2ns_data *data)
-{
-        data->cyc2ns_mul = 0;
-        data->cyc2ns_shift = 0;
-        data->cyc2ns_offset = 0;
-}
-
-static void __init cyc2ns_init(int cpu)
-{
-        struct cyc2ns *c2n = &per_cpu(cyc2ns, cpu);
-
-        cyc2ns_data_init(&c2n->data[0]);
-        cyc2ns_data_init(&c2n->data[1]);
-
-        seqcount_init(&c2n->seq);
-}
-
 static inline unsigned long long cycles_2_ns(unsigned long long cyc)
 {
         struct cyc2ns_data data;
@@ -138,18 +118,11 @@ static inline unsigned long long cycles_2_ns(unsigned long long cyc)
         return ns;
 }
 
-static void set_cyc2ns_scale(unsigned long khz, int cpu, unsigned long long tsc_now)
+static void __set_cyc2ns_scale(unsigned long khz, int cpu, unsigned long long tsc_now)
 {
         unsigned long long ns_now;
         struct cyc2ns_data data;
         struct cyc2ns *c2n;
-        unsigned long flags;
-
-        local_irq_save(flags);
-        sched_clock_idle_sleep_event();
-
-        if (!khz)
-                goto done;
 
         ns_now = cycles_2_ns(tsc_now);
 
@@ -181,13 +154,56 @@ static void set_cyc2ns_scale(unsigned long khz, int cpu, unsigned long long tsc_
         c2n->data[0] = data;
         raw_write_seqcount_latch(&c2n->seq);
         c2n->data[1] = data;
+}
+
+static void set_cyc2ns_scale(unsigned long khz, int cpu, unsigned long long tsc_now)
+{
+        unsigned long flags;
+
+        local_irq_save(flags);
+        sched_clock_idle_sleep_event();
+
+        if (khz)
+                __set_cyc2ns_scale(khz, cpu, tsc_now);
 
-done:
         sched_clock_idle_wakeup_event();
         local_irq_restore(flags);
 }
 
 /*
+ * Initialize cyc2ns for boot cpu
+ */
+static void __init cyc2ns_init_boot_cpu(void)
+{
+        struct cyc2ns *c2n = this_cpu_ptr(&cyc2ns);
+
+        seqcount_init(&c2n->seq);
+        __set_cyc2ns_scale(tsc_khz, smp_processor_id(), rdtsc());
+}
+
+/*
+ * Secondary CPUs do not run through tsc_init(), so set up
+ * all the scale factors for all CPUs, assuming the same
+ * speed as the bootup CPU. (cpufreq notifiers will fix this
+ * up if their speed diverges)
+ */
+static void __init cyc2ns_init_secondary_cpus(void)
+{
+        unsigned int cpu, this_cpu = smp_processor_id();
+        struct cyc2ns *c2n = this_cpu_ptr(&cyc2ns);
+        struct cyc2ns_data *data = c2n->data;
+
+        for_each_possible_cpu(cpu) {
+                if (cpu != this_cpu) {
+                        seqcount_init(&c2n->seq);
+                        c2n = per_cpu_ptr(&cyc2ns, cpu);
+                        c2n->data[0] = data[0];
+                        c2n->data[1] = data[1];
+                }
+        }
+}
+
+/*
  * Scheduler clock - returns current time in nanosec units.
  */
 u64 native_sched_clock(void)
@@ -248,8 +264,7 @@ EXPORT_SYMBOL_GPL(check_tsc_unstable);
 #ifdef CONFIG_X86_TSC
 int __init notsc_setup(char *str)
 {
-        pr_warn("Kernel compiled with CONFIG_X86_TSC, cannot disable TSC completely\n");
-        tsc_disabled = 1;
+        mark_tsc_unstable("boot parameter notsc");
         return 1;
 }
 #else
@@ -665,30 +680,17 @@ static unsigned long cpu_khz_from_cpuid(void)
         return eax_base_mhz * 1000;
 }
 
-/**
- * native_calibrate_cpu - calibrate the cpu on boot
+/*
+ * calibrate cpu using pit, hpet, and ptimer methods. They are available
+ * later in boot after acpi is initialized.
  */
-unsigned long native_calibrate_cpu(void)
+static unsigned long pit_hpet_ptimer_calibrate_cpu(void)
 {
         u64 tsc1, tsc2, delta, ref1, ref2;
         unsigned long tsc_pit_min = ULONG_MAX, tsc_ref_min = ULONG_MAX;
-        unsigned long flags, latch, ms, fast_calibrate;
+        unsigned long flags, latch, ms;
         int hpet = is_hpet_enabled(), i, loopmin;
 
-        fast_calibrate = cpu_khz_from_cpuid();
-        if (fast_calibrate)
-                return fast_calibrate;
-
-        fast_calibrate = cpu_khz_from_msr();
-        if (fast_calibrate)
-                return fast_calibrate;
-
-        local_irq_save(flags);
-        fast_calibrate = quick_pit_calibrate();
-        local_irq_restore(flags);
-        if (fast_calibrate)
-                return fast_calibrate;
-
         /*
          * Run 5 calibration loops to get the lowest frequency value
          * (the best estimate). We use two different calibration modes
@@ -831,6 +833,37 @@ unsigned long native_calibrate_cpu(void)
         return tsc_pit_min;
 }
 
+/**
+ * native_calibrate_cpu_early - can calibrate the cpu early in boot
+ */
+unsigned long native_calibrate_cpu_early(void)
+{
+        unsigned long flags, fast_calibrate = cpu_khz_from_cpuid();
+
+        if (!fast_calibrate)
+                fast_calibrate = cpu_khz_from_msr();
+        if (!fast_calibrate) {
+                local_irq_save(flags);
+                fast_calibrate = quick_pit_calibrate();
+                local_irq_restore(flags);
+        }
+        return fast_calibrate;
+}
+
+
+/**
+ * native_calibrate_cpu - calibrate the cpu
+ */
+static unsigned long native_calibrate_cpu(void)
+{
+        unsigned long tsc_freq = native_calibrate_cpu_early();
+
+        if (!tsc_freq)
+                tsc_freq = pit_hpet_ptimer_calibrate_cpu();
+
+        return tsc_freq;
+}
+
 void recalibrate_cpu_khz(void)
 {
 #ifndef CONFIG_SMP
@@ -1307,7 +1340,7 @@ unreg:
 
 static int __init init_tsc_clocksource(void)
 {
-        if (!boot_cpu_has(X86_FEATURE_TSC) || tsc_disabled > 0 || !tsc_khz)
+        if (!boot_cpu_has(X86_FEATURE_TSC) || !tsc_khz)
                 return 0;
 
         if (tsc_unstable)
@@ -1341,40 +1374,22 @@ unreg:
  */
 device_initcall(init_tsc_clocksource);
 
-void __init tsc_early_delay_calibrate(void)
+static bool __init determine_cpu_tsc_frequencies(bool early)
 {
-        unsigned long lpj;
-
-        if (!boot_cpu_has(X86_FEATURE_TSC))
-                return;
-
-        cpu_khz = x86_platform.calibrate_cpu();
-        tsc_khz = x86_platform.calibrate_tsc();
-
-        tsc_khz = tsc_khz ? : cpu_khz;
-        if (!tsc_khz)
-                return;
-
-        lpj = tsc_khz * 1000;
-        do_div(lpj, HZ);
-        loops_per_jiffy = lpj;
-}
-
-void __init tsc_init(void)
-{
-        u64 lpj, cyc;
-        int cpu;
-
-        if (!boot_cpu_has(X86_FEATURE_TSC)) {
-                setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER);
-                return;
+        /* Make sure that cpu and tsc are not already calibrated */
+        WARN_ON(cpu_khz || tsc_khz);
+
+        if (early) {
+                cpu_khz = x86_platform.calibrate_cpu();
+                tsc_khz = x86_platform.calibrate_tsc();
+        } else {
+                /* We should not be here with non-native cpu calibration */
+                WARN_ON(x86_platform.calibrate_cpu != native_calibrate_cpu);
+                cpu_khz = pit_hpet_ptimer_calibrate_cpu();
         }
 
-        cpu_khz = x86_platform.calibrate_cpu();
-        tsc_khz = x86_platform.calibrate_tsc();
-
         /*
-         * Trust non-zero tsc_khz as authorative,
+         * Trust non-zero tsc_khz as authoritative,
          * and use it to sanity check cpu_khz,
          * which will be off if system timer is off.
          */
@@ -1383,52 +1398,78 @@ void __init tsc_init(void)
         else if (abs(cpu_khz - tsc_khz) * 10 > tsc_khz)
                 cpu_khz = tsc_khz;
 
-        if (!tsc_khz) {
-                mark_tsc_unstable("could not calculate TSC khz");
-                setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER);
-                return;
-        }
+        if (tsc_khz == 0)
+                return false;
 
         pr_info("Detected %lu.%03lu MHz processor\n",
-                (unsigned long)cpu_khz / 1000,
-                (unsigned long)cpu_khz % 1000);
+                (unsigned long)cpu_khz / KHZ,
+                (unsigned long)cpu_khz % KHZ);
 
         if (cpu_khz != tsc_khz) {
                 pr_info("Detected %lu.%03lu MHz TSC",
-                        (unsigned long)tsc_khz / 1000,
-                        (unsigned long)tsc_khz % 1000);
+                        (unsigned long)tsc_khz / KHZ,
+                        (unsigned long)tsc_khz % KHZ);
         }
+        return true;
+}
+
+static unsigned long __init get_loops_per_jiffy(void)
+{
+        unsigned long lpj = tsc_khz * KHZ;
 
+        do_div(lpj, HZ);
+        return lpj;
+}
+
+static void __init tsc_enable_sched_clock(void)
+{
         /* Sanitize TSC ADJUST before cyc2ns gets initialized */
         tsc_store_and_check_tsc_adjust(true);
+        cyc2ns_init_boot_cpu();
+        static_branch_enable(&__use_tsc);
+}
+
+void __init tsc_early_init(void)
+{
+        if (!boot_cpu_has(X86_FEATURE_TSC))
+                return;
+        if (!determine_cpu_tsc_frequencies(true))
+                return;
+        loops_per_jiffy = get_loops_per_jiffy();
 
+        tsc_enable_sched_clock();
+}
+
+void __init tsc_init(void)
+{
         /*
-         * Secondary CPUs do not run through tsc_init(), so set up
-         * all the scale factors for all CPUs, assuming the same
-         * speed as the bootup CPU. (cpufreq notifiers will fix this
-         * up if their speed diverges)
+         * native_calibrate_cpu_early can only calibrate using methods that are
+         * available early in boot.
          */
-        cyc = rdtsc();
-        for_each_possible_cpu(cpu) {
-                cyc2ns_init(cpu);
-                set_cyc2ns_scale(tsc_khz, cpu, cyc);
-        }
+        if (x86_platform.calibrate_cpu == native_calibrate_cpu_early)
+                x86_platform.calibrate_cpu = native_calibrate_cpu;
 
-        if (tsc_disabled > 0)
+        if (!boot_cpu_has(X86_FEATURE_TSC)) {
+                setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER);
                 return;
+        }
 
-        /* now allow native_sched_clock() to use rdtsc */
+        if (!tsc_khz) {
+                /* We failed to determine frequencies earlier, try again */
+                if (!determine_cpu_tsc_frequencies(false)) {
+                        mark_tsc_unstable("could not calculate TSC khz");
+                        setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER);
+                        return;
+                }
+                tsc_enable_sched_clock();
+        }
 
-        tsc_disabled = 0;
-        static_branch_enable(&__use_tsc);
+        cyc2ns_init_secondary_cpus();
 
         if (!no_sched_irq_time)
                 enable_sched_clock_irqtime();
 
-        lpj = ((u64)tsc_khz * 1000);
-        do_div(lpj, HZ);
-        lpj_fine = lpj;
-
+        lpj_fine = get_loops_per_jiffy();
         use_tsc_delay();
 
         check_system_tsc_reliable();
@@ -1455,7 +1496,7 @@ unsigned long calibrate_delay_is_known(void)
         int constant_tsc = cpu_has(&cpu_data(cpu), X86_FEATURE_CONSTANT_TSC);
         const struct cpumask *mask = topology_core_cpumask(cpu);
 
-        if (tsc_disabled || !constant_tsc || !mask)
+        if (!constant_tsc || !mask)
                 return 0;
 
         sibling = cpumask_any_but(mask, cpu);
diff --git a/arch/x86/kernel/tsc_msr.c b/arch/x86/kernel/tsc_msr.c
index 19afdbd7d0a7..27ef714d886c 100644
--- a/arch/x86/kernel/tsc_msr.c
+++ b/arch/x86/kernel/tsc_msr.c
@@ -1,17 +1,19 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
- * tsc_msr.c - TSC frequency enumeration via MSR
+ * TSC frequency enumeration via MSR
  *
- * Copyright (C) 2013 Intel Corporation
+ * Copyright (C) 2013, 2018 Intel Corporation
  * Author: Bin Gao <bin.gao@intel.com>
- *
- * This file is released under the GPLv2.
  */
 
 #include <linux/kernel.h>
-#include <asm/processor.h>
-#include <asm/setup.h>
+
 #include <asm/apic.h>
+#include <asm/cpu_device_id.h>
+#include <asm/intel-family.h>
+#include <asm/msr.h>
 #include <asm/param.h>
+#include <asm/tsc.h>
 
 #define MAX_NUM_FREQS   9
 
@@ -23,44 +25,48 @@
  * field msr_plat does.
  */
 struct freq_desc {
-        u8 x86_family;  /* CPU family */
-        u8 x86_model;   /* model */
         u8 msr_plat;    /* 1: use MSR_PLATFORM_INFO, 0: MSR_IA32_PERF_STATUS */
         u32 freqs[MAX_NUM_FREQS];
 };
 
-static struct freq_desc freq_desc_tables[] = {
-        /* PNW */
-        { 6, 0x27, 0, { 0, 0, 0, 0, 0, 99840, 0, 83200 } },
-        /* CLV+ */
-        { 6, 0x35, 0, { 0, 133200, 0, 0, 0, 99840, 0, 83200 } },
-        /* TNG - Intel Atom processor Z3400 series */
-        { 6, 0x4a, 1, { 0, 100000, 133300, 0, 0, 0, 0, 0 } },
-        /* VLV2 - Intel Atom processor E3000, Z3600, Z3700 series */
-        { 6, 0x37, 1, { 83300, 100000, 133300, 116700, 80000, 0, 0, 0 } },
-        /* ANN - Intel Atom processor Z3500 series */
-        { 6, 0x5a, 1, { 83300, 100000, 133300, 100000, 0, 0, 0, 0 } },
-        /* AMT - Intel Atom processor X7-Z8000 and X5-Z8000 series */
-        { 6, 0x4c, 1, { 83300, 100000, 133300, 116700,
-                        80000, 93300, 90000, 88900, 87500 } },
+/*
+ * Penwell and Clovertrail use spread spectrum clock,
+ * so the freq number is not exactly the same as reported
+ * by MSR based on SDM.
+ */
+static const struct freq_desc freq_desc_pnw = {
+        0, { 0, 0, 0, 0, 0, 99840, 0, 83200 }
 };
 
-static int match_cpu(u8 family, u8 model)
-{
-        int i;
+static const struct freq_desc freq_desc_clv = {
+        0, { 0, 133200, 0, 0, 0, 99840, 0, 83200 }
+};
 
-        for (i = 0; i < ARRAY_SIZE(freq_desc_tables); i++) {
-                if ((family == freq_desc_tables[i].x86_family) &&
-                        (model == freq_desc_tables[i].x86_model))
-                        return i;
-        }
+static const struct freq_desc freq_desc_byt = {
+        1, { 83300, 100000, 133300, 116700, 80000, 0, 0, 0 }
+};
 
-        return -1;
-}
+static const struct freq_desc freq_desc_cht = {
+        1, { 83300, 100000, 133300, 116700, 80000, 93300, 90000, 88900, 87500 }
+};
 
-/* Map CPU reference clock freq ID(0-7) to CPU reference clock freq(KHz) */
-#define id_to_freq(cpu_index, freq_id) \
-        (freq_desc_tables[cpu_index].freqs[freq_id])
+static const struct freq_desc freq_desc_tng = {
+        1, { 0, 100000, 133300, 0, 0, 0, 0, 0 }
+};
+
+static const struct freq_desc freq_desc_ann = {
+        1, { 83300, 100000, 133300, 100000, 0, 0, 0, 0 }
+};
+
+static const struct x86_cpu_id tsc_msr_cpu_ids[] = {
+        INTEL_CPU_FAM6(ATOM_PENWELL,            freq_desc_pnw),
+        INTEL_CPU_FAM6(ATOM_CLOVERVIEW,         freq_desc_clv),
+        INTEL_CPU_FAM6(ATOM_SILVERMONT1,        freq_desc_byt),
+        INTEL_CPU_FAM6(ATOM_AIRMONT,            freq_desc_cht),
+        INTEL_CPU_FAM6(ATOM_MERRIFIELD,         freq_desc_tng),
+        INTEL_CPU_FAM6(ATOM_MOOREFIELD,         freq_desc_ann),
+        {}
+};
 
 /*
  * MSR-based CPU/TSC frequency discovery for certain CPUs.
@@ -70,18 +76,17 @@ static int match_cpu(u8 family, u8 model)
  */
 unsigned long cpu_khz_from_msr(void)
 {
-        u32 lo, hi, ratio, freq_id, freq;
+        u32 lo, hi, ratio, freq;
+        const struct freq_desc *freq_desc;
+        const struct x86_cpu_id *id;
         unsigned long res;
-        int cpu_index;
-
-        if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL)
-                return 0;
 
-        cpu_index = match_cpu(boot_cpu_data.x86, boot_cpu_data.x86_model);
-        if (cpu_index < 0)
+        id = x86_match_cpu(tsc_msr_cpu_ids);
+        if (!id)
                 return 0;
 
-        if (freq_desc_tables[cpu_index].msr_plat) {
+        freq_desc = (struct freq_desc *)id->driver_data;
+        if (freq_desc->msr_plat) {
                 rdmsr(MSR_PLATFORM_INFO, lo, hi);
                 ratio = (lo >> 8) & 0xff;
         } else {
@@ -91,8 +96,9 @@ unsigned long cpu_khz_from_msr(void)
 
         /* Get FSB FREQ ID */
         rdmsr(MSR_FSB_FREQ, lo, hi);
-        freq_id = lo & 0x7;
-        freq = id_to_freq(cpu_index, freq_id);
+
+        /* Map CPU reference clock freq ID(0-7) to CPU reference clock freq(KHz) */
+        freq = freq_desc->freqs[lo & 0x7];
 
         /* TSC frequency = maximum resolved freq * maximum resolved bus ratio */
         res = freq * ratio;
diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
index feb28fee6cea..26038eacf74a 100644
--- a/arch/x86/kernel/unwind_orc.c
+++ b/arch/x86/kernel/unwind_orc.c
@@ -198,7 +198,7 @@ static int orc_sort_cmp(const void *_a, const void *_b)
          * whitelisted .o files which didn't get objtool generation.
          */
         orc_a = cur_orc_table + (a - cur_orc_ip_table);
-        return orc_a->sp_reg == ORC_REG_UNDEFINED ? -1 : 1;
+        return orc_a->sp_reg == ORC_REG_UNDEFINED && !orc_a->end ? -1 : 1;
 }
 
 #ifdef CONFIG_MODULES
@@ -352,7 +352,7 @@ static bool deref_stack_iret_regs(struct unwind_state *state, unsigned long addr
 
 bool unwind_next_frame(struct unwind_state *state)
 {
-        unsigned long ip_p, sp, orig_ip, prev_sp = state->sp;
+        unsigned long ip_p, sp, orig_ip = state->ip, prev_sp = state->sp;
         enum stack_type prev_type = state->stack_info.type;
         struct orc_entry *orc;
         bool indirect = false;
@@ -363,9 +363,9 @@ bool unwind_next_frame(struct unwind_state *state)
         /* Don't let modules unload while we're reading their ORC data. */
         preempt_disable();
 
-        /* Have we reached the end? */
+        /* End-of-stack check for user tasks: */
         if (state->regs && user_mode(state->regs))
-                goto done;
+                goto the_end;
 
         /*
          * Find the orc_entry associated with the text address.
@@ -374,9 +374,16 @@ bool unwind_next_frame(struct unwind_state *state)
          * calls and calls to noreturn functions.
          */
         orc = orc_find(state->signal ? state->ip : state->ip - 1);
-        if (!orc || orc->sp_reg == ORC_REG_UNDEFINED)
-                goto done;
-        orig_ip = state->ip;
+        if (!orc)
+                goto err;
+
+        /* End-of-stack check for kernel threads: */
+        if (orc->sp_reg == ORC_REG_UNDEFINED) {
+                if (!orc->end)
+                        goto err;
+
+                goto the_end;
+        }
 
         /* Find the previous frame's stack: */
         switch (orc->sp_reg) {
@@ -402,7 +409,7 @@ bool unwind_next_frame(struct unwind_state *state)
                 if (!state->regs || !state->full_regs) {
                         orc_warn("missing regs for base reg R10 at ip %pB\n",
                                  (void *)state->ip);
-                        goto done;
+                        goto err;
                 }
                 sp = state->regs->r10;
                 break;
@@ -411,7 +418,7 @@ bool unwind_next_frame(struct unwind_state *state)
                 if (!state->regs || !state->full_regs) {
                         orc_warn("missing regs for base reg R13 at ip %pB\n",
                                  (void *)state->ip);
-                        goto done;
+                        goto err;
                 }
                 sp = state->regs->r13;
                 break;
@@ -420,7 +427,7 @@ bool unwind_next_frame(struct unwind_state *state)
                 if (!state->regs || !state->full_regs) {
                         orc_warn("missing regs for base reg DI at ip %pB\n",
                                  (void *)state->ip);
-                        goto done;
+                        goto err;
                 }
                 sp = state->regs->di;
                 break;
@@ -429,7 +436,7 @@ bool unwind_next_frame(struct unwind_state *state)
                 if (!state->regs || !state->full_regs) {
                         orc_warn("missing regs for base reg DX at ip %pB\n",
                                  (void *)state->ip);
-                        goto done;
+                        goto err;
                 }
                 sp = state->regs->dx;
                 break;
@@ -437,12 +444,12 @@ bool unwind_next_frame(struct unwind_state *state)
         default:
                 orc_warn("unknown SP base reg %d for ip %pB\n",
                          orc->sp_reg, (void *)state->ip);
-                goto done;
+                goto err;
         }
 
         if (indirect) {
                 if (!deref_stack_reg(state, sp, &sp))
-                        goto done;
+                        goto err;
         }
 
         /* Find IP, SP and possibly regs: */
@@ -451,7 +458,7 @@ bool unwind_next_frame(struct unwind_state *state)
                 ip_p = sp - sizeof(long);
 
                 if (!deref_stack_reg(state, ip_p, &state->ip))
-                        goto done;
+                        goto err;
 
                 state->ip = ftrace_graph_ret_addr(state->task, &state->graph_idx,
                                                   state->ip, (void *)ip_p);
@@ -465,7 +472,7 @@ bool unwind_next_frame(struct unwind_state *state)
                 if (!deref_stack_regs(state, sp, &state->ip, &state->sp)) {
                         orc_warn("can't dereference registers at %p for ip %pB\n",
                                  (void *)sp, (void *)orig_ip);
-                        goto done;
+                        goto err;
                 }
 
                 state->regs = (struct pt_regs *)sp;
@@ -477,7 +484,7 @@ bool unwind_next_frame(struct unwind_state *state)
                 if (!deref_stack_iret_regs(state, sp, &state->ip, &state->sp)) {
                         orc_warn("can't dereference iret registers at %p for ip %pB\n",
                                  (void *)sp, (void *)orig_ip);
-                        goto done;
+                        goto err;
                 }
 
                 state->regs = (void *)sp - IRET_FRAME_OFFSET;
@@ -500,18 +507,18 @@ bool unwind_next_frame(struct unwind_state *state)
 
         case ORC_REG_PREV_SP:
                 if (!deref_stack_reg(state, sp + orc->bp_offset, &state->bp))
-                        goto done;
+                        goto err;
                 break;
 
         case ORC_REG_BP:
                 if (!deref_stack_reg(state, state->bp + orc->bp_offset, &state->bp))
-                        goto done;
+                        goto err;
                 break;
 
         default:
                 orc_warn("unknown BP base reg %d for ip %pB\n",
                          orc->bp_reg, (void *)orig_ip);
-                goto done;
+                goto err;
         }
 
         /* Prevent a recursive loop due to bad ORC data: */
@@ -520,13 +527,16 @@ bool unwind_next_frame(struct unwind_state *state)
             state->sp <= prev_sp) {
                 orc_warn("stack going in the wrong direction? ip=%pB\n",
                          (void *)orig_ip);
-                goto done;
+                goto err;
         }
 
         preempt_enable();
         return true;
 
-done:
+err:
+        state->error = true;
+
+the_end:
         preempt_enable();
         state->stack_info.type = STACK_TYPE_UNKNOWN;
         return false;
diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
index 9d0b5af7db91..1c03e4aa6474 100644
--- a/arch/x86/kernel/vm86_32.c
+++ b/arch/x86/kernel/vm86_32.c
@@ -149,7 +149,7 @@ void save_v86_state(struct kernel_vm86_regs *regs, int retval)
         preempt_disable();
         tsk->thread.sp0 = vm86->saved_sp0;
         tsk->thread.sysenter_cs = __KERNEL_CS;
-        update_sp0(tsk);
+        update_task_stack(tsk);
         refresh_sysenter_cs(&tsk->thread);
         vm86->saved_sp0 = 0;
         preempt_enable();
@@ -374,7 +374,7 @@ static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus)
                 refresh_sysenter_cs(&tsk->thread);
         }
 
-        update_sp0(tsk);
+        update_task_stack(tsk);
         preempt_enable();
 
         if (vm86->flags & VM86_SCREEN_BITMAP)
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 5e1458f609a1..8bde0a419f86 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -55,19 +55,22 @@ jiffies_64 = jiffies;
  * so we can enable protection checks as well as retain 2MB large page
  * mappings for kernel text.
  */
-#define X64_ALIGN_RODATA_BEGIN  . = ALIGN(HPAGE_SIZE);
+#define X86_ALIGN_RODATA_BEGIN  . = ALIGN(HPAGE_SIZE);
 
-#define X64_ALIGN_RODATA_END                                    \
+#define X86_ALIGN_RODATA_END                                    \
                 . = ALIGN(HPAGE_SIZE);                          \
-                __end_rodata_hpage_align = .;
+                __end_rodata_hpage_align = .;                   \
+                __end_rodata_aligned = .;
 
 #define ALIGN_ENTRY_TEXT_BEGIN  . = ALIGN(PMD_SIZE);
 #define ALIGN_ENTRY_TEXT_END    . = ALIGN(PMD_SIZE);
 
 #else
 
-#define X64_ALIGN_RODATA_BEGIN
-#define X64_ALIGN_RODATA_END
+#define X86_ALIGN_RODATA_BEGIN
+#define X86_ALIGN_RODATA_END                                    \
+                . = ALIGN(PAGE_SIZE);                           \
+                __end_rodata_aligned = .;
 
 #define ALIGN_ENTRY_TEXT_BEGIN
 #define ALIGN_ENTRY_TEXT_END
@@ -141,9 +144,9 @@ SECTIONS
 
         /* .text should occupy whole number of pages */
         . = ALIGN(PAGE_SIZE);
-        X64_ALIGN_RODATA_BEGIN
+        X86_ALIGN_RODATA_BEGIN
         RO_DATA(PAGE_SIZE)
-        X64_ALIGN_RODATA_END
+        X86_ALIGN_RODATA_END
 
         /* Data */
         .data : AT(ADDR(.data) - LOAD_OFFSET) {
diff --git a/arch/x86/kernel/x86_init.c b/arch/x86/kernel/x86_init.c
index 3ab867603e81..2792b5573818 100644
--- a/arch/x86/kernel/x86_init.c
+++ b/arch/x86/kernel/x86_init.c
@@ -109,7 +109,7 @@ struct x86_cpuinit_ops x86_cpuinit = {
 static void default_nmi_init(void) { };
 
 struct x86_platform_ops x86_platform __ro_after_init = {
-        .calibrate_cpu                  = native_calibrate_cpu,
+        .calibrate_cpu                  = native_calibrate_cpu_early,
         .calibrate_tsc                  = native_calibrate_tsc,
         .get_wallclock                  = mach_get_cmos_time,
         .set_wallclock                  = mach_set_rtc_mmss,
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index b5cd8465d44f..d536d457517b 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1379,7 +1379,7 @@ static void apic_timer_expired(struct kvm_lapic *apic)
          * using swait_active() is safe.
          */
         if (swait_active(q))
-                swake_up(q);
+                swake_up_one(q);
 
         if (apic_lvtt_tscdeadline(apic))
                 ktimer->expired_tscdeadline = ktimer->tscdeadline;
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index e30da9a2430c..5d8e317c2b04 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -7893,6 +7893,8 @@ static int enter_vmx_operation(struct kvm_vcpu *vcpu)
                      HRTIMER_MODE_REL_PINNED);
         vmx->nested.preemption_timer.function = vmx_preemption_timer_fn;
 
+        vmx->nested.vpid02 = allocate_vpid();
+
         vmx->nested.vmxon = true;
         return 0;
 
@@ -8480,21 +8482,20 @@ static int handle_vmptrld(struct kvm_vcpu *vcpu)
 /* Emulate the VMPTRST instruction */
 static int handle_vmptrst(struct kvm_vcpu *vcpu)
 {
-        unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
-        u32 vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
-        gva_t vmcs_gva;
+        unsigned long exit_qual = vmcs_readl(EXIT_QUALIFICATION);
+        u32 instr_info = vmcs_read32(VMX_INSTRUCTION_INFO);
+        gpa_t current_vmptr = to_vmx(vcpu)->nested.current_vmptr;
         struct x86_exception e;
+        gva_t gva;
 
         if (!nested_vmx_check_permission(vcpu))
                 return 1;
 
-        if (get_vmx_mem_address(vcpu, exit_qualification,
-                        vmx_instruction_info, true, &vmcs_gva))
+        if (get_vmx_mem_address(vcpu, exit_qual, instr_info, true, &gva))
                 return 1;
         /* *_system ok, nested_vmx_check_permission has verified cpl=0 */
-        if (kvm_write_guest_virt_system(vcpu, vmcs_gva,
-                                        (void *)&to_vmx(vcpu)->nested.current_vmptr,
-                                        sizeof(u64), &e)) {
+        if (kvm_write_guest_virt_system(vcpu, gva, (void *)&current_vmptr,
+                                        sizeof(gpa_t), &e)) {
                 kvm_inject_page_fault(vcpu, &e);
                 return 1;
         }
@@ -10370,11 +10371,9 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id)
                         goto free_vmcs;
         }
 
-        if (nested) {
+        if (nested)
                 nested_vmx_setup_ctls_msrs(&vmx->nested.msrs,
                                            kvm_vcpu_apicv_active(&vmx->vcpu));
-                vmx->nested.vpid02 = allocate_vpid();
-        }
 
         vmx->nested.posted_intr_nv = -1;
         vmx->nested.current_vmptr = -1ull;
@@ -10391,7 +10390,6 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id)
         return &vmx->vcpu;
 
 free_vmcs:
-        free_vpid(vmx->nested.vpid02);
         free_loaded_vmcs(vmx->loaded_vmcs);
 free_msrs:
         kfree(vmx->guest_msrs);
diff --git a/arch/x86/lib/memcpy_64.S b/arch/x86/lib/memcpy_64.S
index 298ef1479240..3b24dc05251c 100644
--- a/arch/x86/lib/memcpy_64.S
+++ b/arch/x86/lib/memcpy_64.S
@@ -256,7 +256,7 @@ ENTRY(__memcpy_mcsafe)
 
         /* Copy successful. Return zero */
 .L_done_memcpy_trap:
-        xorq %rax, %rax
+        xorl %eax, %eax
         ret
 ENDPROC(__memcpy_mcsafe)
 EXPORT_SYMBOL_GPL(__memcpy_mcsafe)
diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
index 2f3c9196b834..a12afff146d1 100644
--- a/arch/x86/mm/dump_pagetables.c
+++ b/arch/x86/mm/dump_pagetables.c
@@ -111,6 +111,8 @@ static struct addr_marker address_markers[] = {
         [END_OF_SPACE_NR]       = { -1,                 NULL }
 };
 
+#define INIT_PGD        ((pgd_t *) &init_top_pgt)
+
 #else /* CONFIG_X86_64 */
 
 enum address_markers_idx {
@@ -121,6 +123,9 @@ enum address_markers_idx {
 #ifdef CONFIG_HIGHMEM
         PKMAP_BASE_NR,
 #endif
+#ifdef CONFIG_MODIFY_LDT_SYSCALL
+        LDT_NR,
+#endif
         CPU_ENTRY_AREA_NR,
         FIXADDR_START_NR,
         END_OF_SPACE_NR,
@@ -134,11 +139,16 @@ static struct addr_marker address_markers[] = {
 #ifdef CONFIG_HIGHMEM
         [PKMAP_BASE_NR]         = { 0UL,                "Persistent kmap() Area" },
 #endif
+#ifdef CONFIG_MODIFY_LDT_SYSCALL
+        [LDT_NR]                = { 0UL,                "LDT remap" },
+#endif
         [CPU_ENTRY_AREA_NR]     = { 0UL,                "CPU entry area" },
         [FIXADDR_START_NR]      = { 0UL,                "Fixmap area" },
         [END_OF_SPACE_NR]       = { -1,                 NULL }
 };
 
+#define INIT_PGD        (swapper_pg_dir)
+
 #endif /* !CONFIG_X86_64 */
 
 /* Multipliers for offsets within the PTEs */
@@ -496,11 +506,7 @@ static inline bool is_hypervisor_range(int idx)
 static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd,
                                        bool checkwx, bool dmesg)
 {
-#ifdef CONFIG_X86_64
-        pgd_t *start = (pgd_t *) &init_top_pgt;
-#else
-        pgd_t *start = swapper_pg_dir;
-#endif
+        pgd_t *start = INIT_PGD;
         pgprotval_t prot, eff;
         int i;
         struct pg_state st = {};
@@ -563,12 +569,13 @@ void ptdump_walk_pgd_level_debugfs(struct seq_file *m, pgd_t *pgd, bool user)
 }
 EXPORT_SYMBOL_GPL(ptdump_walk_pgd_level_debugfs);
 
-static void ptdump_walk_user_pgd_level_checkwx(void)
+void ptdump_walk_user_pgd_level_checkwx(void)
 {
 #ifdef CONFIG_PAGE_TABLE_ISOLATION
-        pgd_t *pgd = (pgd_t *) &init_top_pgt;
+        pgd_t *pgd = INIT_PGD;
 
-        if (!static_cpu_has(X86_FEATURE_PTI))
+        if (!(__supported_pte_mask & _PAGE_NX) ||
+            !static_cpu_has(X86_FEATURE_PTI))
                 return;
 
         pr_info("x86/mm: Checking user space page tables\n");
@@ -580,7 +587,6 @@ static void ptdump_walk_user_pgd_level_checkwx(void)
 void ptdump_walk_pgd_level_checkwx(void)
 {
         ptdump_walk_pgd_level_core(NULL, NULL, true, false);
-        ptdump_walk_user_pgd_level_checkwx();
 }
 
 static int __init pt_dump_init(void)
@@ -609,6 +615,9 @@ static int __init pt_dump_init(void)
 # endif
         address_markers[FIXADDR_START_NR].start_address = FIXADDR_START;
         address_markers[CPU_ENTRY_AREA_NR].start_address = CPU_ENTRY_AREA_BASE;
+# ifdef CONFIG_MODIFY_LDT_SYSCALL
+        address_markers[LDT_NR].start_address = LDT_BASE_ADDR;
+# endif
 #endif
         return 0;
 }
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 2aafa6ab6103..db1c042e9853 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -317,8 +317,6 @@ static noinline int vmalloc_fault(unsigned long address)
         if (!(address >= VMALLOC_START && address < VMALLOC_END))
                 return -1;
 
-        WARN_ON_ONCE(in_nmi());
-
         /*
          * Synchronize this task's top level page-table
          * with the 'reference' page table.
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index cee58a972cb2..74b157ac078d 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -773,13 +773,44 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
         }
 }
 
+/*
+ * begin/end can be in the direct map or the "high kernel mapping"
+ * used for the kernel image only.  free_init_pages() will do the
+ * right thing for either kind of address.
+ */
+void free_kernel_image_pages(void *begin, void *end)
+{
+        unsigned long begin_ul = (unsigned long)begin;
+        unsigned long end_ul = (unsigned long)end;
+        unsigned long len_pages = (end_ul - begin_ul) >> PAGE_SHIFT;
+
+
+        free_init_pages("unused kernel image", begin_ul, end_ul);
+
+        /*
+         * PTI maps some of the kernel into userspace.  For performance,
+         * this includes some kernel areas that do not contain secrets.
+         * Those areas might be adjacent to the parts of the kernel image
+         * being freed, which may contain secrets.  Remove the "high kernel
+         * image mapping" for these freed areas, ensuring they are not even
+         * potentially vulnerable to Meltdown regardless of the specific
+         * optimizations PTI is currently using.
+         *
+         * The "noalias" prevents unmapping the direct map alias which is
+         * needed to access the freed pages.
+         *
+         * This is only valid for 64bit kernels. 32bit has only one mapping
+         * which can't be treated in this way for obvious reasons.
+         */
+        if (IS_ENABLED(CONFIG_X86_64) && cpu_feature_enabled(X86_FEATURE_PTI))
+                set_memory_np_noalias(begin_ul, len_pages);
+}
+
 void __ref free_initmem(void)
 {
         e820__reallocate_tables();
 
-        free_init_pages("unused kernel",
-                        (unsigned long)(&__init_begin),
-                        (unsigned long)(&__init_end));
+        free_kernel_image_pages(&__init_begin, &__init_end);
 }
 
 #ifdef CONFIG_BLK_DEV_INITRD
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index a688617c727e..dd519f372169 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -1283,20 +1283,10 @@ void mark_rodata_ro(void)
         set_memory_ro(start, (end-start) >> PAGE_SHIFT);
 #endif
 
-        free_init_pages("unused kernel",
-                        (unsigned long) __va(__pa_symbol(text_end)),
-                        (unsigned long) __va(__pa_symbol(rodata_start)));
-        free_init_pages("unused kernel",
-                        (unsigned long) __va(__pa_symbol(rodata_end)),
-                        (unsigned long) __va(__pa_symbol(_sdata)));
+        free_kernel_image_pages((void *)text_end, (void *)rodata_start);
+        free_kernel_image_pages((void *)rodata_end, (void *)_sdata);
 
         debug_checkwx();
-
-        /*
-         * Do this after all of the manipulation of the
-         * kernel text page tables are complete.
-         */
-        pti_clone_kernel_text();
 }
 
 int kern_addr_valid(unsigned long addr)
diff --git a/arch/x86/mm/numa_emulation.c b/arch/x86/mm/numa_emulation.c
index 34a2a3bfde9c..b54d52a2d00a 100644
--- a/arch/x86/mm/numa_emulation.c
+++ b/arch/x86/mm/numa_emulation.c
@@ -61,7 +61,7 @@ static int __init emu_setup_memblk(struct numa_meminfo *ei,
         eb->nid = nid;
 
         if (emu_nid_to_phys[nid] == NUMA_NO_NODE)
-                emu_nid_to_phys[nid] = nid;
+                emu_nid_to_phys[nid] = pb->nid;
 
         pb->start += size;
         if (pb->start >= pb->end) {
@@ -198,40 +198,73 @@ static u64 __init find_end_of_node(u64 start, u64 max_addr, u64 size)
         return end;
 }
 
+static u64 uniform_size(u64 max_addr, u64 base, u64 hole, int nr_nodes)
+{
+        unsigned long max_pfn = PHYS_PFN(max_addr);
+        unsigned long base_pfn = PHYS_PFN(base);
+        unsigned long hole_pfns = PHYS_PFN(hole);
+
+        return PFN_PHYS((max_pfn - base_pfn - hole_pfns) / nr_nodes);
+}
+
 /*
  * Sets up fake nodes of `size' interleaved over physical nodes ranging from
  * `addr' to `max_addr'.
  *
  * Returns zero on success or negative on error.
  */
-static int __init split_nodes_size_interleave(struct numa_meminfo *ei,
+static int __init split_nodes_size_interleave_uniform(struct numa_meminfo *ei,
                                               struct numa_meminfo *pi,
-                                              u64 addr, u64 max_addr, u64 size)
+                                              u64 addr, u64 max_addr, u64 size,
+                                              int nr_nodes, struct numa_memblk *pblk,
+                                              int nid)
 {
         nodemask_t physnode_mask = numa_nodes_parsed;
+        int i, ret, uniform = 0;
         u64 min_size;
-        int nid = 0;
-        int i, ret;
 
-        if (!size)
+        if ((!size && !nr_nodes) || (nr_nodes && !pblk))
                 return -1;
+
         /*
-         * The limit on emulated nodes is MAX_NUMNODES, so the size per node is
-         * increased accordingly if the requested size is too small.  This
-         * creates a uniform distribution of node sizes across the entire
-         * machine (but not necessarily over physical nodes).
+         * In the 'uniform' case split the passed in physical node by
+         * nr_nodes, in the non-uniform case, ignore the passed in
+         * physical block and try to create nodes of at least size
+         * @size.
+         *
+         * In the uniform case, split the nodes strictly by physical
+         * capacity, i.e. ignore holes. In the non-uniform case account
+         * for holes and treat @size as a minimum floor.
          */
-        min_size = (max_addr - addr - mem_hole_size(addr, max_addr)) / MAX_NUMNODES;
-        min_size = max(min_size, FAKE_NODE_MIN_SIZE);
-        if ((min_size & FAKE_NODE_MIN_HASH_MASK) < min_size)
-                min_size = (min_size + FAKE_NODE_MIN_SIZE) &
-                                                FAKE_NODE_MIN_HASH_MASK;
+        if (!nr_nodes)
+                nr_nodes = MAX_NUMNODES;
+        else {
+                nodes_clear(physnode_mask);
+                node_set(pblk->nid, physnode_mask);
+                uniform = 1;
+        }
+
+        if (uniform) {
+                min_size = uniform_size(max_addr, addr, 0, nr_nodes);
+                size = min_size;
+        } else {
+                /*
+                 * The limit on emulated nodes is MAX_NUMNODES, so the
+                 * size per node is increased accordingly if the
+                 * requested size is too small.  This creates a uniform
+                 * distribution of node sizes across the entire machine
+                 * (but not necessarily over physical nodes).
+                 */
+                min_size = uniform_size(max_addr, addr,
+                                mem_hole_size(addr, max_addr), nr_nodes);
+        }
+        min_size = ALIGN(max(min_size, FAKE_NODE_MIN_SIZE), FAKE_NODE_MIN_SIZE);
         if (size < min_size) {
                 pr_err("Fake node size %LuMB too small, increasing to %LuMB\n",
                         size >> 20, min_size >> 20);
                 size = min_size;
         }
-        size &= FAKE_NODE_MIN_HASH_MASK;
+        size = ALIGN_DOWN(size, FAKE_NODE_MIN_SIZE);
 
         /*
          * Fill physical nodes with fake nodes of size until there is no memory
@@ -248,10 +281,14 @@ static int __init split_nodes_size_interleave(struct numa_meminfo *ei,
                                 node_clear(i, physnode_mask);
                                 continue;
                         }
+
                         start = pi->blk[phys_blk].start;
                         limit = pi->blk[phys_blk].end;
 
-                        end = find_end_of_node(start, limit, size);
+                        if (uniform)
+                                end = start + size;
+                        else
+                                end = find_end_of_node(start, limit, size);
                         /*
                          * If there won't be at least FAKE_NODE_MIN_SIZE of
                          * non-reserved memory in ZONE_DMA32 for the next node,
@@ -266,7 +303,8 @@ static int __init split_nodes_size_interleave(struct numa_meminfo *ei,
                          * next node, this one must extend to the end of the
                          * physical node.
                          */
-                        if (limit - end - mem_hole_size(end, limit) < size)
+                        if ((limit - end - mem_hole_size(end, limit) < size)
+                                        && !uniform)
                                 end = limit;
 
                         ret = emu_setup_memblk(ei, pi, nid++ % MAX_NUMNODES,
@@ -276,7 +314,15 @@ static int __init split_nodes_size_interleave(struct numa_meminfo *ei,
                                 return ret;
                 }
         }
-        return 0;
+        return nid;
+}
+
+static int __init split_nodes_size_interleave(struct numa_meminfo *ei,
+                                              struct numa_meminfo *pi,
+                                              u64 addr, u64 max_addr, u64 size)
+{
+        return split_nodes_size_interleave_uniform(ei, pi, addr, max_addr, size,
+                        0, NULL, NUMA_NO_NODE);
 }
 
 int __init setup_emu2phys_nid(int *dfl_phys_nid)
@@ -346,7 +392,28 @@ void __init numa_emulation(struct numa_meminfo *numa_meminfo, int numa_dist_cnt)
          * the fixed node size.  Otherwise, if it is just a single number N,
          * split the system RAM into N fake nodes.
          */
-        if (strchr(emu_cmdline, 'M') || strchr(emu_cmdline, 'G')) {
+        if (strchr(emu_cmdline, 'U')) {
+                nodemask_t physnode_mask = numa_nodes_parsed;
+                unsigned long n;
+                int nid = 0;
+
+                n = simple_strtoul(emu_cmdline, &emu_cmdline, 0);
+                ret = -1;
+                for_each_node_mask(i, physnode_mask) {
+                        ret = split_nodes_size_interleave_uniform(&ei, &pi,
+                                        pi.blk[i].start, pi.blk[i].end, 0,
+                                        n, &pi.blk[i], nid);
+                        if (ret < 0)
+                                break;
+                        if (ret < n) {
+                                pr_info("%s: phys: %d only got %d of %ld nodes, failing\n",
+                                                __func__, i, ret, n);
+                                ret = -1;
+                                break;
+                        }
+                        nid = ret;
+                }
+        } else if (strchr(emu_cmdline, 'M') || strchr(emu_cmdline, 'G')) {
                 u64 size;
 
                 size = memparse(emu_cmdline, &emu_cmdline);
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 3bded76e8d5c..0a74996a1149 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -53,6 +53,7 @@ static DEFINE_SPINLOCK(cpa_lock);
 #define CPA_FLUSHTLB 1
 #define CPA_ARRAY 2
 #define CPA_PAGES_ARRAY 4
+#define CPA_NO_CHECK_ALIAS 8 /* Do not search for aliases */
 
 #ifdef CONFIG_PROC_FS
 static unsigned long direct_pages_count[PG_LEVEL_NUM];
@@ -1486,6 +1487,9 @@ static int change_page_attr_set_clr(unsigned long *addr, int numpages,
 
         /* No alias checking for _NX bit modifications */
         checkalias = (pgprot_val(mask_set) | pgprot_val(mask_clr)) != _PAGE_NX;
+        /* Has caller explicitly disabled alias checking? */
+        if (in_flag & CPA_NO_CHECK_ALIAS)
+                checkalias = 0;
 
         ret = __change_page_attr_set_clr(&cpa, checkalias);
 
@@ -1772,6 +1776,15 @@ int set_memory_np(unsigned long addr, int numpages)
         return change_page_attr_clear(&addr, numpages, __pgprot(_PAGE_PRESENT), 0);
 }
 
+int set_memory_np_noalias(unsigned long addr, int numpages)
+{
+        int cpa_flags = CPA_NO_CHECK_ALIAS;
+
+        return change_page_attr_set_clr(&addr, numpages, __pgprot(0),
+                                        __pgprot(_PAGE_PRESENT), 0,
+                                        cpa_flags, NULL);
+}
+
 int set_memory_4k(unsigned long addr, int numpages)
 {
         return change_page_attr_set_clr(&addr, numpages, __pgprot(0),
@@ -1784,6 +1797,12 @@ int set_memory_nonglobal(unsigned long addr, int numpages)
                                       __pgprot(_PAGE_GLOBAL), 0);
 }
 
+int set_memory_global(unsigned long addr, int numpages)
+{
+        return change_page_attr_set(&addr, numpages,
+                                    __pgprot(_PAGE_GLOBAL), 0);
+}
+
 static int __set_memory_enc_dec(unsigned long addr, int numpages, bool enc)
 {
         struct cpa_data cpa;
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index 47b5951e592b..3ef095c70ae3 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -182,6 +182,14 @@ static void pgd_dtor(pgd_t *pgd)
  */
 #define PREALLOCATED_PMDS       UNSHARED_PTRS_PER_PGD
 
+/*
+ * We allocate separate PMDs for the kernel part of the user page-table
+ * when PTI is enabled. We need them to map the per-process LDT into the
+ * user-space page-table.
+ */
+#define PREALLOCATED_USER_PMDS   (static_cpu_has(X86_FEATURE_PTI) ? \
+                                        KERNEL_PGD_PTRS : 0)
+
 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
 {
         paravirt_alloc_pmd(mm, __pa(pmd) >> PAGE_SHIFT);
@@ -202,14 +210,14 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
 
 /* No need to prepopulate any pagetable entries in non-PAE modes. */
 #define PREALLOCATED_PMDS       0
-
+#define PREALLOCATED_USER_PMDS   0
 #endif  /* CONFIG_X86_PAE */
 
-static void free_pmds(struct mm_struct *mm, pmd_t *pmds[])
+static void free_pmds(struct mm_struct *mm, pmd_t *pmds[], int count)
 {
         int i;
 
-        for(i = 0; i < PREALLOCATED_PMDS; i++)
+        for (i = 0; i < count; i++)
                 if (pmds[i]) {
                         pgtable_pmd_page_dtor(virt_to_page(pmds[i]));
                         free_page((unsigned long)pmds[i]);
@@ -217,7 +225,7 @@ static void free_pmds(struct mm_struct *mm, pmd_t *pmds[])
                 }
 }
 
-static int preallocate_pmds(struct mm_struct *mm, pmd_t *pmds[])
+static int preallocate_pmds(struct mm_struct *mm, pmd_t *pmds[], int count)
 {
         int i;
         bool failed = false;
@@ -226,7 +234,7 @@ static int preallocate_pmds(struct mm_struct *mm, pmd_t *pmds[])
         if (mm == &init_mm)
                 gfp &= ~__GFP_ACCOUNT;
 
-        for(i = 0; i < PREALLOCATED_PMDS; i++) {
+        for (i = 0; i < count; i++) {
                 pmd_t *pmd = (pmd_t *)__get_free_page(gfp);
                 if (!pmd)
                         failed = true;
@@ -241,7 +249,7 @@ static int preallocate_pmds(struct mm_struct *mm, pmd_t *pmds[])
         }
 
         if (failed) {
-                free_pmds(mm, pmds);
+                free_pmds(mm, pmds, count);
                 return -ENOMEM;
         }
 
@@ -254,23 +262,38 @@ static int preallocate_pmds(struct mm_struct *mm, pmd_t *pmds[])
  * preallocate which never got a corresponding vma will need to be
  * freed manually.
  */
+static void mop_up_one_pmd(struct mm_struct *mm, pgd_t *pgdp)
+{
+        pgd_t pgd = *pgdp;
+
+        if (pgd_val(pgd) != 0) {
+                pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
+
+                *pgdp = native_make_pgd(0);
+
+                paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
+                pmd_free(mm, pmd);
+                mm_dec_nr_pmds(mm);
+        }
+}
+
 static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
 {
         int i;
 
-        for(i = 0; i < PREALLOCATED_PMDS; i++) {
-                pgd_t pgd = pgdp[i];
+        for (i = 0; i < PREALLOCATED_PMDS; i++)
+                mop_up_one_pmd(mm, &pgdp[i]);
 
-                if (pgd_val(pgd) != 0) {
-                        pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
 
-                        pgdp[i] = native_make_pgd(0);
+        if (!static_cpu_has(X86_FEATURE_PTI))
+                return;
 
-                        paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
-                        pmd_free(mm, pmd);
-                        mm_dec_nr_pmds(mm);
-                }
-        }
+        pgdp = kernel_to_user_pgdp(pgdp);
+
+        for (i = 0; i < PREALLOCATED_USER_PMDS; i++)
+                mop_up_one_pmd(mm, &pgdp[i + KERNEL_PGD_BOUNDARY]);
+#endif
 }
 
 static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
@@ -296,6 +319,38 @@ static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
         }
 }
 
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+static void pgd_prepopulate_user_pmd(struct mm_struct *mm,
+                                     pgd_t *k_pgd, pmd_t *pmds[])
+{
+        pgd_t *s_pgd = kernel_to_user_pgdp(swapper_pg_dir);
+        pgd_t *u_pgd = kernel_to_user_pgdp(k_pgd);
+        p4d_t *u_p4d;
+        pud_t *u_pud;
+        int i;
+
+        u_p4d = p4d_offset(u_pgd, 0);
+        u_pud = pud_offset(u_p4d, 0);
+
+        s_pgd += KERNEL_PGD_BOUNDARY;
+        u_pud += KERNEL_PGD_BOUNDARY;
+
+        for (i = 0; i < PREALLOCATED_USER_PMDS; i++, u_pud++, s_pgd++) {
+                pmd_t *pmd = pmds[i];
+
+                memcpy(pmd, (pmd_t *)pgd_page_vaddr(*s_pgd),
+                       sizeof(pmd_t) * PTRS_PER_PMD);
+
+                pud_populate(mm, u_pud, pmd);
+        }
+
+}
+#else
+static void pgd_prepopulate_user_pmd(struct mm_struct *mm,
+                                     pgd_t *k_pgd, pmd_t *pmds[])
+{
+}
+#endif
 /*
  * Xen paravirt assumes pgd table should be in one page. 64 bit kernel also
  * assumes that pgd should be in one page.
@@ -329,9 +384,6 @@ static int __init pgd_cache_init(void)
          */
         pgd_cache = kmem_cache_create("pgd_cache", PGD_SIZE, PGD_ALIGN,
                                       SLAB_PANIC, NULL);
-        if (!pgd_cache)
-                return -ENOMEM;
-
         return 0;
 }
 core_initcall(pgd_cache_init);
@@ -343,7 +395,8 @@ static inline pgd_t *_pgd_alloc(void)
          * We allocate one page for pgd.
          */
         if (!SHARED_KERNEL_PMD)
-                return (pgd_t *)__get_free_page(PGALLOC_GFP);
+                return (pgd_t *)__get_free_pages(PGALLOC_GFP,
+                                                 PGD_ALLOCATION_ORDER);
 
         /*
          * Now PAE kernel is not running as a Xen domain. We can allocate
@@ -355,7 +408,7 @@ static inline pgd_t *_pgd_alloc(void)
 static inline void _pgd_free(pgd_t *pgd)
 {
         if (!SHARED_KERNEL_PMD)
-                free_page((unsigned long)pgd);
+                free_pages((unsigned long)pgd, PGD_ALLOCATION_ORDER);
         else
                 kmem_cache_free(pgd_cache, pgd);
 }
@@ -375,6 +428,7 @@ static inline void _pgd_free(pgd_t *pgd)
 pgd_t *pgd_alloc(struct mm_struct *mm)
 {
         pgd_t *pgd;
+        pmd_t *u_pmds[PREALLOCATED_USER_PMDS];
         pmd_t *pmds[PREALLOCATED_PMDS];
 
         pgd = _pgd_alloc();
@@ -384,12 +438,15 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
 
         mm->pgd = pgd;
 
-        if (preallocate_pmds(mm, pmds) != 0)
+        if (preallocate_pmds(mm, pmds, PREALLOCATED_PMDS) != 0)
                 goto out_free_pgd;
 
-        if (paravirt_pgd_alloc(mm) != 0)
+        if (preallocate_pmds(mm, u_pmds, PREALLOCATED_USER_PMDS) != 0)
                 goto out_free_pmds;
 
+        if (paravirt_pgd_alloc(mm) != 0)
+                goto out_free_user_pmds;
+
         /*
          * Make sure that pre-populating the pmds is atomic with
          * respect to anything walking the pgd_list, so that they
@@ -399,13 +456,16 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
 
         pgd_ctor(mm, pgd);
         pgd_prepopulate_pmd(mm, pgd, pmds);
+        pgd_prepopulate_user_pmd(mm, pgd, u_pmds);
 
         spin_unlock(&pgd_lock);
 
         return pgd;
 
+out_free_user_pmds:
+        free_pmds(mm, u_pmds, PREALLOCATED_USER_PMDS);
 out_free_pmds:
-        free_pmds(mm, pmds);
+        free_pmds(mm, pmds, PREALLOCATED_PMDS);
 out_free_pgd:
         _pgd_free(pgd);
 out:
@@ -719,28 +779,50 @@ int pmd_clear_huge(pmd_t *pmd)
         return 0;
 }
 
+#ifdef CONFIG_X86_64
 /**
  * pud_free_pmd_page - Clear pud entry and free pmd page.
  * @pud: Pointer to a PUD.
+ * @addr: Virtual address associated with pud.
  *
- * Context: The pud range has been unmaped and TLB purged.
+ * Context: The pud range has been unmapped and TLB purged.
  * Return: 1 if clearing the entry succeeded. 0 otherwise.
+ *
+ * NOTE: Callers must allow a single page allocation.
  */
-int pud_free_pmd_page(pud_t *pud)
+int pud_free_pmd_page(pud_t *pud, unsigned long addr)
 {
-        pmd_t *pmd;
+        pmd_t *pmd, *pmd_sv;
+        pte_t *pte;
         int i;
 
         if (pud_none(*pud))
                 return 1;
 
         pmd = (pmd_t *)pud_page_vaddr(*pud);
+        pmd_sv = (pmd_t *)__get_free_page(GFP_KERNEL);
+        if (!pmd_sv)
+                return 0;
 
-        for (i = 0; i < PTRS_PER_PMD; i++)
-                if (!pmd_free_pte_page(&pmd[i]))
-                        return 0;
+        for (i = 0; i < PTRS_PER_PMD; i++) {
+                pmd_sv[i] = pmd[i];
+                if (!pmd_none(pmd[i]))
+                        pmd_clear(&pmd[i]);
+        }
 
         pud_clear(pud);
+
+        /* INVLPG to clear all paging-structure caches */
+        flush_tlb_kernel_range(addr, addr + PAGE_SIZE-1);
+
+        for (i = 0; i < PTRS_PER_PMD; i++) {
+                if (!pmd_none(pmd_sv[i])) {
+                        pte = (pte_t *)pmd_page_vaddr(pmd_sv[i]);
+                        free_page((unsigned long)pte);
+                }
+        }
+
+        free_page((unsigned long)pmd_sv);
         free_page((unsigned long)pmd);
 
         return 1;
@@ -749,11 +831,12 @@ int pud_free_pmd_page(pud_t *pud)
 /**
  * pmd_free_pte_page - Clear pmd entry and free pte page.
  * @pmd: Pointer to a PMD.
+ * @addr: Virtual address associated with pmd.
  *
- * Context: The pmd range has been unmaped and TLB purged.
+ * Context: The pmd range has been unmapped and TLB purged.
  * Return: 1 if clearing the entry succeeded. 0 otherwise.
  */
-int pmd_free_pte_page(pmd_t *pmd)
+int pmd_free_pte_page(pmd_t *pmd, unsigned long addr)
 {
         pte_t *pte;
 
@@ -762,8 +845,30 @@ int pmd_free_pte_page(pmd_t *pmd)
 
         pte = (pte_t *)pmd_page_vaddr(*pmd);
         pmd_clear(pmd);
+
+        /* INVLPG to clear all paging-structure caches */
+        flush_tlb_kernel_range(addr, addr + PAGE_SIZE-1);
+
         free_page((unsigned long)pte);
 
         return 1;
 }
+
+#else /* !CONFIG_X86_64 */
+
+int pud_free_pmd_page(pud_t *pud, unsigned long addr)
+{
+        return pud_none(*pud);
+}
+
+/*
+ * Disable free page handling on x86-PAE. This assures that ioremap()
+ * does not update sync'd pmd entries. See vmalloc_sync_one().
+ */
+int pmd_free_pte_page(pmd_t *pmd, unsigned long addr)
+{
+        return pmd_none(*pmd);
+}
+
+#endif /* CONFIG_X86_64 */
 #endif  /* CONFIG_HAVE_ARCH_HUGE_VMAP */
diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
index 4d418e705878..d58b4aba9510 100644
--- a/arch/x86/mm/pti.c
+++ b/arch/x86/mm/pti.c
@@ -54,6 +54,16 @@
 #define __GFP_NOTRACK   0
 #endif
 
+/*
+ * Define the page-table levels we clone for user-space on 32
+ * and 64 bit.
+ */
+#ifdef CONFIG_X86_64
+#define PTI_LEVEL_KERNEL_IMAGE  PTI_CLONE_PMD
+#else
+#define PTI_LEVEL_KERNEL_IMAGE  PTI_CLONE_PTE
+#endif
+
 static void __init pti_print_if_insecure(const char *reason)
 {
         if (boot_cpu_has_bug(X86_BUG_CPU_MELTDOWN))
@@ -117,7 +127,7 @@ enable:
         setup_force_cpu_cap(X86_FEATURE_PTI);
 }
 
-pgd_t __pti_set_user_pgd(pgd_t *pgdp, pgd_t pgd)
+pgd_t __pti_set_user_pgtbl(pgd_t *pgdp, pgd_t pgd)
 {
         /*
          * Changes to the high (kernel) portion of the kernelmode page
@@ -176,7 +186,7 @@ static p4d_t *pti_user_pagetable_walk_p4d(unsigned long address)
 
         if (pgd_none(*pgd)) {
                 unsigned long new_p4d_page = __get_free_page(gfp);
-                if (!new_p4d_page)
+                if (WARN_ON_ONCE(!new_p4d_page))
                         return NULL;
 
                 set_pgd(pgd, __pgd(_KERNPG_TABLE | __pa(new_p4d_page)));
@@ -195,13 +205,17 @@ static p4d_t *pti_user_pagetable_walk_p4d(unsigned long address)
 static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address)
 {
         gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
-        p4d_t *p4d = pti_user_pagetable_walk_p4d(address);
+        p4d_t *p4d;
         pud_t *pud;
 
+        p4d = pti_user_pagetable_walk_p4d(address);
+        if (!p4d)
+                return NULL;
+
         BUILD_BUG_ON(p4d_large(*p4d) != 0);
         if (p4d_none(*p4d)) {
                 unsigned long new_pud_page = __get_free_page(gfp);
-                if (!new_pud_page)
+                if (WARN_ON_ONCE(!new_pud_page))
                         return NULL;
 
                 set_p4d(p4d, __p4d(_KERNPG_TABLE | __pa(new_pud_page)));
@@ -215,7 +229,7 @@ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address)
         }
         if (pud_none(*pud)) {
                 unsigned long new_pmd_page = __get_free_page(gfp);
-                if (!new_pmd_page)
+                if (WARN_ON_ONCE(!new_pmd_page))
                         return NULL;
 
                 set_pud(pud, __pud(_KERNPG_TABLE | __pa(new_pmd_page)));
@@ -224,7 +238,6 @@ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address)
         return pmd_offset(pud, address);
 }
 
-#ifdef CONFIG_X86_VSYSCALL_EMULATION
 /*
  * Walk the shadow copy of the page tables (optionally) trying to allocate
  * page table pages on the way down.  Does not support large pages.
@@ -237,9 +250,13 @@ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address)
 static __init pte_t *pti_user_pagetable_walk_pte(unsigned long address)
 {
         gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
-        pmd_t *pmd = pti_user_pagetable_walk_pmd(address);
+        pmd_t *pmd;
         pte_t *pte;
 
+        pmd = pti_user_pagetable_walk_pmd(address);
+        if (!pmd)
+                return NULL;
+
         /* We can't do anything sensible if we hit a large mapping. */
         if (pmd_large(*pmd)) {
                 WARN_ON(1);
@@ -262,6 +279,7 @@ static __init pte_t *pti_user_pagetable_walk_pte(unsigned long address)
         return pte;
 }
 
+#ifdef CONFIG_X86_VSYSCALL_EMULATION
 static void __init pti_setup_vsyscall(void)
 {
         pte_t *pte, *target_pte;
@@ -282,8 +300,14 @@ static void __init pti_setup_vsyscall(void)
 static void __init pti_setup_vsyscall(void) { }
 #endif
 
+enum pti_clone_level {
+        PTI_CLONE_PMD,
+        PTI_CLONE_PTE,
+};
+
 static void
-pti_clone_pmds(unsigned long start, unsigned long end, pmdval_t clear)
+pti_clone_pgtable(unsigned long start, unsigned long end,
+                  enum pti_clone_level level)
 {
         unsigned long addr;
 
@@ -291,59 +315,105 @@ pti_clone_pmds(unsigned long start, unsigned long end, pmdval_t clear)
          * Clone the populated PMDs which cover start to end. These PMD areas
          * can have holes.
          */
-        for (addr = start; addr < end; addr += PMD_SIZE) {
+        for (addr = start; addr < end;) {
+                pte_t *pte, *target_pte;
                 pmd_t *pmd, *target_pmd;
                 pgd_t *pgd;
                 p4d_t *p4d;
                 pud_t *pud;
 
+                /* Overflow check */
+                if (addr < start)
+                        break;
+
                 pgd = pgd_offset_k(addr);
                 if (WARN_ON(pgd_none(*pgd)))
                         return;
                 p4d = p4d_offset(pgd, addr);
                 if (WARN_ON(p4d_none(*p4d)))
                         return;
+
                 pud = pud_offset(p4d, addr);
-                if (pud_none(*pud))
+                if (pud_none(*pud)) {
+                        addr += PUD_SIZE;
                         continue;
+                }
+
                 pmd = pmd_offset(pud, addr);
-                if (pmd_none(*pmd))
+                if (pmd_none(*pmd)) {
+                        addr += PMD_SIZE;
                         continue;
+                }
 
-                target_pmd = pti_user_pagetable_walk_pmd(addr);
-                if (WARN_ON(!target_pmd))
-                        return;
-
-                /*
-                 * Only clone present PMDs.  This ensures only setting
-                 * _PAGE_GLOBAL on present PMDs.  This should only be
-                 * called on well-known addresses anyway, so a non-
-                 * present PMD would be a surprise.
-                 */
-                if (WARN_ON(!(pmd_flags(*pmd) & _PAGE_PRESENT)))
-                        return;
-
-                /*
-                 * Setting 'target_pmd' below creates a mapping in both
-                 * the user and kernel page tables.  It is effectively
-                 * global, so set it as global in both copies.  Note:
-                 * the X86_FEATURE_PGE check is not _required_ because
-                 * the CPU ignores _PAGE_GLOBAL when PGE is not
-                 * supported.  The check keeps consistentency with
-                 * code that only set this bit when supported.
-                 */
-                if (boot_cpu_has(X86_FEATURE_PGE))
-                        *pmd = pmd_set_flags(*pmd, _PAGE_GLOBAL);
-
-                /*
-                 * Copy the PMD.  That is, the kernelmode and usermode
-                 * tables will share the last-level page tables of this
-                 * address range
-                 */
-                *target_pmd = pmd_clear_flags(*pmd, clear);
+                if (pmd_large(*pmd) || level == PTI_CLONE_PMD) {
+                        target_pmd = pti_user_pagetable_walk_pmd(addr);
+                        if (WARN_ON(!target_pmd))
+                                return;
+
+                        /*
+                         * Only clone present PMDs.  This ensures only setting
+                         * _PAGE_GLOBAL on present PMDs.  This should only be
+                         * called on well-known addresses anyway, so a non-
+                         * present PMD would be a surprise.
+                         */
+                        if (WARN_ON(!(pmd_flags(*pmd) & _PAGE_PRESENT)))
+                                return;
+
+                        /*
+                         * Setting 'target_pmd' below creates a mapping in both
+                         * the user and kernel page tables.  It is effectively
+                         * global, so set it as global in both copies.  Note:
+                         * the X86_FEATURE_PGE check is not _required_ because
+                         * the CPU ignores _PAGE_GLOBAL when PGE is not
+                         * supported.  The check keeps consistentency with
+                         * code that only set this bit when supported.
+                         */
+                        if (boot_cpu_has(X86_FEATURE_PGE))
+                                *pmd = pmd_set_flags(*pmd, _PAGE_GLOBAL);
+
+                        /*
+                         * Copy the PMD.  That is, the kernelmode and usermode
+                         * tables will share the last-level page tables of this
+                         * address range
+                         */
+                        *target_pmd = *pmd;
+
+                        addr += PMD_SIZE;
+
+                } else if (level == PTI_CLONE_PTE) {
+
+                        /* Walk the page-table down to the pte level */
+                        pte = pte_offset_kernel(pmd, addr);
+                        if (pte_none(*pte)) {
+                                addr += PAGE_SIZE;
+                                continue;
+                        }
+
+                        /* Only clone present PTEs */
+                        if (WARN_ON(!(pte_flags(*pte) & _PAGE_PRESENT)))
+                                return;
+
+                        /* Allocate PTE in the user page-table */
+                        target_pte = pti_user_pagetable_walk_pte(addr);
+                        if (WARN_ON(!target_pte))
+                                return;
+
+                        /* Set GLOBAL bit in both PTEs */
+                        if (boot_cpu_has(X86_FEATURE_PGE))
+                                *pte = pte_set_flags(*pte, _PAGE_GLOBAL);
+
+                        /* Clone the PTE */
+                        *target_pte = *pte;
+
+                        addr += PAGE_SIZE;
+
+                } else {
+                        BUG();
+                }
         }
 }
 
+#ifdef CONFIG_X86_64
 /*
  * Clone a single p4d (i.e. a top-level entry on 4-level systems and a
  * next-level entry on 5-level systems.
@@ -354,6 +424,9 @@ static void __init pti_clone_p4d(unsigned long addr)
         pgd_t *kernel_pgd;
 
         user_p4d = pti_user_pagetable_walk_p4d(addr);
+        if (!user_p4d)
+                return;
+
         kernel_pgd = pgd_offset_k(addr);
         kernel_p4d = p4d_offset(kernel_pgd, addr);
         *user_p4d = *kernel_p4d;
@@ -367,6 +440,25 @@ static void __init pti_clone_user_shared(void)
         pti_clone_p4d(CPU_ENTRY_AREA_BASE);
 }
 
+#else /* CONFIG_X86_64 */
+
+/*
+ * On 32 bit PAE systems with 1GB of Kernel address space there is only
+ * one pgd/p4d for the whole kernel. Cloning that would map the whole
+ * address space into the user page-tables, making PTI useless. So clone
+ * the page-table on the PMD level to prevent that.
+ */
+static void __init pti_clone_user_shared(void)
+{
+        unsigned long start, end;
+
+        start = CPU_ENTRY_AREA_BASE;
+        end   = start + (PAGE_SIZE * CPU_ENTRY_AREA_PAGES);
+
+        pti_clone_pgtable(start, end, PTI_CLONE_PMD);
+}
+#endif /* CONFIG_X86_64 */
+
 /*
  * Clone the ESPFIX P4D into the user space visible page table
  */
@@ -380,11 +472,11 @@ static void __init pti_setup_espfix64(void)
 /*
  * Clone the populated PMDs of the entry and irqentry text and force it RO.
  */
-static void __init pti_clone_entry_text(void)
+static void pti_clone_entry_text(void)
 {
-        pti_clone_pmds((unsigned long) __entry_text_start,
-                        (unsigned long) __irqentry_text_end,
-                       _PAGE_RW);
+        pti_clone_pgtable((unsigned long) __entry_text_start,
+                          (unsigned long) __irqentry_text_end,
+                          PTI_CLONE_PMD);
 }
 
 /*
@@ -435,10 +527,17 @@ static inline bool pti_kernel_image_global_ok(void)
 }
 
 /*
+ * This is the only user for these and it is not arch-generic
+ * like the other set_memory.h functions.  Just extern them.
+ */
+extern int set_memory_nonglobal(unsigned long addr, int numpages);
+extern int set_memory_global(unsigned long addr, int numpages);
+
+/*
  * For some configurations, map all of kernel text into the user page
  * tables.  This reduces TLB misses, especially on non-PCID systems.
  */
-void pti_clone_kernel_text(void)
+static void pti_clone_kernel_text(void)
 {
         /*
          * rodata is part of the kernel image and is normally
@@ -446,7 +545,8 @@ void pti_clone_kernel_text(void)
          * clone the areas past rodata, they might contain secrets.
          */
         unsigned long start = PFN_ALIGN(_text);
-        unsigned long end = (unsigned long)__end_rodata_hpage_align;
+        unsigned long end_clone  = (unsigned long)__end_rodata_aligned;
+        unsigned long end_global = PFN_ALIGN((unsigned long)__stop___ex_table);
 
         if (!pti_kernel_image_global_ok())
                 return;
@@ -458,14 +558,18 @@ void pti_clone_kernel_text(void)
          * pti_set_kernel_image_nonglobal() did to clear the
          * global bit.
          */
-        pti_clone_pmds(start, end, _PAGE_RW);
+        pti_clone_pgtable(start, end_clone, PTI_LEVEL_KERNEL_IMAGE);
+
+        /*
+         * pti_clone_pgtable() will set the global bit in any PMDs
+         * that it clones, but we also need to get any PTEs in
+         * the last level for areas that are not huge-page-aligned.
+         */
+
+        /* Set the global bit for normal non-__init kernel text: */
+        set_memory_global(start, (end_global - start) >> PAGE_SHIFT);
 }
 
-/*
- * This is the only user for it and it is not arch-generic like
- * the other set_memory.h functions.  Just extern it.
- */
-extern int set_memory_nonglobal(unsigned long addr, int numpages);
 void pti_set_kernel_image_nonglobal(void)
 {
         /*
@@ -477,9 +581,11 @@ void pti_set_kernel_image_nonglobal(void)
         unsigned long start = PFN_ALIGN(_text);
         unsigned long end = ALIGN((unsigned long)_end, PMD_PAGE_SIZE);
 
-        if (pti_kernel_image_global_ok())
-                return;
-
+        /*
+         * This clears _PAGE_GLOBAL from the entire kernel image.
+         * pti_clone_kernel_text() map put _PAGE_GLOBAL back for
+         * areas that are mapped to userspace.
+         */
         set_memory_nonglobal(start, (end - start) >> PAGE_SHIFT);
 }
 
@@ -493,6 +599,28 @@ void __init pti_init(void)
 
         pr_info("enabled\n");
 
+#ifdef CONFIG_X86_32
+        /*
+         * We check for X86_FEATURE_PCID here. But the init-code will
+         * clear the feature flag on 32 bit because the feature is not
+         * supported on 32 bit anyway. To print the warning we need to
+         * check with cpuid directly again.
+         */
+        if (cpuid_ecx(0x1) & BIT(17)) {
+                /* Use printk to work around pr_fmt() */
+                printk(KERN_WARNING "\n");
+                printk(KERN_WARNING "************************************************************\n");
+                printk(KERN_WARNING "** WARNING! WARNING! WARNING! WARNING! WARNING! WARNING!  **\n");
+                printk(KERN_WARNING "**                                                        **\n");
+                printk(KERN_WARNING "** You are using 32-bit PTI on a 64-bit PCID-capable CPU. **\n");
+                printk(KERN_WARNING "** Your performance will increase dramatically if you     **\n");
+                printk(KERN_WARNING "** switch to a 64-bit kernel!                             **\n");
+                printk(KERN_WARNING "**                                                        **\n");
+                printk(KERN_WARNING "** WARNING! WARNING! WARNING! WARNING! WARNING! WARNING!  **\n");
+                printk(KERN_WARNING "************************************************************\n");
+        }
+#endif
+
         pti_clone_user_shared();
 
         /* Undo all global bits from the init pagetables in head_64.S: */
@@ -502,3 +630,22 @@ void __init pti_init(void)
         pti_setup_espfix64();
         pti_setup_vsyscall();
 }
+
+/*
+ * Finalize the kernel mappings in the userspace page-table. Some of the
+ * mappings for the kernel image might have changed since pti_init()
+ * cloned them. This is because parts of the kernel image have been
+ * mapped RO and/or NX.  These changes need to be cloned again to the
+ * userspace page-table.
+ */
+void pti_finalize(void)
+{
+        /*
+         * We need to clone everything (again) that maps parts of the
+         * kernel image.
+         */
+        pti_clone_entry_text();
+        pti_clone_kernel_text();
+
+        debug_checkwx_user();
+}
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 6eb1f34c3c85..752dbf4e0e50 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -7,6 +7,7 @@
 #include <linux/export.h>
 #include <linux/cpu.h>
 #include <linux/debugfs.h>
+#include <linux/gfp.h>
 
 #include <asm/tlbflush.h>
 #include <asm/mmu_context.h>
@@ -35,7 +36,7 @@
  * necessary invalidation by clearing out the 'ctx_id' which
  * forces a TLB flush when the context is loaded.
  */
-void clear_asid_other(void)
+static void clear_asid_other(void)
 {
         u16 asid;
 
@@ -185,8 +186,11 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
 {
         struct mm_struct *real_prev = this_cpu_read(cpu_tlbstate.loaded_mm);
         u16 prev_asid = this_cpu_read(cpu_tlbstate.loaded_mm_asid);
+        bool was_lazy = this_cpu_read(cpu_tlbstate.is_lazy);
         unsigned cpu = smp_processor_id();
         u64 next_tlb_gen;
+        bool need_flush;
+        u16 new_asid;
 
         /*
          * NB: The scheduler will call us with prev == next when switching
@@ -240,20 +244,41 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
                            next->context.ctx_id);
 
                 /*
-                 * We don't currently support having a real mm loaded without
-                 * our cpu set in mm_cpumask().  We have all the bookkeeping
-                 * in place to figure out whether we would need to flush
-                 * if our cpu were cleared in mm_cpumask(), but we don't
-                 * currently use it.
+                 * Even in lazy TLB mode, the CPU should stay set in the
+                 * mm_cpumask. The TLB shootdown code can figure out from
+                 * from cpu_tlbstate.is_lazy whether or not to send an IPI.
                  */
                 if (WARN_ON_ONCE(real_prev != &init_mm &&
                                  !cpumask_test_cpu(cpu, mm_cpumask(next))))
                         cpumask_set_cpu(cpu, mm_cpumask(next));
 
-                return;
+                /*
+                 * If the CPU is not in lazy TLB mode, we are just switching
+                 * from one thread in a process to another thread in the same
+                 * process. No TLB flush required.
+                 */
+                if (!was_lazy)
+                        return;
+
+                /*
+                 * Read the tlb_gen to check whether a flush is needed.
+                 * If the TLB is up to date, just use it.
+                 * The barrier synchronizes with the tlb_gen increment in
+                 * the TLB shootdown code.
+                 */
+                smp_mb();
+                next_tlb_gen = atomic64_read(&next->context.tlb_gen);
+                if (this_cpu_read(cpu_tlbstate.ctxs[prev_asid].tlb_gen) ==
+                                next_tlb_gen)
+                        return;
+
+                /*
+                 * TLB contents went out of date while we were in lazy
+                 * mode. Fall through to the TLB switching code below.
+                 */
+                new_asid = prev_asid;
+                need_flush = true;
         } else {
-                u16 new_asid;
-                bool need_flush;
                 u64 last_ctx_id = this_cpu_read(cpu_tlbstate.last_ctx_id);
 
                 /*
@@ -285,53 +310,60 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
                         sync_current_stack_to_mm(next);
                 }
 
-                /* Stop remote flushes for the previous mm */
-                VM_WARN_ON_ONCE(!cpumask_test_cpu(cpu, mm_cpumask(real_prev)) &&
-                                real_prev != &init_mm);
-                cpumask_clear_cpu(cpu, mm_cpumask(real_prev));
+                /*
+                 * Stop remote flushes for the previous mm.
+                 * Skip kernel threads; we never send init_mm TLB flushing IPIs,
+                 * but the bitmap manipulation can cause cache line contention.
+                 */
+                if (real_prev != &init_mm) {
+                        VM_WARN_ON_ONCE(!cpumask_test_cpu(cpu,
+                                                mm_cpumask(real_prev)));
+                        cpumask_clear_cpu(cpu, mm_cpumask(real_prev));
+                }
 
                 /*
                  * Start remote flushes and then read tlb_gen.
                  */
-                cpumask_set_cpu(cpu, mm_cpumask(next));
+                if (next != &init_mm)
+                        cpumask_set_cpu(cpu, mm_cpumask(next));
                 next_tlb_gen = atomic64_read(&next->context.tlb_gen);
 
                 choose_new_asid(next, next_tlb_gen, &new_asid, &need_flush);
+        }
 
-                if (need_flush) {
-                        this_cpu_write(cpu_tlbstate.ctxs[new_asid].ctx_id, next->context.ctx_id);
-                        this_cpu_write(cpu_tlbstate.ctxs[new_asid].tlb_gen, next_tlb_gen);
-                        load_new_mm_cr3(next->pgd, new_asid, true);
-
-                        /*
-                         * NB: This gets called via leave_mm() in the idle path
-                         * where RCU functions differently.  Tracing normally
-                         * uses RCU, so we need to use the _rcuidle variant.
-                         *
-                         * (There is no good reason for this.  The idle code should
-                         *  be rearranged to call this before rcu_idle_enter().)
-                         */
-                        trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL);
-                } else {
-                        /* The new ASID is already up to date. */
-                        load_new_mm_cr3(next->pgd, new_asid, false);
-
-                        /* See above wrt _rcuidle. */
-                        trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, 0);
-                }
+        if (need_flush) {
+                this_cpu_write(cpu_tlbstate.ctxs[new_asid].ctx_id, next->context.ctx_id);
+                this_cpu_write(cpu_tlbstate.ctxs[new_asid].tlb_gen, next_tlb_gen);
+                load_new_mm_cr3(next->pgd, new_asid, true);
 
                 /*
-                 * Record last user mm's context id, so we can avoid
-                 * flushing branch buffer with IBPB if we switch back
-                 * to the same user.
+                 * NB: This gets called via leave_mm() in the idle path
+                 * where RCU functions differently.  Tracing normally
+                 * uses RCU, so we need to use the _rcuidle variant.
+                 *
+                 * (There is no good reason for this.  The idle code should
+                 *  be rearranged to call this before rcu_idle_enter().)
                  */
-                if (next != &init_mm)
-                        this_cpu_write(cpu_tlbstate.last_ctx_id, next->context.ctx_id);
+                trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL);
+        } else {
+                /* The new ASID is already up to date. */
+                load_new_mm_cr3(next->pgd, new_asid, false);
 
-                this_cpu_write(cpu_tlbstate.loaded_mm, next);
-                this_cpu_write(cpu_tlbstate.loaded_mm_asid, new_asid);
+                /* See above wrt _rcuidle. */
+                trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, 0);
         }
 
+        /*
+         * Record last user mm's context id, so we can avoid
+         * flushing branch buffer with IBPB if we switch back
+         * to the same user.
+         */
+        if (next != &init_mm)
+                this_cpu_write(cpu_tlbstate.last_ctx_id, next->context.ctx_id);
+
+        this_cpu_write(cpu_tlbstate.loaded_mm, next);
+        this_cpu_write(cpu_tlbstate.loaded_mm_asid, new_asid);
+
         load_mm_cr4(next);
         switch_ldt(real_prev, next);
 }
@@ -354,20 +386,7 @@ void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
         if (this_cpu_read(cpu_tlbstate.loaded_mm) == &init_mm)
                 return;
 
-        if (tlb_defer_switch_to_init_mm()) {
-                /*
-                 * There's a significant optimization that may be possible
-                 * here.  We have accurate enough TLB flush tracking that we
-                 * don't need to maintain coherence of TLB per se when we're
-                 * lazy.  We do, however, need to maintain coherence of
-                 * paging-structure caches.  We could, in principle, leave our
-                 * old mm loaded and only switch to init_mm when
-                 * tlb_remove_page() happens.
-                 */
-                this_cpu_write(cpu_tlbstate.is_lazy, true);
-        } else {
-                switch_mm(NULL, &init_mm, NULL);
-        }
+        this_cpu_write(cpu_tlbstate.is_lazy, true);
 }
 
 /*
@@ -454,6 +473,9 @@ static void flush_tlb_func_common(const struct flush_tlb_info *f,
                  * paging-structure cache to avoid speculatively reading
                  * garbage into our TLB.  Since switching to init_mm is barely
                  * slower than a minimal flush, just switch to init_mm.
+                 *
+                 * This should be rare, with native_flush_tlb_others skipping
+                 * IPIs to lazy TLB mode CPUs.
                  */
                 switch_mm_irqs_off(NULL, &init_mm, NULL);
                 return;
@@ -560,6 +582,9 @@ static void flush_tlb_func_remote(void *info)
 void native_flush_tlb_others(const struct cpumask *cpumask,
                              const struct flush_tlb_info *info)
 {
+        cpumask_var_t lazymask;
+        unsigned int cpu;
+
         count_vm_tlb_event(NR_TLB_REMOTE_FLUSH);
         if (info->end == TLB_FLUSH_ALL)
                 trace_tlb_flush(TLB_REMOTE_SEND_IPI, TLB_FLUSH_ALL);
@@ -583,8 +608,6 @@ void native_flush_tlb_others(const struct cpumask *cpumask,
                  * that UV should be updated so that smp_call_function_many(),
                  * etc, are optimal on UV.
                  */
-                unsigned int cpu;
-
                 cpu = smp_processor_id();
                 cpumask = uv_flush_tlb_others(cpumask, info);
                 if (cpumask)
@@ -592,8 +615,29 @@ void native_flush_tlb_others(const struct cpumask *cpumask,
                                                (void *)info, 1);
                 return;
         }
-        smp_call_function_many(cpumask, flush_tlb_func_remote,
+
+        /*
+         * A temporary cpumask is used in order to skip sending IPIs
+         * to CPUs in lazy TLB state, while keeping them in mm_cpumask(mm).
+         * If the allocation fails, simply IPI every CPU in mm_cpumask.
+         */
+        if (!alloc_cpumask_var(&lazymask, GFP_ATOMIC)) {
+                smp_call_function_many(cpumask, flush_tlb_func_remote,
                                (void *)info, 1);
+                return;
+        }
+
+        cpumask_copy(lazymask, cpumask);
+
+        for_each_cpu(cpu, lazymask) {
+                if (per_cpu(cpu_tlbstate.is_lazy, cpu))
+                        cpumask_clear_cpu(cpu, lazymask);
+        }
+
+        smp_call_function_many(lazymask, flush_tlb_func_remote,
+                               (void *)info, 1);
+
+        free_cpumask_var(lazymask);
 }
 
 /*
@@ -646,6 +690,68 @@ void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start,
         put_cpu();
 }
 
+void tlb_flush_remove_tables_local(void *arg)
+{
+        struct mm_struct *mm = arg;
+
+        if (this_cpu_read(cpu_tlbstate.loaded_mm) == mm &&
+                        this_cpu_read(cpu_tlbstate.is_lazy)) {
+                /*
+                 * We're in lazy mode.  We need to at least flush our
+                 * paging-structure cache to avoid speculatively reading
+                 * garbage into our TLB.  Since switching to init_mm is barely
+                 * slower than a minimal flush, just switch to init_mm.
+                 */
+                switch_mm_irqs_off(NULL, &init_mm, NULL);
+        }
+}
+
+static void mm_fill_lazy_tlb_cpu_mask(struct mm_struct *mm,
+                                      struct cpumask *lazy_cpus)
+{
+        int cpu;
+
+        for_each_cpu(cpu, mm_cpumask(mm)) {
+                if (!per_cpu(cpu_tlbstate.is_lazy, cpu))
+                        cpumask_set_cpu(cpu, lazy_cpus);
+        }
+}
+
+void tlb_flush_remove_tables(struct mm_struct *mm)
+{
+        int cpu = get_cpu();
+        cpumask_var_t lazy_cpus;
+
+        if (cpumask_any_but(mm_cpumask(mm), cpu) >= nr_cpu_ids) {
+                put_cpu();
+                return;
+        }
+
+        if (!zalloc_cpumask_var(&lazy_cpus, GFP_ATOMIC)) {
+                /*
+                 * If the cpumask allocation fails, do a brute force flush
+                 * on all the CPUs that have this mm loaded.
+                 */
+                smp_call_function_many(mm_cpumask(mm),
+                                tlb_flush_remove_tables_local, (void *)mm, 1);
+                put_cpu();
+                return;
+        }
+
+        /*
+         * CPUs with !is_lazy either received a TLB flush IPI while the user
+         * pages in this address range were unmapped, or have context switched
+         * and reloaded %CR3 since then.
+         *
+         * Shootdown IPIs at page table freeing time only need to be sent to
+         * CPUs that may have out of date TLB contents.
+         */
+        mm_fill_lazy_tlb_cpu_mask(mm, lazy_cpus);
+        smp_call_function_many(lazy_cpus,
+                                tlb_flush_remove_tables_local, (void *)mm, 1);
+        free_cpumask_var(lazy_cpus);
+        put_cpu();
+}
 
 static void do_flush_tlb_all(void *info)
 {
diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c
index 55799873ebe5..8f6cc71e0848 100644
--- a/arch/x86/net/bpf_jit_comp32.c
+++ b/arch/x86/net/bpf_jit_comp32.c
@@ -1441,8 +1441,8 @@ static void emit_prologue(u8 **pprog, u32 stack_depth)
 
         /* sub esp,STACK_SIZE */
         EMIT2_off32(0x81, 0xEC, STACK_SIZE);
-        /* sub ebp,SCRATCH_SIZE+4+12*/
-        EMIT3(0x83, add_1reg(0xE8, IA32_EBP), SCRATCH_SIZE + 16);
+        /* sub ebp,SCRATCH_SIZE+12*/
+        EMIT3(0x83, add_1reg(0xE8, IA32_EBP), SCRATCH_SIZE + 12);
         /* xor ebx,ebx */
         EMIT2(0x31, add_2reg(0xC0, IA32_EBX, IA32_EBX));
 
@@ -1475,8 +1475,8 @@ static void emit_epilogue(u8 **pprog, u32 stack_depth)
         /* mov edx,dword ptr [ebp+off]*/
         EMIT3(0x8B, add_2reg(0x40, IA32_EBP, IA32_EDX), STACK_VAR(r0[1]));
 
-        /* add ebp,SCRATCH_SIZE+4+12*/
-        EMIT3(0x83, add_1reg(0xC0, IA32_EBP), SCRATCH_SIZE + 16);
+        /* add ebp,SCRATCH_SIZE+12*/
+        EMIT3(0x83, add_1reg(0xC0, IA32_EBP), SCRATCH_SIZE + 12);
 
         /* mov ebx,dword ptr [ebp-12]*/
         EMIT3(0x8B, add_2reg(0x40, IA32_EBP, IA32_EBX), -12);
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index 5f2eb3231607..ee5d08f25ce4 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -636,6 +636,8 @@ void efi_switch_mm(struct mm_struct *mm)
 #ifdef CONFIG_EFI_MIXED
 extern efi_status_t efi64_thunk(u32, ...);
 
+static DEFINE_SPINLOCK(efi_runtime_lock);
+
 #define runtime_service32(func)                                          \
 ({                                                                       \
         u32 table = (u32)(unsigned long)efi.systab;                      \
@@ -657,17 +659,14 @@ extern efi_status_t efi64_thunk(u32, ...);
 #define efi_thunk(f, ...)                                               \
 ({                                                                      \
         efi_status_t __s;                                               \
-        unsigned long __flags;                                          \
         u32 __func;                                                     \
                                                                         \
-        local_irq_save(__flags);                                        \
         arch_efi_call_virt_setup();                                     \
                                                                         \
         __func = runtime_service32(f);                                  \
         __s = efi64_thunk(__func, __VA_ARGS__);                         \
                                                                         \
         arch_efi_call_virt_teardown();                                  \
-        local_irq_restore(__flags);                                     \
                                                                         \
         __s;                                                            \
 })
@@ -702,14 +701,17 @@ static efi_status_t efi_thunk_get_time(efi_time_t *tm, efi_time_cap_t *tc)
 {
         efi_status_t status;
         u32 phys_tm, phys_tc;
+        unsigned long flags;
 
         spin_lock(&rtc_lock);
+        spin_lock_irqsave(&efi_runtime_lock, flags);
 
         phys_tm = virt_to_phys_or_null(tm);
         phys_tc = virt_to_phys_or_null(tc);
 
         status = efi_thunk(get_time, phys_tm, phys_tc);
 
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
         spin_unlock(&rtc_lock);
 
         return status;
@@ -719,13 +721,16 @@ static efi_status_t efi_thunk_set_time(efi_time_t *tm)
 {
         efi_status_t status;
         u32 phys_tm;
+        unsigned long flags;
 
         spin_lock(&rtc_lock);
+        spin_lock_irqsave(&efi_runtime_lock, flags);
 
         phys_tm = virt_to_phys_or_null(tm);
 
         status = efi_thunk(set_time, phys_tm);
 
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
         spin_unlock(&rtc_lock);
 
         return status;
@@ -737,8 +742,10 @@ efi_thunk_get_wakeup_time(efi_bool_t *enabled, efi_bool_t *pending,
 {
         efi_status_t status;
         u32 phys_enabled, phys_pending, phys_tm;
+        unsigned long flags;
 
         spin_lock(&rtc_lock);
+        spin_lock_irqsave(&efi_runtime_lock, flags);
 
         phys_enabled = virt_to_phys_or_null(enabled);
         phys_pending = virt_to_phys_or_null(pending);
@@ -747,6 +754,7 @@ efi_thunk_get_wakeup_time(efi_bool_t *enabled, efi_bool_t *pending,
         status = efi_thunk(get_wakeup_time, phys_enabled,
                              phys_pending, phys_tm);
 
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
         spin_unlock(&rtc_lock);
 
         return status;
@@ -757,13 +765,16 @@ efi_thunk_set_wakeup_time(efi_bool_t enabled, efi_time_t *tm)
 {
         efi_status_t status;
         u32 phys_tm;
+        unsigned long flags;
 
         spin_lock(&rtc_lock);
+        spin_lock_irqsave(&efi_runtime_lock, flags);
 
         phys_tm = virt_to_phys_or_null(tm);
 
         status = efi_thunk(set_wakeup_time, enabled, phys_tm);
 
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
         spin_unlock(&rtc_lock);
 
         return status;
@@ -781,6 +792,9 @@ efi_thunk_get_variable(efi_char16_t *name, efi_guid_t *vendor,
         efi_status_t status;
         u32 phys_name, phys_vendor, phys_attr;
         u32 phys_data_size, phys_data;
+        unsigned long flags;
+
+        spin_lock_irqsave(&efi_runtime_lock, flags);
 
         phys_data_size = virt_to_phys_or_null(data_size);
         phys_vendor = virt_to_phys_or_null(vendor);
@@ -791,6 +805,8 @@ efi_thunk_get_variable(efi_char16_t *name, efi_guid_t *vendor,
         status = efi_thunk(get_variable, phys_name, phys_vendor,
                            phys_attr, phys_data_size, phys_data);
 
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
+
         return status;
 }
 
@@ -800,6 +816,34 @@ efi_thunk_set_variable(efi_char16_t *name, efi_guid_t *vendor,
 {
         u32 phys_name, phys_vendor, phys_data;
         efi_status_t status;
+        unsigned long flags;
+
+        spin_lock_irqsave(&efi_runtime_lock, flags);
+
+        phys_name = virt_to_phys_or_null_size(name, efi_name_size(name));
+        phys_vendor = virt_to_phys_or_null(vendor);
+        phys_data = virt_to_phys_or_null_size(data, data_size);
+
+        /* If data_size is > sizeof(u32) we've got problems */
+        status = efi_thunk(set_variable, phys_name, phys_vendor,
+                           attr, data_size, phys_data);
+
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
+
+        return status;
+}
+
+static efi_status_t
+efi_thunk_set_variable_nonblocking(efi_char16_t *name, efi_guid_t *vendor,
+                                   u32 attr, unsigned long data_size,
+                                   void *data)
+{
+        u32 phys_name, phys_vendor, phys_data;
+        efi_status_t status;
+        unsigned long flags;
+
+        if (!spin_trylock_irqsave(&efi_runtime_lock, flags))
+                return EFI_NOT_READY;
 
         phys_name = virt_to_phys_or_null_size(name, efi_name_size(name));
         phys_vendor = virt_to_phys_or_null(vendor);
@@ -809,6 +853,8 @@ efi_thunk_set_variable(efi_char16_t *name, efi_guid_t *vendor,
         status = efi_thunk(set_variable, phys_name, phys_vendor,
                            attr, data_size, phys_data);
 
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
+
         return status;
 }
 
@@ -819,6 +865,9 @@ efi_thunk_get_next_variable(unsigned long *name_size,
 {
         efi_status_t status;
         u32 phys_name_size, phys_name, phys_vendor;
+        unsigned long flags;
+
+        spin_lock_irqsave(&efi_runtime_lock, flags);
 
         phys_name_size = virt_to_phys_or_null(name_size);
         phys_vendor = virt_to_phys_or_null(vendor);
@@ -827,6 +876,8 @@ efi_thunk_get_next_variable(unsigned long *name_size,
         status = efi_thunk(get_next_variable, phys_name_size,
                            phys_name, phys_vendor);
 
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
+
         return status;
 }
 
@@ -835,10 +886,15 @@ efi_thunk_get_next_high_mono_count(u32 *count)
 {
         efi_status_t status;
         u32 phys_count;
+        unsigned long flags;
+
+        spin_lock_irqsave(&efi_runtime_lock, flags);
 
         phys_count = virt_to_phys_or_null(count);
         status = efi_thunk(get_next_high_mono_count, phys_count);
 
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
+
         return status;
 }
 
@@ -847,10 +903,15 @@ efi_thunk_reset_system(int reset_type, efi_status_t status,
                        unsigned long data_size, efi_char16_t *data)
 {
         u32 phys_data;
+        unsigned long flags;
+
+        spin_lock_irqsave(&efi_runtime_lock, flags);
 
         phys_data = virt_to_phys_or_null_size(data, data_size);
 
         efi_thunk(reset_system, reset_type, status, data_size, phys_data);
+
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
 }
 
 static efi_status_t
@@ -872,10 +933,13 @@ efi_thunk_query_variable_info(u32 attr, u64 *storage_space,
 {
         efi_status_t status;
         u32 phys_storage, phys_remaining, phys_max;
+        unsigned long flags;
 
         if (efi.runtime_version < EFI_2_00_SYSTEM_TABLE_REVISION)
                 return EFI_UNSUPPORTED;
 
+        spin_lock_irqsave(&efi_runtime_lock, flags);
+
         phys_storage = virt_to_phys_or_null(storage_space);
         phys_remaining = virt_to_phys_or_null(remaining_space);
         phys_max = virt_to_phys_or_null(max_variable_size);
@@ -883,6 +947,35 @@ efi_thunk_query_variable_info(u32 attr, u64 *storage_space,
         status = efi_thunk(query_variable_info, attr, phys_storage,
                            phys_remaining, phys_max);
 
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
+
+        return status;
+}
+
+static efi_status_t
+efi_thunk_query_variable_info_nonblocking(u32 attr, u64 *storage_space,
+                                          u64 *remaining_space,
+                                          u64 *max_variable_size)
+{
+        efi_status_t status;
+        u32 phys_storage, phys_remaining, phys_max;
+        unsigned long flags;
+
+        if (efi.runtime_version < EFI_2_00_SYSTEM_TABLE_REVISION)
+                return EFI_UNSUPPORTED;
+
+        if (!spin_trylock_irqsave(&efi_runtime_lock, flags))
+                return EFI_NOT_READY;
+
+        phys_storage = virt_to_phys_or_null(storage_space);
+        phys_remaining = virt_to_phys_or_null(remaining_space);
+        phys_max = virt_to_phys_or_null(max_variable_size);
+
+        status = efi_thunk(query_variable_info, attr, phys_storage,
+                           phys_remaining, phys_max);
+
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
+
         return status;
 }
 
@@ -908,9 +1001,11 @@ void efi_thunk_runtime_setup(void)
         efi.get_variable = efi_thunk_get_variable;
         efi.get_next_variable = efi_thunk_get_next_variable;
         efi.set_variable = efi_thunk_set_variable;
+        efi.set_variable_nonblocking = efi_thunk_set_variable_nonblocking;
         efi.get_next_high_mono_count = efi_thunk_get_next_high_mono_count;
         efi.reset_system = efi_thunk_reset_system;
         efi.query_variable_info = efi_thunk_query_variable_info;
+        efi.query_variable_info_nonblocking = efi_thunk_query_variable_info_nonblocking;
         efi.update_capsule = efi_thunk_update_capsule;
         efi.query_capsule_caps = efi_thunk_query_capsule_caps;
 }
diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c
index 36c1f8b9f7e0..844d31cb8a0c 100644
--- a/arch/x86/platform/efi/quirks.c
+++ b/arch/x86/platform/efi/quirks.c
@@ -105,12 +105,11 @@ early_param("efi_no_storage_paranoia", setup_storage_paranoia);
 */
 void efi_delete_dummy_variable(void)
 {
-        efi.set_variable((efi_char16_t *)efi_dummy_name,
-                         &EFI_DUMMY_GUID,
-                         EFI_VARIABLE_NON_VOLATILE |
-                         EFI_VARIABLE_BOOTSERVICE_ACCESS |
-                         EFI_VARIABLE_RUNTIME_ACCESS,
-                         0, NULL);
+        efi.set_variable_nonblocking((efi_char16_t *)efi_dummy_name,
+                                     &EFI_DUMMY_GUID,
+                                     EFI_VARIABLE_NON_VOLATILE |
+                                     EFI_VARIABLE_BOOTSERVICE_ACCESS |
+                                     EFI_VARIABLE_RUNTIME_ACCESS, 0, NULL);
 }
 
 /*
@@ -249,7 +248,8 @@ void __init efi_arch_mem_reserve(phys_addr_t addr, u64 size)
         int num_entries;
         void *new;
 
-        if (efi_mem_desc_lookup(addr, &md)) {
+        if (efi_mem_desc_lookup(addr, &md) ||
+            md.type != EFI_BOOT_SERVICES_DATA) {
                 pr_err("Failed to lookup EFI memory descriptor for %pa\n", &addr);
                 return;
         }
diff --git a/arch/x86/platform/intel-mid/Makefile b/arch/x86/platform/intel-mid/Makefile
index fa021dfab088..5cf886c867c2 100644
--- a/arch/x86/platform/intel-mid/Makefile
+++ b/arch/x86/platform/intel-mid/Makefile
@@ -1,4 +1,4 @@
-obj-$(CONFIG_X86_INTEL_MID) += intel-mid.o intel_mid_vrtc.o mfld.o mrfld.o pwr.o
+obj-$(CONFIG_X86_INTEL_MID) += intel-mid.o intel_mid_vrtc.o pwr.o
 
 # SFI specific code
 ifdef CONFIG_X86_INTEL_MID
diff --git a/arch/x86/platform/intel-mid/intel-mid.c b/arch/x86/platform/intel-mid/intel-mid.c
index 2ebdf31d9996..56f66eafb94f 100644
--- a/arch/x86/platform/intel-mid/intel-mid.c
+++ b/arch/x86/platform/intel-mid/intel-mid.c
@@ -36,8 +36,6 @@
 #include <asm/apb_timer.h>
 #include <asm/reboot.h>
 
-#include "intel_mid_weak_decls.h"
-
 /*
  * the clockevent devices on Moorestown/Medfield can be APBT or LAPIC clock,
  * cmdline option x86_intel_mid_timer can be used to override the configuration
@@ -61,10 +59,6 @@
 
 enum intel_mid_timer_options intel_mid_timer_options;
 
-/* intel_mid_ops to store sub arch ops */
-static struct intel_mid_ops *intel_mid_ops;
-/* getter function for sub arch ops*/
-static void *(*get_intel_mid_ops[])(void) = INTEL_MID_OPS_INIT;
 enum intel_mid_cpu_type __intel_mid_cpu_chip;
 EXPORT_SYMBOL_GPL(__intel_mid_cpu_chip);
 
@@ -82,11 +76,6 @@ static void intel_mid_reboot(void)
         intel_scu_ipc_simple_command(IPCMSG_COLD_RESET, 0);
 }
 
-static unsigned long __init intel_mid_calibrate_tsc(void)
-{
-        return 0;
-}
-
 static void __init intel_mid_setup_bp_timer(void)
 {
         apbt_time_init();
@@ -133,6 +122,7 @@ static void intel_mid_arch_setup(void)
         case 0x3C:
         case 0x4A:
                 __intel_mid_cpu_chip = INTEL_MID_CPU_CHIP_TANGIER;
+                x86_platform.legacy.rtc = 1;
                 break;
         case 0x27:
         default:
@@ -140,17 +130,7 @@ static void intel_mid_arch_setup(void)
                 break;
         }
 
-        if (__intel_mid_cpu_chip < MAX_CPU_OPS(get_intel_mid_ops))
-                intel_mid_ops = get_intel_mid_ops[__intel_mid_cpu_chip]();
-        else {
-                intel_mid_ops = get_intel_mid_ops[INTEL_MID_CPU_CHIP_PENWELL]();
-                pr_info("ARCH: Unknown SoC, assuming Penwell!\n");
-        }
-
 out:
-        if (intel_mid_ops->arch_setup)
-                intel_mid_ops->arch_setup();
-
         /*
          * Intel MID platforms are using explicitly defined regulators.
          *
@@ -191,7 +171,6 @@ void __init x86_intel_mid_early_setup(void)
 
         x86_cpuinit.setup_percpu_clockev = apbt_setup_secondary_clock;
 
-        x86_platform.calibrate_tsc = intel_mid_calibrate_tsc;
         x86_platform.get_nmi_reason = intel_mid_get_nmi_reason;
 
         x86_init.pci.arch_init = intel_mid_pci_init;
diff --git a/arch/x86/platform/intel-mid/intel_mid_weak_decls.h b/arch/x86/platform/intel-mid/intel_mid_weak_decls.h
deleted file mode 100644
index 3c1c3866d82b..000000000000
--- a/arch/x86/platform/intel-mid/intel_mid_weak_decls.h
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * intel_mid_weak_decls.h: Weak declarations of intel-mid.c
- *
- * (C) Copyright 2013 Intel Corporation
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; version 2
- * of the License.
- */
-
-
-/* For every CPU addition a new get_<cpuname>_ops interface needs
- * to be added.
- */
-extern void *get_penwell_ops(void);
-extern void *get_cloverview_ops(void);
-extern void *get_tangier_ops(void);
diff --git a/arch/x86/platform/intel-mid/mfld.c b/arch/x86/platform/intel-mid/mfld.c
deleted file mode 100644
index e42978d4deaf..000000000000
--- a/arch/x86/platform/intel-mid/mfld.c
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * mfld.c: Intel Medfield platform setup code
- *
- * (C) Copyright 2013 Intel Corporation
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; version 2
- * of the License.
- */
-
-#include <linux/init.h>
-
-#include <asm/apic.h>
-#include <asm/intel-mid.h>
-#include <asm/intel_mid_vrtc.h>
-
-#include "intel_mid_weak_decls.h"
-
-static unsigned long __init mfld_calibrate_tsc(void)
-{
-        unsigned long fast_calibrate;
-        u32 lo, hi, ratio, fsb;
-
-        rdmsr(MSR_IA32_PERF_STATUS, lo, hi);
-        pr_debug("IA32 perf status is 0x%x, 0x%0x\n", lo, hi);
-        ratio = (hi >> 8) & 0x1f;
-        pr_debug("ratio is %d\n", ratio);
-        if (!ratio) {
-                pr_err("read a zero ratio, should be incorrect!\n");
-                pr_err("force tsc ratio to 16 ...\n");
-                ratio = 16;
-        }
-        rdmsr(MSR_FSB_FREQ, lo, hi);
-        if ((lo & 0x7) == 0x7)
-                fsb = FSB_FREQ_83SKU;
-        else
-                fsb = FSB_FREQ_100SKU;
-        fast_calibrate = ratio * fsb;
-        pr_debug("read penwell tsc %lu khz\n", fast_calibrate);
-        lapic_timer_frequency = fsb * 1000 / HZ;
-
-        /*
-         * TSC on Intel Atom SoCs is reliable and of known frequency.
-         * See tsc_msr.c for details.
-         */
-        setup_force_cpu_cap(X86_FEATURE_TSC_KNOWN_FREQ);
-        setup_force_cpu_cap(X86_FEATURE_TSC_RELIABLE);
-
-        return fast_calibrate;
-}
-
-static void __init penwell_arch_setup(void)
-{
-        x86_platform.calibrate_tsc = mfld_calibrate_tsc;
-}
-
-static struct intel_mid_ops penwell_ops = {
-        .arch_setup = penwell_arch_setup,
-};
-
-void *get_penwell_ops(void)
-{
-        return &penwell_ops;
-}
-
-void *get_cloverview_ops(void)
-{
-        return &penwell_ops;
-}
diff --git a/arch/x86/platform/intel-mid/mrfld.c b/arch/x86/platform/intel-mid/mrfld.c
deleted file mode 100644
index ae7bdeb0e507..000000000000
--- a/arch/x86/platform/intel-mid/mrfld.c
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * Intel Merrifield platform specific setup code
- *
- * (C) Copyright 2013 Intel Corporation
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; version 2
- * of the License.
- */
-
-#include <linux/init.h>
-
-#include <asm/apic.h>
-#include <asm/intel-mid.h>
-
-#include "intel_mid_weak_decls.h"
-
-static unsigned long __init tangier_calibrate_tsc(void)
-{
-        unsigned long fast_calibrate;
-        u32 lo, hi, ratio, fsb, bus_freq;
-
-        /* *********************** */
-        /* Compute TSC:Ratio * FSB */
-        /* *********************** */
-
-        /* Compute Ratio */
-        rdmsr(MSR_PLATFORM_INFO, lo, hi);
-        pr_debug("IA32 PLATFORM_INFO is 0x%x : %x\n", hi, lo);
-
-        ratio = (lo >> 8) & 0xFF;
-        pr_debug("ratio is %d\n", ratio);
-        if (!ratio) {
-                pr_err("Read a zero ratio, force tsc ratio to 4 ...\n");
-                ratio = 4;
-        }
-
-        /* Compute FSB */
-        rdmsr(MSR_FSB_FREQ, lo, hi);
-        pr_debug("Actual FSB frequency detected by SOC 0x%x : %x\n",
-                        hi, lo);
-
-        bus_freq = lo & 0x7;
-        pr_debug("bus_freq = 0x%x\n", bus_freq);
-
-        if (bus_freq == 0)
-                fsb = FSB_FREQ_100SKU;
-        else if (bus_freq == 1)
-                fsb = FSB_FREQ_100SKU;
-        else if (bus_freq == 2)
-                fsb = FSB_FREQ_133SKU;
-        else if (bus_freq == 3)
-                fsb = FSB_FREQ_167SKU;
-        else if (bus_freq == 4)
-                fsb = FSB_FREQ_83SKU;
-        else if (bus_freq == 5)
-                fsb = FSB_FREQ_400SKU;
-        else if (bus_freq == 6)
-                fsb = FSB_FREQ_267SKU;
-        else if (bus_freq == 7)
-                fsb = FSB_FREQ_333SKU;
-        else {
-                BUG();
-                pr_err("Invalid bus_freq! Setting to minimal value!\n");
-                fsb = FSB_FREQ_100SKU;
-        }
-
-        /* TSC = FSB Freq * Resolved HFM Ratio */
-        fast_calibrate = ratio * fsb;
-        pr_debug("calculate tangier tsc %lu KHz\n", fast_calibrate);
-
-        /* ************************************ */
-        /* Calculate Local APIC Timer Frequency */
-        /* ************************************ */
-        lapic_timer_frequency = (fsb * 1000) / HZ;
-
-        pr_debug("Setting lapic_timer_frequency = %d\n",
-                        lapic_timer_frequency);
-
-        /*
-         * TSC on Intel Atom SoCs is reliable and of known frequency.
-         * See tsc_msr.c for details.
-         */
-        setup_force_cpu_cap(X86_FEATURE_TSC_KNOWN_FREQ);
-        setup_force_cpu_cap(X86_FEATURE_TSC_RELIABLE);
-
-        return fast_calibrate;
-}
-
-static void __init tangier_arch_setup(void)
-{
-        x86_platform.calibrate_tsc = tangier_calibrate_tsc;
-        x86_platform.legacy.rtc = 1;
-}
-
-/* tangier arch ops */
-static struct intel_mid_ops tangier_ops = {
-        .arch_setup = tangier_arch_setup,
-};
-
-void *get_tangier_ops(void)
-{
-        return &tangier_ops;
-}
diff --git a/arch/x86/platform/olpc/olpc.c b/arch/x86/platform/olpc/olpc.c
index 7c3077e58fa0..f0e920fb98ad 100644
--- a/arch/x86/platform/olpc/olpc.c
+++ b/arch/x86/platform/olpc/olpc.c
@@ -311,10 +311,8 @@ static int __init add_xo1_platform_devices(void)
                 return PTR_ERR(pdev);
 
         pdev = platform_device_register_simple("olpc-xo1", -1, NULL, 0);
-        if (IS_ERR(pdev))
-                return PTR_ERR(pdev);
 
-        return 0;
+        return PTR_ERR_OR_ZERO(pdev);
 }
 
 static int olpc_xo1_ec_probe(struct platform_device *pdev)
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index ca446da48fd2..e26dfad507c8 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -1607,8 +1607,6 @@ static int parse_tunables_write(struct bau_control *bcp, char *instr,
                                 *tunables[cnt].tunp = val;
                         continue;
                 }
-                if (q == p)
-                        break;
         }
         return 0;
 }
diff --git a/arch/x86/power/hibernate_asm_64.S b/arch/x86/power/hibernate_asm_64.S
index ce8da3a0412c..fd369a6e9ff8 100644
--- a/arch/x86/power/hibernate_asm_64.S
+++ b/arch/x86/power/hibernate_asm_64.S
@@ -137,7 +137,7 @@ ENTRY(restore_registers)
         /* Saved in save_processor_state. */
         lgdt    saved_context_gdt_desc(%rax)
 
-        xorq    %rax, %rax
+        xorl    %eax, %eax
 
         /* tell the hibernation core that we've just restored the memory */
         movq    %rax, in_suspend(%rip)
diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
index 220e97841e49..3a6c8ebc8032 100644
--- a/arch/x86/tools/relocs.c
+++ b/arch/x86/tools/relocs.c
@@ -67,6 +67,7 @@ static const char * const sym_regex_kernel[S_NSYMTYPES] = {
         "__tracedata_(start|end)|"
         "__(start|stop)_notes|"
         "__end_rodata|"
+        "__end_rodata_aligned|"
         "__initramfs_start|"
         "(jiffies|jiffies_64)|"
 #if ELF_BITS == 64
diff --git a/arch/x86/um/vdso/.gitignore b/arch/x86/um/vdso/.gitignore
index 9cac6d072199..f8b69d84238e 100644
--- a/arch/x86/um/vdso/.gitignore
+++ b/arch/x86/um/vdso/.gitignore
@@ -1,2 +1 @@
-vdso-syms.lds
 vdso.lds
diff --git a/arch/x86/um/vdso/Makefile b/arch/x86/um/vdso/Makefile
index b2d6967262b2..822ccdba93ad 100644
--- a/arch/x86/um/vdso/Makefile
+++ b/arch/x86/um/vdso/Makefile
@@ -53,22 +53,6 @@ $(vobjs): KBUILD_CFLAGS += $(CFL)
 CFLAGS_REMOVE_vdso-note.o = -pg -fprofile-arcs -ftest-coverage
 CFLAGS_REMOVE_um_vdso.o = -pg -fprofile-arcs -ftest-coverage
 
-targets += vdso-syms.lds
-extra-$(VDSO64-y)                       += vdso-syms.lds
-
-#
-# Match symbols in the DSO that look like VDSO*; produce a file of constants.
-#
-sed-vdsosym := -e 's/^00*/0/' \
-        -e 's/^\([0-9a-fA-F]*\) . \(VDSO[a-zA-Z0-9_]*\)$$/\2 = 0x\1;/p'
-quiet_cmd_vdsosym = VDSOSYM $@
-define cmd_vdsosym
-        $(NM) $< | LC_ALL=C sed -n $(sed-vdsosym) | LC_ALL=C sort > $@
-endef
-
-$(obj)/%-syms.lds: $(obj)/%.so.dbg FORCE
-        $(call if_changed,vdsosym)
-
 #
 # The DSO images are built using a special linker script.
 #
diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
index 439a94bf89ad..105a57d73701 100644
--- a/arch/x86/xen/enlighten_pv.c
+++ b/arch/x86/xen/enlighten_pv.c
@@ -119,6 +119,27 @@ static void __init xen_banner(void)
                version >> 16, version & 0xffff, extra.extraversion,
                xen_feature(XENFEAT_mmu_pt_update_preserve_ad) ? " (preserve-AD)" : "");
 }
+
+static void __init xen_pv_init_platform(void)
+{
+        set_fixmap(FIX_PARAVIRT_BOOTMAP, xen_start_info->shared_info);
+        HYPERVISOR_shared_info = (void *)fix_to_virt(FIX_PARAVIRT_BOOTMAP);
+
+        /* xen clock uses per-cpu vcpu_info, need to init it for boot cpu */
+        xen_vcpu_info_reset(0);
+
+        /* pvclock is in shared info area */
+        xen_init_time_ops();
+}
+
+static void __init xen_pv_guest_late_init(void)
+{
+#ifndef CONFIG_SMP
+        /* Setup shared vcpu info for non-smp configurations */
+        xen_setup_vcpu_info_placement();
+#endif
+}
+
 /* Check if running on Xen version (major, minor) or later */
 bool
 xen_running_on_version_or_later(unsigned int major, unsigned int minor)
@@ -947,34 +968,8 @@ static void xen_write_msr(unsigned int msr, unsigned low, unsigned high)
         xen_write_msr_safe(msr, low, high);
 }
 
-void xen_setup_shared_info(void)
-{
-        set_fixmap(FIX_PARAVIRT_BOOTMAP, xen_start_info->shared_info);
-
-        HYPERVISOR_shared_info =
-                (struct shared_info *)fix_to_virt(FIX_PARAVIRT_BOOTMAP);
-
-        xen_setup_mfn_list_list();
-
-        if (system_state == SYSTEM_BOOTING) {
-#ifndef CONFIG_SMP
-                /*
-                 * In UP this is as good a place as any to set up shared info.
-                 * Limit this to boot only, at restore vcpu setup is done via
-                 * xen_vcpu_restore().
-                 */
-                xen_setup_vcpu_info_placement();
-#endif
-                /*
-                 * Now that shared info is set up we can start using routines
-                 * that point to pvclock area.
-                 */
-                xen_init_time_ops();
-        }
-}
-
 /* This is called once we have the cpu_possible_mask */
-void __ref xen_setup_vcpu_info_placement(void)
+void __init xen_setup_vcpu_info_placement(void)
 {
         int cpu;
 
@@ -1228,6 +1223,8 @@ asmlinkage __visible void __init xen_start_kernel(void)
         x86_init.irqs.intr_mode_init    = x86_init_noop;
         x86_init.oem.arch_setup = xen_arch_setup;
         x86_init.oem.banner = xen_banner;
+        x86_init.hyper.init_platform = xen_pv_init_platform;
+        x86_init.hyper.guest_late_init = xen_pv_guest_late_init;
 
         /*
          * Set up some pagetable state before starting to set any ptes.
diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
index 2c30cabfda90..52206ad81e4b 100644
--- a/arch/x86/xen/mmu_pv.c
+++ b/arch/x86/xen/mmu_pv.c
@@ -1230,8 +1230,7 @@ static void __init xen_pagetable_p2m_free(void)
          * We roundup to the PMD, which means that if anybody at this stage is
          * using the __ka address of xen_start_info or
          * xen_start_info->shared_info they are in going to crash. Fortunatly
-         * we have already revectored in xen_setup_kernel_pagetable and in
-         * xen_setup_shared_info.
+         * we have already revectored in xen_setup_kernel_pagetable.
          */
         size = roundup(size, PMD_SIZE);
 
@@ -1292,8 +1291,7 @@ static void __init xen_pagetable_init(void)
 
         /* Remap memory freed due to conflicts with E820 map */
         xen_remap_memory();
-
-        xen_setup_shared_info();
+        xen_setup_mfn_list_list();
 }
 static void xen_write_cr2(unsigned long cr2)
 {
diff --git a/arch/x86/xen/suspend_pv.c b/arch/x86/xen/suspend_pv.c
index a2e0f110af56..8303b58c79a9 100644
--- a/arch/x86/xen/suspend_pv.c
+++ b/arch/x86/xen/suspend_pv.c
@@ -27,8 +27,9 @@ void xen_pv_pre_suspend(void)
 void xen_pv_post_suspend(int suspend_cancelled)
 {
         xen_build_mfn_list_list();
-
-        xen_setup_shared_info();
+        set_fixmap(FIX_PARAVIRT_BOOTMAP, xen_start_info->shared_info);
+        HYPERVISOR_shared_info = (void *)fix_to_virt(FIX_PARAVIRT_BOOTMAP);
+        xen_setup_mfn_list_list();
 
         if (suspend_cancelled) {
                 xen_start_info->store_mfn =
diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
index e0f1bcf01d63..c84f1e039d84 100644
--- a/arch/x86/xen/time.c
+++ b/arch/x86/xen/time.c
@@ -31,6 +31,8 @@
 /* Xen may fire a timer up to this many ns early */
 #define TIMER_SLOP      100000
 
+static u64 xen_sched_clock_offset __read_mostly;
+
 /* Get the TSC speed from Xen */
 static unsigned long xen_tsc_khz(void)
 {
@@ -40,7 +42,7 @@ static unsigned long xen_tsc_khz(void)
         return pvclock_tsc_khz(info);
 }
 
-u64 xen_clocksource_read(void)
+static u64 xen_clocksource_read(void)
 {
         struct pvclock_vcpu_time_info *src;
         u64 ret;
@@ -57,6 +59,11 @@ static u64 xen_clocksource_get_cycles(struct clocksource *cs)
         return xen_clocksource_read();
 }
 
+static u64 xen_sched_clock(void)
+{
+        return xen_clocksource_read() - xen_sched_clock_offset;
+}
+
 static void xen_read_wallclock(struct timespec64 *ts)
 {
         struct shared_info *s = HYPERVISOR_shared_info;
@@ -367,7 +374,7 @@ void xen_timer_resume(void)
 }
 
 static const struct pv_time_ops xen_time_ops __initconst = {
-        .sched_clock = xen_clocksource_read,
+        .sched_clock = xen_sched_clock,
         .steal_clock = xen_steal_clock,
 };
 
@@ -503,8 +510,9 @@ static void __init xen_time_init(void)
                 pvclock_gtod_register_notifier(&xen_pvclock_gtod_notifier);
 }
 
-void __ref xen_init_time_ops(void)
+void __init xen_init_time_ops(void)
 {
+        xen_sched_clock_offset = xen_clocksource_read();
         pv_time_ops = xen_time_ops;
 
         x86_init.timers.timer_init = xen_time_init;
@@ -542,11 +550,11 @@ void __init xen_hvm_init_time_ops(void)
                 return;
 
         if (!xen_feature(XENFEAT_hvm_safe_pvclock)) {
-                printk(KERN_INFO "Xen doesn't support pvclock on HVM,"
-                                "disable pv timer\n");
+                pr_info("Xen doesn't support pvclock on HVM, disable pv timer");
                 return;
         }
 
+        xen_sched_clock_offset = xen_clocksource_read();
         pv_time_ops = xen_time_ops;
         x86_init.timers.setup_percpu_clockev = xen_time_init;
         x86_cpuinit.setup_percpu_clockev = xen_hvm_setup_cpu_clockevents;
diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
index 3b34745d0a52..e78684597f57 100644
--- a/arch/x86/xen/xen-ops.h
+++ b/arch/x86/xen/xen-ops.h
@@ -31,7 +31,6 @@ extern struct shared_info xen_dummy_shared_info;
 extern struct shared_info *HYPERVISOR_shared_info;
 
 void xen_setup_mfn_list_list(void);
-void xen_setup_shared_info(void);
 void xen_build_mfn_list_list(void);
 void xen_setup_machphys_mapping(void);
 void xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn);
@@ -68,12 +67,11 @@ void xen_init_irq_ops(void);
 void xen_setup_timer(int cpu);
 void xen_setup_runstate_info(int cpu);
 void xen_teardown_timer(int cpu);
-u64 xen_clocksource_read(void);
 void xen_setup_cpu_clockevents(void);
 void xen_save_time_memory_area(void);
 void xen_restore_time_memory_area(void);
-void __ref xen_init_time_ops(void);
-void __init xen_hvm_init_time_ops(void);
+void xen_init_time_ops(void);
+void xen_hvm_init_time_ops(void);
 
 irqreturn_t xen_debug_interrupt(int irq, void *dev_id);
 
diff --git a/arch/xtensa/include/asm/atomic.h b/arch/xtensa/include/asm/atomic.h
index e7a23f2a519a..7de0149e1cf7 100644
--- a/arch/xtensa/include/asm/atomic.h
+++ b/arch/xtensa/include/asm/atomic.h
@@ -197,107 +197,9 @@ ATOMIC_OPS(xor)
 #undef ATOMIC_OP_RETURN
 #undef ATOMIC_OP
 
-/**
- * atomic_sub_and_test - subtract value from variable and test result
- * @i: integer value to subtract
- * @v: pointer of type atomic_t
- *
- * Atomically subtracts @i from @v and returns
- * true if the result is zero, or false for all
- * other cases.
- */
-#define atomic_sub_and_test(i,v) (atomic_sub_return((i),(v)) == 0)
-
-/**
- * atomic_inc - increment atomic variable
- * @v: pointer of type atomic_t
- *
- * Atomically increments @v by 1.
- */
-#define atomic_inc(v) atomic_add(1,(v))
-
-/**
- * atomic_inc - increment atomic variable
- * @v: pointer of type atomic_t
- *
- * Atomically increments @v by 1.
- */
-#define atomic_inc_return(v) atomic_add_return(1,(v))
-
-/**
- * atomic_dec - decrement atomic variable
- * @v: pointer of type atomic_t
- *
- * Atomically decrements @v by 1.
- */
-#define atomic_dec(v) atomic_sub(1,(v))
-
-/**
- * atomic_dec_return - decrement atomic variable
- * @v: pointer of type atomic_t
- *
- * Atomically decrements @v by 1.
- */
-#define atomic_dec_return(v) atomic_sub_return(1,(v))
-
-/**
- * atomic_dec_and_test - decrement and test
- * @v: pointer of type atomic_t
- *
- * Atomically decrements @v by 1 and
- * returns true if the result is 0, or false for all other
- * cases.
- */
-#define atomic_dec_and_test(v) (atomic_sub_return(1,(v)) == 0)
-
-/**
- * atomic_inc_and_test - increment and test
- * @v: pointer of type atomic_t
- *
- * Atomically increments @v by 1
- * and returns true if the result is zero, or false for all
- * other cases.
- */
-#define atomic_inc_and_test(v) (atomic_add_return(1,(v)) == 0)
-
-/**
- * atomic_add_negative - add and test if negative
- * @v: pointer of type atomic_t
- * @i: integer value to add
- *
- * Atomically adds @i to @v and returns true
- * if the result is negative, or false when
- * result is greater than or equal to zero.
- */
-#define atomic_add_negative(i,v) (atomic_add_return((i),(v)) < 0)
-
 #define atomic_cmpxchg(v, o, n) ((int)cmpxchg(&((v)->counter), (o), (n)))
 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
 
-/**
- * __atomic_add_unless - add unless the number is a given value
- * @v: pointer of type atomic_t
- * @a: the amount to add to v...
- * @u: ...unless v is equal to u.
- *
- * Atomically adds @a to @v, so long as it was not @u.
- * Returns the old value of @v.
- */
-static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
-{
-        int c, old;
-        c = atomic_read(v);
-        for (;;) {
-                if (unlikely(c == (u)))
-                        break;
-                old = atomic_cmpxchg((v), c, c + (a));
-                if (likely(old == c))
-                        break;
-                c = old;
-        }
-        return c;
-}
-
 #endif /* __KERNEL__ */
 
 #endif /* _XTENSA_ATOMIC_H */
diff --git a/block/blk-core.c b/block/blk-core.c
index f84a9b7b6f5a..ee33590f54eb 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -2155,11 +2155,12 @@ static inline bool bio_check_ro(struct bio *bio, struct hd_struct *part)
         if (part->policy && op_is_write(bio_op(bio))) {
                 char b[BDEVNAME_SIZE];
 
-                printk(KERN_ERR
+                WARN_ONCE(1,
                        "generic_make_request: Trying to write "
                         "to read-only block-device %s (partno %d)\n",
                         bio_devname(bio, b), part->partno);
-                return true;
+                /* Older lvm-tools actually trigger this */
+                return false;
         }
 
         return false;
diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index 09b2ee6694fb..3de0836163c2 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -271,7 +271,7 @@ static bool bt_tags_iter(struct sbitmap *bitmap, unsigned int bitnr, void *data)
          * test and set the bit before assining ->rqs[].
          */
         rq = tags->rqs[bitnr];
-        if (rq && blk_mq_rq_state(rq) == MQ_RQ_IN_FLIGHT)
+        if (rq && blk_mq_request_started(rq))
                 iter_data->fn(rq, iter_data->data, reserved);
 
         return true;
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index f8fecfec5df9..9706613eecf9 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -879,6 +879,7 @@ static void acpi_lpss_dismiss(struct device *dev)
 #define LPSS_GPIODEF0_DMA_LLP           BIT(13)
 
 static DEFINE_MUTEX(lpss_iosf_mutex);
+static bool lpss_iosf_d3_entered;
 
 static void lpss_iosf_enter_d3_state(void)
 {
@@ -921,6 +922,9 @@ static void lpss_iosf_enter_d3_state(void)
 
         iosf_mbi_modify(LPSS_IOSF_UNIT_LPIOEP, MBI_CR_WRITE,
                         LPSS_IOSF_GPIODEF0, value1, mask1);
+
+        lpss_iosf_d3_entered = true;
+
 exit:
         mutex_unlock(&lpss_iosf_mutex);
 }
@@ -935,6 +939,11 @@ static void lpss_iosf_exit_d3_state(void)
 
         mutex_lock(&lpss_iosf_mutex);
 
+        if (!lpss_iosf_d3_entered)
+                goto exit;
+
+        lpss_iosf_d3_entered = false;
+
         iosf_mbi_modify(LPSS_IOSF_UNIT_LPIOEP, MBI_CR_WRITE,
                         LPSS_IOSF_GPIODEF0, value1, mask1);
 
@@ -944,13 +953,13 @@ static void lpss_iosf_exit_d3_state(void)
         iosf_mbi_modify(LPSS_IOSF_UNIT_LPIO1, MBI_CFG_WRITE,
                         LPSS_IOSF_PMCSR, value2, mask2);
 
+exit:
         mutex_unlock(&lpss_iosf_mutex);
 }
 
-static int acpi_lpss_suspend(struct device *dev, bool runtime)
+static int acpi_lpss_suspend(struct device *dev, bool wakeup)
 {
         struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
-        bool wakeup = runtime || device_may_wakeup(dev);
         int ret;
 
         if (pdata->dev_desc->flags & LPSS_SAVE_CTX)
@@ -963,14 +972,14 @@ static int acpi_lpss_suspend(struct device *dev, bool runtime)
          * wrong status for devices being about to be powered off. See
          * lpss_iosf_enter_d3_state() for further information.
          */
-        if ((runtime || !pm_suspend_via_firmware()) &&
+        if (acpi_target_system_state() == ACPI_STATE_S0 &&
             lpss_quirks & LPSS_QUIRK_ALWAYS_POWER_ON && iosf_mbi_available())
                 lpss_iosf_enter_d3_state();
 
         return ret;
 }
 
-static int acpi_lpss_resume(struct device *dev, bool runtime)
+static int acpi_lpss_resume(struct device *dev)
 {
         struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
         int ret;
@@ -979,8 +988,7 @@ static int acpi_lpss_resume(struct device *dev, bool runtime)
          * This call is kept first to be in symmetry with
          * acpi_lpss_runtime_suspend() one.
          */
-        if ((runtime || !pm_resume_via_firmware()) &&
-            lpss_quirks & LPSS_QUIRK_ALWAYS_POWER_ON && iosf_mbi_available())
+        if (lpss_quirks & LPSS_QUIRK_ALWAYS_POWER_ON && iosf_mbi_available())
                 lpss_iosf_exit_d3_state();
 
         ret = acpi_dev_resume(dev);
@@ -1004,12 +1012,12 @@ static int acpi_lpss_suspend_late(struct device *dev)
                 return 0;
 
         ret = pm_generic_suspend_late(dev);
-        return ret ? ret : acpi_lpss_suspend(dev, false);
+        return ret ? ret : acpi_lpss_suspend(dev, device_may_wakeup(dev));
 }
 
 static int acpi_lpss_resume_early(struct device *dev)
 {
-        int ret = acpi_lpss_resume(dev, false);
+        int ret = acpi_lpss_resume(dev);
 
         return ret ? ret : pm_generic_resume_early(dev);
 }
@@ -1024,7 +1032,7 @@ static int acpi_lpss_runtime_suspend(struct device *dev)
 
 static int acpi_lpss_runtime_resume(struct device *dev)
 {
-        int ret = acpi_lpss_resume(dev, true);
+        int ret = acpi_lpss_resume(dev);
 
         return ret ? ret : pm_generic_runtime_resume(dev);
 }
diff --git a/drivers/acpi/acpica/psloop.c b/drivers/acpi/acpica/psloop.c
index ee840be150b5..44f35ab3347d 100644
--- a/drivers/acpi/acpica/psloop.c
+++ b/drivers/acpi/acpica/psloop.c
@@ -709,15 +709,20 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
                         } else
                             if ((walk_state->
                                  parse_flags & ACPI_PARSE_MODULE_LEVEL)
+                                && status != AE_CTRL_TRANSFER
                                 && ACPI_FAILURE(status)) {
                                 /*
-                                 * ACPI_PARSE_MODULE_LEVEL means that we are loading a table by
-                                 * executing it as a control method. However, if we encounter
-                                 * an error while loading the table, we need to keep trying to
-                                 * load the table rather than aborting the table load. Set the
-                                 * status to AE_OK to proceed with the table load. If we get a
-                                 * failure at this point, it means that the dispatcher got an
-                                 * error while processing Op (most likely an AML operand error.
+                                 * ACPI_PARSE_MODULE_LEVEL flag means that we are currently
+                                 * loading a table by executing it as a control method.
+                                 * However, if we encounter an error while loading the table,
+                                 * we need to keep trying to load the table rather than
+                                 * aborting the table load (setting the status to AE_OK
+                                 * continues the table load). If we get a failure at this
+                                 * point, it means that the dispatcher got an error while
+                                 * processing Op (most likely an AML operand error) or a
+                                 * control method was called from module level and the
+                                 * dispatcher returned AE_CTRL_TRANSFER. In the latter case,
+                                 * leave the status alone, there's nothing wrong with it.
                                  */
                                 status = AE_OK;
                         }
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index fa0729c1e776..d81c653b9bf6 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -61,7 +61,7 @@ static int atomic_inc_return_safe(atomic_t *v)
 {
         unsigned int counter;
 
-        counter = (unsigned int)__atomic_add_unless(v, 1, 0);
+        counter = (unsigned int)atomic_fetch_add_unless(v, 1, 0);
         if (counter <= (unsigned int)INT_MAX)
                 return (int)counter;
 
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 7436b2d27fa3..a390c6d4f72d 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -298,7 +298,8 @@ static void reset_bdev(struct zram *zram)
         zram->backing_dev = NULL;
         zram->old_block_size = 0;
         zram->bdev = NULL;
-
+        zram->disk->queue->backing_dev_info->capabilities |=
+                                BDI_CAP_SYNCHRONOUS_IO;
         kvfree(zram->bitmap);
         zram->bitmap = NULL;
 }
@@ -400,6 +401,18 @@ static ssize_t backing_dev_store(struct device *dev,
         zram->backing_dev = backing_dev;
         zram->bitmap = bitmap;
         zram->nr_pages = nr_pages;
+        /*
+         * With writeback feature, zram does asynchronous IO so it's no longer
+         * synchronous device so let's remove synchronous io flag. Othewise,
+         * upper layer(e.g., swap) could wait IO completion rather than
+         * (submit and return), which will cause system sluggish.
+         * Furthermore, when the IO function returns(e.g., swap_readpage),
+         * upper layer expects IO was done so it could deallocate the page
+         * freely but in fact, IO is going on so finally could cause
+         * use-after-free when the IO is really done.
+         */
+        zram->disk->queue->backing_dev_info->capabilities &=
+                        ~BDI_CAP_SYNCHRONOUS_IO;
         up_write(&zram->init_lock);
 
         pr_info("setup backing device %s\n", file_name);
diff --git a/drivers/clocksource/Makefile b/drivers/clocksource/Makefile
index 00caf37e52f9..c070cc7992e9 100644
--- a/drivers/clocksource/Makefile
+++ b/drivers/clocksource/Makefile
@@ -49,7 +49,7 @@ obj-$(CONFIG_CLKSRC_SAMSUNG_PWM)	+= samsung_pwm_timer.o
 obj-$(CONFIG_FSL_FTM_TIMER)     += fsl_ftm_timer.o
 obj-$(CONFIG_VF_PIT_TIMER)      += vf_pit_timer.o
 obj-$(CONFIG_CLKSRC_QCOM)       += qcom-timer.o
-obj-$(CONFIG_MTK_TIMER)         += mtk_timer.o
+obj-$(CONFIG_MTK_TIMER)         += timer-mediatek.o
 obj-$(CONFIG_CLKSRC_PISTACHIO)  += time-pistachio.o
 obj-$(CONFIG_CLKSRC_TI_32K)     += timer-ti-32k.o
 obj-$(CONFIG_CLKSRC_NPS)        += timer-nps.o
diff --git a/drivers/clocksource/mtk_timer.c b/drivers/clocksource/mtk_timer.c
deleted file mode 100644
index f9b724fd9950..000000000000
--- a/drivers/clocksource/mtk_timer.c
+++ /dev/null
@@ -1,268 +0,0 @@
-/*
- * Mediatek SoCs General-Purpose Timer handling.
- *
- * Copyright (C) 2014 Matthias Brugger
- *
- * Matthias Brugger <matthias.bgg@gmail.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#define pr_fmt(fmt)     KBUILD_MODNAME ": " fmt
-
-#include <linux/clk.h>
-#include <linux/clockchips.h>
-#include <linux/interrupt.h>
-#include <linux/irq.h>
-#include <linux/irqreturn.h>
-#include <linux/of.h>
-#include <linux/of_address.h>
-#include <linux/of_irq.h>
-#include <linux/sched_clock.h>
-#include <linux/slab.h>
-
-#define GPT_IRQ_EN_REG          0x00
-#define GPT_IRQ_ENABLE(val)     BIT((val) - 1)
-#define GPT_IRQ_ACK_REG         0x08
-#define GPT_IRQ_ACK(val)        BIT((val) - 1)
-
-#define TIMER_CTRL_REG(val)     (0x10 * (val))
-#define TIMER_CTRL_OP(val)      (((val) & 0x3) << 4)
-#define TIMER_CTRL_OP_ONESHOT   (0)
-#define TIMER_CTRL_OP_REPEAT    (1)
-#define TIMER_CTRL_OP_FREERUN   (3)
-#define TIMER_CTRL_CLEAR        (2)
-#define TIMER_CTRL_ENABLE       (1)
-#define TIMER_CTRL_DISABLE      (0)
-
-#define TIMER_CLK_REG(val)      (0x04 + (0x10 * (val)))
-#define TIMER_CLK_SRC(val)      (((val) & 0x1) << 4)
-#define TIMER_CLK_SRC_SYS13M    (0)
-#define TIMER_CLK_SRC_RTC32K    (1)
-#define TIMER_CLK_DIV1          (0x0)
-#define TIMER_CLK_DIV2          (0x1)
-
-#define TIMER_CNT_REG(val)      (0x08 + (0x10 * (val)))
-#define TIMER_CMP_REG(val)      (0x0C + (0x10 * (val)))
-
-#define GPT_CLK_EVT     1
-#define GPT_CLK_SRC     2
-
-struct mtk_clock_event_device {
-        void __iomem *gpt_base;
-        u32 ticks_per_jiffy;
-        struct clock_event_device dev;
-};
-
-static void __iomem *gpt_sched_reg __read_mostly;
-
-static u64 notrace mtk_read_sched_clock(void)
-{
-        return readl_relaxed(gpt_sched_reg);
-}
-
-static inline struct mtk_clock_event_device *to_mtk_clk(
-                                struct clock_event_device *c)
-{
-        return container_of(c, struct mtk_clock_event_device, dev);
-}
-
-static void mtk_clkevt_time_stop(struct mtk_clock_event_device *evt, u8 timer)
-{
-        u32 val;
-
-        val = readl(evt->gpt_base + TIMER_CTRL_REG(timer));
-        writel(val & ~TIMER_CTRL_ENABLE, evt->gpt_base +
-                        TIMER_CTRL_REG(timer));
-}
-
-static void mtk_clkevt_time_setup(struct mtk_clock_event_device *evt,
-                                unsigned long delay, u8 timer)
-{
-        writel(delay, evt->gpt_base + TIMER_CMP_REG(timer));
-}
-
-static void mtk_clkevt_time_start(struct mtk_clock_event_device *evt,
-                bool periodic, u8 timer)
-{
-        u32 val;
-
-        /* Acknowledge interrupt */
-        writel(GPT_IRQ_ACK(timer), evt->gpt_base + GPT_IRQ_ACK_REG);
-
-        val = readl(evt->gpt_base + TIMER_CTRL_REG(timer));
-
-        /* Clear 2 bit timer operation mode field */
-        val &= ~TIMER_CTRL_OP(0x3);
-
-        if (periodic)
-                val |= TIMER_CTRL_OP(TIMER_CTRL_OP_REPEAT);
-        else
-                val |= TIMER_CTRL_OP(TIMER_CTRL_OP_ONESHOT);
-
-        writel(val | TIMER_CTRL_ENABLE | TIMER_CTRL_CLEAR,
-               evt->gpt_base + TIMER_CTRL_REG(timer));
-}
-
-static int mtk_clkevt_shutdown(struct clock_event_device *clk)
-{
-        mtk_clkevt_time_stop(to_mtk_clk(clk), GPT_CLK_EVT);
-        return 0;
-}
-
-static int mtk_clkevt_set_periodic(struct clock_event_device *clk)
-{
-        struct mtk_clock_event_device *evt = to_mtk_clk(clk);
-
-        mtk_clkevt_time_stop(evt, GPT_CLK_EVT);
-        mtk_clkevt_time_setup(evt, evt->ticks_per_jiffy, GPT_CLK_EVT);
-        mtk_clkevt_time_start(evt, true, GPT_CLK_EVT);
-        return 0;
-}
-
-static int mtk_clkevt_next_event(unsigned long event,
-                                   struct clock_event_device *clk)
-{
-        struct mtk_clock_event_device *evt = to_mtk_clk(clk);
-
-        mtk_clkevt_time_stop(evt, GPT_CLK_EVT);
-        mtk_clkevt_time_setup(evt, event, GPT_CLK_EVT);
-        mtk_clkevt_time_start(evt, false, GPT_CLK_EVT);
-
-        return 0;
-}
-
-static irqreturn_t mtk_timer_interrupt(int irq, void *dev_id)
-{
-        struct mtk_clock_event_device *evt = dev_id;
-
-        /* Acknowledge timer0 irq */
-        writel(GPT_IRQ_ACK(GPT_CLK_EVT), evt->gpt_base + GPT_IRQ_ACK_REG);
-        evt->dev.event_handler(&evt->dev);
-
-        return IRQ_HANDLED;
-}
-
-static void
-__init mtk_timer_setup(struct mtk_clock_event_device *evt, u8 timer, u8 option)
-{
-        writel(TIMER_CTRL_CLEAR | TIMER_CTRL_DISABLE,
-                evt->gpt_base + TIMER_CTRL_REG(timer));
-
-        writel(TIMER_CLK_SRC(TIMER_CLK_SRC_SYS13M) | TIMER_CLK_DIV1,
-                        evt->gpt_base + TIMER_CLK_REG(timer));
-
-        writel(0x0, evt->gpt_base + TIMER_CMP_REG(timer));
-
-        writel(TIMER_CTRL_OP(option) | TIMER_CTRL_ENABLE,
-                        evt->gpt_base + TIMER_CTRL_REG(timer));
-}
-
-static void mtk_timer_enable_irq(struct mtk_clock_event_device *evt, u8 timer)
-{
-        u32 val;
-
-        /* Disable all interrupts */
-        writel(0x0, evt->gpt_base + GPT_IRQ_EN_REG);
-
-        /* Acknowledge all spurious pending interrupts */
-        writel(0x3f, evt->gpt_base + GPT_IRQ_ACK_REG);
-
-        val = readl(evt->gpt_base + GPT_IRQ_EN_REG);
-        writel(val | GPT_IRQ_ENABLE(timer),
-                        evt->gpt_base + GPT_IRQ_EN_REG);
-}
-
-static int __init mtk_timer_init(struct device_node *node)
-{
-        struct mtk_clock_event_device *evt;
-        struct resource res;
-        unsigned long rate = 0;
-        struct clk *clk;
-
-        evt = kzalloc(sizeof(*evt), GFP_KERNEL);
-        if (!evt)
-                return -ENOMEM;
-
-        evt->dev.name = "mtk_tick";
-        evt->dev.rating = 300;
-        evt->dev.features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT;
-        evt->dev.set_state_shutdown = mtk_clkevt_shutdown;
-        evt->dev.set_state_periodic = mtk_clkevt_set_periodic;
-        evt->dev.set_state_oneshot = mtk_clkevt_shutdown;
-        evt->dev.tick_resume = mtk_clkevt_shutdown;
-        evt->dev.set_next_event = mtk_clkevt_next_event;
-        evt->dev.cpumask = cpu_possible_mask;
-
-        evt->gpt_base = of_io_request_and_map(node, 0, "mtk-timer");
-        if (IS_ERR(evt->gpt_base)) {
-                pr_err("Can't get resource\n");
-                goto err_kzalloc;
-        }
-
-        evt->dev.irq = irq_of_parse_and_map(node, 0);
-        if (evt->dev.irq <= 0) {
-                pr_err("Can't parse IRQ\n");
-                goto err_mem;
-        }
-
-        clk = of_clk_get(node, 0);
-        if (IS_ERR(clk)) {
-                pr_err("Can't get timer clock\n");
-                goto err_irq;
-        }
-
-        if (clk_prepare_enable(clk)) {
-                pr_err("Can't prepare clock\n");
-                goto err_clk_put;
-        }
-        rate = clk_get_rate(clk);
-
-        if (request_irq(evt->dev.irq, mtk_timer_interrupt,
-                        IRQF_TIMER | IRQF_IRQPOLL, "mtk_timer", evt)) {
-                pr_err("failed to setup irq %d\n", evt->dev.irq);
-                goto err_clk_disable;
-        }
-
-        evt->ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
-
-        /* Configure clock source */
-        mtk_timer_setup(evt, GPT_CLK_SRC, TIMER_CTRL_OP_FREERUN);
-        clocksource_mmio_init(evt->gpt_base + TIMER_CNT_REG(GPT_CLK_SRC),
-                        node->name, rate, 300, 32, clocksource_mmio_readl_up);
-        gpt_sched_reg = evt->gpt_base + TIMER_CNT_REG(GPT_CLK_SRC);
-        sched_clock_register(mtk_read_sched_clock, 32, rate);
-
-        /* Configure clock event */
-        mtk_timer_setup(evt, GPT_CLK_EVT, TIMER_CTRL_OP_REPEAT);
-        clockevents_config_and_register(&evt->dev, rate, 0x3,
-                                        0xffffffff);
-
-        mtk_timer_enable_irq(evt, GPT_CLK_EVT);
-
-        return 0;
-
-err_clk_disable:
-        clk_disable_unprepare(clk);
-err_clk_put:
-        clk_put(clk);
-err_irq:
-        irq_dispose_mapping(evt->dev.irq);
-err_mem:
-        iounmap(evt->gpt_base);
-        of_address_to_resource(node, 0, &res);
-        release_mem_region(res.start, resource_size(&res));
-err_kzalloc:
-        kfree(evt);
-
-        return -EINVAL;
-}
-TIMER_OF_DECLARE(mtk_mt6577, "mediatek,mt6577-timer", mtk_timer_init);
diff --git a/drivers/clocksource/tegra20_timer.c b/drivers/clocksource/tegra20_timer.c
index c337a8100a7b..aa624885e0e2 100644
--- a/drivers/clocksource/tegra20_timer.c
+++ b/drivers/clocksource/tegra20_timer.c
@@ -230,7 +230,7 @@ static int __init tegra20_init_timer(struct device_node *np)
                 return ret;
         }
 
-        tegra_clockevent.cpumask = cpu_all_mask;
+        tegra_clockevent.cpumask = cpu_possible_mask;
         tegra_clockevent.irq = tegra_timer_irq.irq;
         clockevents_config_and_register(&tegra_clockevent, 1000000,
                                         0x1, 0x1fffffff);
@@ -259,6 +259,6 @@ static int __init tegra20_init_rtc(struct device_node *np)
         else
                 clk_prepare_enable(clk);
 
-        return register_persistent_clock(NULL, tegra_read_persistent_clock64);
+        return register_persistent_clock(tegra_read_persistent_clock64);
 }
 TIMER_OF_DECLARE(tegra20_rtc, "nvidia,tegra20-rtc", tegra20_init_rtc);
diff --git a/drivers/clocksource/timer-atcpit100.c b/drivers/clocksource/timer-atcpit100.c
index 5e23d7b4a722..b4bd2f5b801d 100644
--- a/drivers/clocksource/timer-atcpit100.c
+++ b/drivers/clocksource/timer-atcpit100.c
@@ -185,7 +185,7 @@ static struct timer_of to = {
                 .set_state_oneshot = atcpit100_clkevt_set_oneshot,
                 .tick_resume = atcpit100_clkevt_shutdown,
                 .set_next_event = atcpit100_clkevt_next_event,
-                .cpumask = cpu_all_mask,
+                .cpumask = cpu_possible_mask,
         },
 
         .of_irq = {
diff --git a/drivers/clocksource/timer-keystone.c b/drivers/clocksource/timer-keystone.c
index 0eee03250cfc..f5b2eda30bf3 100644
--- a/drivers/clocksource/timer-keystone.c
+++ b/drivers/clocksource/timer-keystone.c
@@ -211,7 +211,7 @@ static int __init keystone_timer_init(struct device_node *np)
         event_dev->set_state_shutdown = keystone_shutdown;
         event_dev->set_state_periodic = keystone_set_periodic;
         event_dev->set_state_oneshot = keystone_shutdown;
-        event_dev->cpumask = cpu_all_mask;
+        event_dev->cpumask = cpu_possible_mask;
         event_dev->owner = THIS_MODULE;
         event_dev->name = TIMER_NAME;
         event_dev->irq = irq;
diff --git a/drivers/clocksource/timer-mediatek.c b/drivers/clocksource/timer-mediatek.c
new file mode 100644
index 000000000000..eb10321f8517
--- /dev/null
+++ b/drivers/clocksource/timer-mediatek.c
@@ -0,0 +1,328 @@
+/*
+ * Mediatek SoCs General-Purpose Timer handling.
+ *
+ * Copyright (C) 2014 Matthias Brugger
+ *
+ * Matthias Brugger <matthias.bgg@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#define pr_fmt(fmt)     KBUILD_MODNAME ": " fmt
+
+#include <linux/clockchips.h>
+#include <linux/clocksource.h>
+#include <linux/interrupt.h>
+#include <linux/irqreturn.h>
+#include <linux/sched_clock.h>
+#include <linux/slab.h>
+#include "timer-of.h"
+
+#define TIMER_CLK_EVT           (1)
+#define TIMER_CLK_SRC           (2)
+
+#define TIMER_SYNC_TICKS        (3)
+
+/* gpt */
+#define GPT_IRQ_EN_REG          0x00
+#define GPT_IRQ_ENABLE(val)     BIT((val) - 1)
+#define GPT_IRQ_ACK_REG         0x08
+#define GPT_IRQ_ACK(val)        BIT((val) - 1)
+
+#define GPT_CTRL_REG(val)       (0x10 * (val))
+#define GPT_CTRL_OP(val)        (((val) & 0x3) << 4)
+#define GPT_CTRL_OP_ONESHOT     (0)
+#define GPT_CTRL_OP_REPEAT      (1)
+#define GPT_CTRL_OP_FREERUN     (3)
+#define GPT_CTRL_CLEAR          (2)
+#define GPT_CTRL_ENABLE         (1)
+#define GPT_CTRL_DISABLE        (0)
+
+#define GPT_CLK_REG(val)        (0x04 + (0x10 * (val)))
+#define GPT_CLK_SRC(val)        (((val) & 0x1) << 4)
+#define GPT_CLK_SRC_SYS13M      (0)
+#define GPT_CLK_SRC_RTC32K      (1)
+#define GPT_CLK_DIV1            (0x0)
+#define GPT_CLK_DIV2            (0x1)
+
+#define GPT_CNT_REG(val)        (0x08 + (0x10 * (val)))
+#define GPT_CMP_REG(val)        (0x0C + (0x10 * (val)))
+
+/* system timer */
+#define SYST_BASE               (0x40)
+
+#define SYST_CON                (SYST_BASE + 0x0)
+#define SYST_VAL                (SYST_BASE + 0x4)
+
+#define SYST_CON_REG(to)        (timer_of_base(to) + SYST_CON)
+#define SYST_VAL_REG(to)        (timer_of_base(to) + SYST_VAL)
+
+/*
+ * SYST_CON_EN: Clock enable. Shall be set to
+ *   - Start timer countdown.
+ *   - Allow timeout ticks being updated.
+ *   - Allow changing interrupt functions.
+ *
+ * SYST_CON_IRQ_EN: Set to allow interrupt.
+ *
+ * SYST_CON_IRQ_CLR: Set to clear interrupt.
+ */
+#define SYST_CON_EN              BIT(0)
+#define SYST_CON_IRQ_EN          BIT(1)
+#define SYST_CON_IRQ_CLR         BIT(4)
+
+static void __iomem *gpt_sched_reg __read_mostly;
+
+static void mtk_syst_ack_irq(struct timer_of *to)
+{
+        /* Clear and disable interrupt */
+        writel(SYST_CON_IRQ_CLR | SYST_CON_EN, SYST_CON_REG(to));
+}
+
+static irqreturn_t mtk_syst_handler(int irq, void *dev_id)
+{
+        struct clock_event_device *clkevt = dev_id;
+        struct timer_of *to = to_timer_of(clkevt);
+
+        mtk_syst_ack_irq(to);
+        clkevt->event_handler(clkevt);
+
+        return IRQ_HANDLED;
+}
+
+static int mtk_syst_clkevt_next_event(unsigned long ticks,
+                                      struct clock_event_device *clkevt)
+{
+        struct timer_of *to = to_timer_of(clkevt);
+
+        /* Enable clock to allow timeout tick update later */
+        writel(SYST_CON_EN, SYST_CON_REG(to));
+
+        /*
+         * Write new timeout ticks. Timer shall start countdown
+         * after timeout ticks are updated.
+         */
+        writel(ticks, SYST_VAL_REG(to));
+
+        /* Enable interrupt */
+        writel(SYST_CON_EN | SYST_CON_IRQ_EN, SYST_CON_REG(to));
+
+        return 0;
+}
+
+static int mtk_syst_clkevt_shutdown(struct clock_event_device *clkevt)
+{
+        /* Disable timer */
+        writel(0, SYST_CON_REG(to_timer_of(clkevt)));
+
+        return 0;
+}
+
+static int mtk_syst_clkevt_resume(struct clock_event_device *clkevt)
+{
+        return mtk_syst_clkevt_shutdown(clkevt);
+}
+
+static int mtk_syst_clkevt_oneshot(struct clock_event_device *clkevt)
+{
+        return 0;
+}
+
+static u64 notrace mtk_gpt_read_sched_clock(void)
+{
+        return readl_relaxed(gpt_sched_reg);
+}
+
+static void mtk_gpt_clkevt_time_stop(struct timer_of *to, u8 timer)
+{
+        u32 val;
+
+        val = readl(timer_of_base(to) + GPT_CTRL_REG(timer));
+        writel(val & ~GPT_CTRL_ENABLE, timer_of_base(to) +
+               GPT_CTRL_REG(timer));
+}
+
+static void mtk_gpt_clkevt_time_setup(struct timer_of *to,
+                                      unsigned long delay, u8 timer)
+{
+        writel(delay, timer_of_base(to) + GPT_CMP_REG(timer));
+}
+
+static void mtk_gpt_clkevt_time_start(struct timer_of *to,
+                                      bool periodic, u8 timer)
+{
+        u32 val;
+
+        /* Acknowledge interrupt */
+        writel(GPT_IRQ_ACK(timer), timer_of_base(to) + GPT_IRQ_ACK_REG);
+
+        val = readl(timer_of_base(to) + GPT_CTRL_REG(timer));
+
+        /* Clear 2 bit timer operation mode field */
+        val &= ~GPT_CTRL_OP(0x3);
+
+        if (periodic)
+                val |= GPT_CTRL_OP(GPT_CTRL_OP_REPEAT);
+        else
+                val |= GPT_CTRL_OP(GPT_CTRL_OP_ONESHOT);
+
+        writel(val | GPT_CTRL_ENABLE | GPT_CTRL_CLEAR,
+               timer_of_base(to) + GPT_CTRL_REG(timer));
+}
+
+static int mtk_gpt_clkevt_shutdown(struct clock_event_device *clk)
+{
+        mtk_gpt_clkevt_time_stop(to_timer_of(clk), TIMER_CLK_EVT);
+
+        return 0;
+}
+
+static int mtk_gpt_clkevt_set_periodic(struct clock_event_device *clk)
+{
+        struct timer_of *to = to_timer_of(clk);
+
+        mtk_gpt_clkevt_time_stop(to, TIMER_CLK_EVT);
+        mtk_gpt_clkevt_time_setup(to, to->of_clk.period, TIMER_CLK_EVT);
+        mtk_gpt_clkevt_time_start(to, true, TIMER_CLK_EVT);
+
+        return 0;
+}
+
+static int mtk_gpt_clkevt_next_event(unsigned long event,
+                                     struct clock_event_device *clk)
+{
+        struct timer_of *to = to_timer_of(clk);
+
+        mtk_gpt_clkevt_time_stop(to, TIMER_CLK_EVT);
+        mtk_gpt_clkevt_time_setup(to, event, TIMER_CLK_EVT);
+        mtk_gpt_clkevt_time_start(to, false, TIMER_CLK_EVT);
+
+        return 0;
+}
+
+static irqreturn_t mtk_gpt_interrupt(int irq, void *dev_id)
+{
+        struct clock_event_device *clkevt = (struct clock_event_device *)dev_id;
+        struct timer_of *to = to_timer_of(clkevt);
+
+        /* Acknowledge timer0 irq */
+        writel(GPT_IRQ_ACK(TIMER_CLK_EVT), timer_of_base(to) + GPT_IRQ_ACK_REG);
+        clkevt->event_handler(clkevt);
+
+        return IRQ_HANDLED;
+}
+
+static void
+__init mtk_gpt_setup(struct timer_of *to, u8 timer, u8 option)
+{
+        writel(GPT_CTRL_CLEAR | GPT_CTRL_DISABLE,
+               timer_of_base(to) + GPT_CTRL_REG(timer));
+
+        writel(GPT_CLK_SRC(GPT_CLK_SRC_SYS13M) | GPT_CLK_DIV1,
+               timer_of_base(to) + GPT_CLK_REG(timer));
+
+        writel(0x0, timer_of_base(to) + GPT_CMP_REG(timer));
+
+        writel(GPT_CTRL_OP(option) | GPT_CTRL_ENABLE,
+               timer_of_base(to) + GPT_CTRL_REG(timer));
+}
+
+static void mtk_gpt_enable_irq(struct timer_of *to, u8 timer)
+{
+        u32 val;
+
+        /* Disable all interrupts */
+        writel(0x0, timer_of_base(to) + GPT_IRQ_EN_REG);
+
+        /* Acknowledge all spurious pending interrupts */
+        writel(0x3f, timer_of_base(to) + GPT_IRQ_ACK_REG);
+
+        val = readl(timer_of_base(to) + GPT_IRQ_EN_REG);
+        writel(val | GPT_IRQ_ENABLE(timer),
+               timer_of_base(to) + GPT_IRQ_EN_REG);
+}
+
+static struct timer_of to = {
+        .flags = TIMER_OF_IRQ | TIMER_OF_BASE | TIMER_OF_CLOCK,
+
+        .clkevt = {
+                .name = "mtk-clkevt",
+                .rating = 300,
+                .cpumask = cpu_possible_mask,
+        },
+
+        .of_irq = {
+                .flags = IRQF_TIMER | IRQF_IRQPOLL,
+        },
+};
+
+static int __init mtk_syst_init(struct device_node *node)
+{
+        int ret;
+
+        to.clkevt.features = CLOCK_EVT_FEAT_DYNIRQ | CLOCK_EVT_FEAT_ONESHOT;
+        to.clkevt.set_state_shutdown = mtk_syst_clkevt_shutdown;
+        to.clkevt.set_state_oneshot = mtk_syst_clkevt_oneshot;
+        to.clkevt.tick_resume = mtk_syst_clkevt_resume;
+        to.clkevt.set_next_event = mtk_syst_clkevt_next_event;
+        to.of_irq.handler = mtk_syst_handler;
+
+        ret = timer_of_init(node, &to);
+        if (ret)
+                goto err;
+
+        clockevents_config_and_register(&to.clkevt, timer_of_rate(&to),
+                                        TIMER_SYNC_TICKS, 0xffffffff);
+
+        return 0;
+err:
+        timer_of_cleanup(&to);
+        return ret;
+}
+
+static int __init mtk_gpt_init(struct device_node *node)
+{
+        int ret;
+
+        to.clkevt.features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT;
+        to.clkevt.set_state_shutdown = mtk_gpt_clkevt_shutdown;
+        to.clkevt.set_state_periodic = mtk_gpt_clkevt_set_periodic;
+        to.clkevt.set_state_oneshot = mtk_gpt_clkevt_shutdown;
+        to.clkevt.tick_resume = mtk_gpt_clkevt_shutdown;
+        to.clkevt.set_next_event = mtk_gpt_clkevt_next_event;
+        to.of_irq.handler = mtk_gpt_interrupt;
+
+        ret = timer_of_init(node, &to);
+        if (ret)
+                goto err;
+
+        /* Configure clock source */
+        mtk_gpt_setup(&to, TIMER_CLK_SRC, GPT_CTRL_OP_FREERUN);
+        clocksource_mmio_init(timer_of_base(&to) + GPT_CNT_REG(TIMER_CLK_SRC),
+                              node->name, timer_of_rate(&to), 300, 32,
+                              clocksource_mmio_readl_up);
+        gpt_sched_reg = timer_of_base(&to) + GPT_CNT_REG(TIMER_CLK_SRC);
+        sched_clock_register(mtk_gpt_read_sched_clock, 32, timer_of_rate(&to));
+
+        /* Configure clock event */
+        mtk_gpt_setup(&to, TIMER_CLK_EVT, GPT_CTRL_OP_REPEAT);
+        clockevents_config_and_register(&to.clkevt, timer_of_rate(&to),
+                                        TIMER_SYNC_TICKS, 0xffffffff);
+
+        mtk_gpt_enable_irq(&to, TIMER_CLK_EVT);
+
+        return 0;
+err:
+        timer_of_cleanup(&to);
+        return ret;
+}
+TIMER_OF_DECLARE(mtk_mt6577, "mediatek,mt6577-timer", mtk_gpt_init);
+TIMER_OF_DECLARE(mtk_mt6765, "mediatek,mt6765-timer", mtk_syst_init);
diff --git a/drivers/clocksource/timer-sprd.c b/drivers/clocksource/timer-sprd.c
index ef9ebeafb3ed..430cb99d8d79 100644
--- a/drivers/clocksource/timer-sprd.c
+++ b/drivers/clocksource/timer-sprd.c
@@ -156,4 +156,54 @@ static int __init sprd_timer_init(struct device_node *np)
         return 0;
 }
 
+static struct timer_of suspend_to = {
+        .flags = TIMER_OF_BASE | TIMER_OF_CLOCK,
+};
+
+static u64 sprd_suspend_timer_read(struct clocksource *cs)
+{
+        return ~(u64)readl_relaxed(timer_of_base(&suspend_to) +
+                                   TIMER_VALUE_SHDW_LO) & cs->mask;
+}
+
+static int sprd_suspend_timer_enable(struct clocksource *cs)
+{
+        sprd_timer_update_counter(timer_of_base(&suspend_to),
+                                  TIMER_VALUE_LO_MASK);
+        sprd_timer_enable(timer_of_base(&suspend_to), TIMER_CTL_PERIOD_MODE);
+
+        return 0;
+}
+
+static void sprd_suspend_timer_disable(struct clocksource *cs)
+{
+        sprd_timer_disable(timer_of_base(&suspend_to));
+}
+
+static struct clocksource suspend_clocksource = {
+        .name   = "sprd_suspend_timer",
+        .rating = 200,
+        .read   = sprd_suspend_timer_read,
+        .enable = sprd_suspend_timer_enable,
+        .disable = sprd_suspend_timer_disable,
+        .mask   = CLOCKSOURCE_MASK(32),
+        .flags  = CLOCK_SOURCE_IS_CONTINUOUS | CLOCK_SOURCE_SUSPEND_NONSTOP,
+};
+
+static int __init sprd_suspend_timer_init(struct device_node *np)
+{
+        int ret;
+
+        ret = timer_of_init(np, &suspend_to);
+        if (ret)
+                return ret;
+
+        clocksource_register_hz(&suspend_clocksource,
+                                timer_of_rate(&suspend_to));
+
+        return 0;
+}
+
 TIMER_OF_DECLARE(sc9860_timer, "sprd,sc9860-timer", sprd_timer_init);
+TIMER_OF_DECLARE(sc9860_persistent_timer, "sprd,sc9860-suspend-timer",
+                 sprd_suspend_timer_init);
diff --git a/drivers/clocksource/timer-ti-32k.c b/drivers/clocksource/timer-ti-32k.c
index 880a861ab3c8..29e2e1a78a43 100644
--- a/drivers/clocksource/timer-ti-32k.c
+++ b/drivers/clocksource/timer-ti-32k.c
@@ -78,8 +78,7 @@ static struct ti_32k ti_32k_timer = {
                 .rating         = 250,
                 .read           = ti_32k_read_cycles,
                 .mask           = CLOCKSOURCE_MASK(32),
-                .flags          = CLOCK_SOURCE_IS_CONTINUOUS |
-                                CLOCK_SOURCE_SUSPEND_NONSTOP,
+                .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
         },
 };
 
diff --git a/drivers/clocksource/zevio-timer.c b/drivers/clocksource/zevio-timer.c
index a6a0338eea77..f74689334f7c 100644
--- a/drivers/clocksource/zevio-timer.c
+++ b/drivers/clocksource/zevio-timer.c
@@ -162,7 +162,7 @@ static int __init zevio_timer_add(struct device_node *node)
                 timer->clkevt.set_state_oneshot = zevio_timer_set_oneshot;
                 timer->clkevt.tick_resume       = zevio_timer_set_oneshot;
                 timer->clkevt.rating            = 200;
-                timer->clkevt.cpumask           = cpu_all_mask;
+                timer->clkevt.cpumask           = cpu_possible_mask;
                 timer->clkevt.features          = CLOCK_EVT_FEAT_ONESHOT;
                 timer->clkevt.irq               = irqnr;
 
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 3c3971256130..d4ed0022b0dd 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -311,12 +311,20 @@ static DEFINE_MUTEX(intel_pstate_limits_lock);
 
 #ifdef CONFIG_ACPI
 
-static bool intel_pstate_get_ppc_enable_status(void)
+static bool intel_pstate_acpi_pm_profile_server(void)
 {
         if (acpi_gbl_FADT.preferred_profile == PM_ENTERPRISE_SERVER ||
             acpi_gbl_FADT.preferred_profile == PM_PERFORMANCE_SERVER)
                 return true;
 
+        return false;
+}
+
+static bool intel_pstate_get_ppc_enable_status(void)
+{
+        if (intel_pstate_acpi_pm_profile_server())
+                return true;
+
         return acpi_ppc;
 }
 
@@ -459,6 +467,11 @@ static inline void intel_pstate_init_acpi_perf_limits(struct cpufreq_policy *pol
 static inline void intel_pstate_exit_perf_limits(struct cpufreq_policy *policy)
 {
 }
+
+static inline bool intel_pstate_acpi_pm_profile_server(void)
+{
+        return false;
+}
 #endif
 
 static inline void update_turbo_state(void)
@@ -1841,7 +1854,7 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
                 intel_pstate_hwp_enable(cpu);
 
                 id = x86_match_cpu(intel_pstate_hwp_boost_ids);
-                if (id)
+                if (id && intel_pstate_acpi_pm_profile_server())
                         hwp_boost = true;
         }
 
diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
index 1c6cbda56afe..09d823d36d3a 100644
--- a/drivers/crypto/padlock-aes.c
+++ b/drivers/crypto/padlock-aes.c
@@ -266,6 +266,8 @@ static inline void padlock_xcrypt_ecb(const u8 *input, u8 *output, void *key,
                 return;
         }
 
+        count -= initial;
+
         if (initial)
                 asm volatile (".byte 0xf3,0x0f,0xa7,0xc8"       /* rep xcryptecb */
                               : "+S"(input), "+D"(output)
@@ -273,7 +275,7 @@ static inline void padlock_xcrypt_ecb(const u8 *input, u8 *output, void *key,
 
         asm volatile (".byte 0xf3,0x0f,0xa7,0xc8"       /* rep xcryptecb */
                       : "+S"(input), "+D"(output)
-                      : "d"(control_word), "b"(key), "c"(count - initial));
+                      : "d"(control_word), "b"(key), "c"(count));
 }
 
 static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key,
@@ -284,6 +286,8 @@ static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key,
         if (count < cbc_fetch_blocks)
                 return cbc_crypt(input, output, key, iv, control_word, count);
 
+        count -= initial;
+
         if (initial)
                 asm volatile (".byte 0xf3,0x0f,0xa7,0xd0"       /* rep xcryptcbc */
                               : "+S" (input), "+D" (output), "+a" (iv)
@@ -291,7 +295,7 @@ static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key,
 
         asm volatile (".byte 0xf3,0x0f,0xa7,0xd0"       /* rep xcryptcbc */
                       : "+S" (input), "+D" (output), "+a" (iv)
-                      : "d" (control_word), "b" (key), "c" (count-initial));
+                      : "d" (control_word), "b" (key), "c" (count));
         return iv;
 }
 
diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig
index 781a4a337557..d8e159feb573 100644
--- a/drivers/firmware/efi/Kconfig
+++ b/drivers/firmware/efi/Kconfig
@@ -87,6 +87,18 @@ config EFI_RUNTIME_WRAPPERS
 config EFI_ARMSTUB
         bool
 
+config EFI_ARMSTUB_DTB_LOADER
+        bool "Enable the DTB loader"
+        depends on EFI_ARMSTUB
+        help
+          Select this config option to add support for the dtb= command
+          line parameter, allowing a device tree blob to be loaded into
+          memory from the EFI System Partition by the stub.
+
+          The device tree is typically provided by the platform or by
+          the bootloader, so this option is mostly for development
+          purposes only.
+
 config EFI_BOOTLOADER_CONTROL
         tristate "EFI Bootloader Control"
         depends on EFI_VARS
diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
index 3bf0dca378a6..a7902fccdcfa 100644
--- a/drivers/firmware/efi/cper.c
+++ b/drivers/firmware/efi/cper.c
@@ -48,8 +48,21 @@ u64 cper_next_record_id(void)
 {
         static atomic64_t seq;
 
-        if (!atomic64_read(&seq))
-                atomic64_set(&seq, ((u64)get_seconds()) << 32);
+        if (!atomic64_read(&seq)) {
+                time64_t time = ktime_get_real_seconds();
+
+                /*
+                 * This code is unlikely to still be needed in year 2106,
+                 * but just in case, let's use a few more bits for timestamps
+                 * after y2038 to be sure they keep increasing monotonically
+                 * for the next few hundred years...
+                 */
+                if (time < 0x80000000)
+                        atomic64_set(&seq, (ktime_get_real_seconds()) << 32);
+                else
+                        atomic64_set(&seq, 0x8000000000000000ull |
+                                           ktime_get_real_seconds() << 24);
+        }
 
         return atomic64_inc_return(&seq);
 }
@@ -459,7 +472,7 @@ cper_estatus_print_section(const char *pfx, struct acpi_hest_generic_data *gdata
                 else
                         goto err_section_too_small;
 #if defined(CONFIG_ARM64) || defined(CONFIG_ARM)
-        } else if (!uuid_le_cmp(*sec_type, CPER_SEC_PROC_ARM)) {
+        } else if (guid_equal(sec_type, &CPER_SEC_PROC_ARM)) {
                 struct cper_sec_proc_arm *arm_err = acpi_hest_get_payload(gdata);
 
                 printk("%ssection_type: ARM processor error\n", newpfx);
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index 232f4915223b..2a29dd9c986d 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -82,8 +82,11 @@ struct mm_struct efi_mm = {
         .mmap_sem               = __RWSEM_INITIALIZER(efi_mm.mmap_sem),
         .page_table_lock        = __SPIN_LOCK_UNLOCKED(efi_mm.page_table_lock),
         .mmlist                 = LIST_HEAD_INIT(efi_mm.mmlist),
+        .cpu_bitmap             = { [BITS_TO_LONGS(NR_CPUS)] = 0},
 };
 
+struct workqueue_struct *efi_rts_wq;
+
 static bool disable_runtime;
 static int __init setup_noefi(char *arg)
 {
@@ -337,6 +340,18 @@ static int __init efisubsys_init(void)
         if (!efi_enabled(EFI_BOOT))
                 return 0;
 
+        /*
+         * Since we process only one efi_runtime_service() at a time, an
+         * ordered workqueue (which creates only one execution context)
+         * should suffice all our needs.
+         */
+        efi_rts_wq = alloc_ordered_workqueue("efi_rts_wq", 0);
+        if (!efi_rts_wq) {
+                pr_err("Creating efi_rts_wq failed, EFI runtime services disabled.\n");
+                clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+                return 0;
+        }
+
         /* We register the efi directory at /sys/firmware/efi */
         efi_kobj = kobject_create_and_add("efi", firmware_kobj);
         if (!efi_kobj) {
@@ -388,7 +403,7 @@ subsys_initcall(efisubsys_init);
  * and if so, populate the supplied memory descriptor with the appropriate
  * data.
  */
-int __init efi_mem_desc_lookup(u64 phys_addr, efi_memory_desc_t *out_md)
+int efi_mem_desc_lookup(u64 phys_addr, efi_memory_desc_t *out_md)
 {
         efi_memory_desc_t *md;
 
@@ -406,12 +421,6 @@ int __init efi_mem_desc_lookup(u64 phys_addr, efi_memory_desc_t *out_md)
                 u64 size;
                 u64 end;
 
-                if (!(md->attribute & EFI_MEMORY_RUNTIME) &&
-                    md->type != EFI_BOOT_SERVICES_DATA &&
-                    md->type != EFI_RUNTIME_SERVICES_DATA) {
-                        continue;
-                }
-
                 size = md->num_pages << EFI_PAGE_SHIFT;
                 end = md->phys_addr + size;
                 if (phys_addr >= md->phys_addr && phys_addr < end) {
diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c
index 1ab80e06e7c5..5d06bd247d07 100644
--- a/drivers/firmware/efi/esrt.c
+++ b/drivers/firmware/efi/esrt.c
@@ -250,7 +250,10 @@ void __init efi_esrt_init(void)
                 return;
 
         rc = efi_mem_desc_lookup(efi.esrt, &md);
-        if (rc < 0) {
+        if (rc < 0 ||
+            (!(md.attribute & EFI_MEMORY_RUNTIME) &&
+             md.type != EFI_BOOT_SERVICES_DATA &&
+             md.type != EFI_RUNTIME_SERVICES_DATA)) {
                 pr_warn("ESRT header is not in the memory map.\n");
                 return;
         }
@@ -326,7 +329,8 @@ void __init efi_esrt_init(void)
 
         end = esrt_data + size;
         pr_info("Reserving ESRT space from %pa to %pa.\n", &esrt_data, &end);
-        efi_mem_reserve(esrt_data, esrt_data_size);
+        if (md.type == EFI_BOOT_SERVICES_DATA)
+                efi_mem_reserve(esrt_data, esrt_data_size);
 
         pr_debug("esrt-init: loaded.\n");
 }
diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c
index 01a9d78ee415..6920033de6d4 100644
--- a/drivers/firmware/efi/libstub/arm-stub.c
+++ b/drivers/firmware/efi/libstub/arm-stub.c
@@ -40,31 +40,6 @@
 
 static u64 virtmap_base = EFI_RT_VIRTUAL_BASE;
 
-efi_status_t efi_open_volume(efi_system_table_t *sys_table_arg,
-                             void *__image, void **__fh)
-{
-        efi_file_io_interface_t *io;
-        efi_loaded_image_t *image = __image;
-        efi_file_handle_t *fh;
-        efi_guid_t fs_proto = EFI_FILE_SYSTEM_GUID;
-        efi_status_t status;
-        void *handle = (void *)(unsigned long)image->device_handle;
-
-        status = sys_table_arg->boottime->handle_protocol(handle,
-                                 &fs_proto, (void **)&io);
-        if (status != EFI_SUCCESS) {
-                efi_printk(sys_table_arg, "Failed to handle fs_proto\n");
-                return status;
-        }
-
-        status = io->open_volume(io, &fh);
-        if (status != EFI_SUCCESS)
-                efi_printk(sys_table_arg, "Failed to open volume\n");
-
-        *__fh = fh;
-        return status;
-}
-
 void efi_char16_printk(efi_system_table_t *sys_table_arg,
                               efi_char16_t *str)
 {
@@ -202,9 +177,10 @@ unsigned long efi_entry(void *handle, efi_system_table_t *sys_table,
          * 'dtb=' unless UEFI Secure Boot is disabled.  We assume that secure
          * boot is enabled if we can't determine its state.
          */
-        if (secure_boot != efi_secureboot_mode_disabled &&
-            strstr(cmdline_ptr, "dtb=")) {
-                pr_efi(sys_table, "Ignoring DTB from command line.\n");
+        if (!IS_ENABLED(CONFIG_EFI_ARMSTUB_DTB_LOADER) ||
+             secure_boot != efi_secureboot_mode_disabled) {
+                if (strstr(cmdline_ptr, "dtb="))
+                        pr_efi(sys_table, "Ignoring DTB from command line.\n");
         } else {
                 status = handle_cmdline_files(sys_table, image, cmdline_ptr,
                                               "dtb=",
diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c
index 50a9cab5a834..e94975f4655b 100644
--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
@@ -413,6 +413,34 @@ static efi_status_t efi_file_close(void *handle)
         return efi_call_proto(efi_file_handle, close, handle);
 }
 
+static efi_status_t efi_open_volume(efi_system_table_t *sys_table_arg,
+                                    efi_loaded_image_t *image,
+                                    efi_file_handle_t **__fh)
+{
+        efi_file_io_interface_t *io;
+        efi_file_handle_t *fh;
+        efi_guid_t fs_proto = EFI_FILE_SYSTEM_GUID;
+        efi_status_t status;
+        void *handle = (void *)(unsigned long)efi_table_attr(efi_loaded_image,
+                                                             device_handle,
+                                                             image);
+
+        status = efi_call_early(handle_protocol, handle,
+                                &fs_proto, (void **)&io);
+        if (status != EFI_SUCCESS) {
+                efi_printk(sys_table_arg, "Failed to handle fs_proto\n");
+                return status;
+        }
+
+        status = efi_call_proto(efi_file_io_interface, open_volume, io, &fh);
+        if (status != EFI_SUCCESS)
+                efi_printk(sys_table_arg, "Failed to open volume\n");
+        else
+                *__fh = fh;
+
+        return status;
+}
+
 /*
  * Parse the ASCII string 'cmdline' for EFI options, denoted by the efi=
  * option, e.g. efi=nochunk.
@@ -563,8 +591,7 @@ efi_status_t handle_cmdline_files(efi_system_table_t *sys_table_arg,
 
                 /* Only open the volume once. */
                 if (!i) {
-                        status = efi_open_volume(sys_table_arg, image,
-                                                 (void **)&fh);
+                        status = efi_open_volume(sys_table_arg, image, &fh);
                         if (status != EFI_SUCCESS)
                                 goto free_files;
                 }
diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h
index f59564b72ddc..32799cf039ef 100644
--- a/drivers/firmware/efi/libstub/efistub.h
+++ b/drivers/firmware/efi/libstub/efistub.h
@@ -36,9 +36,6 @@ extern int __pure is_quiet(void);
 
 void efi_char16_printk(efi_system_table_t *, efi_char16_t *);
 
-efi_status_t efi_open_volume(efi_system_table_t *sys_table_arg, void *__image,
-                             void **__fh);
-
 unsigned long get_dram_base(efi_system_table_t *sys_table_arg);
 
 efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c
index ae54870b2788..aa66cbf23512 100644
--- a/drivers/firmware/efi/runtime-wrappers.c
+++ b/drivers/firmware/efi/runtime-wrappers.c
@@ -1,6 +1,15 @@
 /*
  * runtime-wrappers.c - Runtime Services function call wrappers
  *
+ * Implementation summary:
+ * -----------------------
+ * 1. When user/kernel thread requests to execute efi_runtime_service(),
+ * enqueue work to efi_rts_wq.
+ * 2. Caller thread waits for completion until the work is finished
+ * because it's dependent on the return status and execution of
+ * efi_runtime_service().
+ * For instance, get_variable() and get_next_variable().
+ *
  * Copyright (C) 2014 Linaro Ltd. <ard.biesheuvel@linaro.org>
  *
  * Split off from arch/x86/platform/efi/efi.c
@@ -22,6 +31,9 @@
 #include <linux/mutex.h>
 #include <linux/semaphore.h>
 #include <linux/stringify.h>
+#include <linux/workqueue.h>
+#include <linux/completion.h>
+
 #include <asm/efi.h>
 
 /*
@@ -33,6 +45,76 @@
 #define __efi_call_virt(f, args...) \
         __efi_call_virt_pointer(efi.systab->runtime, f, args)
 
+/* efi_runtime_service() function identifiers */
+enum efi_rts_ids {
+        GET_TIME,
+        SET_TIME,
+        GET_WAKEUP_TIME,
+        SET_WAKEUP_TIME,
+        GET_VARIABLE,
+        GET_NEXT_VARIABLE,
+        SET_VARIABLE,
+        QUERY_VARIABLE_INFO,
+        GET_NEXT_HIGH_MONO_COUNT,
+        UPDATE_CAPSULE,
+        QUERY_CAPSULE_CAPS,
+};
+
+/*
+ * efi_runtime_work:    Details of EFI Runtime Service work
+ * @arg<1-5>:           EFI Runtime Service function arguments
+ * @status:             Status of executing EFI Runtime Service
+ * @efi_rts_id:         EFI Runtime Service function identifier
+ * @efi_rts_comp:       Struct used for handling completions
+ */
+struct efi_runtime_work {
+        void *arg1;
+        void *arg2;
+        void *arg3;
+        void *arg4;
+        void *arg5;
+        efi_status_t status;
+        struct work_struct work;
+        enum efi_rts_ids efi_rts_id;
+        struct completion efi_rts_comp;
+};
+
+/*
+ * efi_queue_work:      Queue efi_runtime_service() and wait until it's done
+ * @rts:                efi_runtime_service() function identifier
+ * @rts_arg<1-5>:       efi_runtime_service() function arguments
+ *
+ * Accesses to efi_runtime_services() are serialized by a binary
+ * semaphore (efi_runtime_lock) and caller waits until the work is
+ * finished, hence _only_ one work is queued at a time and the caller
+ * thread waits for completion.
+ */
+#define efi_queue_work(_rts, _arg1, _arg2, _arg3, _arg4, _arg5)         \
+({                                                                      \
+        struct efi_runtime_work efi_rts_work;                           \
+        efi_rts_work.status = EFI_ABORTED;                              \
+                                                                        \
+        init_completion(&efi_rts_work.efi_rts_comp);                    \
+        INIT_WORK_ONSTACK(&efi_rts_work.work, efi_call_rts);            \
+        efi_rts_work.arg1 = _arg1;                                      \
+        efi_rts_work.arg2 = _arg2;                                      \
+        efi_rts_work.arg3 = _arg3;                                      \
+        efi_rts_work.arg4 = _arg4;                                      \
+        efi_rts_work.arg5 = _arg5;                                      \
+        efi_rts_work.efi_rts_id = _rts;                                 \
+                                                                        \
+        /*                                                              \
+         * queue_work() returns 0 if work was already on queue,         \
+         * _ideally_ this should never happen.                          \
+         */                                                             \
+        if (queue_work(efi_rts_wq, &efi_rts_work.work))                 \
+                wait_for_completion(&efi_rts_work.efi_rts_comp);        \
+        else                                                            \
+                pr_err("Failed to queue work to efi_rts_wq.\n");        \
+                                                                        \
+        efi_rts_work.status;                                            \
+})
+
 void efi_call_virt_check_flags(unsigned long flags, const char *call)
 {
         unsigned long cur_flags, mismatch;
@@ -90,13 +172,98 @@ void efi_call_virt_check_flags(unsigned long flags, const char *call)
  */
 static DEFINE_SEMAPHORE(efi_runtime_lock);
 
+/*
+ * Calls the appropriate efi_runtime_service() with the appropriate
+ * arguments.
+ *
+ * Semantics followed by efi_call_rts() to understand efi_runtime_work:
+ * 1. If argument was a pointer, recast it from void pointer to original
+ * pointer type.
+ * 2. If argument was a value, recast it from void pointer to original
+ * pointer type and dereference it.
+ */
+static void efi_call_rts(struct work_struct *work)
+{
+        struct efi_runtime_work *efi_rts_work;
+        void *arg1, *arg2, *arg3, *arg4, *arg5;
+        efi_status_t status = EFI_NOT_FOUND;
+
+        efi_rts_work = container_of(work, struct efi_runtime_work, work);
+        arg1 = efi_rts_work->arg1;
+        arg2 = efi_rts_work->arg2;
+        arg3 = efi_rts_work->arg3;
+        arg4 = efi_rts_work->arg4;
+        arg5 = efi_rts_work->arg5;
+
+        switch (efi_rts_work->efi_rts_id) {
+        case GET_TIME:
+                status = efi_call_virt(get_time, (efi_time_t *)arg1,
+                                       (efi_time_cap_t *)arg2);
+                break;
+        case SET_TIME:
+                status = efi_call_virt(set_time, (efi_time_t *)arg1);
+                break;
+        case GET_WAKEUP_TIME:
+                status = efi_call_virt(get_wakeup_time, (efi_bool_t *)arg1,
+                                       (efi_bool_t *)arg2, (efi_time_t *)arg3);
+                break;
+        case SET_WAKEUP_TIME:
+                status = efi_call_virt(set_wakeup_time, *(efi_bool_t *)arg1,
+                                       (efi_time_t *)arg2);
+                break;
+        case GET_VARIABLE:
+                status = efi_call_virt(get_variable, (efi_char16_t *)arg1,
+                                       (efi_guid_t *)arg2, (u32 *)arg3,
+                                       (unsigned long *)arg4, (void *)arg5);
+                break;
+        case GET_NEXT_VARIABLE:
+                status = efi_call_virt(get_next_variable, (unsigned long *)arg1,
+                                       (efi_char16_t *)arg2,
+                                       (efi_guid_t *)arg3);
+                break;
+        case SET_VARIABLE:
+                status = efi_call_virt(set_variable, (efi_char16_t *)arg1,
+                                       (efi_guid_t *)arg2, *(u32 *)arg3,
+                                       *(unsigned long *)arg4, (void *)arg5);
+                break;
+        case QUERY_VARIABLE_INFO:
+                status = efi_call_virt(query_variable_info, *(u32 *)arg1,
+                                       (u64 *)arg2, (u64 *)arg3, (u64 *)arg4);
+                break;
+        case GET_NEXT_HIGH_MONO_COUNT:
+                status = efi_call_virt(get_next_high_mono_count, (u32 *)arg1);
+                break;
+        case UPDATE_CAPSULE:
+                status = efi_call_virt(update_capsule,
+                                       (efi_capsule_header_t **)arg1,
+                                       *(unsigned long *)arg2,
+                                       *(unsigned long *)arg3);
+                break;
+        case QUERY_CAPSULE_CAPS:
+                status = efi_call_virt(query_capsule_caps,
+                                       (efi_capsule_header_t **)arg1,
+                                       *(unsigned long *)arg2, (u64 *)arg3,
+                                       (int *)arg4);
+                break;
+        default:
+                /*
+                 * Ideally, we should never reach here because a caller of this
+                 * function should have put the right efi_runtime_service()
+                 * function identifier into efi_rts_work->efi_rts_id
+                 */
+                pr_err("Requested executing invalid EFI Runtime Service.\n");
+        }
+        efi_rts_work->status = status;
+        complete(&efi_rts_work->efi_rts_comp);
+}
+
 static efi_status_t virt_efi_get_time(efi_time_t *tm, efi_time_cap_t *tc)
 {
         efi_status_t status;
 
         if (down_interruptible(&efi_runtime_lock))
                 return EFI_ABORTED;
-        status = efi_call_virt(get_time, tm, tc);
+        status = efi_queue_work(GET_TIME, tm, tc, NULL, NULL, NULL);
         up(&efi_runtime_lock);
         return status;
 }
@@ -107,7 +274,7 @@ static efi_status_t virt_efi_set_time(efi_time_t *tm)
 
         if (down_interruptible(&efi_runtime_lock))
                 return EFI_ABORTED;
-        status = efi_call_virt(set_time, tm);
+        status = efi_queue_work(SET_TIME, tm, NULL, NULL, NULL, NULL);
         up(&efi_runtime_lock);
         return status;
 }
@@ -120,7 +287,8 @@ static efi_status_t virt_efi_get_wakeup_time(efi_bool_t *enabled,
 
         if (down_interruptible(&efi_runtime_lock))
                 return EFI_ABORTED;
-        status = efi_call_virt(get_wakeup_time, enabled, pending, tm);
+        status = efi_queue_work(GET_WAKEUP_TIME, enabled, pending, tm, NULL,
+                                NULL);
         up(&efi_runtime_lock);
         return status;
 }
@@ -131,7 +299,8 @@ static efi_status_t virt_efi_set_wakeup_time(efi_bool_t enabled, efi_time_t *tm)
 
         if (down_interruptible(&efi_runtime_lock))
                 return EFI_ABORTED;
-        status = efi_call_virt(set_wakeup_time, enabled, tm);
+        status = efi_queue_work(SET_WAKEUP_TIME, &enabled, tm, NULL, NULL,
+                                NULL);
         up(&efi_runtime_lock);
         return status;
 }
@@ -146,8 +315,8 @@ static efi_status_t virt_efi_get_variable(efi_char16_t *name,
 
         if (down_interruptible(&efi_runtime_lock))
                 return EFI_ABORTED;
-        status = efi_call_virt(get_variable, name, vendor, attr, data_size,
-                               data);
+        status = efi_queue_work(GET_VARIABLE, name, vendor, attr, data_size,
+                                data);
         up(&efi_runtime_lock);
         return status;
 }
@@ -160,7 +329,8 @@ static efi_status_t virt_efi_get_next_variable(unsigned long *name_size,
 
         if (down_interruptible(&efi_runtime_lock))
                 return EFI_ABORTED;
-        status = efi_call_virt(get_next_variable, name_size, name, vendor);
+        status = efi_queue_work(GET_NEXT_VARIABLE, name_size, name, vendor,
+                                NULL, NULL);
         up(&efi_runtime_lock);
         return status;
 }
@@ -175,8 +345,8 @@ static efi_status_t virt_efi_set_variable(efi_char16_t *name,
 
         if (down_interruptible(&efi_runtime_lock))
                 return EFI_ABORTED;
-        status = efi_call_virt(set_variable, name, vendor, attr, data_size,
-                               data);
+        status = efi_queue_work(SET_VARIABLE, name, vendor, &attr, &data_size,
+                                data);
         up(&efi_runtime_lock);
         return status;
 }
@@ -210,8 +380,8 @@ static efi_status_t virt_efi_query_variable_info(u32 attr,
 
         if (down_interruptible(&efi_runtime_lock))
                 return EFI_ABORTED;
-        status = efi_call_virt(query_variable_info, attr, storage_space,
-                               remaining_space, max_variable_size);
+        status = efi_queue_work(QUERY_VARIABLE_INFO, &attr, storage_space,
+                                remaining_space, max_variable_size, NULL);
         up(&efi_runtime_lock);
         return status;
 }
@@ -242,7 +412,8 @@ static efi_status_t virt_efi_get_next_high_mono_count(u32 *count)
 
         if (down_interruptible(&efi_runtime_lock))
                 return EFI_ABORTED;
-        status = efi_call_virt(get_next_high_mono_count, count);
+        status = efi_queue_work(GET_NEXT_HIGH_MONO_COUNT, count, NULL, NULL,
+                                NULL, NULL);
         up(&efi_runtime_lock);
         return status;
 }
@@ -272,7 +443,8 @@ static efi_status_t virt_efi_update_capsule(efi_capsule_header_t **capsules,
 
         if (down_interruptible(&efi_runtime_lock))
                 return EFI_ABORTED;
-        status = efi_call_virt(update_capsule, capsules, count, sg_list);
+        status = efi_queue_work(UPDATE_CAPSULE, capsules, &count, &sg_list,
+                                NULL, NULL);
         up(&efi_runtime_lock);
         return status;
 }
@@ -289,8 +461,8 @@ static efi_status_t virt_efi_query_capsule_caps(efi_capsule_header_t **capsules,
 
         if (down_interruptible(&efi_runtime_lock))
                 return EFI_ABORTED;
-        status = efi_call_virt(query_capsule_caps, capsules, count, max_size,
-                               reset_type);
+        status = efi_queue_work(QUERY_CAPSULE_CAPS, capsules, &count,
+                                max_size, reset_type, NULL);
         up(&efi_runtime_lock);
         return status;
 }
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index e2232cbcec8b..addd9fecc198 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -25,6 +25,7 @@
 
 struct acpi_gpio_event {
         struct list_head node;
+        struct list_head initial_sync_list;
         acpi_handle handle;
         unsigned int pin;
         unsigned int irq;
@@ -50,6 +51,9 @@ struct acpi_gpio_chip {
         struct list_head events;
 };
 
+static LIST_HEAD(acpi_gpio_initial_sync_list);
+static DEFINE_MUTEX(acpi_gpio_initial_sync_list_lock);
+
 static int acpi_gpiochip_find(struct gpio_chip *gc, void *data)
 {
         if (!gc->parent)
@@ -85,6 +89,21 @@ static struct gpio_desc *acpi_get_gpiod(char *path, int pin)
         return gpiochip_get_desc(chip, pin);
 }
 
+static void acpi_gpio_add_to_initial_sync_list(struct acpi_gpio_event *event)
+{
+        mutex_lock(&acpi_gpio_initial_sync_list_lock);
+        list_add(&event->initial_sync_list, &acpi_gpio_initial_sync_list);
+        mutex_unlock(&acpi_gpio_initial_sync_list_lock);
+}
+
+static void acpi_gpio_del_from_initial_sync_list(struct acpi_gpio_event *event)
+{
+        mutex_lock(&acpi_gpio_initial_sync_list_lock);
+        if (!list_empty(&event->initial_sync_list))
+                list_del_init(&event->initial_sync_list);
+        mutex_unlock(&acpi_gpio_initial_sync_list_lock);
+}
+
 static irqreturn_t acpi_gpio_irq_handler(int irq, void *data)
 {
         struct acpi_gpio_event *event = data;
@@ -136,7 +155,7 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
         irq_handler_t handler = NULL;
         struct gpio_desc *desc;
         unsigned long irqflags;
-        int ret, pin, irq;
+        int ret, pin, irq, value;
 
         if (!acpi_gpio_get_irq_resource(ares, &agpio))
                 return AE_OK;
@@ -167,6 +186,8 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
 
         gpiod_direction_input(desc);
 
+        value = gpiod_get_value(desc);
+
         ret = gpiochip_lock_as_irq(chip, pin);
         if (ret) {
                 dev_err(chip->parent, "Failed to lock GPIO as interrupt\n");
@@ -208,6 +229,7 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
         event->irq = irq;
         event->pin = pin;
         event->desc = desc;
+        INIT_LIST_HEAD(&event->initial_sync_list);
 
         ret = request_threaded_irq(event->irq, NULL, handler, irqflags,
                                    "ACPI:Event", event);
@@ -222,6 +244,18 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
                 enable_irq_wake(irq);
 
         list_add_tail(&event->node, &acpi_gpio->events);
+
+        /*
+         * Make sure we trigger the initial state of the IRQ when using RISING
+         * or FALLING.  Note we run the handlers on late_init, the AML code
+         * may refer to OperationRegions from other (builtin) drivers which
+         * may be probed after us.
+         */
+        if (handler == acpi_gpio_irq_handler &&
+            (((irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
+             ((irqflags & IRQF_TRIGGER_FALLING) && value == 0)))
+                acpi_gpio_add_to_initial_sync_list(event);
+
         return AE_OK;
 
 fail_free_event:
@@ -294,6 +328,8 @@ void acpi_gpiochip_free_interrupts(struct gpio_chip *chip)
         list_for_each_entry_safe_reverse(event, ep, &acpi_gpio->events, node) {
                 struct gpio_desc *desc;
 
+                acpi_gpio_del_from_initial_sync_list(event);
+
                 if (irqd_is_wakeup_set(irq_get_irq_data(event->irq)))
                         disable_irq_wake(event->irq);
 
@@ -1158,3 +1194,21 @@ bool acpi_can_fallback_to_crs(struct acpi_device *adev, const char *con_id)
 
         return con_id == NULL;
 }
+
+/* Sync the initial state of handlers after all builtin drivers have probed */
+static int acpi_gpio_initial_sync(void)
+{
+        struct acpi_gpio_event *event, *ep;
+
+        mutex_lock(&acpi_gpio_initial_sync_list_lock);
+        list_for_each_entry_safe(event, ep, &acpi_gpio_initial_sync_list,
+                                 initial_sync_list) {
+                acpi_evaluate_object(event->handle, NULL, NULL, NULL);
+                list_del_init(&event->initial_sync_list);
+        }
+        mutex_unlock(&acpi_gpio_initial_sync_list_lock);
+
+        return 0;
+}
+/* We must use _sync so that this runs after the first deferred_probe run */
+late_initcall_sync(acpi_gpio_initial_sync);
diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
index 73021b388e12..dd3ff2f2cdce 100644
--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
@@ -429,6 +429,18 @@ static void adv7511_hpd_work(struct work_struct *work)
         else
                 status = connector_status_disconnected;
 
+        /*
+         * The bridge resets its registers on unplug. So when we get a plug
+         * event and we're already supposed to be powered, cycle the bridge to
+         * restore its state.
+         */
+        if (status == connector_status_connected &&
+            adv7511->connector.status == connector_status_disconnected &&
+            adv7511->powered) {
+                regcache_mark_dirty(adv7511->regmap);
+                adv7511_power_on(adv7511);
+        }
+
         if (adv7511->connector.status != status) {
                 adv7511->connector.status = status;
                 if (status == connector_status_disconnected)
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 130da5195f3b..81e32199d3ef 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -1510,8 +1510,9 @@ int drm_atomic_helper_async_check(struct drm_device *dev,
 {
         struct drm_crtc *crtc;
         struct drm_crtc_state *crtc_state;
-        struct drm_plane *plane;
-        struct drm_plane_state *old_plane_state, *new_plane_state;
+        struct drm_plane *plane = NULL;
+        struct drm_plane_state *old_plane_state = NULL;
+        struct drm_plane_state *new_plane_state = NULL;
         const struct drm_plane_helper_funcs *funcs;
         int i, n_planes = 0;
 
@@ -1527,7 +1528,8 @@ int drm_atomic_helper_async_check(struct drm_device *dev,
         if (n_planes != 1)
                 return -EINVAL;
 
-        if (!new_plane_state->crtc)
+        if (!new_plane_state->crtc ||
+            old_plane_state->crtc != new_plane_state->crtc)
                 return -EINVAL;
 
         funcs = plane->helper_private;
diff --git a/drivers/gpu/drm/drm_context.c b/drivers/gpu/drm/drm_context.c
index 3c4000facb36..f973d287696a 100644
--- a/drivers/gpu/drm/drm_context.c
+++ b/drivers/gpu/drm/drm_context.c
@@ -372,7 +372,7 @@ int drm_legacy_addctx(struct drm_device *dev, void *data,
                 ctx->handle = drm_legacy_ctxbitmap_next(dev);
         }
         DRM_DEBUG("%d\n", ctx->handle);
-        if (ctx->handle == -1) {
+        if (ctx->handle < 0) {
                 DRM_DEBUG("Not enough free contexts.\n");
                 /* Should this return -EBUSY instead? */
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index 1d34619eb3fe..a951ec75d01f 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -320,6 +320,9 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
                         vc4_state->x_scaling[0] = VC4_SCALING_TPZ;
                 if (vc4_state->y_scaling[0] == VC4_SCALING_NONE)
                         vc4_state->y_scaling[0] = VC4_SCALING_TPZ;
+        } else {
+                vc4_state->x_scaling[1] = VC4_SCALING_NONE;
+                vc4_state->y_scaling[1] = VC4_SCALING_NONE;
         }
 
         vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE &&
diff --git a/drivers/i2c/busses/i2c-xlp9xx.c b/drivers/i2c/busses/i2c-xlp9xx.c
index 1f41a4f89c08..8a873975cf12 100644
--- a/drivers/i2c/busses/i2c-xlp9xx.c
+++ b/drivers/i2c/busses/i2c-xlp9xx.c
@@ -191,28 +191,43 @@ static void xlp9xx_i2c_drain_rx_fifo(struct xlp9xx_i2c_dev *priv)
         if (priv->len_recv) {
                 /* read length byte */
                 rlen = xlp9xx_read_i2c_reg(priv, XLP9XX_I2C_MRXFIFO);
+
+                /*
+                 * We expect at least 2 interrupts for I2C_M_RECV_LEN
+                 * transactions. The length is updated during the first
+                 * interrupt, and the buffer contents are only copied
+                 * during subsequent interrupts. If in case the interrupts
+                 * get merged we would complete the transaction without
+                 * copying out the bytes from RX fifo. To avoid this now we
+                 * drain the fifo as and when data is available.
+                 * We drained the rlen byte already, decrement total length
+                 * by one.
+                 */
+
+                len--;
                 if (rlen > I2C_SMBUS_BLOCK_MAX || rlen == 0) {
                         rlen = 0;       /*abort transfer */
                         priv->msg_buf_remaining = 0;
                         priv->msg_len = 0;
-                } else {
-                        *buf++ = rlen;
-                        if (priv->client_pec)
-                                ++rlen; /* account for error check byte */
-                        /* update remaining bytes and message length */
-                        priv->msg_buf_remaining = rlen;
-                        priv->msg_len = rlen + 1;
+                        xlp9xx_i2c_update_rlen(priv);
+                        return;
                 }
+
+                *buf++ = rlen;
+                if (priv->client_pec)
+                        ++rlen; /* account for error check byte */
+                /* update remaining bytes and message length */
+                priv->msg_buf_remaining = rlen;
+                priv->msg_len = rlen + 1;
                 xlp9xx_i2c_update_rlen(priv);
                 priv->len_recv = false;
-        } else {
-                len = min(priv->msg_buf_remaining, len);
-                for (i = 0; i < len; i++, buf++)
-                        *buf = xlp9xx_read_i2c_reg(priv, XLP9XX_I2C_MRXFIFO);
-
-                priv->msg_buf_remaining -= len;
         }
 
+        len = min(priv->msg_buf_remaining, len);
+        for (i = 0; i < len; i++, buf++)
+                *buf = xlp9xx_read_i2c_reg(priv, XLP9XX_I2C_MRXFIFO);
+
+        priv->msg_buf_remaining -= len;
         priv->msg_buf = buf;
 
         if (priv->msg_buf_remaining)
diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
index a6e904973ba8..475910ffbcb6 100644
--- a/drivers/infiniband/core/rdma_core.c
+++ b/drivers/infiniband/core/rdma_core.c
@@ -121,7 +121,7 @@ static int uverbs_try_lock_object(struct ib_uobject *uobj, bool exclusive)
          * this lock.
          */
         if (!exclusive)
-                return __atomic_add_unless(&uobj->usecnt, 1, -1) == -1 ?
+                return atomic_fetch_add_unless(&uobj->usecnt, 1, -1) == -1 ?
                         -EBUSY : 0;
 
         /* lock is either WRITE or DESTROY - should be exclusive */
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index cc06e8404e9b..583d3a10b940 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1984,15 +1984,64 @@ static int modify_qp(struct ib_uverbs_file *file,
                 goto release_qp;
         }
 
-        if ((cmd->base.attr_mask & IB_QP_AV) &&
-            !rdma_is_port_valid(qp->device, cmd->base.dest.port_num)) {
-                ret = -EINVAL;
-                goto release_qp;
+        if ((cmd->base.attr_mask & IB_QP_AV)) {
+                if (!rdma_is_port_valid(qp->device, cmd->base.dest.port_num)) {
+                        ret = -EINVAL;
+                        goto release_qp;
+                }
+
+                if (cmd->base.attr_mask & IB_QP_STATE &&
+                    cmd->base.qp_state == IB_QPS_RTR) {
+                /* We are in INIT->RTR TRANSITION (if we are not,
+                 * this transition will be rejected in subsequent checks).
+                 * In the INIT->RTR transition, we cannot have IB_QP_PORT set,
+                 * but the IB_QP_STATE flag is required.
+                 *
+                 * Since kernel 3.14 (commit dbf727de7440), the uverbs driver,
+                 * when IB_QP_AV is set, has required inclusion of a valid
+                 * port number in the primary AV. (AVs are created and handled
+                 * differently for infiniband and ethernet (RoCE) ports).
+                 *
+                 * Check the port number included in the primary AV against
+                 * the port number in the qp struct, which was set (and saved)
+                 * in the RST->INIT transition.
+                 */
+                        if (cmd->base.dest.port_num != qp->real_qp->port) {
+                                ret = -EINVAL;
+                                goto release_qp;
+                        }
+                } else {
+                /* We are in SQD->SQD. (If we are not, this transition will
+                 * be rejected later in the verbs layer checks).
+                 * Check for both IB_QP_PORT and IB_QP_AV, these can be set
+                 * together in the SQD->SQD transition.
+                 *
+                 * If only IP_QP_AV was set, add in IB_QP_PORT as well (the
+                 * verbs layer driver does not track primary port changes
+                 * resulting from path migration. Thus, in SQD, if the primary
+                 * AV is modified, the primary port should also be modified).
+                 *
+                 * Note that in this transition, the IB_QP_STATE flag
+                 * is not allowed.
+                 */
+                        if (((cmd->base.attr_mask & (IB_QP_AV | IB_QP_PORT))
+                             == (IB_QP_AV | IB_QP_PORT)) &&
+                            cmd->base.port_num != cmd->base.dest.port_num) {
+                                ret = -EINVAL;
+                                goto release_qp;
+                        }
+                        if ((cmd->base.attr_mask & (IB_QP_AV | IB_QP_PORT))
+                            == IB_QP_AV) {
+                                cmd->base.attr_mask |= IB_QP_PORT;
+                                cmd->base.port_num = cmd->base.dest.port_num;
+                        }
+                }
         }
 
         if ((cmd->base.attr_mask & IB_QP_ALT_PATH) &&
             (!rdma_is_port_valid(qp->device, cmd->base.alt_port_num) ||
-            !rdma_is_port_valid(qp->device, cmd->base.alt_dest.port_num))) {
+            !rdma_is_port_valid(qp->device, cmd->base.alt_dest.port_num) ||
+            cmd->base.alt_port_num != cmd->base.alt_dest.port_num)) {
                 ret = -EINVAL;
                 goto release_qp;
         }
diff --git a/drivers/input/keyboard/hilkbd.c b/drivers/input/keyboard/hilkbd.c
index a4e404aaf64b..5c7afdec192c 100644
--- a/drivers/input/keyboard/hilkbd.c
+++ b/drivers/input/keyboard/hilkbd.c
@@ -57,8 +57,8 @@ MODULE_LICENSE("GPL v2");
  #define HIL_DATA               0x1
  #define HIL_CMD                0x3
  #define HIL_IRQ                2
- #define hil_readb(p)           readb(p)
- #define hil_writeb(v,p)        writeb((v),(p))
+ #define hil_readb(p)           readb((const volatile void __iomem *)(p))
+ #define hil_writeb(v, p)       writeb((v), (volatile void __iomem *)(p))
 
 #else
 #error "HIL is not supported on this platform"
diff --git a/drivers/irqchip/Kconfig b/drivers/irqchip/Kconfig
index e9233db16e03..d564d21245c5 100644
--- a/drivers/irqchip/Kconfig
+++ b/drivers/irqchip/Kconfig
@@ -8,7 +8,7 @@ config ARM_GIC
         bool
         select IRQ_DOMAIN
         select IRQ_DOMAIN_HIERARCHY
-        select MULTI_IRQ_HANDLER
+        select GENERIC_IRQ_MULTI_HANDLER
         select GENERIC_IRQ_EFFECTIVE_AFF_MASK
 
 config ARM_GIC_PM
@@ -34,7 +34,7 @@ config GIC_NON_BANKED
 config ARM_GIC_V3
         bool
         select IRQ_DOMAIN
-        select MULTI_IRQ_HANDLER
+        select GENERIC_IRQ_MULTI_HANDLER
         select IRQ_DOMAIN_HIERARCHY
         select PARTITION_PERCPU
         select GENERIC_IRQ_EFFECTIVE_AFF_MASK
@@ -66,7 +66,7 @@ config ARM_NVIC
 config ARM_VIC
         bool
         select IRQ_DOMAIN
-        select MULTI_IRQ_HANDLER
+        select GENERIC_IRQ_MULTI_HANDLER
 
 config ARM_VIC_NR
         int
@@ -93,14 +93,14 @@ config ATMEL_AIC_IRQ
         bool
         select GENERIC_IRQ_CHIP
         select IRQ_DOMAIN
-        select MULTI_IRQ_HANDLER
+        select GENERIC_IRQ_MULTI_HANDLER
         select SPARSE_IRQ
 
 config ATMEL_AIC5_IRQ
         bool
         select GENERIC_IRQ_CHIP
         select IRQ_DOMAIN
-        select MULTI_IRQ_HANDLER
+        select GENERIC_IRQ_MULTI_HANDLER
         select SPARSE_IRQ
 
 config I8259
@@ -137,7 +137,7 @@ config DW_APB_ICTL
 config FARADAY_FTINTC010
         bool
         select IRQ_DOMAIN
-        select MULTI_IRQ_HANDLER
+        select GENERIC_IRQ_MULTI_HANDLER
         select SPARSE_IRQ
 
 config HISILICON_IRQ_MBIGEN
@@ -162,7 +162,7 @@ config CLPS711X_IRQCHIP
         bool
         depends on ARCH_CLPS711X
         select IRQ_DOMAIN
-        select MULTI_IRQ_HANDLER
+        select GENERIC_IRQ_MULTI_HANDLER
         select SPARSE_IRQ
         default y
 
@@ -181,7 +181,7 @@ config OMAP_IRQCHIP
 config ORION_IRQCHIP
         bool
         select IRQ_DOMAIN
-        select MULTI_IRQ_HANDLER
+        select GENERIC_IRQ_MULTI_HANDLER
 
 config PIC32_EVIC
         bool
diff --git a/drivers/irqchip/irq-gic-v3-its-fsl-mc-msi.c b/drivers/irqchip/irq-gic-v3-its-fsl-mc-msi.c
index 4eca5c763766..606efa64adff 100644
--- a/drivers/irqchip/irq-gic-v3-its-fsl-mc-msi.c
+++ b/drivers/irqchip/irq-gic-v3-its-fsl-mc-msi.c
@@ -45,6 +45,9 @@ static int its_fsl_mc_msi_prepare(struct irq_domain *msi_domain,
          */
         info->scratchpad[0].ul = mc_bus_dev->icid;
         msi_info = msi_get_domain_info(msi_domain->parent);
+
+        /* Allocate at least 32 MSIs, and always as a power of 2 */
+        nvec = max_t(int, 32, roundup_pow_of_two(nvec));
         return msi_info->ops->msi_prepare(msi_domain->parent, dev, nvec, info);
 }
 
diff --git a/drivers/irqchip/irq-gic-v3-its-pci-msi.c b/drivers/irqchip/irq-gic-v3-its-pci-msi.c
index 25a98de5cfb2..8d6d009d1d58 100644
--- a/drivers/irqchip/irq-gic-v3-its-pci-msi.c
+++ b/drivers/irqchip/irq-gic-v3-its-pci-msi.c
@@ -66,7 +66,7 @@ static int its_pci_msi_prepare(struct irq_domain *domain, struct device *dev,
 {
         struct pci_dev *pdev, *alias_dev;
         struct msi_domain_info *msi_info;
-        int alias_count = 0;
+        int alias_count = 0, minnvec = 1;
 
         if (!dev_is_pci(dev))
                 return -EINVAL;
@@ -86,8 +86,18 @@ static int its_pci_msi_prepare(struct irq_domain *domain, struct device *dev,
         /* ITS specific DeviceID, as the core ITS ignores dev. */
         info->scratchpad[0].ul = pci_msi_domain_get_msi_rid(domain, pdev);
 
-        return msi_info->ops->msi_prepare(domain->parent,
-                                          dev, max(nvec, alias_count), info);
+        /*
+         * Always allocate a power of 2, and special case device 0 for
+         * broken systems where the DevID is not wired (and all devices
+         * appear as DevID 0). For that reason, we generously allocate a
+         * minimum of 32 MSIs for DevID 0. If you want more because all
+         * your devices are aliasing to DevID 0, consider fixing your HW.
+         */
+        nvec = max(nvec, alias_count);
+        if (!info->scratchpad[0].ul)
+                minnvec = 32;
+        nvec = max_t(int, minnvec, roundup_pow_of_two(nvec));
+        return msi_info->ops->msi_prepare(domain->parent, dev, nvec, info);
 }
 
 static struct msi_domain_ops its_pci_msi_ops = {
diff --git a/drivers/irqchip/irq-gic-v3-its-platform-msi.c b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
index 8881a053c173..7b8e87b493fe 100644
--- a/drivers/irqchip/irq-gic-v3-its-platform-msi.c
+++ b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
@@ -73,6 +73,8 @@ static int its_pmsi_prepare(struct irq_domain *domain, struct device *dev,
         /* ITS specific DeviceID, as the core ITS ignores dev. */
         info->scratchpad[0].ul = dev_id;
 
+        /* Allocate at least 32 MSIs, and always as a power of 2 */
+        nvec = max_t(int, 32, roundup_pow_of_two(nvec));
         return msi_info->ops->msi_prepare(domain->parent,
                                           dev, nvec, info);
 }
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index d7842d312d3e..316a57530f6d 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -23,6 +23,8 @@
 #include <linux/dma-iommu.h>
 #include <linux/interrupt.h>
 #include <linux/irqdomain.h>
+#include <linux/list.h>
+#include <linux/list_sort.h>
 #include <linux/log2.h>
 #include <linux/mm.h>
 #include <linux/msi.h>
@@ -160,7 +162,7 @@ static struct {
 } vpe_proxy;
 
 static LIST_HEAD(its_nodes);
-static DEFINE_SPINLOCK(its_lock);
+static DEFINE_RAW_SPINLOCK(its_lock);
 static struct rdists *gic_rdists;
 static struct irq_domain *its_parent;
 
@@ -1421,112 +1423,176 @@ static struct irq_chip its_irq_chip = {
         .irq_set_vcpu_affinity  = its_irq_set_vcpu_affinity,
 };
 
+
 /*
  * How we allocate LPIs:
  *
- * The GIC has id_bits bits for interrupt identifiers. From there, we
- * must subtract 8192 which are reserved for SGIs/PPIs/SPIs. Then, as
- * we allocate LPIs by chunks of 32, we can shift the whole thing by 5
- * bits to the right.
+ * lpi_range_list contains ranges of LPIs that are to available to
+ * allocate from. To allocate LPIs, just pick the first range that
+ * fits the required allocation, and reduce it by the required
+ * amount. Once empty, remove the range from the list.
+ *
+ * To free a range of LPIs, add a free range to the list, sort it and
+ * merge the result if the new range happens to be adjacent to an
+ * already free block.
  *
- * This gives us (((1UL << id_bits) - 8192) >> 5) possible allocations.
+ * The consequence of the above is that allocation is cost is low, but
+ * freeing is expensive. We assumes that freeing rarely occurs.
  */
-#define IRQS_PER_CHUNK_SHIFT    5
-#define IRQS_PER_CHUNK          (1UL << IRQS_PER_CHUNK_SHIFT)
-#define ITS_MAX_LPI_NRBITS      16 /* 64K LPIs */
 
-static unsigned long *lpi_bitmap;
-static u32 lpi_chunks;
-static DEFINE_SPINLOCK(lpi_lock);
+static DEFINE_MUTEX(lpi_range_lock);
+static LIST_HEAD(lpi_range_list);
+
+struct lpi_range {
+        struct list_head        entry;
+        u32                     base_id;
+        u32                     span;
+};
 
-static int its_lpi_to_chunk(int lpi)
+static struct lpi_range *mk_lpi_range(u32 base, u32 span)
 {
-        return (lpi - 8192) >> IRQS_PER_CHUNK_SHIFT;
+        struct lpi_range *range;
+
+        range = kzalloc(sizeof(*range), GFP_KERNEL);
+        if (range) {
+                INIT_LIST_HEAD(&range->entry);
+                range->base_id = base;
+                range->span = span;
+        }
+
+        return range;
 }
 
-static int its_chunk_to_lpi(int chunk)
+static int lpi_range_cmp(void *priv, struct list_head *a, struct list_head *b)
 {
-        return (chunk << IRQS_PER_CHUNK_SHIFT) + 8192;
+        struct lpi_range *ra, *rb;
+
+        ra = container_of(a, struct lpi_range, entry);
+        rb = container_of(b, struct lpi_range, entry);
+
+        return rb->base_id - ra->base_id;
 }
 
-static int __init its_lpi_init(u32 id_bits)
+static void merge_lpi_ranges(void)
 {
-        lpi_chunks = its_lpi_to_chunk(1UL << id_bits);
+        struct lpi_range *range, *tmp;
 
-        lpi_bitmap = kcalloc(BITS_TO_LONGS(lpi_chunks), sizeof(long),
-                             GFP_KERNEL);
-        if (!lpi_bitmap) {
-                lpi_chunks = 0;
-                return -ENOMEM;
+        list_for_each_entry_safe(range, tmp, &lpi_range_list, entry) {
+                if (!list_is_last(&range->entry, &lpi_range_list) &&
+                    (tmp->base_id == (range->base_id + range->span))) {
+                        tmp->base_id = range->base_id;
+                        tmp->span += range->span;
+                        list_del(&range->entry);
+                        kfree(range);
+                }
         }
+}
 
-        pr_info("ITS: Allocated %d chunks for LPIs\n", (int)lpi_chunks);
-        return 0;
+static int alloc_lpi_range(u32 nr_lpis, u32 *base)
+{
+        struct lpi_range *range, *tmp;
+        int err = -ENOSPC;
+
+        mutex_lock(&lpi_range_lock);
+
+        list_for_each_entry_safe(range, tmp, &lpi_range_list, entry) {
+                if (range->span >= nr_lpis) {
+                        *base = range->base_id;
+                        range->base_id += nr_lpis;
+                        range->span -= nr_lpis;
+
+                        if (range->span == 0) {
+                                list_del(&range->entry);
+                                kfree(range);
+                        }
+
+                        err = 0;
+                        break;
+                }
+        }
+
+        mutex_unlock(&lpi_range_lock);
+
+        pr_debug("ITS: alloc %u:%u\n", *base, nr_lpis);
+        return err;
 }
 
-static unsigned long *its_lpi_alloc_chunks(int nr_irqs, int *base, int *nr_ids)
+static int free_lpi_range(u32 base, u32 nr_lpis)
 {
-        unsigned long *bitmap = NULL;
-        int chunk_id;
-        int nr_chunks;
-        int i;
+        struct lpi_range *new;
+        int err = 0;
+
+        mutex_lock(&lpi_range_lock);
+
+        new = mk_lpi_range(base, nr_lpis);
+        if (!new) {
+                err = -ENOMEM;
+                goto out;
+        }
+
+        list_add(&new->entry, &lpi_range_list);
+        list_sort(NULL, &lpi_range_list, lpi_range_cmp);
+        merge_lpi_ranges();
+out:
+        mutex_unlock(&lpi_range_lock);
+        return err;
+}
+
+static int __init its_lpi_init(u32 id_bits)
+{
+        u32 lpis = (1UL << id_bits) - 8192;
+        u32 numlpis;
+        int err;
+
+        numlpis = 1UL << GICD_TYPER_NUM_LPIS(gic_rdists->gicd_typer);
+
+        if (numlpis > 2 && !WARN_ON(numlpis > lpis)) {
+                lpis = numlpis;
+                pr_info("ITS: Using hypervisor restricted LPI range [%u]\n",
+                        lpis);
+        }
 
-        nr_chunks = DIV_ROUND_UP(nr_irqs, IRQS_PER_CHUNK);
+        /*
+         * Initializing the allocator is just the same as freeing the
+         * full range of LPIs.
+         */
+        err = free_lpi_range(8192, lpis);
+        pr_debug("ITS: Allocator initialized for %u LPIs\n", lpis);
+        return err;
+}
 
-        spin_lock(&lpi_lock);
+static unsigned long *its_lpi_alloc(int nr_irqs, u32 *base, int *nr_ids)
+{
+        unsigned long *bitmap = NULL;
+        int err = 0;
 
         do {
-                chunk_id = bitmap_find_next_zero_area(lpi_bitmap, lpi_chunks,
-                                                      0, nr_chunks, 0);
-                if (chunk_id < lpi_chunks)
+                err = alloc_lpi_range(nr_irqs, base);
+                if (!err)
                         break;
 
-                nr_chunks--;
-        } while (nr_chunks > 0);
+                nr_irqs /= 2;
+        } while (nr_irqs > 0);
 
-        if (!nr_chunks)
+        if (err)
                 goto out;
 
-        bitmap = kcalloc(BITS_TO_LONGS(nr_chunks * IRQS_PER_CHUNK),
-                         sizeof(long),
-                         GFP_ATOMIC);
+        bitmap = kcalloc(BITS_TO_LONGS(nr_irqs), sizeof (long), GFP_ATOMIC);
         if (!bitmap)
                 goto out;
 
-        for (i = 0; i < nr_chunks; i++)
-                set_bit(chunk_id + i, lpi_bitmap);
-
-        *base = its_chunk_to_lpi(chunk_id);
-        *nr_ids = nr_chunks * IRQS_PER_CHUNK;
+        *nr_ids = nr_irqs;
 
 out:
-        spin_unlock(&lpi_lock);
-
         if (!bitmap)
                 *base = *nr_ids = 0;
 
         return bitmap;
 }
 
-static void its_lpi_free_chunks(unsigned long *bitmap, int base, int nr_ids)
+static void its_lpi_free(unsigned long *bitmap, u32 base, u32 nr_ids)
 {
-        int lpi;
-
-        spin_lock(&lpi_lock);
-
-        for (lpi = base; lpi < (base + nr_ids); lpi += IRQS_PER_CHUNK) {
-                int chunk = its_lpi_to_chunk(lpi);
-
-                BUG_ON(chunk > lpi_chunks);
-                if (test_bit(chunk, lpi_bitmap)) {
-                        clear_bit(chunk, lpi_bitmap);
-                } else {
-                        pr_err("Bad LPI chunk %d\n", chunk);
-                }
-        }
-
-        spin_unlock(&lpi_lock);
-
+        WARN_ON(free_lpi_range(base, nr_ids));
         kfree(bitmap);
 }
 
@@ -1559,7 +1625,7 @@ static int __init its_alloc_lpi_tables(void)
 {
         phys_addr_t paddr;
 
-        lpi_id_bits = min_t(u32, gic_rdists->id_bits, ITS_MAX_LPI_NRBITS);
+        lpi_id_bits = GICD_TYPER_ID_BITS(gic_rdists->gicd_typer);
         gic_rdists->prop_page = its_allocate_prop_table(GFP_NOWAIT);
         if (!gic_rdists->prop_page) {
                 pr_err("Failed to allocate PROPBASE\n");
@@ -1997,12 +2063,12 @@ static void its_cpu_init_collections(void)
 {
         struct its_node *its;
 
-        spin_lock(&its_lock);
+        raw_spin_lock(&its_lock);
 
         list_for_each_entry(its, &its_nodes, entry)
                 its_cpu_init_collection(its);
 
-        spin_unlock(&its_lock);
+        raw_spin_unlock(&its_lock);
 }
 
 static struct its_device *its_find_device(struct its_node *its, u32 dev_id)
@@ -2134,17 +2200,20 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
         if (!its_alloc_device_table(its, dev_id))
                 return NULL;
 
+        if (WARN_ON(!is_power_of_2(nvecs)))
+                nvecs = roundup_pow_of_two(nvecs);
+
         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
         /*
-         * We allocate at least one chunk worth of LPIs bet device,
-         * and thus that many ITEs. The device may require less though.
+         * Even if the device wants a single LPI, the ITT must be
+         * sized as a power of two (and you need at least one bit...).
          */
-        nr_ites = max(IRQS_PER_CHUNK, roundup_pow_of_two(nvecs));
+        nr_ites = max(2, nvecs);
         sz = nr_ites * its->ite_size;
         sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1;
         itt = kzalloc(sz, GFP_KERNEL);
         if (alloc_lpis) {
-                lpi_map = its_lpi_alloc_chunks(nvecs, &lpi_base, &nr_lpis);
+                lpi_map = its_lpi_alloc(nvecs, &lpi_base, &nr_lpis);
                 if (lpi_map)
                         col_map = kcalloc(nr_lpis, sizeof(*col_map),
                                           GFP_KERNEL);
@@ -2379,9 +2448,9 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
         /* If all interrupts have been freed, start mopping the floor */
         if (bitmap_empty(its_dev->event_map.lpi_map,
                          its_dev->event_map.nr_lpis)) {
-                its_lpi_free_chunks(its_dev->event_map.lpi_map,
-                                    its_dev->event_map.lpi_base,
-                                    its_dev->event_map.nr_lpis);
+                its_lpi_free(its_dev->event_map.lpi_map,
+                             its_dev->event_map.lpi_base,
+                             its_dev->event_map.nr_lpis);
                 kfree(its_dev->event_map.col_map);
 
                 /* Unmap device/itt */
@@ -2780,7 +2849,7 @@ static void its_vpe_irq_domain_free(struct irq_domain *domain,
         }
 
         if (bitmap_empty(vm->db_bitmap, vm->nr_db_lpis)) {
-                its_lpi_free_chunks(vm->db_bitmap, vm->db_lpi_base, vm->nr_db_lpis);
+                its_lpi_free(vm->db_bitmap, vm->db_lpi_base, vm->nr_db_lpis);
                 its_free_prop_table(vm->vprop_page);
         }
 }
@@ -2795,18 +2864,18 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virq
 
         BUG_ON(!vm);
 
-        bitmap = its_lpi_alloc_chunks(nr_irqs, &base, &nr_ids);
+        bitmap = its_lpi_alloc(roundup_pow_of_two(nr_irqs), &base, &nr_ids);
         if (!bitmap)
                 return -ENOMEM;
 
         if (nr_ids < nr_irqs) {
-                its_lpi_free_chunks(bitmap, base, nr_ids);
+                its_lpi_free(bitmap, base, nr_ids);
                 return -ENOMEM;
         }
 
         vprop_page = its_allocate_prop_table(GFP_KERNEL);
         if (!vprop_page) {
-                its_lpi_free_chunks(bitmap, base, nr_ids);
+                its_lpi_free(bitmap, base, nr_ids);
                 return -ENOMEM;
         }
 
@@ -2833,7 +2902,7 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virq
                 if (i > 0)
                         its_vpe_irq_domain_free(domain, virq, i - 1);
 
-                its_lpi_free_chunks(bitmap, base, nr_ids);
+                its_lpi_free(bitmap, base, nr_ids);
                 its_free_prop_table(vprop_page);
         }
 
@@ -3070,7 +3139,7 @@ static int its_save_disable(void)
         struct its_node *its;
         int err = 0;
 
-        spin_lock(&its_lock);
+        raw_spin_lock(&its_lock);
         list_for_each_entry(its, &its_nodes, entry) {
                 void __iomem *base;
 
@@ -3102,7 +3171,7 @@ err:
                         writel_relaxed(its->ctlr_save, base + GITS_CTLR);
                 }
         }
-        spin_unlock(&its_lock);
+        raw_spin_unlock(&its_lock);
 
         return err;
 }
@@ -3112,7 +3181,7 @@ static void its_restore_enable(void)
         struct its_node *its;
         int ret;
 
-        spin_lock(&its_lock);
+        raw_spin_lock(&its_lock);
         list_for_each_entry(its, &its_nodes, entry) {
                 void __iomem *base;
                 int i;
@@ -3164,7 +3233,7 @@ static void its_restore_enable(void)
                     GITS_TYPER_HCC(gic_read_typer(base + GITS_TYPER)))
                         its_cpu_init_collection(its);
         }
-        spin_unlock(&its_lock);
+        raw_spin_unlock(&its_lock);
 }
 
 static struct syscore_ops its_syscore_ops = {
@@ -3398,9 +3467,9 @@ static int __init its_probe_one(struct resource *res,
         if (err)
                 goto out_free_tables;
 
-        spin_lock(&its_lock);
+        raw_spin_lock(&its_lock);
         list_add(&its->entry, &its_nodes);
-        spin_unlock(&its_lock);
+        raw_spin_unlock(&its_lock);
 
         return 0;
 
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 76ea56d779a1..e214181b77b7 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -877,7 +877,7 @@ static struct irq_chip gic_eoimode1_chip = {
         .flags                  = IRQCHIP_SET_TYPE_MASKED,
 };
 
-#define GIC_ID_NR               (1U << gic_data.rdists.id_bits)
+#define GIC_ID_NR       (1U << GICD_TYPER_ID_BITS(gic_data.rdists.gicd_typer))
 
 static int gic_irq_domain_map(struct irq_domain *d, unsigned int irq,
                               irq_hw_number_t hw)
@@ -1091,7 +1091,7 @@ static int __init gic_init_bases(void __iomem *dist_base,
          * The GIC only supports up to 1020 interrupt sources (SGI+PPI+SPI)
          */
         typer = readl_relaxed(gic_data.dist_base + GICD_TYPER);
-        gic_data.rdists.id_bits = GICD_TYPER_ID_BITS(typer);
+        gic_data.rdists.gicd_typer = typer;
         gic_irqs = GICD_TYPER_IRQS(typer);
         if (gic_irqs > 1020)
                 gic_irqs = 1020;
diff --git a/drivers/irqchip/irq-ingenic.c b/drivers/irqchip/irq-ingenic.c
index fc5953dea509..2ff08986b536 100644
--- a/drivers/irqchip/irq-ingenic.c
+++ b/drivers/irqchip/irq-ingenic.c
@@ -165,6 +165,7 @@ static int __init intc_1chip_of_init(struct device_node *node,
         return ingenic_intc_of_init(node, 1);
 }
 IRQCHIP_DECLARE(jz4740_intc, "ingenic,jz4740-intc", intc_1chip_of_init);
+IRQCHIP_DECLARE(jz4725b_intc, "ingenic,jz4725b-intc", intc_1chip_of_init);
 
 static int __init intc_2chip_of_init(struct device_node *node,
         struct device_node *parent)
diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c
index 3a7e8905a97e..3df527fcf4e1 100644
--- a/drivers/irqchip/irq-stm32-exti.c
+++ b/drivers/irqchip/irq-stm32-exti.c
@@ -159,6 +159,7 @@ static const struct stm32_exti_bank *stm32mp1_exti_banks[] = {
 };
 
 static const struct stm32_desc_irq stm32mp1_desc_irq[] = {
+        { .exti = 0, .irq_parent = 6 },
         { .exti = 1, .irq_parent = 7 },
         { .exti = 2, .irq_parent = 8 },
         { .exti = 3, .irq_parent = 9 },
diff --git a/drivers/media/platform/vsp1/vsp1_drm.c b/drivers/media/platform/vsp1/vsp1_drm.c
index edb35a5c57ea..a99fc0ced7a7 100644
--- a/drivers/media/platform/vsp1/vsp1_drm.c
+++ b/drivers/media/platform/vsp1/vsp1_drm.c
@@ -728,9 +728,6 @@ EXPORT_SYMBOL_GPL(vsp1_du_setup_lif);
  */
 void vsp1_du_atomic_begin(struct device *dev, unsigned int pipe_index)
 {
-        struct vsp1_device *vsp1 = dev_get_drvdata(dev);
-
-        mutex_lock(&vsp1->drm->lock);
 }
 EXPORT_SYMBOL_GPL(vsp1_du_atomic_begin);
 
@@ -846,6 +843,7 @@ void vsp1_du_atomic_flush(struct device *dev, unsigned int pipe_index,
 
         drm_pipe->crc = cfg->crc;
 
+        mutex_lock(&vsp1->drm->lock);
         vsp1_du_pipeline_setup_inputs(vsp1, pipe);
         vsp1_du_pipeline_configure(pipe);
         mutex_unlock(&vsp1->drm->lock);
diff --git a/drivers/media/rc/bpf-lirc.c b/drivers/media/rc/bpf-lirc.c
index fcfab6635f9c..81b150e5dfdb 100644
--- a/drivers/media/rc/bpf-lirc.c
+++ b/drivers/media/rc/bpf-lirc.c
@@ -174,6 +174,7 @@ static int lirc_bpf_detach(struct rc_dev *rcdev, struct bpf_prog *prog)
 
         rcu_assign_pointer(raw->progs, new_array);
         bpf_prog_array_free(old_array);
+        bpf_prog_put(prog);
 unlock:
         mutex_unlock(&ir_raw_handler_lock);
         return ret;
diff --git a/drivers/media/rc/rc-ir-raw.c b/drivers/media/rc/rc-ir-raw.c
index 2e0066b1a31c..e7948908e78c 100644
--- a/drivers/media/rc/rc-ir-raw.c
+++ b/drivers/media/rc/rc-ir-raw.c
@@ -30,13 +30,13 @@ static int ir_raw_event_thread(void *data)
                 while (kfifo_out(&raw->kfifo, &ev, 1)) {
                         if (is_timing_event(ev)) {
                                 if (ev.duration == 0)
-                                        dev_err(&dev->dev, "nonsensical timing event of duration 0");
+                                        dev_warn_once(&dev->dev, "nonsensical timing event of duration 0");
                                 if (is_timing_event(raw->prev_ev) &&
                                     !is_transition(&ev, &raw->prev_ev))
-                                        dev_err(&dev->dev, "two consecutive events of type %s",
-                                                TO_STR(ev.pulse));
+                                        dev_warn_once(&dev->dev, "two consecutive events of type %s",
+                                                      TO_STR(ev.pulse));
                                 if (raw->prev_ev.reset && ev.pulse == 0)
-                                        dev_err(&dev->dev, "timing event after reset should be pulse");
+                                        dev_warn_once(&dev->dev, "timing event after reset should be pulse");
                         }
                         list_for_each_entry(handler, &ir_raw_handler_list, list)
                                 if (dev->enabled_protocols &
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index 2e222d9ee01f..ca68e1d2b2f9 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -679,6 +679,14 @@ static void ir_timer_repeat(struct timer_list *t)
         spin_unlock_irqrestore(&dev->keylock, flags);
 }
 
+static unsigned int repeat_period(int protocol)
+{
+        if (protocol >= ARRAY_SIZE(protocols))
+                return 100;
+
+        return protocols[protocol].repeat_period;
+}
+
 /**
  * rc_repeat() - signals that a key is still pressed
  * @dev:        the struct rc_dev descriptor of the device
@@ -691,7 +699,7 @@ void rc_repeat(struct rc_dev *dev)
 {
         unsigned long flags;
         unsigned int timeout = nsecs_to_jiffies(dev->timeout) +
-                msecs_to_jiffies(protocols[dev->last_protocol].repeat_period);
+                msecs_to_jiffies(repeat_period(dev->last_protocol));
         struct lirc_scancode sc = {
                 .scancode = dev->last_scancode, .rc_proto = dev->last_protocol,
                 .keycode = dev->keypressed ? dev->last_keycode : KEY_RESERVED,
@@ -803,7 +811,7 @@ void rc_keydown(struct rc_dev *dev, enum rc_proto protocol, u32 scancode,
 
         if (dev->keypressed) {
                 dev->keyup_jiffies = jiffies + nsecs_to_jiffies(dev->timeout) +
-                        msecs_to_jiffies(protocols[protocol].repeat_period);
+                        msecs_to_jiffies(repeat_period(protocol));
                 mod_timer(&dev->timer_keyup, dev->keyup_jiffies);
         }
         spin_unlock_irqrestore(&dev->keylock, flags);
diff --git a/drivers/mmc/host/mxcmmc.c b/drivers/mmc/host/mxcmmc.c
index 75f781c11e89..de4e6e5bf304 100644
--- a/drivers/mmc/host/mxcmmc.c
+++ b/drivers/mmc/host/mxcmmc.c
@@ -293,9 +293,10 @@ static void mxcmci_swap_buffers(struct mmc_data *data)
         int i;
 
         for_each_sg(data->sg, sg, data->sg_len, i) {
-                void *buf = kmap_atomic(sg_page(sg) + sg->offset;
+                void *buf = kmap_atomic(sg_page(sg) + sg->offset);
                 buffer_swap32(buf, sg->length);
                 kunmap_atomic(buf);
+        }
 }
 #else
 static inline void mxcmci_swap_buffers(struct mmc_data *data) {}
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 63e3844c5bec..217b790d22ed 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1717,6 +1717,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
                 goto err_upper_unlink;
         }
 
+        bond->nest_level = dev_get_nest_level(bond_dev) + 1;
+
         /* If the mode uses primary, then the following is handled by
          * bond_change_active_slave().
          */
@@ -1764,7 +1766,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
         if (bond_mode_can_use_xmit_hash(bond))
                 bond_update_slave_arr(bond, NULL);
 
-        bond->nest_level = dev_get_nest_level(bond_dev);
 
         netdev_info(bond_dev, "Enslaving %s as %s interface with %s link\n",
                     slave_dev->name,
@@ -3415,6 +3416,13 @@ static void bond_fold_stats(struct rtnl_link_stats64 *_res,
         }
 }
 
+static int bond_get_nest_level(struct net_device *bond_dev)
+{
+        struct bonding *bond = netdev_priv(bond_dev);
+
+        return bond->nest_level;
+}
+
 static void bond_get_stats(struct net_device *bond_dev,
                            struct rtnl_link_stats64 *stats)
 {
@@ -3423,7 +3431,7 @@ static void bond_get_stats(struct net_device *bond_dev,
         struct list_head *iter;
         struct slave *slave;
 
-        spin_lock(&bond->stats_lock);
+        spin_lock_nested(&bond->stats_lock, bond_get_nest_level(bond_dev));
         memcpy(stats, &bond->bond_stats, sizeof(*stats));
 
         rcu_read_lock();
@@ -4227,6 +4235,7 @@ static const struct net_device_ops bond_netdev_ops = {
         .ndo_neigh_setup        = bond_neigh_setup,
         .ndo_vlan_rx_add_vid    = bond_vlan_rx_add_vid,
         .ndo_vlan_rx_kill_vid   = bond_vlan_rx_kill_vid,
+        .ndo_get_lock_subclass  = bond_get_nest_level,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_netpoll_setup      = bond_netpoll_setup,
         .ndo_netpoll_cleanup    = bond_netpoll_cleanup,
@@ -4725,6 +4734,7 @@ static int bond_init(struct net_device *bond_dev)
         if (!bond->wq)
                 return -ENOMEM;
 
+        bond->nest_level = SINGLE_DEPTH_NESTING;
         netdev_lockdep_set_classes(bond_dev);
 
         list_add_tail(&bond->bond_list, &bn->dev_list);
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 12ff0020ecd6..b7dfd4109d24 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -1072,6 +1072,7 @@ static void ems_usb_disconnect(struct usb_interface *intf)
                 usb_free_urb(dev->intr_urb);
 
                 kfree(dev->intr_in_buffer);
+                kfree(dev->tx_msg_buffer);
         }
 }
 
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 9ef07a06aceb..bb28c701381a 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -2617,7 +2617,6 @@ static const struct mv88e6xxx_ops mv88e6085_ops = {
         .rmu_disable = mv88e6085_g1_rmu_disable,
         .vtu_getnext = mv88e6352_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
-        .serdes_power = mv88e6341_serdes_power,
 };
 
 static const struct mv88e6xxx_ops mv88e6095_ops = {
@@ -2783,6 +2782,7 @@ static const struct mv88e6xxx_ops mv88e6141_ops = {
         .reset = mv88e6352_g1_reset,
         .vtu_getnext = mv88e6352_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
+        .serdes_power = mv88e6341_serdes_power,
         .gpio_ops = &mv88e6352_gpio_ops,
 };
 
@@ -2960,7 +2960,6 @@ static const struct mv88e6xxx_ops mv88e6175_ops = {
         .reset = mv88e6352_g1_reset,
         .vtu_getnext = mv88e6352_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
-        .serdes_power = mv88e6341_serdes_power,
 };
 
 static const struct mv88e6xxx_ops mv88e6176_ops = {
@@ -3336,6 +3335,7 @@ static const struct mv88e6xxx_ops mv88e6341_ops = {
         .reset = mv88e6352_g1_reset,
         .vtu_getnext = mv88e6352_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
+        .serdes_power = mv88e6341_serdes_power,
         .gpio_ops = &mv88e6352_gpio_ops,
         .avb_ops = &mv88e6390_avb_ops,
 };
diff --git a/drivers/net/ethernet/8390/mac8390.c b/drivers/net/ethernet/8390/mac8390.c
index b6d735bf8011..342ae08ec3c2 100644
--- a/drivers/net/ethernet/8390/mac8390.c
+++ b/drivers/net/ethernet/8390/mac8390.c
@@ -153,9 +153,6 @@ static void dayna_block_input(struct net_device *dev, int count,
 static void dayna_block_output(struct net_device *dev, int count,
                                const unsigned char *buf, int start_page);
 
-#define memcpy_fromio(a, b, c)  memcpy((a), (void *)(b), (c))
-#define memcpy_toio(a, b, c)    memcpy((void *)(a), (b), (c))
-
 #define memcmp_withio(a, b, c)  memcmp((a), (void *)(b), (c))
 
 /* Slow Sane (16-bit chunk memory read/write) Cabletron uses this */
@@ -239,7 +236,7 @@ static enum mac8390_access mac8390_testio(unsigned long membase)
         unsigned long outdata = 0xA5A0B5B0;
         unsigned long indata =  0x00000000;
         /* Try writing 32 bits */
-        memcpy_toio(membase, &outdata, 4);
+        memcpy_toio((void __iomem *)membase, &outdata, 4);
         /* Now compare them */
         if (memcmp_withio(&outdata, membase, 4) == 0)
                 return ACCESS_32;
@@ -711,7 +708,7 @@ static void sane_get_8390_hdr(struct net_device *dev,
                               struct e8390_pkt_hdr *hdr, int ring_page)
 {
         unsigned long hdr_start = (ring_page - WD_START_PG)<<8;
-        memcpy_fromio(hdr, dev->mem_start + hdr_start, 4);
+        memcpy_fromio(hdr, (void __iomem *)dev->mem_start + hdr_start, 4);
         /* Fix endianness */
         hdr->count = swab16(hdr->count);
 }
@@ -725,13 +722,16 @@ static void sane_block_input(struct net_device *dev, int count,
         if (xfer_start + count > ei_status.rmem_end) {
                 /* We must wrap the input move. */
                 int semi_count = ei_status.rmem_end - xfer_start;
-                memcpy_fromio(skb->data, dev->mem_start + xfer_base,
+                memcpy_fromio(skb->data,
+                              (void __iomem *)dev->mem_start + xfer_base,
                               semi_count);
                 count -= semi_count;
-                memcpy_fromio(skb->data + semi_count, ei_status.rmem_start,
-                              count);
+                memcpy_fromio(skb->data + semi_count,
+                              (void __iomem *)ei_status.rmem_start, count);
         } else {
-                memcpy_fromio(skb->data, dev->mem_start + xfer_base, count);
+                memcpy_fromio(skb->data,
+                              (void __iomem *)dev->mem_start + xfer_base,
+                              count);
         }
 }
 
@@ -740,7 +740,7 @@ static void sane_block_output(struct net_device *dev, int count,
 {
         long shmem = (start_page - WD_START_PG)<<8;
 
-        memcpy_toio(dev->mem_start + shmem, buf, count);
+        memcpy_toio((void __iomem *)dev->mem_start + shmem, buf, count);
 }
 
 /* dayna block input/output */
diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
index 1b9d3130af4d..17f12c18d225 100644
--- a/drivers/net/ethernet/amazon/ena/ena_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_com.c
@@ -333,6 +333,7 @@ static int ena_com_init_io_sq(struct ena_com_dev *ena_dev,
 
         memset(&io_sq->desc_addr, 0x0, sizeof(io_sq->desc_addr));
 
+        io_sq->dma_addr_bits = ena_dev->dma_addr_bits;
         io_sq->desc_entry_size =
                 (io_sq->direction == ENA_COM_IO_QUEUE_DIRECTION_TX) ?
                 sizeof(struct ena_eth_io_tx_desc) :
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
index 4b5d625de8f0..8a3a60bb2688 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
@@ -1111,14 +1111,14 @@ static void xgbe_phy_adjust_link(struct xgbe_prv_data *pdata)
 
                 if (pdata->tx_pause != pdata->phy.tx_pause) {
                         new_state = 1;
-                        pdata->hw_if.config_tx_flow_control(pdata);
                         pdata->tx_pause = pdata->phy.tx_pause;
+                        pdata->hw_if.config_tx_flow_control(pdata);
                 }
 
                 if (pdata->rx_pause != pdata->phy.rx_pause) {
                         new_state = 1;
-                        pdata->hw_if.config_rx_flow_control(pdata);
                         pdata->rx_pause = pdata->phy.rx_pause;
+                        pdata->hw_if.config_rx_flow_control(pdata);
                 }
 
                 /* Speed support */
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index 956860a69797..3bdab972420b 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -762,7 +762,7 @@ static int hw_atl_b0_hw_packet_filter_set(struct aq_hw_s *self,
 
         hw_atl_rpfl2promiscuous_mode_en_set(self, IS_FILTER_ENABLED(IFF_PROMISC));
         hw_atl_rpfl2multicast_flr_en_set(self,
-                                         IS_FILTER_ENABLED(IFF_MULTICAST), 0);
+                                         IS_FILTER_ENABLED(IFF_ALLMULTI), 0);
 
         hw_atl_rpfl2_accept_all_mc_packets_set(self,
                                                IS_FILTER_ENABLED(IFF_ALLMULTI));
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
index 5d08d2aeb172..e337da6ba2a4 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
@@ -1083,6 +1083,8 @@ static int bgx_lmac_enable(struct bgx *bgx, u8 lmacid)
         lmac->dmacs_count = (RX_DMAC_COUNT / bgx->lmac_count);
         lmac->dmacs = kcalloc(lmac->dmacs_count, sizeof(*lmac->dmacs),
                               GFP_KERNEL);
+        if (!lmac->dmacs)
+                return -ENOMEM;
 
         /* Enable lmac */
         bgx_reg_modify(bgx, lmacid, BGX_CMRX_CFG, CMR_EN);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
index 00fc5f1afb1d..7dddb9e748b8 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
@@ -1038,10 +1038,8 @@ static void mk_act_open_req(struct filter_entry *f, struct sk_buff *skb,
         OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_ACT_OPEN_REQ, qid_filterid));
         req->local_port = cpu_to_be16(f->fs.val.lport);
         req->peer_port = cpu_to_be16(f->fs.val.fport);
-        req->local_ip = f->fs.val.lip[0] | f->fs.val.lip[1] << 8 |
-                f->fs.val.lip[2] << 16 | f->fs.val.lip[3] << 24;
-        req->peer_ip = f->fs.val.fip[0] | f->fs.val.fip[1] << 8 |
-                f->fs.val.fip[2] << 16 | f->fs.val.fip[3] << 24;
+        memcpy(&req->local_ip, f->fs.val.lip, 4);
+        memcpy(&req->peer_ip, f->fs.val.fip, 4);
         req->opt0 = cpu_to_be64(NAGLE_V(f->fs.newvlan == VLAN_REMOVE ||
                                         f->fs.newvlan == VLAN_REWRITE) |
                                 DELACK_V(f->fs.hitcnts) |
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index bc03c175a3cd..a8926e97935e 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -3072,6 +3072,7 @@ static void cxgb_del_udp_tunnel(struct net_device *netdev,
 
                 adapter->geneve_port = 0;
                 t4_write_reg(adapter, MPS_RX_GENEVE_TYPE_A, 0);
+                break;
         default:
                 return;
         }
@@ -3157,6 +3158,7 @@ static void cxgb_add_udp_tunnel(struct net_device *netdev,
 
                 t4_write_reg(adapter, MPS_RX_GENEVE_TYPE_A,
                              GENEVE_V(be16_to_cpu(ti->port)) | GENEVE_EN_F);
+                break;
         default:
                 return;
         }
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index 90c645b8538e..60641e202534 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -2047,28 +2047,42 @@ static int enic_stop(struct net_device *netdev)
         return 0;
 }
 
+static int _enic_change_mtu(struct net_device *netdev, int new_mtu)
+{
+        bool running = netif_running(netdev);
+        int err = 0;
+
+        ASSERT_RTNL();
+        if (running) {
+                err = enic_stop(netdev);
+                if (err)
+                        return err;
+        }
+
+        netdev->mtu = new_mtu;
+
+        if (running) {
+                err = enic_open(netdev);
+                if (err)
+                        return err;
+        }
+
+        return 0;
+}
+
 static int enic_change_mtu(struct net_device *netdev, int new_mtu)
 {
         struct enic *enic = netdev_priv(netdev);
-        int running = netif_running(netdev);
 
         if (enic_is_dynamic(enic) || enic_is_sriov_vf(enic))
                 return -EOPNOTSUPP;
 
-        if (running)
-                enic_stop(netdev);
-
-        netdev->mtu = new_mtu;
-
         if (netdev->mtu > enic->port_mtu)
                 netdev_warn(netdev,
-                        "interface MTU (%d) set higher than port MTU (%d)\n",
-                        netdev->mtu, enic->port_mtu);
+                            "interface MTU (%d) set higher than port MTU (%d)\n",
+                            netdev->mtu, enic->port_mtu);
 
-        if (running)
-                enic_open(netdev);
-
-        return 0;
+        return _enic_change_mtu(netdev, new_mtu);
 }
 
 static void enic_change_mtu_work(struct work_struct *work)
@@ -2076,47 +2090,9 @@ static void enic_change_mtu_work(struct work_struct *work)
         struct enic *enic = container_of(work, struct enic, change_mtu_work);
         struct net_device *netdev = enic->netdev;
         int new_mtu = vnic_dev_mtu(enic->vdev);
-        int err;
-        unsigned int i;
-
-        new_mtu = max_t(int, ENIC_MIN_MTU, min_t(int, ENIC_MAX_MTU, new_mtu));
 
         rtnl_lock();
-
-        /* Stop RQ */
-        del_timer_sync(&enic->notify_timer);
-
-        for (i = 0; i < enic->rq_count; i++)
-                napi_disable(&enic->napi[i]);
-
-        vnic_intr_mask(&enic->intr[0]);
-        enic_synchronize_irqs(enic);
-        err = vnic_rq_disable(&enic->rq[0]);
-        if (err) {
-                rtnl_unlock();
-                netdev_err(netdev, "Unable to disable RQ.\n");
-                return;
-        }
-        vnic_rq_clean(&enic->rq[0], enic_free_rq_buf);
-        vnic_cq_clean(&enic->cq[0]);
-        vnic_intr_clean(&enic->intr[0]);
-
-        /* Fill RQ with new_mtu-sized buffers */
-        netdev->mtu = new_mtu;
-        vnic_rq_fill(&enic->rq[0], enic_rq_alloc_buf);
-        /* Need at least one buffer on ring to get going */
-        if (vnic_rq_desc_used(&enic->rq[0]) == 0) {
-                rtnl_unlock();
-                netdev_err(netdev, "Unable to alloc receive buffers.\n");
-                return;
-        }
-
-        /* Start RQ */
-        vnic_rq_enable(&enic->rq[0]);
-        napi_enable(&enic->napi[0]);
-        vnic_intr_unmask(&enic->intr[0]);
-        enic_notify_timer_start(enic);
-
+        (void)_enic_change_mtu(netdev, new_mtu);
         rtnl_unlock();
 
         netdev_info(netdev, "interface MTU set as %d\n", netdev->mtu);
@@ -2916,7 +2892,6 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          */
 
         enic->port_mtu = enic->config.mtu;
-        (void)enic_change_mtu(netdev, enic->port_mtu);
 
         err = enic_set_mac_addr(netdev, enic->mac_addr);
         if (err) {
@@ -3006,6 +2981,7 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         /* MTU range: 68 - 9000 */
         netdev->min_mtu = ENIC_MIN_MTU;
         netdev->max_mtu = ENIC_MAX_MTU;
+        netdev->mtu     = enic->port_mtu;
 
         err = register_netdev(netdev);
         if (err) {
diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c
index 5b122728dcb4..09e9da10b786 100644
--- a/drivers/net/ethernet/huawei/hinic/hinic_main.c
+++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c
@@ -983,6 +983,7 @@ static int nic_dev_init(struct pci_dev *pdev)
         hinic_hwdev_cb_register(nic_dev->hwdev, HINIC_MGMT_MSG_CMD_LINK_STATUS,
                                 nic_dev, link_status_event_handler);
 
+        SET_NETDEV_DEV(netdev, &pdev->dev);
         err = register_netdev(netdev);
         if (err) {
                 dev_err(&pdev->dev, "Failed to register netdev\n");
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index eb9eb7aa953a..405236cf0b04 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -858,8 +858,6 @@ struct mlx5e_profile {
                 mlx5e_fp_handle_rx_cqe handle_rx_cqe;
                 mlx5e_fp_handle_rx_cqe handle_rx_cqe_mpwqe;
         } rx_handlers;
-        void    (*netdev_registered_init)(struct mlx5e_priv *priv);
-        void    (*netdev_registered_remove)(struct mlx5e_priv *priv);
         int     max_tc;
 };
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index 86bc9ac99586..722998d68564 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -443,16 +443,12 @@ static int mlx5e_dcbnl_ieee_setapp(struct net_device *dev, struct dcb_app *app)
         bool is_new;
         int err;
 
-        if (app->selector != IEEE_8021QAZ_APP_SEL_DSCP)
-                return -EINVAL;
-
-        if (!MLX5_CAP_GEN(priv->mdev, vport_group_manager))
-                return -EINVAL;
-
-        if (!MLX5_DSCP_SUPPORTED(priv->mdev))
-                return -EINVAL;
+        if (!MLX5_CAP_GEN(priv->mdev, vport_group_manager) ||
+            !MLX5_DSCP_SUPPORTED(priv->mdev))
+                return -EOPNOTSUPP;
 
-        if (app->protocol >= MLX5E_MAX_DSCP)
+        if ((app->selector != IEEE_8021QAZ_APP_SEL_DSCP) ||
+            (app->protocol >= MLX5E_MAX_DSCP))
                 return -EINVAL;
 
         /* Save the old entry info */
@@ -500,16 +496,12 @@ static int mlx5e_dcbnl_ieee_delapp(struct net_device *dev, struct dcb_app *app)
         struct mlx5e_priv *priv = netdev_priv(dev);
         int err;
 
-        if (app->selector != IEEE_8021QAZ_APP_SEL_DSCP)
-                return -EINVAL;
-
-        if (!MLX5_CAP_GEN(priv->mdev, vport_group_manager))
-                return -EINVAL;
-
-        if (!MLX5_DSCP_SUPPORTED(priv->mdev))
-                return -EINVAL;
+        if  (!MLX5_CAP_GEN(priv->mdev, vport_group_manager) ||
+             !MLX5_DSCP_SUPPORTED(priv->mdev))
+                return -EOPNOTSUPP;
 
-        if (app->protocol >= MLX5E_MAX_DSCP)
+        if ((app->selector != IEEE_8021QAZ_APP_SEL_DSCP) ||
+            (app->protocol >= MLX5E_MAX_DSCP))
                 return -EINVAL;
 
         /* Skip if no dscp app entry */
@@ -1146,7 +1138,7 @@ static int mlx5e_set_trust_state(struct mlx5e_priv *priv, u8 trust_state)
 {
         int err;
 
-        err =  mlx5_set_trust_state(priv->mdev, trust_state);
+        err = mlx5_set_trust_state(priv->mdev, trust_state);
         if (err)
                 return err;
         priv->dcbx_dp.trust_state = trust_state;
@@ -1172,6 +1164,8 @@ static int mlx5e_trust_initialize(struct mlx5e_priv *priv)
         struct mlx5_core_dev *mdev = priv->mdev;
         int err;
 
+        priv->dcbx_dp.trust_state = MLX5_QPTS_TRUST_PCP;
+
         if (!MLX5_DSCP_SUPPORTED(mdev))
                 return 0;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index dae4156a710d..c592678ab5f1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -3712,7 +3712,8 @@ int mlx5e_change_mtu(struct net_device *netdev, int new_mtu,
 
         if (!reset) {
                 params->sw_mtu = new_mtu;
-                set_mtu_cb(priv);
+                if (set_mtu_cb)
+                        set_mtu_cb(priv);
                 netdev->mtu = params->sw_mtu;
                 goto out;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 3a2c4e548226..dfbcda0d0e08 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1970,15 +1970,15 @@ static bool actions_match_supported(struct mlx5e_priv *priv,
 static bool same_hw_devs(struct mlx5e_priv *priv, struct mlx5e_priv *peer_priv)
 {
         struct mlx5_core_dev *fmdev, *pmdev;
-        u16 func_id, peer_id;
+        u64 fsystem_guid, psystem_guid;
 
         fmdev = priv->mdev;
         pmdev = peer_priv->mdev;
 
-        func_id = (u16)((fmdev->pdev->bus->number << 8) | PCI_SLOT(fmdev->pdev->devfn));
-        peer_id = (u16)((pmdev->pdev->bus->number << 8) | PCI_SLOT(pmdev->pdev->devfn));
+        mlx5_query_nic_vport_system_image_guid(fmdev, &fsystem_guid);
+        mlx5_query_nic_vport_system_image_guid(pmdev, &psystem_guid);
 
-        return (func_id == peer_id);
+        return (fsystem_guid == psystem_guid);
 }
 
 static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index dd01ad4c0b54..40dba9e8af92 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1696,7 +1696,7 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev)
         int vport_num;
         int err;
 
-        if (!MLX5_VPORT_MANAGER(dev))
+        if (!MLX5_ESWITCH_MANAGER(dev))
                 return 0;
 
         esw_info(dev,
@@ -1765,7 +1765,7 @@ abort:
 
 void mlx5_eswitch_cleanup(struct mlx5_eswitch *esw)
 {
-        if (!esw || !MLX5_VPORT_MANAGER(esw->dev))
+        if (!esw || !MLX5_ESWITCH_MANAGER(esw->dev))
                 return;
 
         esw_info(esw->dev, "cleanup\n");
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
index af3bb2f7a504..b7c21eb21a21 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
@@ -76,6 +76,7 @@ void mlx5i_init(struct mlx5_core_dev *mdev,
                 void *ppriv)
 {
         struct mlx5e_priv *priv  = mlx5i_epriv(netdev);
+        u16 max_mtu;
 
         /* priv init */
         priv->mdev        = mdev;
@@ -84,6 +85,9 @@ void mlx5i_init(struct mlx5_core_dev *mdev,
         priv->ppriv       = ppriv;
         mutex_init(&priv->state_lock);
 
+        mlx5_query_port_max_mtu(mdev, &max_mtu, 1);
+        netdev->mtu = max_mtu;
+
         mlx5e_build_nic_params(mdev, &priv->channels.params,
                                profile->max_nch(mdev), netdev->mtu);
         mlx5i_build_nic_params(mdev, &priv->channels.params);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c
index 3c0d882ba183..f6f6a568d66a 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c
@@ -327,12 +327,16 @@ static void mlxsw_afa_resource_add(struct mlxsw_afa_block *block,
         list_add(&resource->list, &block->resource_list);
 }
 
+static void mlxsw_afa_resource_del(struct mlxsw_afa_resource *resource)
+{
+        list_del(&resource->list);
+}
+
 static void mlxsw_afa_resources_destroy(struct mlxsw_afa_block *block)
 {
         struct mlxsw_afa_resource *resource, *tmp;
 
         list_for_each_entry_safe(resource, tmp, &block->resource_list, list) {
-                list_del(&resource->list);
                 resource->destructor(block, resource);
         }
 }
@@ -530,6 +534,7 @@ static void
 mlxsw_afa_fwd_entry_ref_destroy(struct mlxsw_afa_block *block,
                                 struct mlxsw_afa_fwd_entry_ref *fwd_entry_ref)
 {
+        mlxsw_afa_resource_del(&fwd_entry_ref->resource);
         mlxsw_afa_fwd_entry_put(block->afa, fwd_entry_ref->fwd_entry);
         kfree(fwd_entry_ref);
 }
@@ -579,6 +584,7 @@ static void
 mlxsw_afa_counter_destroy(struct mlxsw_afa_block *block,
                           struct mlxsw_afa_counter *counter)
 {
+        mlxsw_afa_resource_del(&counter->resource);
         block->afa->ops->counter_index_put(block->afa->ops_priv,
                                            counter->counter_index);
         kfree(counter);
@@ -626,8 +632,8 @@ static char *mlxsw_afa_block_append_action(struct mlxsw_afa_block *block,
         char *oneact;
         char *actions;
 
-        if (WARN_ON(block->finished))
-                return NULL;
+        if (block->finished)
+                return ERR_PTR(-EINVAL);
         if (block->cur_act_index + action_size >
             block->afa->max_acts_per_set) {
                 struct mlxsw_afa_set *set;
@@ -637,7 +643,7 @@ static char *mlxsw_afa_block_append_action(struct mlxsw_afa_block *block,
                  */
                 set = mlxsw_afa_set_create(false);
                 if (!set)
-                        return NULL;
+                        return ERR_PTR(-ENOBUFS);
                 set->prev = block->cur_set;
                 block->cur_act_index = 0;
                 block->cur_set->next = set;
@@ -724,8 +730,8 @@ int mlxsw_afa_block_append_vlan_modify(struct mlxsw_afa_block *block,
                                                   MLXSW_AFA_VLAN_CODE,
                                                   MLXSW_AFA_VLAN_SIZE);
 
-        if (!act)
-                return -ENOBUFS;
+        if (IS_ERR(act))
+                return PTR_ERR(act);
         mlxsw_afa_vlan_pack(act, MLXSW_AFA_VLAN_VLAN_TAG_CMD_NOP,
                             MLXSW_AFA_VLAN_CMD_SET_OUTER, vid,
                             MLXSW_AFA_VLAN_CMD_SET_OUTER, pcp,
@@ -806,8 +812,8 @@ int mlxsw_afa_block_append_drop(struct mlxsw_afa_block *block)
                                                   MLXSW_AFA_TRAPDISC_CODE,
                                                   MLXSW_AFA_TRAPDISC_SIZE);
 
-        if (!act)
-                return -ENOBUFS;
+        if (IS_ERR(act))
+                return PTR_ERR(act);
         mlxsw_afa_trapdisc_pack(act, MLXSW_AFA_TRAPDISC_TRAP_ACTION_NOP,
                                 MLXSW_AFA_TRAPDISC_FORWARD_ACTION_DISCARD, 0);
         return 0;
@@ -820,8 +826,8 @@ int mlxsw_afa_block_append_trap(struct mlxsw_afa_block *block, u16 trap_id)
                                                   MLXSW_AFA_TRAPDISC_CODE,
                                                   MLXSW_AFA_TRAPDISC_SIZE);
 
-        if (!act)
-                return -ENOBUFS;
+        if (IS_ERR(act))
+                return PTR_ERR(act);
         mlxsw_afa_trapdisc_pack(act, MLXSW_AFA_TRAPDISC_TRAP_ACTION_TRAP,
                                 MLXSW_AFA_TRAPDISC_FORWARD_ACTION_DISCARD,
                                 trap_id);
@@ -836,8 +842,8 @@ int mlxsw_afa_block_append_trap_and_forward(struct mlxsw_afa_block *block,
                                                   MLXSW_AFA_TRAPDISC_CODE,
                                                   MLXSW_AFA_TRAPDISC_SIZE);
 
-        if (!act)
-                return -ENOBUFS;
+        if (IS_ERR(act))
+                return PTR_ERR(act);
         mlxsw_afa_trapdisc_pack(act, MLXSW_AFA_TRAPDISC_TRAP_ACTION_TRAP,
                                 MLXSW_AFA_TRAPDISC_FORWARD_ACTION_FORWARD,
                                 trap_id);
@@ -856,6 +862,7 @@ static void
 mlxsw_afa_mirror_destroy(struct mlxsw_afa_block *block,
                          struct mlxsw_afa_mirror *mirror)
 {
+        mlxsw_afa_resource_del(&mirror->resource);
         block->afa->ops->mirror_del(block->afa->ops_priv,
                                     mirror->local_in_port,
                                     mirror->span_id,
@@ -908,8 +915,8 @@ mlxsw_afa_block_append_allocated_mirror(struct mlxsw_afa_block *block,
         char *act = mlxsw_afa_block_append_action(block,
                                                   MLXSW_AFA_TRAPDISC_CODE,
                                                   MLXSW_AFA_TRAPDISC_SIZE);
-        if (!act)
-                return -ENOBUFS;
+        if (IS_ERR(act))
+                return PTR_ERR(act);
         mlxsw_afa_trapdisc_pack(act, MLXSW_AFA_TRAPDISC_TRAP_ACTION_NOP,
                                 MLXSW_AFA_TRAPDISC_FORWARD_ACTION_FORWARD, 0);
         mlxsw_afa_trapdisc_mirror_pack(act, true, mirror_agent);
@@ -996,8 +1003,8 @@ int mlxsw_afa_block_append_fwd(struct mlxsw_afa_block *block,
 
         act = mlxsw_afa_block_append_action(block, MLXSW_AFA_FORWARD_CODE,
                                             MLXSW_AFA_FORWARD_SIZE);
-        if (!act) {
-                err = -ENOBUFS;
+        if (IS_ERR(act)) {
+                err = PTR_ERR(act);
                 goto err_append_action;
         }
         mlxsw_afa_forward_pack(act, MLXSW_AFA_FORWARD_TYPE_PBS,
@@ -1052,8 +1059,8 @@ int mlxsw_afa_block_append_allocated_counter(struct mlxsw_afa_block *block,
 {
         char *act = mlxsw_afa_block_append_action(block, MLXSW_AFA_POLCNT_CODE,
                                                   MLXSW_AFA_POLCNT_SIZE);
-        if (!act)
-                return -ENOBUFS;
+        if (IS_ERR(act))
+                return PTR_ERR(act);
         mlxsw_afa_polcnt_pack(act, MLXSW_AFA_POLCNT_COUNTER_SET_TYPE_PACKETS_BYTES,
                               counter_index);
         return 0;
@@ -1123,8 +1130,8 @@ int mlxsw_afa_block_append_fid_set(struct mlxsw_afa_block *block, u16 fid)
         char *act = mlxsw_afa_block_append_action(block,
                                                   MLXSW_AFA_VIRFWD_CODE,
                                                   MLXSW_AFA_VIRFWD_SIZE);
-        if (!act)
-                return -ENOBUFS;
+        if (IS_ERR(act))
+                return PTR_ERR(act);
         mlxsw_afa_virfwd_pack(act, MLXSW_AFA_VIRFWD_FID_CMD_SET, fid);
         return 0;
 }
@@ -1193,8 +1200,8 @@ int mlxsw_afa_block_append_mcrouter(struct mlxsw_afa_block *block,
         char *act = mlxsw_afa_block_append_action(block,
                                                   MLXSW_AFA_MCROUTER_CODE,
                                                   MLXSW_AFA_MCROUTER_SIZE);
-        if (!act)
-                return -ENOBUFS;
+        if (IS_ERR(act))
+                return PTR_ERR(act);
         mlxsw_afa_mcrouter_pack(act, MLXSW_AFA_MCROUTER_RPF_ACTION_TRAP,
                                 expected_irif, min_mtu, rmid_valid, kvdl_index);
         return 0;
diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.c b/drivers/net/ethernet/netronome/nfp/flower/main.c
index 1decf3a1cad3..e57d23746585 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/main.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/main.c
@@ -80,7 +80,7 @@ nfp_flower_repr_get_type_and_port(struct nfp_app *app, u32 port_id, u8 *port)
                         return NFP_REPR_TYPE_VF;
         }
 
-        return NFP_FLOWER_CMSG_PORT_TYPE_UNSPEC;
+        return __NFP_REPR_TYPE_MAX;
 }
 
 static struct net_device *
@@ -91,6 +91,8 @@ nfp_flower_repr_get(struct nfp_app *app, u32 port_id)
         u8 port = 0;
 
         repr_type = nfp_flower_repr_get_type_and_port(app, port_id, &port);
+        if (repr_type > NFP_REPR_TYPE_MAX)
+                return NULL;
 
         reprs = rcu_dereference(app->reprs[repr_type]);
         if (!reprs)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 60f59abab009..ef6a8d39db2f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -53,7 +53,7 @@
 #include "dwmac1000.h"
 #include "hwif.h"
 
-#define STMMAC_ALIGN(x) L1_CACHE_ALIGN(x)
+#define STMMAC_ALIGN(x)         __ALIGN_KERNEL(x, SMP_CACHE_BYTES)
 #define TSO_MAX_BUFF_SIZE       (SZ_16K - 1)
 
 /* Module parameters */
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
index 8d375e51a526..6a393b16a1fc 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
@@ -257,7 +257,7 @@ static int stmmac_pci_probe(struct pci_dev *pdev,
                 return -ENOMEM;
 
         /* Enable pci device */
-        ret = pcim_enable_device(pdev);
+        ret = pci_enable_device(pdev);
         if (ret) {
                 dev_err(&pdev->dev, "%s: ERROR: failed to enable device\n",
                         __func__);
@@ -300,9 +300,45 @@ static int stmmac_pci_probe(struct pci_dev *pdev,
 static void stmmac_pci_remove(struct pci_dev *pdev)
 {
         stmmac_dvr_remove(&pdev->dev);
+        pci_disable_device(pdev);
 }
 
-static SIMPLE_DEV_PM_OPS(stmmac_pm_ops, stmmac_suspend, stmmac_resume);
+static int stmmac_pci_suspend(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        int ret;
+
+        ret = stmmac_suspend(dev);
+        if (ret)
+                return ret;
+
+        ret = pci_save_state(pdev);
+        if (ret)
+                return ret;
+
+        pci_disable_device(pdev);
+        pci_wake_from_d3(pdev, true);
+        return 0;
+}
+
+static int stmmac_pci_resume(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        int ret;
+
+        pci_restore_state(pdev);
+        pci_set_power_state(pdev, PCI_D0);
+
+        ret = pci_enable_device(pdev);
+        if (ret)
+                return ret;
+
+        pci_set_master(pdev);
+
+        return stmmac_resume(dev);
+}
+
+static SIMPLE_DEV_PM_OPS(stmmac_pm_ops, stmmac_pci_suspend, stmmac_pci_resume);
 
 /* synthetic ID, no official vendor */
 #define PCI_VENDOR_ID_STMMAC 0x700
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 358edab9e72e..3e34cb8ac1d3 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -2086,14 +2086,16 @@ static int cpsw_ndo_vlan_rx_add_vid(struct net_device *ndev,
                 int i;
 
                 for (i = 0; i < cpsw->data.slaves; i++) {
-                        if (vid == cpsw->slaves[i].port_vlan)
-                                return -EINVAL;
+                        if (vid == cpsw->slaves[i].port_vlan) {
+                                ret = -EINVAL;
+                                goto err;
+                        }
                 }
         }
 
         dev_info(priv->dev, "Adding vlanid %d to vlan filter\n", vid);
         ret = cpsw_add_vlan_ale_entry(priv, vid);
-
+err:
         pm_runtime_put(cpsw->dev);
         return ret;
 }
@@ -2119,22 +2121,17 @@ static int cpsw_ndo_vlan_rx_kill_vid(struct net_device *ndev,
 
                 for (i = 0; i < cpsw->data.slaves; i++) {
                         if (vid == cpsw->slaves[i].port_vlan)
-                                return -EINVAL;
+                                goto err;
                 }
         }
 
         dev_info(priv->dev, "removing vlanid %d from vlan filter\n", vid);
         ret = cpsw_ale_del_vlan(cpsw->ale, vid, 0);
-        if (ret != 0)
-                return ret;
-
-        ret = cpsw_ale_del_ucast(cpsw->ale, priv->mac_addr,
-                                 HOST_PORT_NUM, ALE_VLAN, vid);
-        if (ret != 0)
-                return ret;
-
-        ret = cpsw_ale_del_mcast(cpsw->ale, priv->ndev->broadcast,
-                                 0, ALE_VLAN, vid);
+        ret |= cpsw_ale_del_ucast(cpsw->ale, priv->mac_addr,
+                                  HOST_PORT_NUM, ALE_VLAN, vid);
+        ret |= cpsw_ale_del_mcast(cpsw->ale, priv->ndev->broadcast,
+                                  0, ALE_VLAN, vid);
+err:
         pm_runtime_put(cpsw->dev);
         return ret;
 }
diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c
index 93dc05c194d3..5766225a4ce1 100644
--- a/drivers/net/ethernet/ti/cpsw_ale.c
+++ b/drivers/net/ethernet/ti/cpsw_ale.c
@@ -394,7 +394,7 @@ int cpsw_ale_del_mcast(struct cpsw_ale *ale, u8 *addr, int port_mask,
 
         idx = cpsw_ale_match_addr(ale, addr, (flags & ALE_VLAN) ? vid : 0);
         if (idx < 0)
-                return -EINVAL;
+                return -ENOENT;
 
         cpsw_ale_read(ale, idx, ale_entry);
 
diff --git a/drivers/net/netdevsim/devlink.c b/drivers/net/netdevsim/devlink.c
index ba663e5af168..5135fc371f01 100644
--- a/drivers/net/netdevsim/devlink.c
+++ b/drivers/net/netdevsim/devlink.c
@@ -207,6 +207,7 @@ void nsim_devlink_teardown(struct netdevsim *ns)
                 struct net *net = nsim_to_net(ns);
                 bool *reg_devlink = net_generic(net, nsim_devlink_id);
 
+                devlink_resources_unregister(ns->devlink, NULL);
                 devlink_unregister(ns->devlink);
                 devlink_free(ns->devlink);
                 ns->devlink = NULL;
diff --git a/drivers/net/phy/mdio-mux-bcm-iproc.c b/drivers/net/phy/mdio-mux-bcm-iproc.c
index 0831b7142df7..0c5b68e7da51 100644
--- a/drivers/net/phy/mdio-mux-bcm-iproc.c
+++ b/drivers/net/phy/mdio-mux-bcm-iproc.c
@@ -218,7 +218,7 @@ out:
 
 static int mdio_mux_iproc_remove(struct platform_device *pdev)
 {
-        struct iproc_mdiomux_desc *md = dev_get_platdata(&pdev->dev);
+        struct iproc_mdiomux_desc *md = platform_get_drvdata(pdev);
 
         mdio_mux_uninit(md->mux_handle);
         mdiobus_unregister(md->mii_bus);
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index ed10d49eb5e0..aeca484a75b8 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -1242,6 +1242,8 @@ static int lan78xx_link_reset(struct lan78xx_net *dev)
                         mod_timer(&dev->stat_monitor,
                                   jiffies + STAT_UPDATE_TIMER);
                 }
+
+                tasklet_schedule(&dev->bh);
         }
 
         return ret;
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 53085c63277b..2b6ec927809e 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -586,7 +586,8 @@ static struct sk_buff *receive_small(struct net_device *dev,
                                      struct receive_queue *rq,
                                      void *buf, void *ctx,
                                      unsigned int len,
-                                     unsigned int *xdp_xmit)
+                                     unsigned int *xdp_xmit,
+                                     unsigned int *rbytes)
 {
         struct sk_buff *skb;
         struct bpf_prog *xdp_prog;
@@ -601,6 +602,7 @@ static struct sk_buff *receive_small(struct net_device *dev,
         int err;
 
         len -= vi->hdr_len;
+        *rbytes += len;
 
         rcu_read_lock();
         xdp_prog = rcu_dereference(rq->xdp_prog);
@@ -705,11 +707,13 @@ static struct sk_buff *receive_big(struct net_device *dev,
                                    struct virtnet_info *vi,
                                    struct receive_queue *rq,
                                    void *buf,
-                                   unsigned int len)
+                                   unsigned int len,
+                                   unsigned int *rbytes)
 {
         struct page *page = buf;
         struct sk_buff *skb = page_to_skb(vi, rq, page, 0, len, PAGE_SIZE);
 
+        *rbytes += len - vi->hdr_len;
         if (unlikely(!skb))
                 goto err;
 
@@ -727,7 +731,8 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
                                          void *buf,
                                          void *ctx,
                                          unsigned int len,
-                                         unsigned int *xdp_xmit)
+                                         unsigned int *xdp_xmit,
+                                         unsigned int *rbytes)
 {
         struct virtio_net_hdr_mrg_rxbuf *hdr = buf;
         u16 num_buf = virtio16_to_cpu(vi->vdev, hdr->num_buffers);
@@ -740,6 +745,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
         int err;
 
         head_skb = NULL;
+        *rbytes += len - vi->hdr_len;
 
         rcu_read_lock();
         xdp_prog = rcu_dereference(rq->xdp_prog);
@@ -877,6 +883,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
                         goto err_buf;
                 }
 
+                *rbytes += len;
                 page = virt_to_head_page(buf);
 
                 truesize = mergeable_ctx_to_truesize(ctx);
@@ -932,6 +939,7 @@ err_skb:
                         dev->stats.rx_length_errors++;
                         break;
                 }
+                *rbytes += len;
                 page = virt_to_head_page(buf);
                 put_page(page);
         }
@@ -942,14 +950,13 @@ xdp_xmit:
         return NULL;
 }
 
-static int receive_buf(struct virtnet_info *vi, struct receive_queue *rq,
-                       void *buf, unsigned int len, void **ctx,
-                       unsigned int *xdp_xmit)
+static void receive_buf(struct virtnet_info *vi, struct receive_queue *rq,
+                        void *buf, unsigned int len, void **ctx,
+                        unsigned int *xdp_xmit, unsigned int *rbytes)
 {
         struct net_device *dev = vi->dev;
         struct sk_buff *skb;
         struct virtio_net_hdr_mrg_rxbuf *hdr;
-        int ret;
 
         if (unlikely(len < vi->hdr_len + ETH_HLEN)) {
                 pr_debug("%s: short packet %i\n", dev->name, len);
@@ -961,23 +968,22 @@ static int receive_buf(struct virtnet_info *vi, struct receive_queue *rq,
                 } else {
                         put_page(virt_to_head_page(buf));
                 }
-                return 0;
+                return;
         }
 
         if (vi->mergeable_rx_bufs)
-                skb = receive_mergeable(dev, vi, rq, buf, ctx, len, xdp_xmit);
+                skb = receive_mergeable(dev, vi, rq, buf, ctx, len, xdp_xmit,
+                                        rbytes);
         else if (vi->big_packets)
-                skb = receive_big(dev, vi, rq, buf, len);
+                skb = receive_big(dev, vi, rq, buf, len, rbytes);
         else
-                skb = receive_small(dev, vi, rq, buf, ctx, len, xdp_xmit);
+                skb = receive_small(dev, vi, rq, buf, ctx, len, xdp_xmit, rbytes);
 
         if (unlikely(!skb))
-                return 0;
+                return;
 
         hdr = skb_vnet_hdr(skb);
 
-        ret = skb->len;
-
         if (hdr->hdr.flags & VIRTIO_NET_HDR_F_DATA_VALID)
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
 
@@ -994,12 +1000,11 @@ static int receive_buf(struct virtnet_info *vi, struct receive_queue *rq,
                  ntohs(skb->protocol), skb->len, skb->pkt_type);
 
         napi_gro_receive(&rq->napi, skb);
-        return ret;
+        return;
 
 frame_err:
         dev->stats.rx_frame_errors++;
         dev_kfree_skb(skb);
-        return 0;
 }
 
 /* Unlike mergeable buffers, all buffers are allocated to the
@@ -1249,13 +1254,13 @@ static int virtnet_receive(struct receive_queue *rq, int budget,
 
                 while (received < budget &&
                        (buf = virtqueue_get_buf_ctx(rq->vq, &len, &ctx))) {
-                        bytes += receive_buf(vi, rq, buf, len, ctx, xdp_xmit);
+                        receive_buf(vi, rq, buf, len, ctx, xdp_xmit, &bytes);
                         received++;
                 }
         } else {
                 while (received < budget &&
                        (buf = virtqueue_get_buf(rq->vq, &len)) != NULL) {
-                        bytes += receive_buf(vi, rq, buf, len, NULL, xdp_xmit);
+                        receive_buf(vi, rq, buf, len, NULL, xdp_xmit, &bytes);
                         received++;
                 }
         }
diff --git a/drivers/net/wan/lmc/lmc_main.c b/drivers/net/wan/lmc/lmc_main.c
index 90a4ad9a2d08..b3a1b6f5c406 100644
--- a/drivers/net/wan/lmc/lmc_main.c
+++ b/drivers/net/wan/lmc/lmc_main.c
@@ -1362,7 +1362,7 @@ static irqreturn_t lmc_interrupt (int irq, void *dev_instance) /*fold00*/
             case 0x001:
                 printk(KERN_WARNING "%s: Master Abort (naughty)\n", dev->name);
                 break;
-            case 0x010:
+            case 0x002:
                 printk(KERN_WARNING "%s: Target Abort (not so naughty)\n", dev->name);
                 break;
             default:
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
index 45928b5b8d97..4fffa6988087 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
@@ -1785,7 +1785,8 @@ brcmf_pcie_prepare_fw_request(struct brcmf_pciedev_info *devinfo)
         fwreq->items[BRCMF_PCIE_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
         fwreq->items[BRCMF_PCIE_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
         fwreq->items[BRCMF_PCIE_FW_NVRAM].flags = BRCMF_FW_REQF_OPTIONAL;
-        fwreq->domain_nr = pci_domain_nr(devinfo->pdev->bus);
+        /* NVRAM reserves PCI domain 0 for Broadcom's SDK faked bus */
+        fwreq->domain_nr = pci_domain_nr(devinfo->pdev->bus) + 1;
         fwreq->bus_nr = devinfo->pdev->bus->number;
 
         return fwreq;
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
index e20c30b29c03..c8ea63d02619 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
@@ -178,6 +178,17 @@ const struct iwl_cfg iwl9260_2ac_cfg = {
         .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
 };
 
+const struct iwl_cfg iwl9260_killer_2ac_cfg = {
+        .name = "Killer (R) Wireless-AC 1550 Wireless Network Adapter (9260NGW)",
+        .fw_name_pre = IWL9260A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
+        IWL_DEVICE_9000,
+        .ht_params = &iwl9000_ht_params,
+        .nvm_ver = IWL9000_NVM_VERSION,
+        .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+};
+
 const struct iwl_cfg iwl9270_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 9270",
         .fw_name_pre = IWL9260A_FW_PRE,
@@ -267,6 +278,34 @@ const struct iwl_cfg iwl9560_2ac_cfg_soc = {
         .soc_latency = 5000,
 };
 
+const struct iwl_cfg iwl9560_killer_2ac_cfg_soc = {
+        .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)",
+        .fw_name_pre = IWL9000A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
+        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        IWL_DEVICE_9000,
+        .ht_params = &iwl9000_ht_params,
+        .nvm_ver = IWL9000_NVM_VERSION,
+        .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+        .integrated = true,
+        .soc_latency = 5000,
+};
+
+const struct iwl_cfg iwl9560_killer_s_2ac_cfg_soc = {
+        .name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)",
+        .fw_name_pre = IWL9000A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
+        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        IWL_DEVICE_9000,
+        .ht_params = &iwl9000_ht_params,
+        .nvm_ver = IWL9000_NVM_VERSION,
+        .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+        .integrated = true,
+        .soc_latency = 5000,
+};
+
 const struct iwl_cfg iwl9460_2ac_cfg_shared_clk = {
         .name = "Intel(R) Dual Band Wireless AC 9460",
         .fw_name_pre = IWL9000A_FW_PRE,
@@ -327,6 +366,36 @@ const struct iwl_cfg iwl9560_2ac_cfg_shared_clk = {
         .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK
 };
 
+const struct iwl_cfg iwl9560_killer_2ac_cfg_shared_clk = {
+        .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)",
+        .fw_name_pre = IWL9000A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
+        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        IWL_DEVICE_9000,
+        .ht_params = &iwl9000_ht_params,
+        .nvm_ver = IWL9000_NVM_VERSION,
+        .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+        .integrated = true,
+        .soc_latency = 5000,
+        .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK
+};
+
+const struct iwl_cfg iwl9560_killer_s_2ac_cfg_shared_clk = {
+        .name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)",
+        .fw_name_pre = IWL9000A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
+        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        IWL_DEVICE_9000,
+        .ht_params = &iwl9000_ht_params,
+        .nvm_ver = IWL9000_NVM_VERSION,
+        .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+        .integrated = true,
+        .soc_latency = 5000,
+        .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK
+};
+
 MODULE_FIRMWARE(IWL9000A_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL9000B_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL9000RFB_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
index c503b26793f6..84a816809723 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
@@ -551,6 +551,7 @@ extern const struct iwl_cfg iwl8275_2ac_cfg;
 extern const struct iwl_cfg iwl4165_2ac_cfg;
 extern const struct iwl_cfg iwl9160_2ac_cfg;
 extern const struct iwl_cfg iwl9260_2ac_cfg;
+extern const struct iwl_cfg iwl9260_killer_2ac_cfg;
 extern const struct iwl_cfg iwl9270_2ac_cfg;
 extern const struct iwl_cfg iwl9460_2ac_cfg;
 extern const struct iwl_cfg iwl9560_2ac_cfg;
@@ -558,10 +559,14 @@ extern const struct iwl_cfg iwl9460_2ac_cfg_soc;
 extern const struct iwl_cfg iwl9461_2ac_cfg_soc;
 extern const struct iwl_cfg iwl9462_2ac_cfg_soc;
 extern const struct iwl_cfg iwl9560_2ac_cfg_soc;
+extern const struct iwl_cfg iwl9560_killer_2ac_cfg_soc;
+extern const struct iwl_cfg iwl9560_killer_s_2ac_cfg_soc;
 extern const struct iwl_cfg iwl9460_2ac_cfg_shared_clk;
 extern const struct iwl_cfg iwl9461_2ac_cfg_shared_clk;
 extern const struct iwl_cfg iwl9462_2ac_cfg_shared_clk;
 extern const struct iwl_cfg iwl9560_2ac_cfg_shared_clk;
+extern const struct iwl_cfg iwl9560_killer_2ac_cfg_shared_clk;
+extern const struct iwl_cfg iwl9560_killer_s_2ac_cfg_shared_clk;
 extern const struct iwl_cfg iwl22000_2ac_cfg_hr;
 extern const struct iwl_cfg iwl22000_2ac_cfg_hr_cdb;
 extern const struct iwl_cfg iwl22000_2ac_cfg_jf;
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index 38234bda9017..8520523b91b4 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -545,6 +545,9 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x2526, 0x1210, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x1410, iwl9270_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x1420, iwl9460_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2526, 0x1550, iwl9260_killer_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2526, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2526, 0x1610, iwl9270_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2526, 0x2034, iwl9560_2ac_cfg_soc)},
@@ -554,6 +557,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x4234, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2526, 0x42A4, iwl9462_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2526, 0x8014, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x271B, 0x0010, iwl9160_2ac_cfg)},
         {IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)},
@@ -578,6 +582,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x2720, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2720, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2720, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2720, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2720, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2720, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2720, 0x4030, iwl9560_2ac_cfg)},
@@ -604,6 +610,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x30DC, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x30DC, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x30DC, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x30DC, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x30DC, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x30DC, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x30DC, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -630,6 +638,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x31DC, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x31DC, 0x1030, iwl9560_2ac_cfg_shared_clk)},
         {IWL_PCI_DEVICE(0x31DC, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x31DC, 0x1551, iwl9560_killer_s_2ac_cfg_shared_clk)},
+        {IWL_PCI_DEVICE(0x31DC, 0x1552, iwl9560_killer_2ac_cfg_shared_clk)},
         {IWL_PCI_DEVICE(0x31DC, 0x2030, iwl9560_2ac_cfg_shared_clk)},
         {IWL_PCI_DEVICE(0x31DC, 0x2034, iwl9560_2ac_cfg_shared_clk)},
         {IWL_PCI_DEVICE(0x31DC, 0x4030, iwl9560_2ac_cfg_shared_clk)},
@@ -656,6 +666,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x34F0, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x34F0, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x34F0, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x34F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x34F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x34F0, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x34F0, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x34F0, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -682,6 +694,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x3DF0, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x3DF0, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x3DF0, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x3DF0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x3DF0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x3DF0, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x3DF0, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x3DF0, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -708,6 +722,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x43F0, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x43F0, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x43F0, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x43F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x43F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x43F0, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x43F0, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x43F0, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -743,6 +759,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x9DF0, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x9DF0, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x9DF0, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x9DF0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x9DF0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x9DF0, 0x2010, iwl9460_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x9DF0, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x9DF0, 0x2034, iwl9560_2ac_cfg_soc)},
@@ -771,6 +789,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0xA0F0, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0xA0F0, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA0F0, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA0F0, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA0F0, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA0F0, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -797,6 +817,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0xA370, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0xA370, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA370, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0xA370, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0xA370, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA370, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA370, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA370, 0x4030, iwl9560_2ac_cfg_soc)},
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index a57daecf1d57..9dd2ca62d84a 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -87,6 +87,7 @@ struct netfront_cb {
 /* IRQ name is queue name with "-tx" or "-rx" appended */
 #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3)
 
+static DECLARE_WAIT_QUEUE_HEAD(module_load_q);
 static DECLARE_WAIT_QUEUE_HEAD(module_unload_q);
 
 struct netfront_stats {
@@ -893,7 +894,6 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
                                   struct sk_buff *skb,
                                   struct sk_buff_head *list)
 {
-        struct skb_shared_info *shinfo = skb_shinfo(skb);
         RING_IDX cons = queue->rx.rsp_cons;
         struct sk_buff *nskb;
 
@@ -902,15 +902,16 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
                         RING_GET_RESPONSE(&queue->rx, ++cons);
                 skb_frag_t *nfrag = &skb_shinfo(nskb)->frags[0];
 
-                if (shinfo->nr_frags == MAX_SKB_FRAGS) {
+                if (skb_shinfo(skb)->nr_frags == MAX_SKB_FRAGS) {
                         unsigned int pull_to = NETFRONT_SKB_CB(skb)->pull_to;
 
                         BUG_ON(pull_to <= skb_headlen(skb));
                         __pskb_pull_tail(skb, pull_to - skb_headlen(skb));
                 }
-                BUG_ON(shinfo->nr_frags >= MAX_SKB_FRAGS);
+                BUG_ON(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS);
 
-                skb_add_rx_frag(skb, shinfo->nr_frags, skb_frag_page(nfrag),
+                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+                                skb_frag_page(nfrag),
                                 rx->offset, rx->status, PAGE_SIZE);
 
                 skb_shinfo(nskb)->nr_frags = 0;
@@ -1330,6 +1331,11 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
         netif_carrier_off(netdev);
 
         xenbus_switch_state(dev, XenbusStateInitialising);
+        wait_event(module_load_q,
+                           xenbus_read_driver_state(dev->otherend) !=
+                           XenbusStateClosed &&
+                           xenbus_read_driver_state(dev->otherend) !=
+                           XenbusStateUnknown);
         return netdev;
 
  exit:
diff --git a/drivers/nubus/bus.c b/drivers/nubus/bus.c
index a59b6c4bb5b8..ad3d17c42e23 100644
--- a/drivers/nubus/bus.c
+++ b/drivers/nubus/bus.c
@@ -5,6 +5,7 @@
 // Copyright (C) 2017 Finn Thain
 
 #include <linux/device.h>
+#include <linux/dma-mapping.h>
 #include <linux/list.h>
 #include <linux/nubus.h>
 #include <linux/seq_file.h>
@@ -93,6 +94,8 @@ int nubus_device_register(struct nubus_board *board)
         board->dev.release = nubus_device_release;
         board->dev.bus = &nubus_bus_type;
         dev_set_name(&board->dev, "slot.%X", board->slot);
+        board->dev.dma_mask = &board->dev.coherent_dma_mask;
+        dma_set_mask(&board->dev, DMA_BIT_MASK(32));
         return device_register(&board->dev);
 }
 
diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
index 35b7fc87eac5..5cb40b2518f9 100644
--- a/drivers/pci/bus.c
+++ b/drivers/pci/bus.c
@@ -330,7 +330,7 @@ void pci_bus_add_device(struct pci_dev *dev)
                 return;
         }
 
-        dev->is_added = 1;
+        pci_dev_assign_added(dev, true);
 }
 EXPORT_SYMBOL_GPL(pci_bus_add_device);
 
@@ -347,14 +347,14 @@ void pci_bus_add_devices(const struct pci_bus *bus)
 
         list_for_each_entry(dev, &bus->devices, bus_list) {
                 /* Skip already-added devices */
-                if (dev->is_added)
+                if (pci_dev_is_added(dev))
                         continue;
                 pci_bus_add_device(dev);
         }
 
         list_for_each_entry(dev, &bus->devices, bus_list) {
                 /* Skip if device attach failed */
-                if (!dev->is_added)
+                if (!pci_dev_is_added(dev))
                         continue;
                 child = dev->subordinate;
                 if (child)
diff --git a/drivers/pci/controller/pcie-mobiveil.c b/drivers/pci/controller/pcie-mobiveil.c
index 4d6c20e47bed..cf0aa7cee5b0 100644
--- a/drivers/pci/controller/pcie-mobiveil.c
+++ b/drivers/pci/controller/pcie-mobiveil.c
@@ -107,7 +107,7 @@
 #define CFG_WINDOW_TYPE 0
 #define IO_WINDOW_TYPE          1
 #define MEM_WINDOW_TYPE 2
-#define IB_WIN_SIZE             (256 * 1024 * 1024 * 1024)
+#define IB_WIN_SIZE             ((u64)256 * 1024 * 1024 * 1024)
 #define MAX_PIO_WINDOWS 8
 
 /* Parameters for the waiting for link up routine */
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index 3a17b290df5d..ef0b1b6ba86f 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -509,7 +509,7 @@ static void enable_slot(struct acpiphp_slot *slot)
 
         list_for_each_entry(dev, &bus->devices, bus_list) {
                 /* Assume that newly added devices are powered on already. */
-                if (!dev->is_added)
+                if (!pci_dev_is_added(dev))
                         dev->current_state = PCI_D0;
         }
 
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index 882f1f9596df..08817253c8a2 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -288,6 +288,7 @@ struct pci_sriov {
 
 /* pci_dev priv_flags */
 #define PCI_DEV_DISCONNECTED 0
+#define PCI_DEV_ADDED 1
 
 static inline int pci_dev_set_disconnected(struct pci_dev *dev, void *unused)
 {
@@ -300,6 +301,16 @@ static inline bool pci_dev_is_disconnected(const struct pci_dev *dev)
         return test_bit(PCI_DEV_DISCONNECTED, &dev->priv_flags);
 }
 
+static inline void pci_dev_assign_added(struct pci_dev *dev, bool added)
+{
+        assign_bit(PCI_DEV_ADDED, &dev->priv_flags, added);
+}
+
+static inline bool pci_dev_is_added(const struct pci_dev *dev)
+{
+        return test_bit(PCI_DEV_ADDED, &dev->priv_flags);
+}
+
 #ifdef CONFIG_PCI_ATS
 void pci_restore_ats_state(struct pci_dev *dev);
 #else
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index ac876e32de4b..611adcd9c169 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -2433,13 +2433,13 @@ int pci_scan_slot(struct pci_bus *bus, int devfn)
         dev = pci_scan_single_device(bus, devfn);
         if (!dev)
                 return 0;
-        if (!dev->is_added)
+        if (!pci_dev_is_added(dev))
                 nr++;
 
         for (fn = next_fn(bus, dev, 0); fn > 0; fn = next_fn(bus, dev, fn)) {
                 dev = pci_scan_single_device(bus, devfn + fn);
                 if (dev) {
-                        if (!dev->is_added)
+                        if (!pci_dev_is_added(dev))
                                 nr++;
                         dev->multifunction = 1;
                 }
diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c
index 6f072eae4f7a..5e3d0dced2b8 100644
--- a/drivers/pci/remove.c
+++ b/drivers/pci/remove.c
@@ -19,11 +19,12 @@ static void pci_stop_dev(struct pci_dev *dev)
 {
         pci_pme_active(dev, false);
 
-        if (dev->is_added) {
+        if (pci_dev_is_added(dev)) {
                 device_release_driver(&dev->dev);
                 pci_proc_detach_device(dev);
                 pci_remove_sysfs_dev_files(dev);
-                dev->is_added = 0;
+
+                pci_dev_assign_added(dev, false);
         }
 
         if (dev->bus->self)
diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index ea23c8dffc25..ffec695e0bfb 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
@@ -754,9 +754,9 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport,
         case ELS_LOGO:
                 if (fip->mode == FIP_MODE_VN2VN) {
                         if (fip->state != FIP_ST_VNMP_UP)
-                                return -EINVAL;
+                                goto drop;
                         if (ntoh24(fh->fh_d_id) == FC_FID_FLOGI)
-                                return -EINVAL;
+                                goto drop;
                 } else {
                         if (fip->state != FIP_ST_ENABLED)
                                 return 0;
@@ -799,9 +799,9 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport,
         fip->send(fip, skb);
         return -EINPROGRESS;
 drop:
-        kfree_skb(skb);
         LIBFCOE_FIP_DBG(fip, "drop els_send op %u d_id %x\n",
                         op, ntoh24(fh->fh_d_id));
+        kfree_skb(skb);
         return -EINVAL;
 }
 EXPORT_SYMBOL(fcoe_ctlr_els_send);
diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
index 31d31aad3de1..89b1f1af2fd4 100644
--- a/drivers/scsi/libfc/fc_rport.c
+++ b/drivers/scsi/libfc/fc_rport.c
@@ -2164,6 +2164,7 @@ static void fc_rport_recv_logo_req(struct fc_lport *lport, struct fc_frame *fp)
                 FC_RPORT_DBG(rdata, "Received LOGO request while in state %s\n",
                              fc_rport_state(rdata));
 
+                rdata->flags &= ~FC_RP_STARTED;
                 fc_rport_enter_delete(rdata, RPORT_EV_STOP);
                 mutex_unlock(&rdata->rp_mutex);
                 kref_put(&rdata->kref, fc_rport_destroy);
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index d6093838f5f2..c972cc2b3d5b 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -284,11 +284,11 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode)
                  */
                 if (opcode != ISCSI_OP_SCSI_DATA_OUT) {
                         iscsi_conn_printk(KERN_INFO, conn,
-                                          "task [op %x/%x itt "
+                                          "task [op %x itt "
                                           "0x%x/0x%x] "
                                           "rejected.\n",
-                                          task->hdr->opcode, opcode,
-                                          task->itt, task->hdr_itt);
+                                          opcode, task->itt,
+                                          task->hdr_itt);
                         return -EACCES;
                 }
                 /*
@@ -297,10 +297,10 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode)
                  */
                 if (conn->session->fast_abort) {
                         iscsi_conn_printk(KERN_INFO, conn,
-                                          "task [op %x/%x itt "
+                                          "task [op %x itt "
                                           "0x%x/0x%x] fast abort.\n",
-                                          task->hdr->opcode, opcode,
-                                          task->itt, task->hdr_itt);
+                                          opcode, task->itt,
+                                          task->hdr_itt);
                         return -EACCES;
                 }
                 break;
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 569392d0d4c9..e44c91edf92d 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -3343,11 +3343,10 @@ _base_mpi_ep_writeq(__u64 b, volatile void __iomem *addr,
                                         spinlock_t *writeq_lock)
 {
         unsigned long flags;
-        __u64 data_out = b;
 
         spin_lock_irqsave(writeq_lock, flags);
-        writel((u32)(data_out), addr);
-        writel((u32)(data_out >> 32), (addr + 4));
+        __raw_writel((u32)(b), addr);
+        __raw_writel((u32)(b >> 32), (addr + 4));
         mmiowb();
         spin_unlock_irqrestore(writeq_lock, flags);
 }
@@ -3367,7 +3366,8 @@ _base_mpi_ep_writeq(__u64 b, volatile void __iomem *addr,
 static inline void
 _base_writeq(__u64 b, volatile void __iomem *addr, spinlock_t *writeq_lock)
 {
-        writeq(b, addr);
+        __raw_writeq(b, addr);
+        mmiowb();
 }
 #else
 static inline void
@@ -5268,7 +5268,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes,
 
         /* send message 32-bits at a time */
         for (i = 0, failed = 0; i < request_bytes/4 && !failed; i++) {
-                writel((u32)(request[i]), &ioc->chip->Doorbell);
+                writel(cpu_to_le32(request[i]), &ioc->chip->Doorbell);
                 if ((_base_wait_for_doorbell_ack(ioc, 5)))
                         failed = 1;
         }
@@ -5289,7 +5289,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes,
         }
 
         /* read the first two 16-bits, it gives the total length of the reply */
-        reply[0] = (u16)(readl(&ioc->chip->Doorbell)
+        reply[0] = le16_to_cpu(readl(&ioc->chip->Doorbell)
             & MPI2_DOORBELL_DATA_MASK);
         writel(0, &ioc->chip->HostInterruptStatus);
         if ((_base_wait_for_doorbell_int(ioc, 5))) {
@@ -5298,7 +5298,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes,
                         ioc->name, __LINE__);
                 return -EFAULT;
         }
-        reply[1] = (u16)(readl(&ioc->chip->Doorbell)
+        reply[1] = le16_to_cpu(readl(&ioc->chip->Doorbell)
             & MPI2_DOORBELL_DATA_MASK);
         writel(0, &ioc->chip->HostInterruptStatus);
 
@@ -5312,7 +5312,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes,
                 if (i >=  reply_bytes/2) /* overflow case */
                         readl(&ioc->chip->Doorbell);
                 else
-                        reply[i] = (u16)(readl(&ioc->chip->Doorbell)
+                        reply[i] = le16_to_cpu(readl(&ioc->chip->Doorbell)
                             & MPI2_DOORBELL_DATA_MASK);
                 writel(0, &ioc->chip->HostInterruptStatus);
         }
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index 091ec1207bea..cff83b9457f7 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -888,7 +888,7 @@ static void qedi_get_boot_tgt_info(struct nvm_iscsi_block *block,
         ipv6_en = !!(block->generic.ctrl_flags &
                      NVM_ISCSI_CFG_GEN_IPV6_ENABLED);
 
-        snprintf(tgt->iscsi_name, NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN, "%s\n",
+        snprintf(tgt->iscsi_name, sizeof(tgt->iscsi_name), "%s\n",
                  block->target[index].target_name.byte);
 
         tgt->ipv6_en = ipv6_en;
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index 89a4999fa631..c8731568f9c4 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -2141,6 +2141,7 @@ qla24xx_vport_delete(struct fc_vport *fc_vport)
                 msleep(1000);
 
         qla24xx_disable_vp(vha);
+        qla2x00_wait_for_sess_deletion(vha);
 
         vha->flags.delete_progress = 1;
 
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index f68eb6096559..2660a48d918a 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -214,6 +214,7 @@ void qla2x00_handle_login_done_event(struct scsi_qla_host *, fc_port_t *,
 int qla24xx_post_gnl_work(struct scsi_qla_host *, fc_port_t *);
 int qla24xx_async_abort_cmd(srb_t *);
 int qla24xx_post_relogin_work(struct scsi_qla_host *vha);
+void qla2x00_wait_for_sess_deletion(scsi_qla_host_t *);
 
 /*
  * Global Functions in qla_mid.c source file.
diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
index 2c35b0b2baa0..7a3744006419 100644
--- a/drivers/scsi/qla2xxx/qla_gs.c
+++ b/drivers/scsi/qla2xxx/qla_gs.c
@@ -3708,6 +3708,10 @@ int qla24xx_async_gpnid(scsi_qla_host_t *vha, port_id_t *id)
         return rval;
 
 done_free_sp:
+        spin_lock_irqsave(&vha->hw->vport_slock, flags);
+        list_del(&sp->elem);
+        spin_unlock_irqrestore(&vha->hw->vport_slock, flags);
+
         if (sp->u.iocb_cmd.u.ctarg.req) {
                 dma_free_coherent(&vha->hw->pdev->dev,
                         sizeof(struct ct_sns_pkt),
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index db0e3279e07a..1b19b954bbae 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1489,11 +1489,10 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun,
 
         wait_for_completion(&tm_iocb->u.tmf.comp);
 
-        rval = tm_iocb->u.tmf.comp_status == CS_COMPLETE ?
-            QLA_SUCCESS : QLA_FUNCTION_FAILED;
+        rval = tm_iocb->u.tmf.data;
 
-        if ((rval != QLA_SUCCESS) || tm_iocb->u.tmf.data) {
-                ql_dbg(ql_dbg_taskm, vha, 0x8030,
+        if (rval != QLA_SUCCESS) {
+                ql_log(ql_log_warn, vha, 0x8030,
                     "TM IOCB failed (%x).\n", rval);
         }
 
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
index 37ae0f6d8ae5..59fd5a9dfeb8 100644
--- a/drivers/scsi/qla2xxx/qla_inline.h
+++ b/drivers/scsi/qla2xxx/qla_inline.h
@@ -222,6 +222,8 @@ qla2xxx_get_qpair_sp(struct qla_qpair *qpair, fc_port_t *fcport, gfp_t flag)
         sp->fcport = fcport;
         sp->iocbs = 1;
         sp->vha = qpair->vha;
+        INIT_LIST_HEAD(&sp->elem);
+
 done:
         if (!sp)
                 QLA_QPAIR_MARK_NOT_BUSY(qpair);
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index a91cca52b5d5..dd93a22fe843 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -2130,34 +2130,11 @@ __qla2x00_alloc_iocbs(struct qla_qpair *qpair, srb_t *sp)
         req_cnt = 1;
         handle = 0;
 
-        if (!sp)
-                goto skip_cmd_array;
-
-        /* Check for room in outstanding command list. */
-        handle = req->current_outstanding_cmd;
-        for (index = 1; index < req->num_outstanding_cmds; index++) {
-                handle++;
-                if (handle == req->num_outstanding_cmds)
-                        handle = 1;
-                if (!req->outstanding_cmds[handle])
-                        break;
-        }
-        if (index == req->num_outstanding_cmds) {
-                ql_log(ql_log_warn, vha, 0x700b,
-                    "No room on outstanding cmd array.\n");
-                goto queuing_error;
-        }
-
-        /* Prep command array. */
-        req->current_outstanding_cmd = handle;
-        req->outstanding_cmds[handle] = sp;
-        sp->handle = handle;
-
-        /* Adjust entry-counts as needed. */
-        if (sp->type != SRB_SCSI_CMD)
+        if (sp && (sp->type != SRB_SCSI_CMD)) {
+                /* Adjust entry-counts as needed. */
                 req_cnt = sp->iocbs;
+        }
 
-skip_cmd_array:
         /* Check for room on request queue. */
         if (req->cnt < req_cnt + 2) {
                 if (qpair->use_shadow_reg)
@@ -2183,6 +2160,28 @@ skip_cmd_array:
         if (req->cnt < req_cnt + 2)
                 goto queuing_error;
 
+        if (sp) {
+                /* Check for room in outstanding command list. */
+                handle = req->current_outstanding_cmd;
+                for (index = 1; index < req->num_outstanding_cmds; index++) {
+                        handle++;
+                        if (handle == req->num_outstanding_cmds)
+                                handle = 1;
+                        if (!req->outstanding_cmds[handle])
+                                break;
+                }
+                if (index == req->num_outstanding_cmds) {
+                        ql_log(ql_log_warn, vha, 0x700b,
+                            "No room on outstanding cmd array.\n");
+                        goto queuing_error;
+                }
+
+                /* Prep command array. */
+                req->current_outstanding_cmd = handle;
+                req->outstanding_cmds[handle] = sp;
+                sp->handle = handle;
+        }
+
         /* Prep packet */
         req->cnt -= req_cnt;
         pkt = req->ring_ptr;
@@ -2195,6 +2194,8 @@ skip_cmd_array:
                 pkt->handle = handle;
         }
 
+        return pkt;
+
 queuing_error:
         qpair->tgt_counters.num_alloc_iocb_failed++;
         return pkt;
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 9fa5a2557f2c..7756106d4555 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -631,6 +631,9 @@ qla2x00_async_event(scsi_qla_host_t *vha, struct rsp_que *rsp, uint16_t *mb)
         unsigned long   flags;
         fc_port_t       *fcport = NULL;
 
+        if (!vha->hw->flags.fw_started)
+                return;
+
         /* Setup to process RIO completion. */
         handle_cnt = 0;
         if (IS_CNA_CAPABLE(ha))
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 7e875f575229..f0ec13d48bf3 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -4220,6 +4220,9 @@ qla25xx_init_req_que(struct scsi_qla_host *vha, struct req_que *req)
         mbx_cmd_t *mcp = &mc;
         struct qla_hw_data *ha = vha->hw;
 
+        if (!ha->flags.fw_started)
+                return QLA_SUCCESS;
+
         ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x10d3,
             "Entered %s.\n", __func__);
 
@@ -4289,6 +4292,9 @@ qla25xx_init_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp)
         mbx_cmd_t *mcp = &mc;
         struct qla_hw_data *ha = vha->hw;
 
+        if (!ha->flags.fw_started)
+                return QLA_SUCCESS;
+
         ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x10d6,
             "Entered %s.\n", __func__);
 
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index f6f0a759a7c2..aa727d07b702 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -152,11 +152,18 @@ int
 qla24xx_disable_vp(scsi_qla_host_t *vha)
 {
         unsigned long flags;
-        int ret;
+        int ret = QLA_SUCCESS;
+        fc_port_t *fcport;
+
+        if (vha->hw->flags.fw_started)
+                ret = qla24xx_control_vp(vha, VCE_COMMAND_DISABLE_VPS_LOGO_ALL);
 
-        ret = qla24xx_control_vp(vha, VCE_COMMAND_DISABLE_VPS_LOGO_ALL);
         atomic_set(&vha->loop_state, LOOP_DOWN);
         atomic_set(&vha->loop_down_timer, LOOP_DOWN_TIME);
+        list_for_each_entry(fcport, &vha->vp_fcports, list)
+                fcport->logout_on_delete = 0;
+
+        qla2x00_mark_all_devices_lost(vha, 0);
 
         /* Remove port id from vp target map */
         spin_lock_irqsave(&vha->hw->hardware_lock, flags);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 9f309e572be4..1fbd16c8c9a7 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -303,6 +303,7 @@ static void qla2x00_free_device(scsi_qla_host_t *);
 static int qla2xxx_map_queues(struct Scsi_Host *shost);
 static void qla2x00_destroy_deferred_work(struct qla_hw_data *);
 
+
 struct scsi_host_template qla2xxx_driver_template = {
         .module                 = THIS_MODULE,
         .name                   = QLA2XXX_DRIVER_NAME,
@@ -1147,7 +1148,7 @@ static inline int test_fcport_count(scsi_qla_host_t *vha)
  * qla2x00_wait_for_sess_deletion can only be called from remove_one.
  * it has dependency on UNLOADING flag to stop device discovery
  */
-static void
+void
 qla2x00_wait_for_sess_deletion(scsi_qla_host_t *vha)
 {
         qla2x00_mark_all_devices_lost(vha, 0);
@@ -3603,6 +3604,8 @@ qla2x00_remove_one(struct pci_dev *pdev)
 
         base_vha = pci_get_drvdata(pdev);
         ha = base_vha->hw;
+        ql_log(ql_log_info, base_vha, 0xb079,
+            "Removing driver\n");
 
         /* Indicate device removal to prevent future board_disable and wait
          * until any pending board_disable has completed. */
@@ -3625,6 +3628,21 @@ qla2x00_remove_one(struct pci_dev *pdev)
         }
         qla2x00_wait_for_hba_ready(base_vha);
 
+        if (IS_QLA25XX(ha) || IS_QLA2031(ha) || IS_QLA27XX(ha)) {
+                if (ha->flags.fw_started)
+                        qla2x00_abort_isp_cleanup(base_vha);
+        } else if (!IS_QLAFX00(ha)) {
+                if (IS_QLA8031(ha)) {
+                        ql_dbg(ql_dbg_p3p, base_vha, 0xb07e,
+                            "Clearing fcoe driver presence.\n");
+                        if (qla83xx_clear_drv_presence(base_vha) != QLA_SUCCESS)
+                                ql_dbg(ql_dbg_p3p, base_vha, 0xb079,
+                                    "Error while clearing DRV-Presence.\n");
+                }
+
+                qla2x00_try_to_stop_firmware(base_vha);
+        }
+
         qla2x00_wait_for_sess_deletion(base_vha);
 
         /*
@@ -3648,14 +3666,6 @@ qla2x00_remove_one(struct pci_dev *pdev)
 
         qla2x00_delete_all_vps(ha, base_vha);
 
-        if (IS_QLA8031(ha)) {
-                ql_dbg(ql_dbg_p3p, base_vha, 0xb07e,
-                    "Clearing fcoe driver presence.\n");
-                if (qla83xx_clear_drv_presence(base_vha) != QLA_SUCCESS)
-                        ql_dbg(ql_dbg_p3p, base_vha, 0xb079,
-                            "Error while clearing DRV-Presence.\n");
-        }
-
         qla2x00_abort_all_cmds(base_vha, DID_NO_CONNECT << 16);
 
         qla2x00_dfs_remove(base_vha);
@@ -3715,24 +3725,6 @@ qla2x00_free_device(scsi_qla_host_t *vha)
                 qla2x00_stop_timer(vha);
 
         qla25xx_delete_queues(vha);
-
-        if (ha->flags.fce_enabled)
-                qla2x00_disable_fce_trace(vha, NULL, NULL);
-
-        if (ha->eft)
-                qla2x00_disable_eft_trace(vha);
-
-        if (IS_QLA25XX(ha) ||  IS_QLA2031(ha) || IS_QLA27XX(ha)) {
-                if (ha->flags.fw_started)
-                        qla2x00_abort_isp_cleanup(vha);
-        } else {
-                if (ha->flags.fw_started) {
-                        /* Stop currently executing firmware. */
-                        qla2x00_try_to_stop_firmware(vha);
-                        ha->flags.fw_started = 0;
-                }
-        }
-
         vha->flags.online = 0;
 
         /* turn-off interrupts on the card */
@@ -6028,8 +6020,9 @@ qla2x00_do_dpc(void *data)
                                 set_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags);
                 }
 
-                if (test_and_clear_bit(ISP_ABORT_NEEDED,
-                                                &base_vha->dpc_flags)) {
+                if (test_and_clear_bit
+                    (ISP_ABORT_NEEDED, &base_vha->dpc_flags) &&
+                    !test_bit(UNLOADING, &base_vha->dpc_flags)) {
 
                         ql_dbg(ql_dbg_dpc, base_vha, 0x4007,
                             "ISP abort scheduled.\n");
diff --git a/drivers/scsi/qla2xxx/qla_sup.c b/drivers/scsi/qla2xxx/qla_sup.c
index 04458eb19d38..4499c787165f 100644
--- a/drivers/scsi/qla2xxx/qla_sup.c
+++ b/drivers/scsi/qla2xxx/qla_sup.c
@@ -1880,6 +1880,9 @@ qla24xx_beacon_off(struct scsi_qla_host *vha)
         if (IS_P3P_TYPE(ha))
                 return QLA_SUCCESS;
 
+        if (!ha->flags.fw_started)
+                return QLA_SUCCESS;
+
         ha->beacon_blink_led = 0;
 
         if (IS_QLA2031(ha) || IS_QLA27XX(ha))
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index cd2fdac000c9..ba9ba0e04f42 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1741,15 +1741,11 @@ sg_start_req(Sg_request *srp, unsigned char *cmd)
          *
          * With scsi-mq enabled, there are a fixed number of preallocated
          * requests equal in number to shost->can_queue.  If all of the
-         * preallocated requests are already in use, then using GFP_ATOMIC with
-         * blk_get_request() will return -EWOULDBLOCK, whereas using GFP_KERNEL
-         * will cause blk_get_request() to sleep until an active command
-         * completes, freeing up a request.  Neither option is ideal, but
-         * GFP_KERNEL is the better choice to prevent userspace from getting an
-         * unexpected EWOULDBLOCK.
-         *
-         * With scsi-mq disabled, blk_get_request() with GFP_KERNEL usually
-         * does not sleep except under memory pressure.
+         * preallocated requests are already in use, then blk_get_request()
+         * will sleep until an active command completes, freeing up a request.
+         * Although waiting in an asynchronous interface is less than ideal, we
+         * do not want to use BLK_MQ_REQ_NOWAIT here because userspace might
+         * not expect an EWOULDBLOCK from this condition.
          */
         rq = blk_get_request(q, hp->dxfer_direction == SG_DXFER_TO_DEV ?
                         REQ_OP_SCSI_OUT : REQ_OP_SCSI_IN, 0);
@@ -2185,6 +2181,7 @@ sg_add_sfp(Sg_device * sdp)
         write_lock_irqsave(&sdp->sfd_lock, iflags);
         if (atomic_read(&sdp->detaching)) {
                 write_unlock_irqrestore(&sdp->sfd_lock, iflags);
+                kfree(sfp);
                 return ERR_PTR(-ENODEV);
         }
         list_add_tail(&sfp->sfd_siblings, &sdp->sfds);
diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index 3f3cb72e0c0c..d0389b20574d 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -523,18 +523,26 @@ static int sr_init_command(struct scsi_cmnd *SCpnt)
 static int sr_block_open(struct block_device *bdev, fmode_t mode)
 {
         struct scsi_cd *cd;
+        struct scsi_device *sdev;
         int ret = -ENXIO;
 
+        cd = scsi_cd_get(bdev->bd_disk);
+        if (!cd)
+                goto out;
+
+        sdev = cd->device;
+        scsi_autopm_get_device(sdev);
         check_disk_change(bdev);
 
         mutex_lock(&sr_mutex);
-        cd = scsi_cd_get(bdev->bd_disk);
-        if (cd) {
-                ret = cdrom_open(&cd->cdi, bdev, mode);
-                if (ret)
-                        scsi_cd_put(cd);
-        }
+        ret = cdrom_open(&cd->cdi, bdev, mode);
         mutex_unlock(&sr_mutex);
+
+        scsi_autopm_put_device(sdev);
+        if (ret)
+                scsi_cd_put(cd);
+
+out:
         return ret;
 }
 
@@ -562,6 +570,8 @@ static int sr_block_ioctl(struct block_device *bdev, fmode_t mode, unsigned cmd,
         if (ret)
                 goto out;
 
+        scsi_autopm_get_device(sdev);
+
         /*
          * Send SCSI addressing ioctls directly to mid level, send other
          * ioctls to cdrom/block level.
@@ -570,15 +580,18 @@ static int sr_block_ioctl(struct block_device *bdev, fmode_t mode, unsigned cmd,
         case SCSI_IOCTL_GET_IDLUN:
         case SCSI_IOCTL_GET_BUS_NUMBER:
                 ret = scsi_ioctl(sdev, cmd, argp);
-                goto out;
+                goto put;
         }
 
         ret = cdrom_ioctl(&cd->cdi, bdev, mode, cmd, arg);
         if (ret != -ENOSYS)
-                goto out;
+                goto put;
 
         ret = scsi_ioctl(sdev, cmd, argp);
 
+put:
+        scsi_autopm_put_device(sdev);
+
 out:
         mutex_unlock(&sr_mutex);
         return ret;
diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
index 777e5f1e52d1..0cd947f78b5b 100644
--- a/drivers/scsi/vmw_pvscsi.c
+++ b/drivers/scsi/vmw_pvscsi.c
@@ -561,9 +561,14 @@ static void pvscsi_complete_request(struct pvscsi_adapter *adapter,
             (btstat == BTSTAT_SUCCESS ||
              btstat == BTSTAT_LINKED_COMMAND_COMPLETED ||
              btstat == BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG)) {
-                cmd->result = (DID_OK << 16) | sdstat;
-                if (sdstat == SAM_STAT_CHECK_CONDITION && cmd->sense_buffer)
-                        cmd->result |= (DRIVER_SENSE << 24);
+                if (sdstat == SAM_STAT_COMMAND_TERMINATED) {
+                        cmd->result = (DID_RESET << 16);
+                } else {
+                        cmd->result = (DID_OK << 16) | sdstat;
+                        if (sdstat == SAM_STAT_CHECK_CONDITION &&
+                            cmd->sense_buffer)
+                                cmd->result |= (DRIVER_SENSE << 24);
+                }
         } else
                 switch (btstat) {
                 case BTSTAT_SUCCESS:
diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
index a1a0025b59e0..d5d33e12e952 100644
--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -402,6 +402,8 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
                         fput(asma->file);
                         goto out;
                 }
+        } else {
+                vma_set_anonymous(vma);
         }
 
         if (vma->vm_file)
diff --git a/drivers/target/iscsi/cxgbit/cxgbit_target.c b/drivers/target/iscsi/cxgbit/cxgbit_target.c
index 514986b57c2d..25eb3891e34b 100644
--- a/drivers/target/iscsi/cxgbit/cxgbit_target.c
+++ b/drivers/target/iscsi/cxgbit/cxgbit_target.c
@@ -652,6 +652,7 @@ static int cxgbit_set_iso_npdu(struct cxgbit_sock *csk)
         struct iscsi_param *param;
         u32 mrdsl, mbl;
         u32 max_npdu, max_iso_npdu;
+        u32 max_iso_payload;
 
         if (conn->login->leading_connection) {
                 param = iscsi_find_param_from_key(MAXBURSTLENGTH,
@@ -670,8 +671,10 @@ static int cxgbit_set_iso_npdu(struct cxgbit_sock *csk)
         mrdsl = conn_ops->MaxRecvDataSegmentLength;
         max_npdu = mbl / mrdsl;
 
-        max_iso_npdu = CXGBIT_MAX_ISO_PAYLOAD /
-                        (ISCSI_HDR_LEN + mrdsl +
+        max_iso_payload = rounddown(CXGBIT_MAX_ISO_PAYLOAD, csk->emss);
+
+        max_iso_npdu = max_iso_payload /
+                       (ISCSI_HDR_LEN + mrdsl +
                         cxgbit_digest_len[csk->submode]);
 
         csk->max_iso_npdu = min(max_npdu, max_iso_npdu);
@@ -741,6 +744,9 @@ static int cxgbit_set_params(struct iscsi_conn *conn)
         if (conn_ops->MaxRecvDataSegmentLength > cdev->mdsl)
                 conn_ops->MaxRecvDataSegmentLength = cdev->mdsl;
 
+        if (cxgbit_set_digest(csk))
+                return -1;
+
         if (conn->login->leading_connection) {
                 param = iscsi_find_param_from_key(ERRORRECOVERYLEVEL,
                                                   conn->param_list);
@@ -764,7 +770,7 @@ static int cxgbit_set_params(struct iscsi_conn *conn)
                         if (is_t5(cdev->lldi.adapter_type))
                                 goto enable_ddp;
                         else
-                                goto enable_digest;
+                                return 0;
                 }
 
                 if (test_bit(CDEV_ISO_ENABLE, &cdev->flags)) {
@@ -781,10 +787,6 @@ enable_ddp:
                 }
         }
 
-enable_digest:
-        if (cxgbit_set_digest(csk))
-                return -1;
-
         return 0;
 }
 
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index a502f1af4a21..ed3114556fda 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1560,9 +1560,12 @@ int vhost_init_device_iotlb(struct vhost_dev *d, bool enabled)
         d->iotlb = niotlb;
 
         for (i = 0; i < d->nvqs; ++i) {
-                mutex_lock(&d->vqs[i]->mutex);
-                d->vqs[i]->iotlb = niotlb;
-                mutex_unlock(&d->vqs[i]->mutex);
+                struct vhost_virtqueue *vq = d->vqs[i];
+
+                mutex_lock(&vq->mutex);
+                vq->iotlb = niotlb;
+                __vhost_vq_meta_reset(vq);
+                mutex_unlock(&vq->mutex);
         }
 
         vhost_umem_clean(oiotlb);
diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
index 46a4484e3da7..c6f78d27947b 100644
--- a/drivers/video/fbdev/efifb.c
+++ b/drivers/video/fbdev/efifb.c
@@ -20,7 +20,7 @@
 #include <drm/drm_connector.h>  /* For DRM_MODE_PANEL_ORIENTATION_* */
 
 static bool request_mem_succeeded = false;
-static bool nowc = false;
+static u64 mem_flags = EFI_MEMORY_WC | EFI_MEMORY_UC;
 
 static struct fb_var_screeninfo efifb_defined = {
         .activate               = FB_ACTIVATE_NOW,
@@ -68,8 +68,12 @@ static int efifb_setcolreg(unsigned regno, unsigned red, unsigned green,
 
 static void efifb_destroy(struct fb_info *info)
 {
-        if (info->screen_base)
-                iounmap(info->screen_base);
+        if (info->screen_base) {
+                if (mem_flags & (EFI_MEMORY_UC | EFI_MEMORY_WC))
+                        iounmap(info->screen_base);
+                else
+                        memunmap(info->screen_base);
+        }
         if (request_mem_succeeded)
                 release_mem_region(info->apertures->ranges[0].base,
                                    info->apertures->ranges[0].size);
@@ -104,7 +108,7 @@ static int efifb_setup(char *options)
                         else if (!strncmp(this_opt, "width:", 6))
                                 screen_info.lfb_width = simple_strtoul(this_opt+6, NULL, 0);
                         else if (!strcmp(this_opt, "nowc"))
-                                nowc = true;
+                                mem_flags &= ~EFI_MEMORY_WC;
                 }
         }
 
@@ -164,6 +168,7 @@ static int efifb_probe(struct platform_device *dev)
         unsigned int size_remap;
         unsigned int size_total;
         char *option = NULL;
+        efi_memory_desc_t md;
 
         if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI || pci_dev_disabled)
                 return -ENODEV;
@@ -272,12 +277,35 @@ static int efifb_probe(struct platform_device *dev)
         info->apertures->ranges[0].base = efifb_fix.smem_start;
         info->apertures->ranges[0].size = size_remap;
 
-        if (nowc)
-                info->screen_base = ioremap(efifb_fix.smem_start, efifb_fix.smem_len);
-        else
-                info->screen_base = ioremap_wc(efifb_fix.smem_start, efifb_fix.smem_len);
+        if (!efi_mem_desc_lookup(efifb_fix.smem_start, &md)) {
+                if ((efifb_fix.smem_start + efifb_fix.smem_len) >
+                    (md.phys_addr + (md.num_pages << EFI_PAGE_SHIFT))) {
+                        pr_err("efifb: video memory @ 0x%lx spans multiple EFI memory regions\n",
+                               efifb_fix.smem_start);
+                        err = -EIO;
+                        goto err_release_fb;
+                }
+                /*
+                 * If the UEFI memory map covers the efifb region, we may only
+                 * remap it using the attributes the memory map prescribes.
+                 */
+                mem_flags |= EFI_MEMORY_WT | EFI_MEMORY_WB;
+                mem_flags &= md.attribute;
+        }
+        if (mem_flags & EFI_MEMORY_WC)
+                info->screen_base = ioremap_wc(efifb_fix.smem_start,
+                                               efifb_fix.smem_len);
+        else if (mem_flags & EFI_MEMORY_UC)
+                info->screen_base = ioremap(efifb_fix.smem_start,
+                                            efifb_fix.smem_len);
+        else if (mem_flags & EFI_MEMORY_WT)
+                info->screen_base = memremap(efifb_fix.smem_start,
+                                             efifb_fix.smem_len, MEMREMAP_WT);
+        else if (mem_flags & EFI_MEMORY_WB)
+                info->screen_base = memremap(efifb_fix.smem_start,
+                                             efifb_fix.smem_len, MEMREMAP_WB);
         if (!info->screen_base) {
-                pr_err("efifb: abort, cannot ioremap video memory 0x%x @ 0x%lx\n",
+                pr_err("efifb: abort, cannot remap video memory 0x%x @ 0x%lx\n",
                         efifb_fix.smem_len, efifb_fix.smem_start);
                 err = -EIO;
                 goto err_release_fb;
@@ -371,7 +399,10 @@ err_fb_dealoc:
 err_groups:
         sysfs_remove_groups(&dev->dev.kobj, efifb_groups);
 err_unmap:
-        iounmap(info->screen_base);
+        if (mem_flags & (EFI_MEMORY_UC | EFI_MEMORY_WC))
+                iounmap(info->screen_base);
+        else
+                memunmap(info->screen_base);
 err_release_fb:
         framebuffer_release(info);
 err_release_mem:
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 6b237e3f4983..3988c0914322 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -513,7 +513,9 @@ static int virtballoon_migratepage(struct balloon_dev_info *vb_dev_info,
         tell_host(vb, vb->inflate_vq);
 
         /* balloon's page migration 2nd step -- deflate "page" */
+        spin_lock_irqsave(&vb_dev_info->pages_lock, flags);
         balloon_page_delete(page);
+        spin_unlock_irqrestore(&vb_dev_info->pages_lock, flags);
         vb->num_pfns = VIRTIO_BALLOON_PAGES_PER_PAGE;
         set_page_pfns(vb, vb->pfns, page);
         tell_host(vb, vb->deflate_vq);
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index a1b18082991b..183cc5418722 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -648,7 +648,7 @@ static void afs_wake_up_async_call(struct sock *sk, struct rxrpc_call *rxcall,
         trace_afs_notify_call(rxcall, call);
         call->need_attention = true;
 
-        u = __atomic_add_unless(&call->usage, 1, 0);
+        u = atomic_fetch_add_unless(&call->usage, 1, 0);
         if (u != 0) {
                 trace_afs_call(call, afs_call_trace_wake, u,
                                atomic_read(&call->net->nr_outstanding_calls),
diff --git a/fs/dcache.c b/fs/dcache.c
index 0e8e5de3c48a..ceb7b491d1b9 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -358,14 +358,11 @@ static void dentry_unlink_inode(struct dentry * dentry)
         __releases(dentry->d_inode->i_lock)
 {
         struct inode *inode = dentry->d_inode;
-        bool hashed = !d_unhashed(dentry);
 
-        if (hashed)
-                raw_write_seqcount_begin(&dentry->d_seq);
+        raw_write_seqcount_begin(&dentry->d_seq);
         __d_clear_type_and_inode(dentry);
         hlist_del_init(&dentry->d_u.d_alias);
-        if (hashed)
-                raw_write_seqcount_end(&dentry->d_seq);
+        raw_write_seqcount_end(&dentry->d_seq);
         spin_unlock(&dentry->d_lock);
         spin_unlock(&inode->i_lock);
         if (!inode->i_nlink)
@@ -1932,10 +1929,12 @@ struct dentry *d_make_root(struct inode *root_inode)
 
         if (root_inode) {
                 res = d_alloc_anon(root_inode->i_sb);
-                if (res)
+                if (res) {
+                        res->d_flags |= DCACHE_RCUACCESS;
                         d_instantiate(res, root_inode);
-                else
+                } else {
                         iput(root_inode);
+                }
         }
         return res;
 }
diff --git a/fs/efivarfs/inode.c b/fs/efivarfs/inode.c
index 71fccccf317e..8c6ab6c95727 100644
--- a/fs/efivarfs/inode.c
+++ b/fs/efivarfs/inode.c
@@ -86,7 +86,9 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry,
         /* length of the variable name itself: remove GUID and separator */
         namelen = dentry->d_name.len - EFI_VARIABLE_GUID_LEN - 1;
 
-        uuid_le_to_bin(dentry->d_name.name + namelen + 1, &var->var.VendorGuid);
+        err = guid_parse(dentry->d_name.name + namelen + 1, &var->var.VendorGuid);
+        if (err)
+                goto out;
 
         if (efivar_variable_is_removable(var->var.VendorGuid,
                                          dentry->d_name.name, namelen))
diff --git a/fs/iomap.c b/fs/iomap.c
index 77397b5a96ef..0d0bd8845586 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -1443,7 +1443,7 @@ iomap_bmap(struct address_space *mapping, sector_t bno,
                 const struct iomap_ops *ops)
 {
         struct inode *inode = mapping->host;
-        loff_t pos = bno >> inode->i_blkbits;
+        loff_t pos = bno << inode->i_blkbits;
         unsigned blocksize = i_blocksize(inode);
 
         if (filemap_write_and_wait(mapping))
diff --git a/fs/jfs/jfs_dinode.h b/fs/jfs/jfs_dinode.h
index 395c4c0d0f06..1682a87c00b2 100644
--- a/fs/jfs/jfs_dinode.h
+++ b/fs/jfs/jfs_dinode.h
@@ -115,6 +115,13 @@ struct dinode {
                                         dxd_t _dxd;     /* 16: */
                                         union {
                                                 __le32 _rdev;   /* 4: */
+                                                /*
+                                                 * The fast symlink area
+                                                 * is expected to overflow
+                                                 * into _inlineea when
+                                                 * needed (which will clear
+                                                 * INLINEEA).
+                                                 */
                                                 u8 _fastsymlink[128];
                                         } _u;
                                         u8 _inlineea[128];
diff --git a/fs/jfs/jfs_incore.h b/fs/jfs/jfs_incore.h
index 1f26d1910409..9940a1e04cbf 100644
--- a/fs/jfs/jfs_incore.h
+++ b/fs/jfs/jfs_incore.h
@@ -87,6 +87,7 @@ struct jfs_inode_info {
                 struct {
                         unchar _unused[16];     /* 16: */
                         dxd_t _dxd;             /* 16: */
+                        /* _inline may overflow into _inline_ea when needed */
                         unchar _inline[128];    /* 128: inline symlink */
                         /* _inline_ea may overlay the last part of
                          * file._xtroot if maxentry = XTROOTINITSLOT
diff --git a/fs/jfs/super.c b/fs/jfs/super.c
index 1b9264fd54b6..f08571433aba 100644
--- a/fs/jfs/super.c
+++ b/fs/jfs/super.c
@@ -967,8 +967,7 @@ static int __init init_jfs_fs(void)
         jfs_inode_cachep =
             kmem_cache_create_usercopy("jfs_ip", sizeof(struct jfs_inode_info),
                         0, SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_ACCOUNT,
-                        offsetof(struct jfs_inode_info, i_inline),
-                        sizeof_field(struct jfs_inode_info, i_inline),
+                        offsetof(struct jfs_inode_info, i_inline), IDATASIZE,
                         init_once);
         if (jfs_inode_cachep == NULL)
                 return -ENOMEM;
diff --git a/fs/namespace.c b/fs/namespace.c
index 8ddd14806799..bd2f4c68506a 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -659,12 +659,21 @@ int __legitimize_mnt(struct vfsmount *bastard, unsigned seq)
                 return 0;
         mnt = real_mount(bastard);
         mnt_add_count(mnt, 1);
+        smp_mb();                       // see mntput_no_expire()
         if (likely(!read_seqretry(&mount_lock, seq)))
                 return 0;
         if (bastard->mnt_flags & MNT_SYNC_UMOUNT) {
                 mnt_add_count(mnt, -1);
                 return 1;
         }
+        lock_mount_hash();
+        if (unlikely(bastard->mnt_flags & MNT_DOOMED)) {
+                mnt_add_count(mnt, -1);
+                unlock_mount_hash();
+                return 1;
+        }
+        unlock_mount_hash();
+        /* caller will mntput() */
         return -1;
 }
 
@@ -1195,12 +1204,27 @@ static DECLARE_DELAYED_WORK(delayed_mntput_work, delayed_mntput);
 static void mntput_no_expire(struct mount *mnt)
 {
         rcu_read_lock();
-        mnt_add_count(mnt, -1);
-        if (likely(mnt->mnt_ns)) { /* shouldn't be the last one */
+        if (likely(READ_ONCE(mnt->mnt_ns))) {
+                /*
+                 * Since we don't do lock_mount_hash() here,
+                 * ->mnt_ns can change under us.  However, if it's
+                 * non-NULL, then there's a reference that won't
+                 * be dropped until after an RCU delay done after
+                 * turning ->mnt_ns NULL.  So if we observe it
+                 * non-NULL under rcu_read_lock(), the reference
+                 * we are dropping is not the final one.
+                 */
+                mnt_add_count(mnt, -1);
                 rcu_read_unlock();
                 return;
         }
         lock_mount_hash();
+        /*
+         * make sure that if __legitimize_mnt() has not seen us grab
+         * mount_lock, we'll see their refcount increment here.
+         */
+        smp_mb();
+        mnt_add_count(mnt, -1);
         if (mnt_get_count(mnt)) {
                 rcu_read_unlock();
                 unlock_mount_hash();
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 6dd146885da9..f6c4ccd693f4 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -6466,34 +6466,34 @@ static void nfs4_lock_done(struct rpc_task *task, void *calldata)
                 if (data->arg.new_lock && !data->cancelled) {
                         data->fl.fl_flags &= ~(FL_SLEEP | FL_ACCESS);
                         if (locks_lock_inode_wait(lsp->ls_state->inode, &data->fl) < 0)
-                                break;
+                                goto out_restart;
                 }
-
                 if (data->arg.new_lock_owner != 0) {
                         nfs_confirm_seqid(&lsp->ls_seqid, 0);
                         nfs4_stateid_copy(&lsp->ls_stateid, &data->res.stateid);
                         set_bit(NFS_LOCK_INITIALIZED, &lsp->ls_flags);
-                        goto out_done;
-                } else if (nfs4_update_lock_stateid(lsp, &data->res.stateid))
-                        goto out_done;
-
+                } else if (!nfs4_update_lock_stateid(lsp, &data->res.stateid))
+                        goto out_restart;
                 break;
         case -NFS4ERR_BAD_STATEID:
         case -NFS4ERR_OLD_STATEID:
         case -NFS4ERR_STALE_STATEID:
         case -NFS4ERR_EXPIRED:
                 if (data->arg.new_lock_owner != 0) {
-                        if (nfs4_stateid_match(&data->arg.open_stateid,
+                        if (!nfs4_stateid_match(&data->arg.open_stateid,
                                                 &lsp->ls_state->open_stateid))
-                                goto out_done;
-                } else if (nfs4_stateid_match(&data->arg.lock_stateid,
+                                goto out_restart;
+                } else if (!nfs4_stateid_match(&data->arg.lock_stateid,
                                                 &lsp->ls_stateid))
-                                goto out_done;
+                                goto out_restart;
         }
-        if (!data->cancelled)
-                rpc_restart_call_prepare(task);
 out_done:
         dprintk("%s: done, ret = %d!\n", __func__, data->rpc_status);
+        return;
+out_restart:
+        if (!data->cancelled)
+                rpc_restart_call_prepare(task);
+        goto out_done;
 }
 
 static void nfs4_lock_release(void *calldata)
@@ -6502,7 +6502,7 @@ static void nfs4_lock_release(void *calldata)
 
         dprintk("%s: begin!\n", __func__);
         nfs_free_seqid(data->arg.open_seqid);
-        if (data->cancelled) {
+        if (data->cancelled && data->rpc_status == 0) {
                 struct rpc_task *task;
                 task = nfs4_do_unlck(&data->fl, data->ctx, data->lsp,
                                 data->arg.lock_seqid);
diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c
index 2751476e6b6e..f098b9f1c396 100644
--- a/fs/squashfs/block.c
+++ b/fs/squashfs/block.c
@@ -167,6 +167,8 @@ int squashfs_read_data(struct super_block *sb, u64 index, int length,
         }
 
         if (compressed) {
+                if (!msblk->stream)
+                        goto read_failure;
                 length = squashfs_decompress(msblk, bh, b, offset, length,
                         output);
                 if (length < 0)
diff --git a/fs/squashfs/file.c b/fs/squashfs/file.c
index fcff2e0487fe..f1c1430ae721 100644
--- a/fs/squashfs/file.c
+++ b/fs/squashfs/file.c
@@ -374,13 +374,29 @@ static int read_blocklist(struct inode *inode, int index, u64 *block)
         return squashfs_block_size(size);
 }
 
+void squashfs_fill_page(struct page *page, struct squashfs_cache_entry *buffer, int offset, int avail)
+{
+        int copied;
+        void *pageaddr;
+
+        pageaddr = kmap_atomic(page);
+        copied = squashfs_copy_data(pageaddr, buffer, offset, avail);
+        memset(pageaddr + copied, 0, PAGE_SIZE - copied);
+        kunmap_atomic(pageaddr);
+
+        flush_dcache_page(page);
+        if (copied == avail)
+                SetPageUptodate(page);
+        else
+                SetPageError(page);
+}
+
 /* Copy data into page cache  */
 void squashfs_copy_cache(struct page *page, struct squashfs_cache_entry *buffer,
         int bytes, int offset)
 {
         struct inode *inode = page->mapping->host;
         struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
-        void *pageaddr;
         int i, mask = (1 << (msblk->block_log - PAGE_SHIFT)) - 1;
         int start_index = page->index & ~mask, end_index = start_index | mask;
 
@@ -406,12 +422,7 @@ void squashfs_copy_cache(struct page *page, struct squashfs_cache_entry *buffer,
                 if (PageUptodate(push_page))
                         goto skip_page;
 
-                pageaddr = kmap_atomic(push_page);
-                squashfs_copy_data(pageaddr, buffer, offset, avail);
-                memset(pageaddr + avail, 0, PAGE_SIZE - avail);
-                kunmap_atomic(pageaddr);
-                flush_dcache_page(push_page);
-                SetPageUptodate(push_page);
+                squashfs_fill_page(push_page, buffer, offset, avail);
 skip_page:
                 unlock_page(push_page);
                 if (i != page->index)
@@ -420,10 +431,9 @@ skip_page:
 }
 
 /* Read datablock stored packed inside a fragment (tail-end packed block) */
-static int squashfs_readpage_fragment(struct page *page)
+static int squashfs_readpage_fragment(struct page *page, int expected)
 {
         struct inode *inode = page->mapping->host;
-        struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
         struct squashfs_cache_entry *buffer = squashfs_get_fragment(inode->i_sb,
                 squashfs_i(inode)->fragment_block,
                 squashfs_i(inode)->fragment_size);
@@ -434,23 +444,16 @@ static int squashfs_readpage_fragment(struct page *page)
                         squashfs_i(inode)->fragment_block,
                         squashfs_i(inode)->fragment_size);
         else
-                squashfs_copy_cache(page, buffer, i_size_read(inode) &
-                        (msblk->block_size - 1),
+                squashfs_copy_cache(page, buffer, expected,
                         squashfs_i(inode)->fragment_offset);
 
         squashfs_cache_put(buffer);
         return res;
 }
 
-static int squashfs_readpage_sparse(struct page *page, int index, int file_end)
+static int squashfs_readpage_sparse(struct page *page, int expected)
 {
-        struct inode *inode = page->mapping->host;
-        struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
-        int bytes = index == file_end ?
-                        (i_size_read(inode) & (msblk->block_size - 1)) :
-                         msblk->block_size;
-
-        squashfs_copy_cache(page, NULL, bytes, 0);
+        squashfs_copy_cache(page, NULL, expected, 0);
         return 0;
 }
 
@@ -460,6 +463,9 @@ static int squashfs_readpage(struct file *file, struct page *page)
         struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
         int index = page->index >> (msblk->block_log - PAGE_SHIFT);
         int file_end = i_size_read(inode) >> msblk->block_log;
+        int expected = index == file_end ?
+                        (i_size_read(inode) & (msblk->block_size - 1)) :
+                         msblk->block_size;
         int res;
         void *pageaddr;
 
@@ -478,11 +484,11 @@ static int squashfs_readpage(struct file *file, struct page *page)
                         goto error_out;
 
                 if (bsize == 0)
-                        res = squashfs_readpage_sparse(page, index, file_end);
+                        res = squashfs_readpage_sparse(page, expected);
                 else
-                        res = squashfs_readpage_block(page, block, bsize);
+                        res = squashfs_readpage_block(page, block, bsize, expected);
         } else
-                res = squashfs_readpage_fragment(page);
+                res = squashfs_readpage_fragment(page, expected);
 
         if (!res)
                 return 0;
diff --git a/fs/squashfs/file_cache.c b/fs/squashfs/file_cache.c
index f2310d2a2019..a9ba8d96776a 100644
--- a/fs/squashfs/file_cache.c
+++ b/fs/squashfs/file_cache.c
@@ -20,7 +20,7 @@
 #include "squashfs.h"
 
 /* Read separately compressed datablock and memcopy into page cache */
-int squashfs_readpage_block(struct page *page, u64 block, int bsize)
+int squashfs_readpage_block(struct page *page, u64 block, int bsize, int expected)
 {
         struct inode *i = page->mapping->host;
         struct squashfs_cache_entry *buffer = squashfs_get_datablock(i->i_sb,
@@ -31,7 +31,7 @@ int squashfs_readpage_block(struct page *page, u64 block, int bsize)
                 ERROR("Unable to read page, block %llx, size %x\n", block,
                         bsize);
         else
-                squashfs_copy_cache(page, buffer, buffer->length, 0);
+                squashfs_copy_cache(page, buffer, expected, 0);
 
         squashfs_cache_put(buffer);
         return res;
diff --git a/fs/squashfs/file_direct.c b/fs/squashfs/file_direct.c
index cb485d8e0e91..80db1b86a27c 100644
--- a/fs/squashfs/file_direct.c
+++ b/fs/squashfs/file_direct.c
@@ -21,10 +21,11 @@
 #include "page_actor.h"
 
 static int squashfs_read_cache(struct page *target_page, u64 block, int bsize,
-        int pages, struct page **page);
+        int pages, struct page **page, int bytes);
 
 /* Read separately compressed datablock directly into page cache */
-int squashfs_readpage_block(struct page *target_page, u64 block, int bsize)
+int squashfs_readpage_block(struct page *target_page, u64 block, int bsize,
+        int expected)
 
 {
         struct inode *inode = target_page->mapping->host;
@@ -83,7 +84,7 @@ int squashfs_readpage_block(struct page *target_page, u64 block, int bsize)
                  * using an intermediate buffer.
                  */
                 res = squashfs_read_cache(target_page, block, bsize, pages,
-                                                                page);
+                                                        page, expected);
                 if (res < 0)
                         goto mark_errored;
 
@@ -95,6 +96,11 @@ int squashfs_readpage_block(struct page *target_page, u64 block, int bsize)
         if (res < 0)
                 goto mark_errored;
 
+        if (res != expected) {
+                res = -EIO;
+                goto mark_errored;
+        }
+
         /* Last page may have trailing bytes not filled */
         bytes = res % PAGE_SIZE;
         if (bytes) {
@@ -138,13 +144,12 @@ out:
 
 
 static int squashfs_read_cache(struct page *target_page, u64 block, int bsize,
-        int pages, struct page **page)
+        int pages, struct page **page, int bytes)
 {
         struct inode *i = target_page->mapping->host;
         struct squashfs_cache_entry *buffer = squashfs_get_datablock(i->i_sb,
                                                  block, bsize);
-        int bytes = buffer->length, res = buffer->error, n, offset = 0;
-        void *pageaddr;
+        int res = buffer->error, n, offset = 0;
 
         if (res) {
                 ERROR("Unable to read page, block %llx, size %x\n", block,
@@ -159,12 +164,7 @@ static int squashfs_read_cache(struct page *target_page, u64 block, int bsize,
                 if (page[n] == NULL)
                         continue;
 
-                pageaddr = kmap_atomic(page[n]);
-                squashfs_copy_data(pageaddr, buffer, offset, avail);
-                memset(pageaddr + avail, 0, PAGE_SIZE - avail);
-                kunmap_atomic(pageaddr);
-                flush_dcache_page(page[n]);
-                SetPageUptodate(page[n]);
+                squashfs_fill_page(page[n], buffer, offset, avail);
                 unlock_page(page[n]);
                 if (page[n] != target_page)
                         put_page(page[n]);
diff --git a/fs/squashfs/fragment.c b/fs/squashfs/fragment.c
index 86ad9a4b8c36..0681feab4a84 100644
--- a/fs/squashfs/fragment.c
+++ b/fs/squashfs/fragment.c
@@ -49,11 +49,16 @@ int squashfs_frag_lookup(struct super_block *sb, unsigned int fragment,
                                 u64 *fragment_block)
 {
         struct squashfs_sb_info *msblk = sb->s_fs_info;
-        int block = SQUASHFS_FRAGMENT_INDEX(fragment);
-        int offset = SQUASHFS_FRAGMENT_INDEX_OFFSET(fragment);
-        u64 start_block = le64_to_cpu(msblk->fragment_index[block]);
+        int block, offset, size;
         struct squashfs_fragment_entry fragment_entry;
-        int size;
+        u64 start_block;
+
+        if (fragment >= msblk->fragments)
+                return -EIO;
+        block = SQUASHFS_FRAGMENT_INDEX(fragment);
+        offset = SQUASHFS_FRAGMENT_INDEX_OFFSET(fragment);
+
+        start_block = le64_to_cpu(msblk->fragment_index[block]);
 
         size = squashfs_read_metadata(sb, &fragment_entry, &start_block,
                                         &offset, sizeof(fragment_entry));
diff --git a/fs/squashfs/squashfs.h b/fs/squashfs/squashfs.h
index 887d6d270080..f89f8a74c6ce 100644
--- a/fs/squashfs/squashfs.h
+++ b/fs/squashfs/squashfs.h
@@ -67,11 +67,12 @@ extern __le64 *squashfs_read_fragment_index_table(struct super_block *,
                                 u64, u64, unsigned int);
 
 /* file.c */
+void squashfs_fill_page(struct page *, struct squashfs_cache_entry *, int, int);
 void squashfs_copy_cache(struct page *, struct squashfs_cache_entry *, int,
                                 int);
 
 /* file_xxx.c */
-extern int squashfs_readpage_block(struct page *, u64, int);
+extern int squashfs_readpage_block(struct page *, u64, int, int);
 
 /* id.c */
 extern int squashfs_get_id(struct super_block *, unsigned int, unsigned int *);
diff --git a/fs/squashfs/squashfs_fs_sb.h b/fs/squashfs/squashfs_fs_sb.h
index 1da565cb50c3..ef69c31947bf 100644
--- a/fs/squashfs/squashfs_fs_sb.h
+++ b/fs/squashfs/squashfs_fs_sb.h
@@ -75,6 +75,7 @@ struct squashfs_sb_info {
         unsigned short                          block_log;
         long long                               bytes_used;
         unsigned int                            inodes;
+        unsigned int                            fragments;
         int                                     xattr_ids;
 };
 #endif
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 8a73b97217c8..40e657386fa5 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -175,6 +175,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
         msblk->inode_table = le64_to_cpu(sblk->inode_table_start);
         msblk->directory_table = le64_to_cpu(sblk->directory_table_start);
         msblk->inodes = le32_to_cpu(sblk->inodes);
+        msblk->fragments = le32_to_cpu(sblk->fragments);
         flags = le16_to_cpu(sblk->flags);
 
         TRACE("Found valid superblock on %pg\n", sb->s_bdev);
@@ -185,7 +186,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
         TRACE("Filesystem size %lld bytes\n", msblk->bytes_used);
         TRACE("Block size %d\n", msblk->block_size);
         TRACE("Number of inodes %d\n", msblk->inodes);
-        TRACE("Number of fragments %d\n", le32_to_cpu(sblk->fragments));
+        TRACE("Number of fragments %d\n", msblk->fragments);
         TRACE("Number of ids %d\n", le16_to_cpu(sblk->no_ids));
         TRACE("sblk->inode_table_start %llx\n", msblk->inode_table);
         TRACE("sblk->directory_table_start %llx\n", msblk->directory_table);
@@ -272,7 +273,7 @@ allocate_id_index_table:
         sb->s_export_op = &squashfs_export_ops;
 
 handle_fragments:
-        fragments = le32_to_cpu(sblk->fragments);
+        fragments = msblk->fragments;
         if (fragments == 0)
                 goto check_directory_table;
 
diff --git a/fs/timerfd.c b/fs/timerfd.c
index cdad49da3ff7..38c695ce385b 100644
--- a/fs/timerfd.c
+++ b/fs/timerfd.c
@@ -533,8 +533,8 @@ static int do_timerfd_gettime(int ufd, struct itimerspec64 *t)
 }
 
 SYSCALL_DEFINE4(timerfd_settime, int, ufd, int, flags,
-                const struct itimerspec __user *, utmr,
-                struct itimerspec __user *, otmr)
+                const struct __kernel_itimerspec __user *, utmr,
+                struct __kernel_itimerspec __user *, otmr)
 {
         struct itimerspec64 new, old;
         int ret;
@@ -550,7 +550,7 @@ SYSCALL_DEFINE4(timerfd_settime, int, ufd, int, flags,
         return ret;
 }
 
-SYSCALL_DEFINE2(timerfd_gettime, int, ufd, struct itimerspec __user *, otmr)
+SYSCALL_DEFINE2(timerfd_gettime, int, ufd, struct __kernel_itimerspec __user *, otmr)
 {
         struct itimerspec64 kotmr;
         int ret = do_timerfd_gettime(ufd, &kotmr);
@@ -559,7 +559,7 @@ SYSCALL_DEFINE2(timerfd_gettime, int, ufd, struct itimerspec __user *, otmr)
         return put_itimerspec64(&kotmr, otmr) ? -EFAULT : 0;
 }
 
-#ifdef CONFIG_COMPAT
+#ifdef CONFIG_COMPAT_32BIT_TIME
 COMPAT_SYSCALL_DEFINE4(timerfd_settime, int, ufd, int, flags,
                 const struct compat_itimerspec __user *, utmr,
                 struct compat_itimerspec __user *, otmr)
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 594d192b2331..bad9cea37f12 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -633,8 +633,10 @@ static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
                 /* the various vma->vm_userfaultfd_ctx still points to it */
                 down_write(&mm->mmap_sem);
                 for (vma = mm->mmap; vma; vma = vma->vm_next)
-                        if (vma->vm_userfaultfd_ctx.ctx == release_new_ctx)
+                        if (vma->vm_userfaultfd_ctx.ctx == release_new_ctx) {
                                 vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
+                                vma->vm_flags &= ~(VM_UFFD_WP | VM_UFFD_MISSING);
+                        }
                 up_write(&mm->mmap_sem);
 
                 userfaultfd_ctx_put(release_new_ctx);
diff --git a/include/asm-generic/atomic-instrumented.h b/include/asm-generic/atomic-instrumented.h
index ec07f23678ea..0d4b1d3dbc1e 100644
--- a/include/asm-generic/atomic-instrumented.h
+++ b/include/asm-generic/atomic-instrumented.h
@@ -84,42 +84,59 @@ static __always_inline bool atomic64_try_cmpxchg(atomic64_t *v, s64 *old, s64 ne
 }
 #endif
 
-static __always_inline int __atomic_add_unless(atomic_t *v, int a, int u)
+#ifdef arch_atomic_fetch_add_unless
+#define atomic_fetch_add_unless atomic_fetch_add_unless
+static __always_inline int atomic_fetch_add_unless(atomic_t *v, int a, int u)
 {
         kasan_check_write(v, sizeof(*v));
-        return __arch_atomic_add_unless(v, a, u);
+        return arch_atomic_fetch_add_unless(v, a, u);
 }
+#endif
 
-
-static __always_inline bool atomic64_add_unless(atomic64_t *v, s64 a, s64 u)
+#ifdef arch_atomic64_fetch_add_unless
+#define atomic64_fetch_add_unless atomic64_fetch_add_unless
+static __always_inline s64 atomic64_fetch_add_unless(atomic64_t *v, s64 a, s64 u)
 {
         kasan_check_write(v, sizeof(*v));
-        return arch_atomic64_add_unless(v, a, u);
+        return arch_atomic64_fetch_add_unless(v, a, u);
 }
+#endif
 
+#ifdef arch_atomic_inc
+#define atomic_inc atomic_inc
 static __always_inline void atomic_inc(atomic_t *v)
 {
         kasan_check_write(v, sizeof(*v));
         arch_atomic_inc(v);
 }
+#endif
 
+#ifdef arch_atomic64_inc
+#define atomic64_inc atomic64_inc
 static __always_inline void atomic64_inc(atomic64_t *v)
 {
         kasan_check_write(v, sizeof(*v));
         arch_atomic64_inc(v);
 }
+#endif
 
+#ifdef arch_atomic_dec
+#define atomic_dec atomic_dec
 static __always_inline void atomic_dec(atomic_t *v)
 {
         kasan_check_write(v, sizeof(*v));
         arch_atomic_dec(v);
 }
+#endif
 
+#ifdef atch_atomic64_dec
+#define atomic64_dec
 static __always_inline void atomic64_dec(atomic64_t *v)
 {
         kasan_check_write(v, sizeof(*v));
         arch_atomic64_dec(v);
 }
+#endif
 
 static __always_inline void atomic_add(int i, atomic_t *v)
 {
@@ -181,65 +198,95 @@ static __always_inline void atomic64_xor(s64 i, atomic64_t *v)
         arch_atomic64_xor(i, v);
 }
 
+#ifdef arch_atomic_inc_return
+#define atomic_inc_return atomic_inc_return
 static __always_inline int atomic_inc_return(atomic_t *v)
 {
         kasan_check_write(v, sizeof(*v));
         return arch_atomic_inc_return(v);
 }
+#endif
 
+#ifdef arch_atomic64_in_return
+#define atomic64_inc_return atomic64_inc_return
 static __always_inline s64 atomic64_inc_return(atomic64_t *v)
 {
         kasan_check_write(v, sizeof(*v));
         return arch_atomic64_inc_return(v);
 }
+#endif
 
+#ifdef arch_atomic_dec_return
+#define atomic_dec_return atomic_dec_return
 static __always_inline int atomic_dec_return(atomic_t *v)
 {
         kasan_check_write(v, sizeof(*v));
         return arch_atomic_dec_return(v);
 }
+#endif
 
+#ifdef arch_atomic64_dec_return
+#define atomic64_dec_return atomic64_dec_return
 static __always_inline s64 atomic64_dec_return(atomic64_t *v)
 {
         kasan_check_write(v, sizeof(*v));
         return arch_atomic64_dec_return(v);
 }
+#endif
 
-static __always_inline s64 atomic64_inc_not_zero(atomic64_t *v)
+#ifdef arch_atomic64_inc_not_zero
+#define atomic64_inc_not_zero atomic64_inc_not_zero
+static __always_inline bool atomic64_inc_not_zero(atomic64_t *v)
 {
         kasan_check_write(v, sizeof(*v));
         return arch_atomic64_inc_not_zero(v);
 }
+#endif
 
+#ifdef arch_atomic64_dec_if_positive
+#define atomic64_dec_if_positive atomic64_dec_if_positive
 static __always_inline s64 atomic64_dec_if_positive(atomic64_t *v)
 {
         kasan_check_write(v, sizeof(*v));
         return arch_atomic64_dec_if_positive(v);
 }
+#endif
 
+#ifdef arch_atomic_dec_and_test
+#define atomic_dec_and_test atomic_dec_and_test
 static __always_inline bool atomic_dec_and_test(atomic_t *v)
 {
         kasan_check_write(v, sizeof(*v));
         return arch_atomic_dec_and_test(v);
 }
+#endif
 
+#ifdef arch_atomic64_dec_and_test
+#define atomic64_dec_and_test atomic64_dec_and_test
 static __always_inline bool atomic64_dec_and_test(atomic64_t *v)
 {
         kasan_check_write(v, sizeof(*v));
         return arch_atomic64_dec_and_test(v);
 }
+#endif
 
+#ifdef arch_atomic_inc_and_test
+#define atomic_inc_and_test atomic_inc_and_test
 static __always_inline bool atomic_inc_and_test(atomic_t *v)
 {
         kasan_check_write(v, sizeof(*v));
         return arch_atomic_inc_and_test(v);
 }
+#endif
 
+#ifdef arch_atomic64_inc_and_test
+#define atomic64_inc_and_test atomic64_inc_and_test
 static __always_inline bool atomic64_inc_and_test(atomic64_t *v)
 {
         kasan_check_write(v, sizeof(*v));
         return arch_atomic64_inc_and_test(v);
 }
+#endif
 
 static __always_inline int atomic_add_return(int i, atomic_t *v)
 {
@@ -325,152 +372,96 @@ static __always_inline s64 atomic64_fetch_xor(s64 i, atomic64_t *v)
         return arch_atomic64_fetch_xor(i, v);
 }
 
+#ifdef arch_atomic_sub_and_test
+#define atomic_sub_and_test atomic_sub_and_test
 static __always_inline bool atomic_sub_and_test(int i, atomic_t *v)
 {
         kasan_check_write(v, sizeof(*v));
         return arch_atomic_sub_and_test(i, v);
 }
+#endif
 
+#ifdef arch_atomic64_sub_and_test
+#define atomic64_sub_and_test atomic64_sub_and_test
 static __always_inline bool atomic64_sub_and_test(s64 i, atomic64_t *v)
 {
         kasan_check_write(v, sizeof(*v));
         return arch_atomic64_sub_and_test(i, v);
 }
+#endif
 
+#ifdef arch_atomic_add_negative
+#define atomic_add_negative atomic_add_negative
 static __always_inline bool atomic_add_negative(int i, atomic_t *v)
 {
         kasan_check_write(v, sizeof(*v));
         return arch_atomic_add_negative(i, v);
 }
+#endif
 
+#ifdef arch_atomic64_add_negative
+#define atomic64_add_negative atomic64_add_negative
 static __always_inline bool atomic64_add_negative(s64 i, atomic64_t *v)
 {
         kasan_check_write(v, sizeof(*v));
         return arch_atomic64_add_negative(i, v);
 }
+#endif
 
-static __always_inline unsigned long
-cmpxchg_size(volatile void *ptr, unsigned long old, unsigned long new, int size)
-{
-        kasan_check_write(ptr, size);
-        switch (size) {
-        case 1:
-                return arch_cmpxchg((u8 *)ptr, (u8)old, (u8)new);
-        case 2:
-                return arch_cmpxchg((u16 *)ptr, (u16)old, (u16)new);
-        case 4:
-                return arch_cmpxchg((u32 *)ptr, (u32)old, (u32)new);
-        case 8:
-                BUILD_BUG_ON(sizeof(unsigned long) != 8);
-                return arch_cmpxchg((u64 *)ptr, (u64)old, (u64)new);
-        }
-        BUILD_BUG();
-        return 0;
-}
+#define xchg(ptr, new)                                                  \
+({                                                                      \
+        typeof(ptr) __ai_ptr = (ptr);                                   \
+        kasan_check_write(__ai_ptr, sizeof(*__ai_ptr));                 \
+        arch_xchg(__ai_ptr, (new));                                     \
+})
 
 #define cmpxchg(ptr, old, new)                                          \
 ({                                                                      \
-        ((__typeof__(*(ptr)))cmpxchg_size((ptr), (unsigned long)(old),  \
-                (unsigned long)(new), sizeof(*(ptr))));                 \
+        typeof(ptr) __ai_ptr = (ptr);                                   \
+        kasan_check_write(__ai_ptr, sizeof(*__ai_ptr));                 \
+        arch_cmpxchg(__ai_ptr, (old), (new));                           \
 })
 
-static __always_inline unsigned long
-sync_cmpxchg_size(volatile void *ptr, unsigned long old, unsigned long new,
-                  int size)
-{
-        kasan_check_write(ptr, size);
-        switch (size) {
-        case 1:
-                return arch_sync_cmpxchg((u8 *)ptr, (u8)old, (u8)new);
-        case 2:
-                return arch_sync_cmpxchg((u16 *)ptr, (u16)old, (u16)new);
-        case 4:
-                return arch_sync_cmpxchg((u32 *)ptr, (u32)old, (u32)new);
-        case 8:
-                BUILD_BUG_ON(sizeof(unsigned long) != 8);
-                return arch_sync_cmpxchg((u64 *)ptr, (u64)old, (u64)new);
-        }
-        BUILD_BUG();
-        return 0;
-}
-
 #define sync_cmpxchg(ptr, old, new)                                     \
 ({                                                                      \
-        ((__typeof__(*(ptr)))sync_cmpxchg_size((ptr),                   \
-                (unsigned long)(old), (unsigned long)(new),             \
-                sizeof(*(ptr))));                                       \
+        typeof(ptr) __ai_ptr = (ptr);                                   \
+        kasan_check_write(__ai_ptr, sizeof(*__ai_ptr));                 \
+        arch_sync_cmpxchg(__ai_ptr, (old), (new));                      \
 })
 
-static __always_inline unsigned long
-cmpxchg_local_size(volatile void *ptr, unsigned long old, unsigned long new,
-                   int size)
-{
-        kasan_check_write(ptr, size);
-        switch (size) {
-        case 1:
-                return arch_cmpxchg_local((u8 *)ptr, (u8)old, (u8)new);
-        case 2:
-                return arch_cmpxchg_local((u16 *)ptr, (u16)old, (u16)new);
-        case 4:
-                return arch_cmpxchg_local((u32 *)ptr, (u32)old, (u32)new);
-        case 8:
-                BUILD_BUG_ON(sizeof(unsigned long) != 8);
-                return arch_cmpxchg_local((u64 *)ptr, (u64)old, (u64)new);
-        }
-        BUILD_BUG();
-        return 0;
-}
-
 #define cmpxchg_local(ptr, old, new)                                    \
 ({                                                                      \
-        ((__typeof__(*(ptr)))cmpxchg_local_size((ptr),                  \
-                (unsigned long)(old), (unsigned long)(new),             \
-                sizeof(*(ptr))));                                       \
+        typeof(ptr) __ai_ptr = (ptr);                                   \
+        kasan_check_write(__ai_ptr, sizeof(*__ai_ptr));                 \
+        arch_cmpxchg_local(__ai_ptr, (old), (new));                     \
 })
 
-static __always_inline u64
-cmpxchg64_size(volatile u64 *ptr, u64 old, u64 new)
-{
-        kasan_check_write(ptr, sizeof(*ptr));
-        return arch_cmpxchg64(ptr, old, new);
-}
-
 #define cmpxchg64(ptr, old, new)                                        \
 ({                                                                      \
-        ((__typeof__(*(ptr)))cmpxchg64_size((ptr), (u64)(old),          \
-                (u64)(new)));                                           \
+        typeof(ptr) __ai_ptr = (ptr);                                   \
+        kasan_check_write(__ai_ptr, sizeof(*__ai_ptr));                 \
+        arch_cmpxchg64(__ai_ptr, (old), (new));                         \
 })
 
-static __always_inline u64
-cmpxchg64_local_size(volatile u64 *ptr, u64 old, u64 new)
-{
-        kasan_check_write(ptr, sizeof(*ptr));
-        return arch_cmpxchg64_local(ptr, old, new);
-}
-
 #define cmpxchg64_local(ptr, old, new)                                  \
 ({                                                                      \
-        ((__typeof__(*(ptr)))cmpxchg64_local_size((ptr), (u64)(old),    \
-                (u64)(new)));                                           \
+        typeof(ptr) __ai_ptr = (ptr);                                   \
+        kasan_check_write(__ai_ptr, sizeof(*__ai_ptr));                 \
+        arch_cmpxchg64_local(__ai_ptr, (old), (new));                   \
 })
 
-/*
- * Originally we had the following code here:
- *     __typeof__(p1) ____p1 = (p1);
- *     kasan_check_write(____p1, 2 * sizeof(*____p1));
- *     arch_cmpxchg_double(____p1, (p2), (o1), (o2), (n1), (n2));
- * But it leads to compilation failures (see gcc issue 72873).
- * So for now it's left non-instrumented.
- * There are few callers of cmpxchg_double(), so it's not critical.
- */
 #define cmpxchg_double(p1, p2, o1, o2, n1, n2)                          \
 ({                                                                      \
-        arch_cmpxchg_double((p1), (p2), (o1), (o2), (n1), (n2));        \
+        typeof(p1) __ai_p1 = (p1);                                      \
+        kasan_check_write(__ai_p1, 2 * sizeof(*__ai_p1));               \
+        arch_cmpxchg_double(__ai_p1, (p2), (o1), (o2), (n1), (n2));     \
 })
 
-#define cmpxchg_double_local(p1, p2, o1, o2, n1, n2)                    \
-({                                                                      \
-        arch_cmpxchg_double_local((p1), (p2), (o1), (o2), (n1), (n2));  \
+#define cmpxchg_double_local(p1, p2, o1, o2, n1, n2)                            \
+({                                                                              \
+        typeof(p1) __ai_p1 = (p1);                                              \
+        kasan_check_write(__ai_p1, 2 * sizeof(*__ai_p1));                       \
+        arch_cmpxchg_double_local(__ai_p1, (p2), (o1), (o2), (n1), (n2));       \
 })
 
 #endif /* _LINUX_ATOMIC_INSTRUMENTED_H */
diff --git a/include/asm-generic/atomic.h b/include/asm-generic/atomic.h
index abe6dd9ca2a8..13324aa828eb 100644
--- a/include/asm-generic/atomic.h
+++ b/include/asm-generic/atomic.h
@@ -186,11 +186,6 @@ ATOMIC_OP(xor, ^)
 
 #include <linux/irqflags.h>
 
-static inline int atomic_add_negative(int i, atomic_t *v)
-{
-        return atomic_add_return(i, v) < 0;
-}
-
 static inline void atomic_add(int i, atomic_t *v)
 {
         atomic_add_return(i, v);
@@ -201,35 +196,7 @@ static inline void atomic_sub(int i, atomic_t *v)
         atomic_sub_return(i, v);
 }
 
-static inline void atomic_inc(atomic_t *v)
-{
-        atomic_add_return(1, v);
-}
-
-static inline void atomic_dec(atomic_t *v)
-{
-        atomic_sub_return(1, v);
-}
-
-#define atomic_dec_return(v)            atomic_sub_return(1, (v))
-#define atomic_inc_return(v)            atomic_add_return(1, (v))
-
-#define atomic_sub_and_test(i, v)       (atomic_sub_return((i), (v)) == 0)
-#define atomic_dec_and_test(v)          (atomic_dec_return(v) == 0)
-#define atomic_inc_and_test(v)          (atomic_inc_return(v) == 0)
-
 #define atomic_xchg(ptr, v)             (xchg(&(ptr)->counter, (v)))
 #define atomic_cmpxchg(v, old, new)     (cmpxchg(&((v)->counter), (old), (new)))
 
-#ifndef __atomic_add_unless
-static inline int __atomic_add_unless(atomic_t *v, int a, int u)
-{
-        int c, old;
-        c = atomic_read(v);
-        while (c != u && (old = atomic_cmpxchg(v, c, c + a)) != c)
-                c = old;
-        return c;
-}
-#endif
-
 #endif /* __ASM_GENERIC_ATOMIC_H */
diff --git a/include/asm-generic/atomic64.h b/include/asm-generic/atomic64.h
index 8d28eb010d0d..97b28b7f1f29 100644
--- a/include/asm-generic/atomic64.h
+++ b/include/asm-generic/atomic64.h
@@ -11,6 +11,7 @@
  */
 #ifndef _ASM_GENERIC_ATOMIC64_H
 #define _ASM_GENERIC_ATOMIC64_H
+#include <linux/types.h>
 
 typedef struct {
         long long counter;
@@ -50,18 +51,10 @@ ATOMIC64_OPS(xor)
 #undef ATOMIC64_OP
 
 extern long long atomic64_dec_if_positive(atomic64_t *v);
+#define atomic64_dec_if_positive atomic64_dec_if_positive
 extern long long atomic64_cmpxchg(atomic64_t *v, long long o, long long n);
 extern long long atomic64_xchg(atomic64_t *v, long long new);
-extern int       atomic64_add_unless(atomic64_t *v, long long a, long long u);
-
-#define atomic64_add_negative(a, v)     (atomic64_add_return((a), (v)) < 0)
-#define atomic64_inc(v)                 atomic64_add(1LL, (v))
-#define atomic64_inc_return(v)          atomic64_add_return(1LL, (v))
-#define atomic64_inc_and_test(v)        (atomic64_inc_return(v) == 0)
-#define atomic64_sub_and_test(a, v)     (atomic64_sub_return((a), (v)) == 0)
-#define atomic64_dec(v)                 atomic64_sub(1LL, (v))
-#define atomic64_dec_return(v)          atomic64_sub_return(1LL, (v))
-#define atomic64_dec_and_test(v)        (atomic64_dec_return((v)) == 0)
-#define atomic64_inc_not_zero(v)        atomic64_add_unless((v), 1LL, 0LL)
+extern long long atomic64_fetch_add_unless(atomic64_t *v, long long a, long long u);
+#define atomic64_fetch_add_unless atomic64_fetch_add_unless
 
 #endif  /*  _ASM_GENERIC_ATOMIC64_H  */
diff --git a/include/asm-generic/bitops/atomic.h b/include/asm-generic/bitops/atomic.h
index 04deffaf5f7d..dd90c9792909 100644
--- a/include/asm-generic/bitops/atomic.h
+++ b/include/asm-generic/bitops/atomic.h
@@ -2,189 +2,67 @@
 #ifndef _ASM_GENERIC_BITOPS_ATOMIC_H_
 #define _ASM_GENERIC_BITOPS_ATOMIC_H_
 
-#include <asm/types.h>
-#include <linux/irqflags.h>
-
-#ifdef CONFIG_SMP
-#include <asm/spinlock.h>
-#include <asm/cache.h>          /* we use L1_CACHE_BYTES */
-
-/* Use an array of spinlocks for our atomic_ts.
- * Hash function to index into a different SPINLOCK.
- * Since "a" is usually an address, use one spinlock per cacheline.
- */
-#  define ATOMIC_HASH_SIZE 4
-#  define ATOMIC_HASH(a) (&(__atomic_hash[ (((unsigned long) a)/L1_CACHE_BYTES) & (ATOMIC_HASH_SIZE-1) ]))
-
-extern arch_spinlock_t __atomic_hash[ATOMIC_HASH_SIZE] __lock_aligned;
-
-/* Can't use raw_spin_lock_irq because of #include problems, so
- * this is the substitute */
-#define _atomic_spin_lock_irqsave(l,f) do {     \
-        arch_spinlock_t *s = ATOMIC_HASH(l);    \
-        local_irq_save(f);                      \
-        arch_spin_lock(s);                      \
-} while(0)
-
-#define _atomic_spin_unlock_irqrestore(l,f) do {        \
-        arch_spinlock_t *s = ATOMIC_HASH(l);            \
-        arch_spin_unlock(s);                            \
-        local_irq_restore(f);                           \
-} while(0)
-
-
-#else
-#  define _atomic_spin_lock_irqsave(l,f) do { local_irq_save(f); } while (0)
-#  define _atomic_spin_unlock_irqrestore(l,f) do { local_irq_restore(f); } while (0)
-#endif
+#include <linux/atomic.h>
+#include <linux/compiler.h>
+#include <asm/barrier.h>
 
 /*
- * NMI events can occur at any time, including when interrupts have been
- * disabled by *_irqsave().  So you can get NMI events occurring while a
- * *_bit function is holding a spin lock.  If the NMI handler also wants
- * to do bit manipulation (and they do) then you can get a deadlock
- * between the original caller of *_bit() and the NMI handler.
- *
- * by Keith Owens
+ * Implementation of atomic bitops using atomic-fetch ops.
+ * See Documentation/atomic_bitops.txt for details.
  */
 
-/**
- * set_bit - Atomically set a bit in memory
- * @nr: the bit to set
- * @addr: the address to start counting from
- *
- * This function is atomic and may not be reordered.  See __set_bit()
- * if you do not require the atomic guarantees.
- *
- * Note: there are no guarantees that this function will not be reordered
- * on non x86 architectures, so if you are writing portable code,
- * make sure not to rely on its reordering guarantees.
- *
- * Note that @nr may be almost arbitrarily large; this function is not
- * restricted to acting on a single-word quantity.
- */
-static inline void set_bit(int nr, volatile unsigned long *addr)
+static inline void set_bit(unsigned int nr, volatile unsigned long *p)
 {
-        unsigned long mask = BIT_MASK(nr);
-        unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
-        unsigned long flags;
-
-        _atomic_spin_lock_irqsave(p, flags);
-        *p  |= mask;
-        _atomic_spin_unlock_irqrestore(p, flags);
+        p += BIT_WORD(nr);
+        atomic_long_or(BIT_MASK(nr), (atomic_long_t *)p);
 }
 
-/**
- * clear_bit - Clears a bit in memory
- * @nr: Bit to clear
- * @addr: Address to start counting from
- *
- * clear_bit() is atomic and may not be reordered.  However, it does
- * not contain a memory barrier, so if it is used for locking purposes,
- * you should call smp_mb__before_atomic() and/or smp_mb__after_atomic()
- * in order to ensure changes are visible on other processors.
- */
-static inline void clear_bit(int nr, volatile unsigned long *addr)
+static inline void clear_bit(unsigned int nr, volatile unsigned long *p)
 {
-        unsigned long mask = BIT_MASK(nr);
-        unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
-        unsigned long flags;
-
-        _atomic_spin_lock_irqsave(p, flags);
-        *p &= ~mask;
-        _atomic_spin_unlock_irqrestore(p, flags);
+        p += BIT_WORD(nr);
+        atomic_long_andnot(BIT_MASK(nr), (atomic_long_t *)p);
 }
 
-/**
- * change_bit - Toggle a bit in memory
- * @nr: Bit to change
- * @addr: Address to start counting from
- *
- * change_bit() is atomic and may not be reordered. It may be
- * reordered on other architectures than x86.
- * Note that @nr may be almost arbitrarily large; this function is not
- * restricted to acting on a single-word quantity.
- */
-static inline void change_bit(int nr, volatile unsigned long *addr)
+static inline void change_bit(unsigned int nr, volatile unsigned long *p)
 {
-        unsigned long mask = BIT_MASK(nr);
-        unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
-        unsigned long flags;
-
-        _atomic_spin_lock_irqsave(p, flags);
-        *p ^= mask;
-        _atomic_spin_unlock_irqrestore(p, flags);
+        p += BIT_WORD(nr);
+        atomic_long_xor(BIT_MASK(nr), (atomic_long_t *)p);
 }
 
-/**
- * test_and_set_bit - Set a bit and return its old value
- * @nr: Bit to set
- * @addr: Address to count from
- *
- * This operation is atomic and cannot be reordered.
- * It may be reordered on other architectures than x86.
- * It also implies a memory barrier.
- */
-static inline int test_and_set_bit(int nr, volatile unsigned long *addr)
+static inline int test_and_set_bit(unsigned int nr, volatile unsigned long *p)
 {
+        long old;
         unsigned long mask = BIT_MASK(nr);
-        unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
-        unsigned long old;
-        unsigned long flags;
 
-        _atomic_spin_lock_irqsave(p, flags);
-        old = *p;
-        *p = old | mask;
-        _atomic_spin_unlock_irqrestore(p, flags);
+        p += BIT_WORD(nr);
+        if (READ_ONCE(*p) & mask)
+                return 1;
 
-        return (old & mask) != 0;
+        old = atomic_long_fetch_or(mask, (atomic_long_t *)p);
+        return !!(old & mask);
 }
 
-/**
- * test_and_clear_bit - Clear a bit and return its old value
- * @nr: Bit to clear
- * @addr: Address to count from
- *
- * This operation is atomic and cannot be reordered.
- * It can be reorderdered on other architectures other than x86.
- * It also implies a memory barrier.
- */
-static inline int test_and_clear_bit(int nr, volatile unsigned long *addr)
+static inline int test_and_clear_bit(unsigned int nr, volatile unsigned long *p)
 {
+        long old;
         unsigned long mask = BIT_MASK(nr);
-        unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
-        unsigned long old;
-        unsigned long flags;
 
-        _atomic_spin_lock_irqsave(p, flags);
-        old = *p;
-        *p = old & ~mask;
-        _atomic_spin_unlock_irqrestore(p, flags);
+        p += BIT_WORD(nr);
+        if (!(READ_ONCE(*p) & mask))
+                return 0;
 
-        return (old & mask) != 0;
+        old = atomic_long_fetch_andnot(mask, (atomic_long_t *)p);
+        return !!(old & mask);
 }
 
-/**
- * test_and_change_bit - Change a bit and return its old value
- * @nr: Bit to change
- * @addr: Address to count from
- *
- * This operation is atomic and cannot be reordered.
- * It also implies a memory barrier.
- */
-static inline int test_and_change_bit(int nr, volatile unsigned long *addr)
+static inline int test_and_change_bit(unsigned int nr, volatile unsigned long *p)
 {
+        long old;
         unsigned long mask = BIT_MASK(nr);
-        unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
-        unsigned long old;
-        unsigned long flags;
-
-        _atomic_spin_lock_irqsave(p, flags);
-        old = *p;
-        *p = old ^ mask;
-        _atomic_spin_unlock_irqrestore(p, flags);
 
-        return (old & mask) != 0;
+        p += BIT_WORD(nr);
+        old = atomic_long_fetch_xor(mask, (atomic_long_t *)p);
+        return !!(old & mask);
 }
 
 #endif /* _ASM_GENERIC_BITOPS_ATOMIC_H */
diff --git a/include/asm-generic/bitops/lock.h b/include/asm-generic/bitops/lock.h
index 67ab280ad134..3ae021368f48 100644
--- a/include/asm-generic/bitops/lock.h
+++ b/include/asm-generic/bitops/lock.h
@@ -2,6 +2,10 @@
 #ifndef _ASM_GENERIC_BITOPS_LOCK_H_
 #define _ASM_GENERIC_BITOPS_LOCK_H_
 
+#include <linux/atomic.h>
+#include <linux/compiler.h>
+#include <asm/barrier.h>
+
 /**
  * test_and_set_bit_lock - Set a bit and return its old value, for lock
  * @nr: Bit to set
@@ -11,7 +15,20 @@
  * the returned value is 0.
  * It can be used to implement bit locks.
  */
-#define test_and_set_bit_lock(nr, addr) test_and_set_bit(nr, addr)
+static inline int test_and_set_bit_lock(unsigned int nr,
+                                        volatile unsigned long *p)
+{
+        long old;
+        unsigned long mask = BIT_MASK(nr);
+
+        p += BIT_WORD(nr);
+        if (READ_ONCE(*p) & mask)
+                return 1;
+
+        old = atomic_long_fetch_or_acquire(mask, (atomic_long_t *)p);
+        return !!(old & mask);
+}
+
 
 /**
  * clear_bit_unlock - Clear a bit in memory, for unlock
@@ -20,11 +37,11 @@
  *
  * This operation is atomic and provides release barrier semantics.
  */
-#define clear_bit_unlock(nr, addr)      \
-do {                                    \
-        smp_mb__before_atomic();        \
-        clear_bit(nr, addr);            \
-} while (0)
+static inline void clear_bit_unlock(unsigned int nr, volatile unsigned long *p)
+{
+        p += BIT_WORD(nr);
+        atomic_long_fetch_andnot_release(BIT_MASK(nr), (atomic_long_t *)p);
+}
 
 /**
  * __clear_bit_unlock - Clear a bit in memory, for unlock
@@ -37,11 +54,38 @@ do {					\
  *
  * See for example x86's implementation.
  */
-#define __clear_bit_unlock(nr, addr)    \
-do {                                    \
-        smp_mb__before_atomic();        \
-        clear_bit(nr, addr);            \
-} while (0)
+static inline void __clear_bit_unlock(unsigned int nr,
+                                      volatile unsigned long *p)
+{
+        unsigned long old;
 
-#endif /* _ASM_GENERIC_BITOPS_LOCK_H_ */
+        p += BIT_WORD(nr);
+        old = READ_ONCE(*p);
+        old &= ~BIT_MASK(nr);
+        atomic_long_set_release((atomic_long_t *)p, old);
+}
+
+/**
+ * clear_bit_unlock_is_negative_byte - Clear a bit in memory and test if bottom
+ *                                     byte is negative, for unlock.
+ * @nr: the bit to clear
+ * @addr: the address to start counting from
+ *
+ * This is a bit of a one-trick-pony for the filemap code, which clears
+ * PG_locked and tests PG_waiters,
+ */
+#ifndef clear_bit_unlock_is_negative_byte
+static inline bool clear_bit_unlock_is_negative_byte(unsigned int nr,
+                                                     volatile unsigned long *p)
+{
+        long old;
+        unsigned long mask = BIT_MASK(nr);
+
+        p += BIT_WORD(nr);
+        old = atomic_long_fetch_andnot_release(mask, (atomic_long_t *)p);
+        return !!(old & BIT(7));
+}
+#define clear_bit_unlock_is_negative_byte clear_bit_unlock_is_negative_byte
+#endif
 
+#endif /* _ASM_GENERIC_BITOPS_LOCK_H_ */
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
index f59639afaa39..b081794ba135 100644
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -1019,8 +1019,8 @@ int pud_set_huge(pud_t *pud, phys_addr_t addr, pgprot_t prot);
 int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot);
 int pud_clear_huge(pud_t *pud);
 int pmd_clear_huge(pmd_t *pmd);
-int pud_free_pmd_page(pud_t *pud);
-int pmd_free_pte_page(pmd_t *pmd);
+int pud_free_pmd_page(pud_t *pud, unsigned long addr);
+int pmd_free_pte_page(pmd_t *pmd, unsigned long addr);
 #else   /* !CONFIG_HAVE_ARCH_HUGE_VMAP */
 static inline int p4d_set_huge(p4d_t *p4d, phys_addr_t addr, pgprot_t prot)
 {
@@ -1046,11 +1046,11 @@ static inline int pmd_clear_huge(pmd_t *pmd)
 {
         return 0;
 }
-static inline int pud_free_pmd_page(pud_t *pud)
+static inline int pud_free_pmd_page(pud_t *pud, unsigned long addr)
 {
         return 0;
 }
-static inline int pmd_free_pte_page(pmd_t *pmd)
+static inline int pmd_free_pte_page(pmd_t *pmd, unsigned long addr)
 {
         return 0;
 }
diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h
index 3063125197ad..e811ef7b8350 100644
--- a/include/asm-generic/tlb.h
+++ b/include/asm-generic/tlb.h
@@ -303,4 +303,14 @@ static inline void tlb_remove_check_page_size_change(struct mmu_gather *tlb,
 
 #define tlb_migrate_finish(mm) do {} while (0)
 
+/*
+ * Used to flush the TLB when page tables are removed, when lazy
+ * TLB mode may cause a CPU to retain intermediate translations
+ * pointing to about-to-be-freed page table memory.
+ */
+#ifndef HAVE_TLB_FLUSH_REMOVE_TABLES
+#define tlb_flush_remove_tables(mm) do {} while (0)
+#define tlb_flush_remove_tables_local(mm) do {} while (0)
+#endif
+
 #endif /* _ASM_GENERIC__TLB_H */
diff --git a/include/linux/atomic.h b/include/linux/atomic.h
index 01ce3997cb42..1e8e88bdaf09 100644
--- a/include/linux/atomic.h
+++ b/include/linux/atomic.h
@@ -2,6 +2,8 @@
 /* Atomic operations usable in machine independent code */
 #ifndef _LINUX_ATOMIC_H
 #define _LINUX_ATOMIC_H
+#include <linux/types.h>
+
 #include <asm/atomic.h>
 #include <asm/barrier.h>
 
@@ -36,40 +38,46 @@
  * barriers on top of the relaxed variant. In the case where the relaxed
  * variant is already fully ordered, no additional barriers are needed.
  *
- * Besides, if an arch has a special barrier for acquire/release, it could
- * implement its own __atomic_op_* and use the same framework for building
- * variants
- *
- * If an architecture overrides __atomic_op_acquire() it will probably want
- * to define smp_mb__after_spinlock().
+ * If an architecture overrides __atomic_acquire_fence() it will probably
+ * want to define smp_mb__after_spinlock().
  */
-#ifndef __atomic_op_acquire
+#ifndef __atomic_acquire_fence
+#define __atomic_acquire_fence          smp_mb__after_atomic
+#endif
+
+#ifndef __atomic_release_fence
+#define __atomic_release_fence          smp_mb__before_atomic
+#endif
+
+#ifndef __atomic_pre_full_fence
+#define __atomic_pre_full_fence         smp_mb__before_atomic
+#endif
+
+#ifndef __atomic_post_full_fence
+#define __atomic_post_full_fence        smp_mb__after_atomic
+#endif
+
 #define __atomic_op_acquire(op, args...)                                \
 ({                                                                      \
         typeof(op##_relaxed(args)) __ret  = op##_relaxed(args);         \
-        smp_mb__after_atomic();                                         \
+        __atomic_acquire_fence();                                       \
         __ret;                                                          \
 })
-#endif
 
-#ifndef __atomic_op_release
 #define __atomic_op_release(op, args...)                                \
 ({                                                                      \
-        smp_mb__before_atomic();                                        \
+        __atomic_release_fence();                                       \
         op##_relaxed(args);                                             \
 })
-#endif
 
-#ifndef __atomic_op_fence
 #define __atomic_op_fence(op, args...)                                  \
 ({                                                                      \
         typeof(op##_relaxed(args)) __ret;                               \
-        smp_mb__before_atomic();                                        \
+        __atomic_pre_full_fence();                                      \
         __ret = op##_relaxed(args);                                     \
-        smp_mb__after_atomic();                                         \
+        __atomic_post_full_fence();                                     \
         __ret;                                                          \
 })
-#endif
 
 /* atomic_add_return_relaxed */
 #ifndef atomic_add_return_relaxed
@@ -95,11 +103,23 @@
 #endif
 #endif /* atomic_add_return_relaxed */
 
+#ifndef atomic_inc
+#define atomic_inc(v)                   atomic_add(1, (v))
+#endif
+
 /* atomic_inc_return_relaxed */
 #ifndef atomic_inc_return_relaxed
+
+#ifndef atomic_inc_return
+#define atomic_inc_return(v)            atomic_add_return(1, (v))
+#define atomic_inc_return_relaxed(v)    atomic_add_return_relaxed(1, (v))
+#define atomic_inc_return_acquire(v)    atomic_add_return_acquire(1, (v))
+#define atomic_inc_return_release(v)    atomic_add_return_release(1, (v))
+#else /* atomic_inc_return */
 #define  atomic_inc_return_relaxed      atomic_inc_return
 #define  atomic_inc_return_acquire      atomic_inc_return
 #define  atomic_inc_return_release      atomic_inc_return
+#endif /* atomic_inc_return */
 
 #else /* atomic_inc_return_relaxed */
 
@@ -143,11 +163,23 @@
 #endif
 #endif /* atomic_sub_return_relaxed */
 
+#ifndef atomic_dec
+#define atomic_dec(v)                   atomic_sub(1, (v))
+#endif
+
 /* atomic_dec_return_relaxed */
 #ifndef atomic_dec_return_relaxed
+
+#ifndef atomic_dec_return
+#define atomic_dec_return(v)            atomic_sub_return(1, (v))
+#define atomic_dec_return_relaxed(v)    atomic_sub_return_relaxed(1, (v))
+#define atomic_dec_return_acquire(v)    atomic_sub_return_acquire(1, (v))
+#define atomic_dec_return_release(v)    atomic_sub_return_release(1, (v))
+#else /* atomic_dec_return */
 #define  atomic_dec_return_relaxed      atomic_dec_return
 #define  atomic_dec_return_acquire      atomic_dec_return
 #define  atomic_dec_return_release      atomic_dec_return
+#endif /* atomic_dec_return */
 
 #else /* atomic_dec_return_relaxed */
 
@@ -328,12 +360,22 @@
 #endif
 #endif /* atomic_fetch_and_relaxed */
 
-#ifdef atomic_andnot
-/* atomic_fetch_andnot_relaxed */
+#ifndef atomic_andnot
+#define atomic_andnot(i, v)             atomic_and(~(int)(i), (v))
+#endif
+
 #ifndef atomic_fetch_andnot_relaxed
-#define atomic_fetch_andnot_relaxed     atomic_fetch_andnot
-#define atomic_fetch_andnot_acquire     atomic_fetch_andnot
-#define atomic_fetch_andnot_release     atomic_fetch_andnot
+
+#ifndef atomic_fetch_andnot
+#define atomic_fetch_andnot(i, v)               atomic_fetch_and(~(int)(i), (v))
+#define atomic_fetch_andnot_relaxed(i, v)       atomic_fetch_and_relaxed(~(int)(i), (v))
+#define atomic_fetch_andnot_acquire(i, v)       atomic_fetch_and_acquire(~(int)(i), (v))
+#define atomic_fetch_andnot_release(i, v)       atomic_fetch_and_release(~(int)(i), (v))
+#else /* atomic_fetch_andnot */
+#define atomic_fetch_andnot_relaxed             atomic_fetch_andnot
+#define atomic_fetch_andnot_acquire             atomic_fetch_andnot
+#define atomic_fetch_andnot_release             atomic_fetch_andnot
+#endif /* atomic_fetch_andnot */
 
 #else /* atomic_fetch_andnot_relaxed */
 
@@ -352,7 +394,6 @@
         __atomic_op_fence(atomic_fetch_andnot, __VA_ARGS__)
 #endif
 #endif /* atomic_fetch_andnot_relaxed */
-#endif /* atomic_andnot */
 
 /* atomic_fetch_xor_relaxed */
 #ifndef atomic_fetch_xor_relaxed
@@ -520,112 +561,140 @@
 #endif /* xchg_relaxed */
 
 /**
+ * atomic_fetch_add_unless - add unless the number is already a given value
+ * @v: pointer of type atomic_t
+ * @a: the amount to add to v...
+ * @u: ...unless v is equal to u.
+ *
+ * Atomically adds @a to @v, if @v was not already @u.
+ * Returns the original value of @v.
+ */
+#ifndef atomic_fetch_add_unless
+static inline int atomic_fetch_add_unless(atomic_t *v, int a, int u)
+{
+        int c = atomic_read(v);
+
+        do {
+                if (unlikely(c == u))
+                        break;
+        } while (!atomic_try_cmpxchg(v, &c, c + a));
+
+        return c;
+}
+#endif
+
+/**
  * atomic_add_unless - add unless the number is already a given value
  * @v: pointer of type atomic_t
  * @a: the amount to add to v...
  * @u: ...unless v is equal to u.
  *
- * Atomically adds @a to @v, so long as @v was not already @u.
- * Returns non-zero if @v was not @u, and zero otherwise.
+ * Atomically adds @a to @v, if @v was not already @u.
+ * Returns true if the addition was done.
  */
-static inline int atomic_add_unless(atomic_t *v, int a, int u)
+static inline bool atomic_add_unless(atomic_t *v, int a, int u)
 {
-        return __atomic_add_unless(v, a, u) != u;
+        return atomic_fetch_add_unless(v, a, u) != u;
 }
 
 /**
  * atomic_inc_not_zero - increment unless the number is zero
  * @v: pointer of type atomic_t
  *
- * Atomically increments @v by 1, so long as @v is non-zero.
- * Returns non-zero if @v was non-zero, and zero otherwise.
+ * Atomically increments @v by 1, if @v is non-zero.
+ * Returns true if the increment was done.
  */
 #ifndef atomic_inc_not_zero
 #define atomic_inc_not_zero(v)          atomic_add_unless((v), 1, 0)
 #endif
 
-#ifndef atomic_andnot
-static inline void atomic_andnot(int i, atomic_t *v)
-{
-        atomic_and(~i, v);
-}
-
-static inline int atomic_fetch_andnot(int i, atomic_t *v)
-{
-        return atomic_fetch_and(~i, v);
-}
-
-static inline int atomic_fetch_andnot_relaxed(int i, atomic_t *v)
+/**
+ * atomic_inc_and_test - increment and test
+ * @v: pointer of type atomic_t
+ *
+ * Atomically increments @v by 1
+ * and returns true if the result is zero, or false for all
+ * other cases.
+ */
+#ifndef atomic_inc_and_test
+static inline bool atomic_inc_and_test(atomic_t *v)
 {
-        return atomic_fetch_and_relaxed(~i, v);
+        return atomic_inc_return(v) == 0;
 }
+#endif
 
-static inline int atomic_fetch_andnot_acquire(int i, atomic_t *v)
+/**
+ * atomic_dec_and_test - decrement and test
+ * @v: pointer of type atomic_t
+ *
+ * Atomically decrements @v by 1 and
+ * returns true if the result is 0, or false for all other
+ * cases.
+ */
+#ifndef atomic_dec_and_test
+static inline bool atomic_dec_and_test(atomic_t *v)
 {
-        return atomic_fetch_and_acquire(~i, v);
+        return atomic_dec_return(v) == 0;
 }
+#endif
 
-static inline int atomic_fetch_andnot_release(int i, atomic_t *v)
+/**
+ * atomic_sub_and_test - subtract value from variable and test result
+ * @i: integer value to subtract
+ * @v: pointer of type atomic_t
+ *
+ * Atomically subtracts @i from @v and returns
+ * true if the result is zero, or false for all
+ * other cases.
+ */
+#ifndef atomic_sub_and_test
+static inline bool atomic_sub_and_test(int i, atomic_t *v)
 {
-        return atomic_fetch_and_release(~i, v);
+        return atomic_sub_return(i, v) == 0;
 }
 #endif
 
 /**
- * atomic_inc_not_zero_hint - increment if not null
+ * atomic_add_negative - add and test if negative
+ * @i: integer value to add
  * @v: pointer of type atomic_t
- * @hint: probable value of the atomic before the increment
- *
- * This version of atomic_inc_not_zero() gives a hint of probable
- * value of the atomic. This helps processor to not read the memory
- * before doing the atomic read/modify/write cycle, lowering
- * number of bus transactions on some arches.
  *
- * Returns: 0 if increment was not done, 1 otherwise.
+ * Atomically adds @i to @v and returns true
+ * if the result is negative, or false when
+ * result is greater than or equal to zero.
  */
-#ifndef atomic_inc_not_zero_hint
-static inline int atomic_inc_not_zero_hint(atomic_t *v, int hint)
+#ifndef atomic_add_negative
+static inline bool atomic_add_negative(int i, atomic_t *v)
 {
-        int val, c = hint;
-
-        /* sanity test, should be removed by compiler if hint is a constant */
-        if (!hint)
-                return atomic_inc_not_zero(v);
-
-        do {
-                val = atomic_cmpxchg(v, c, c + 1);
-                if (val == c)
-                        return 1;
-                c = val;
-        } while (c);
-
-        return 0;
+        return atomic_add_return(i, v) < 0;
 }
 #endif
 
 #ifndef atomic_inc_unless_negative
-static inline int atomic_inc_unless_negative(atomic_t *p)
+static inline bool atomic_inc_unless_negative(atomic_t *v)
 {
-        int v, v1;
-        for (v = 0; v >= 0; v = v1) {
-                v1 = atomic_cmpxchg(p, v, v + 1);
-                if (likely(v1 == v))
-                        return 1;
-        }
-        return 0;
+        int c = atomic_read(v);
+
+        do {
+                if (unlikely(c < 0))
+                        return false;
+        } while (!atomic_try_cmpxchg(v, &c, c + 1));
+
+        return true;
 }
 #endif
 
 #ifndef atomic_dec_unless_positive
-static inline int atomic_dec_unless_positive(atomic_t *p)
+static inline bool atomic_dec_unless_positive(atomic_t *v)
 {
-        int v, v1;
-        for (v = 0; v <= 0; v = v1) {
-                v1 = atomic_cmpxchg(p, v, v - 1);
-                if (likely(v1 == v))
-                        return 1;
-        }
-        return 0;
+        int c = atomic_read(v);
+
+        do {
+                if (unlikely(c > 0))
+                        return false;
+        } while (!atomic_try_cmpxchg(v, &c, c - 1));
+
+        return true;
 }
 #endif
 
@@ -639,17 +708,14 @@ static inline int atomic_dec_unless_positive(atomic_t *p)
 #ifndef atomic_dec_if_positive
 static inline int atomic_dec_if_positive(atomic_t *v)
 {
-        int c, old, dec;
-        c = atomic_read(v);
-        for (;;) {
+        int dec, c = atomic_read(v);
+
+        do {
                 dec = c - 1;
                 if (unlikely(dec < 0))
                         break;
-                old = atomic_cmpxchg((v), c, dec);
-                if (likely(old == c))
-                        break;
-                c = old;
-        }
+        } while (!atomic_try_cmpxchg(v, &c, dec));
+
         return dec;
 }
 #endif
@@ -693,11 +759,23 @@ static inline int atomic_dec_if_positive(atomic_t *v)
 #endif
 #endif /* atomic64_add_return_relaxed */
 
+#ifndef atomic64_inc
+#define atomic64_inc(v)                 atomic64_add(1, (v))
+#endif
+
 /* atomic64_inc_return_relaxed */
 #ifndef atomic64_inc_return_relaxed
+
+#ifndef atomic64_inc_return
+#define atomic64_inc_return(v)          atomic64_add_return(1, (v))
+#define atomic64_inc_return_relaxed(v)  atomic64_add_return_relaxed(1, (v))
+#define atomic64_inc_return_acquire(v)  atomic64_add_return_acquire(1, (v))
+#define atomic64_inc_return_release(v)  atomic64_add_return_release(1, (v))
+#else /* atomic64_inc_return */
 #define  atomic64_inc_return_relaxed    atomic64_inc_return
 #define  atomic64_inc_return_acquire    atomic64_inc_return
 #define  atomic64_inc_return_release    atomic64_inc_return
+#endif /* atomic64_inc_return */
 
 #else /* atomic64_inc_return_relaxed */
 
@@ -742,11 +820,23 @@ static inline int atomic_dec_if_positive(atomic_t *v)
 #endif
 #endif /* atomic64_sub_return_relaxed */
 
+#ifndef atomic64_dec
+#define atomic64_dec(v)                 atomic64_sub(1, (v))
+#endif
+
 /* atomic64_dec_return_relaxed */
 #ifndef atomic64_dec_return_relaxed
+
+#ifndef atomic64_dec_return
+#define atomic64_dec_return(v)          atomic64_sub_return(1, (v))
+#define atomic64_dec_return_relaxed(v)  atomic64_sub_return_relaxed(1, (v))
+#define atomic64_dec_return_acquire(v)  atomic64_sub_return_acquire(1, (v))
+#define atomic64_dec_return_release(v)  atomic64_sub_return_release(1, (v))
+#else /* atomic64_dec_return */
 #define  atomic64_dec_return_relaxed    atomic64_dec_return
 #define  atomic64_dec_return_acquire    atomic64_dec_return
 #define  atomic64_dec_return_release    atomic64_dec_return
+#endif /* atomic64_dec_return */
 
 #else /* atomic64_dec_return_relaxed */
 
@@ -927,12 +1017,22 @@ static inline int atomic_dec_if_positive(atomic_t *v)
 #endif
 #endif /* atomic64_fetch_and_relaxed */
 
-#ifdef atomic64_andnot
-/* atomic64_fetch_andnot_relaxed */
+#ifndef atomic64_andnot
+#define atomic64_andnot(i, v)           atomic64_and(~(long long)(i), (v))
+#endif
+
 #ifndef atomic64_fetch_andnot_relaxed
-#define atomic64_fetch_andnot_relaxed   atomic64_fetch_andnot
-#define atomic64_fetch_andnot_acquire   atomic64_fetch_andnot
-#define atomic64_fetch_andnot_release   atomic64_fetch_andnot
+
+#ifndef atomic64_fetch_andnot
+#define atomic64_fetch_andnot(i, v)             atomic64_fetch_and(~(long long)(i), (v))
+#define atomic64_fetch_andnot_relaxed(i, v)     atomic64_fetch_and_relaxed(~(long long)(i), (v))
+#define atomic64_fetch_andnot_acquire(i, v)     atomic64_fetch_and_acquire(~(long long)(i), (v))
+#define atomic64_fetch_andnot_release(i, v)     atomic64_fetch_and_release(~(long long)(i), (v))
+#else /* atomic64_fetch_andnot */
+#define atomic64_fetch_andnot_relaxed           atomic64_fetch_andnot
+#define atomic64_fetch_andnot_acquire           atomic64_fetch_andnot
+#define atomic64_fetch_andnot_release           atomic64_fetch_andnot
+#endif /* atomic64_fetch_andnot */
 
 #else /* atomic64_fetch_andnot_relaxed */
 
@@ -951,7 +1051,6 @@ static inline int atomic_dec_if_positive(atomic_t *v)
         __atomic_op_fence(atomic64_fetch_andnot, __VA_ARGS__)
 #endif
 #endif /* atomic64_fetch_andnot_relaxed */
-#endif /* atomic64_andnot */
 
 /* atomic64_fetch_xor_relaxed */
 #ifndef atomic64_fetch_xor_relaxed
@@ -1049,30 +1148,164 @@ static inline int atomic_dec_if_positive(atomic_t *v)
 #define atomic64_try_cmpxchg_release    atomic64_try_cmpxchg
 #endif /* atomic64_try_cmpxchg */
 
-#ifndef atomic64_andnot
-static inline void atomic64_andnot(long long i, atomic64_t *v)
+/**
+ * atomic64_fetch_add_unless - add unless the number is already a given value
+ * @v: pointer of type atomic64_t
+ * @a: the amount to add to v...
+ * @u: ...unless v is equal to u.
+ *
+ * Atomically adds @a to @v, if @v was not already @u.
+ * Returns the original value of @v.
+ */
+#ifndef atomic64_fetch_add_unless
+static inline long long atomic64_fetch_add_unless(atomic64_t *v, long long a,
+                                                  long long u)
 {
-        atomic64_and(~i, v);
+        long long c = atomic64_read(v);
+
+        do {
+                if (unlikely(c == u))
+                        break;
+        } while (!atomic64_try_cmpxchg(v, &c, c + a));
+
+        return c;
 }
+#endif
 
-static inline long long atomic64_fetch_andnot(long long i, atomic64_t *v)
+/**
+ * atomic64_add_unless - add unless the number is already a given value
+ * @v: pointer of type atomic_t
+ * @a: the amount to add to v...
+ * @u: ...unless v is equal to u.
+ *
+ * Atomically adds @a to @v, if @v was not already @u.
+ * Returns true if the addition was done.
+ */
+static inline bool atomic64_add_unless(atomic64_t *v, long long a, long long u)
 {
-        return atomic64_fetch_and(~i, v);
+        return atomic64_fetch_add_unless(v, a, u) != u;
 }
 
-static inline long long atomic64_fetch_andnot_relaxed(long long i, atomic64_t *v)
+/**
+ * atomic64_inc_not_zero - increment unless the number is zero
+ * @v: pointer of type atomic64_t
+ *
+ * Atomically increments @v by 1, if @v is non-zero.
+ * Returns true if the increment was done.
+ */
+#ifndef atomic64_inc_not_zero
+#define atomic64_inc_not_zero(v)        atomic64_add_unless((v), 1, 0)
+#endif
+
+/**
+ * atomic64_inc_and_test - increment and test
+ * @v: pointer of type atomic64_t
+ *
+ * Atomically increments @v by 1
+ * and returns true if the result is zero, or false for all
+ * other cases.
+ */
+#ifndef atomic64_inc_and_test
+static inline bool atomic64_inc_and_test(atomic64_t *v)
 {
-        return atomic64_fetch_and_relaxed(~i, v);
+        return atomic64_inc_return(v) == 0;
 }
+#endif
 
-static inline long long atomic64_fetch_andnot_acquire(long long i, atomic64_t *v)
+/**
+ * atomic64_dec_and_test - decrement and test
+ * @v: pointer of type atomic64_t
+ *
+ * Atomically decrements @v by 1 and
+ * returns true if the result is 0, or false for all other
+ * cases.
+ */
+#ifndef atomic64_dec_and_test
+static inline bool atomic64_dec_and_test(atomic64_t *v)
 {
-        return atomic64_fetch_and_acquire(~i, v);
+        return atomic64_dec_return(v) == 0;
 }
+#endif
 
-static inline long long atomic64_fetch_andnot_release(long long i, atomic64_t *v)
+/**
+ * atomic64_sub_and_test - subtract value from variable and test result
+ * @i: integer value to subtract
+ * @v: pointer of type atomic64_t
+ *
+ * Atomically subtracts @i from @v and returns
+ * true if the result is zero, or false for all
+ * other cases.
+ */
+#ifndef atomic64_sub_and_test
+static inline bool atomic64_sub_and_test(long long i, atomic64_t *v)
+{
+        return atomic64_sub_return(i, v) == 0;
+}
+#endif
+
+/**
+ * atomic64_add_negative - add and test if negative
+ * @i: integer value to add
+ * @v: pointer of type atomic64_t
+ *
+ * Atomically adds @i to @v and returns true
+ * if the result is negative, or false when
+ * result is greater than or equal to zero.
+ */
+#ifndef atomic64_add_negative
+static inline bool atomic64_add_negative(long long i, atomic64_t *v)
 {
-        return atomic64_fetch_and_release(~i, v);
+        return atomic64_add_return(i, v) < 0;
+}
+#endif
+
+#ifndef atomic64_inc_unless_negative
+static inline bool atomic64_inc_unless_negative(atomic64_t *v)
+{
+        long long c = atomic64_read(v);
+
+        do {
+                if (unlikely(c < 0))
+                        return false;
+        } while (!atomic64_try_cmpxchg(v, &c, c + 1));
+
+        return true;
+}
+#endif
+
+#ifndef atomic64_dec_unless_positive
+static inline bool atomic64_dec_unless_positive(atomic64_t *v)
+{
+        long long c = atomic64_read(v);
+
+        do {
+                if (unlikely(c > 0))
+                        return false;
+        } while (!atomic64_try_cmpxchg(v, &c, c - 1));
+
+        return true;
+}
+#endif
+
+/*
+ * atomic64_dec_if_positive - decrement by 1 if old value positive
+ * @v: pointer of type atomic64_t
+ *
+ * The function returns the old value of *v minus 1, even if
+ * the atomic64 variable, v, was not decremented.
+ */
+#ifndef atomic64_dec_if_positive
+static inline long long atomic64_dec_if_positive(atomic64_t *v)
+{
+        long long dec, c = atomic64_read(v);
+
+        do {
+                dec = c - 1;
+                if (unlikely(dec < 0))
+                        break;
+        } while (!atomic64_try_cmpxchg(v, &c, dec));
+
+        return dec;
 }
 #endif
 
diff --git a/include/linux/bitops.h b/include/linux/bitops.h
index 4cac4e1a72ff..af419012d77d 100644
--- a/include/linux/bitops.h
+++ b/include/linux/bitops.h
@@ -2,29 +2,9 @@
 #ifndef _LINUX_BITOPS_H
 #define _LINUX_BITOPS_H
 #include <asm/types.h>
+#include <linux/bits.h>
 
-#ifdef  __KERNEL__
-#define BIT(nr)                 (1UL << (nr))
-#define BIT_ULL(nr)             (1ULL << (nr))
-#define BIT_MASK(nr)            (1UL << ((nr) % BITS_PER_LONG))
-#define BIT_WORD(nr)            ((nr) / BITS_PER_LONG)
-#define BIT_ULL_MASK(nr)        (1ULL << ((nr) % BITS_PER_LONG_LONG))
-#define BIT_ULL_WORD(nr)        ((nr) / BITS_PER_LONG_LONG)
-#define BITS_PER_BYTE           8
 #define BITS_TO_LONGS(nr)       DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(long))
-#endif
-
-/*
- * Create a contiguous bitmask starting at bit position @l and ending at
- * position @h. For example
- * GENMASK_ULL(39, 21) gives us the 64bit vector 0x000000ffffe00000.
- */
-#define GENMASK(h, l) \
-        (((~0UL) - (1UL << (l)) + 1) & (~0UL >> (BITS_PER_LONG - 1 - (h))))
-
-#define GENMASK_ULL(h, l) \
-        (((~0ULL) - (1ULL << (l)) + 1) & \
-         (~0ULL >> (BITS_PER_LONG_LONG - 1 - (h))))
 
 extern unsigned int __sw_hweight8(unsigned int w);
 extern unsigned int __sw_hweight16(unsigned int w);
diff --git a/include/linux/bits.h b/include/linux/bits.h
new file mode 100644
index 000000000000..2b7b532c1d51
--- /dev/null
+++ b/include/linux/bits.h
@@ -0,0 +1,26 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef __LINUX_BITS_H
+#define __LINUX_BITS_H
+#include <asm/bitsperlong.h>
+
+#define BIT(nr)                 (1UL << (nr))
+#define BIT_ULL(nr)             (1ULL << (nr))
+#define BIT_MASK(nr)            (1UL << ((nr) % BITS_PER_LONG))
+#define BIT_WORD(nr)            ((nr) / BITS_PER_LONG)
+#define BIT_ULL_MASK(nr)        (1ULL << ((nr) % BITS_PER_LONG_LONG))
+#define BIT_ULL_WORD(nr)        ((nr) / BITS_PER_LONG_LONG)
+#define BITS_PER_BYTE           8
+
+/*
+ * Create a contiguous bitmask starting at bit position @l and ending at
+ * position @h. For example
+ * GENMASK_ULL(39, 21) gives us the 64bit vector 0x000000ffffe00000.
+ */
+#define GENMASK(h, l) \
+        (((~0UL) - (1UL << (l)) + 1) & (~0UL >> (BITS_PER_LONG - 1 - (h))))
+
+#define GENMASK_ULL(h, l) \
+        (((~0ULL) - (1ULL << (l)) + 1) & \
+         (~0ULL >> (BITS_PER_LONG_LONG - 1 - (h))))
+
+#endif  /* __LINUX_BITS_H */
diff --git a/include/linux/clocksource.h b/include/linux/clocksource.h
index 7dff1963c185..308918928767 100644
--- a/include/linux/clocksource.h
+++ b/include/linux/clocksource.h
@@ -194,6 +194,9 @@ extern void clocksource_suspend(void);
 extern void clocksource_resume(void);
 extern struct clocksource * __init clocksource_default_clock(void);
 extern void clocksource_mark_unstable(struct clocksource *cs);
+extern void
+clocksource_start_suspend_timing(struct clocksource *cs, u64 start_cycles);
+extern u64 clocksource_stop_suspend_timing(struct clocksource *cs, u64 now);
 
 extern u64
 clocks_calc_max_nsecs(u32 mult, u32 shift, u32 maxadj, u64 mask, u64 *max_cycles);
diff --git a/include/linux/compat.h b/include/linux/compat.h
index c68acc47da57..df45ee8413d6 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -115,11 +115,6 @@ typedef	compat_ulong_t		compat_aio_context_t;
 struct compat_sel_arg_struct;
 struct rusage;
 
-struct compat_itimerspec {
-        struct compat_timespec it_interval;
-        struct compat_timespec it_value;
-};
-
 struct compat_utimbuf {
         compat_time_t           actime;
         compat_time_t           modtime;
@@ -300,10 +295,6 @@ extern int compat_get_timespec(struct timespec *, const void __user *);
 extern int compat_put_timespec(const struct timespec *, void __user *);
 extern int compat_get_timeval(struct timeval *, const void __user *);
 extern int compat_put_timeval(const struct timeval *, void __user *);
-extern int get_compat_itimerspec64(struct itimerspec64 *its,
-                        const struct compat_itimerspec __user *uits);
-extern int put_compat_itimerspec64(const struct itimerspec64 *its,
-                        struct compat_itimerspec __user *uits);
 
 struct compat_iovec {
         compat_uptr_t   iov_base;
diff --git a/include/linux/compat_time.h b/include/linux/compat_time.h
index 31f2774f1994..e70bfd1d2c3f 100644
--- a/include/linux/compat_time.h
+++ b/include/linux/compat_time.h
@@ -17,7 +17,16 @@ struct compat_timeval {
         s32             tv_usec;
 };
 
+struct compat_itimerspec {
+        struct compat_timespec it_interval;
+        struct compat_timespec it_value;
+};
+
 extern int compat_get_timespec64(struct timespec64 *, const void __user *);
 extern int compat_put_timespec64(const struct timespec64 *, void __user *);
+extern int get_compat_itimerspec64(struct itimerspec64 *its,
+                        const struct compat_itimerspec __user *uits);
+extern int put_compat_itimerspec64(const struct itimerspec64 *its,
+                        struct compat_itimerspec __user *uits);
 
 #endif /* _LINUX_COMPAT_TIME_H */
diff --git a/include/linux/cpu.h b/include/linux/cpu.h
index a97a63eef59f..3233fbe23594 100644
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -30,7 +30,7 @@ struct cpu {
 };
 
 extern void boot_cpu_init(void);
-extern void boot_cpu_state_init(void);
+extern void boot_cpu_hotplug_init(void);
 extern void cpu_init(void);
 extern void trap_init(void);
 
diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
index 8796ba387152..4cf06a64bc02 100644
--- a/include/linux/cpuhotplug.h
+++ b/include/linux/cpuhotplug.h
@@ -164,6 +164,7 @@ enum cpuhp_state {
         CPUHP_AP_PERF_POWERPC_NEST_IMC_ONLINE,
         CPUHP_AP_PERF_POWERPC_CORE_IMC_ONLINE,
         CPUHP_AP_PERF_POWERPC_THREAD_IMC_ONLINE,
+        CPUHP_AP_WATCHDOG_ONLINE,
         CPUHP_AP_WORKQUEUE_ONLINE,
         CPUHP_AP_RCUTREE_ONLINE,
         CPUHP_AP_ONLINE_DYN,
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 56add823f190..401e4b254e30 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -894,6 +894,16 @@ typedef struct _efi_file_handle {
         void *flush;
 } efi_file_handle_t;
 
+typedef struct {
+        u64 revision;
+        u32 open_volume;
+} efi_file_io_interface_32_t;
+
+typedef struct {
+        u64 revision;
+        u64 open_volume;
+} efi_file_io_interface_64_t;
+
 typedef struct _efi_file_io_interface {
         u64 revision;
         int (*open_volume)(struct _efi_file_io_interface *,
@@ -988,14 +998,12 @@ extern void efi_memmap_walk (efi_freemem_callback_t callback, void *arg);
 extern void efi_gettimeofday (struct timespec64 *ts);
 extern void efi_enter_virtual_mode (void);      /* switch EFI to virtual mode, if possible */
 #ifdef CONFIG_X86
-extern void efi_late_init(void);
 extern void efi_free_boot_services(void);
 extern efi_status_t efi_query_variable_store(u32 attributes,
                                              unsigned long size,
                                              bool nonblocking);
 extern void efi_find_mirror(void);
 #else
-static inline void efi_late_init(void) {}
 static inline void efi_free_boot_services(void) {}
 
 static inline efi_status_t efi_query_variable_store(u32 attributes,
@@ -1651,4 +1659,7 @@ struct linux_efi_tpm_eventlog {
 
 extern int efi_tpm_eventlog_init(void);
 
+/* Workqueue to queue EFI Runtime Services */
+extern struct workqueue_struct *efi_rts_wq;
+
 #endif /* _LINUX_EFI_H */
diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
index cbb872c1b607..9d2ea3e907d0 100644
--- a/include/linux/irqchip/arm-gic-v3.h
+++ b/include/linux/irqchip/arm-gic-v3.h
@@ -73,6 +73,7 @@
 #define GICD_TYPER_MBIS                 (1U << 16)
 
 #define GICD_TYPER_ID_BITS(typer)       ((((typer) >> 19) & 0x1f) + 1)
+#define GICD_TYPER_NUM_LPIS(typer)      ((((typer) >> 11) & 0x1f) + 1)
 #define GICD_TYPER_IRQS(typer)          ((((typer) & 0x1f) + 1) * 32)
 
 #define GICD_IROUTER_SPI_MODE_ONE       (0U << 31)
@@ -576,8 +577,8 @@ struct rdists {
                 phys_addr_t     phys_base;
         } __percpu              *rdist;
         struct page             *prop_page;
-        int                     id_bits;
         u64                     flags;
+        u32                     gicd_typer;
         bool                    has_vlpis;
         bool                    has_direct_lpi;
 };
diff --git a/include/linux/ktime.h b/include/linux/ktime.h
index 5b9fddbaac41..b2bb44f87f5a 100644
--- a/include/linux/ktime.h
+++ b/include/linux/ktime.h
@@ -93,8 +93,11 @@ static inline ktime_t timeval_to_ktime(struct timeval tv)
 /* Map the ktime_t to timeval conversion to ns_to_timeval function */
 #define ktime_to_timeval(kt)            ns_to_timeval((kt))
 
-/* Convert ktime_t to nanoseconds - NOP in the scalar storage format: */
-#define ktime_to_ns(kt)                 (kt)
+/* Convert ktime_t to nanoseconds */
+static inline s64 ktime_to_ns(const ktime_t kt)
+{
+        return kt;
+}
 
 /**
  * ktime_compare - Compares two ktime_t variables for less, greater or equal
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 7ba6d356d18f..68a5121694ef 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -466,6 +466,9 @@ static inline void vma_set_anonymous(struct vm_area_struct *vma)
         vma->vm_ops = NULL;
 }
 
+/* flush_tlb_range() takes a vma, not a mm, and can care about flags */
+#define TLB_FLUSH_VMA(mm,flags) { .vm_mm = (mm), .vm_flags = (flags) }
+
 struct mmu_gather;
 struct inode;
 
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 99ce070e7dcb..efdc24dd9e97 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -335,176 +335,183 @@ struct core_state {
 
 struct kioctx_table;
 struct mm_struct {
-        struct vm_area_struct *mmap;            /* list of VMAs */
-        struct rb_root mm_rb;
-        u32 vmacache_seqnum;                   /* per-thread vmacache */
+        struct {
+                struct vm_area_struct *mmap;            /* list of VMAs */
+                struct rb_root mm_rb;
+                u32 vmacache_seqnum;                   /* per-thread vmacache */
 #ifdef CONFIG_MMU
-        unsigned long (*get_unmapped_area) (struct file *filp,
+                unsigned long (*get_unmapped_area) (struct file *filp,
                                 unsigned long addr, unsigned long len,
                                 unsigned long pgoff, unsigned long flags);
 #endif
-        unsigned long mmap_base;                /* base of mmap area */
-        unsigned long mmap_legacy_base;         /* base of mmap area in bottom-up allocations */
+                unsigned long mmap_base;        /* base of mmap area */
+                unsigned long mmap_legacy_base; /* base of mmap area in bottom-up allocations */
 #ifdef CONFIG_HAVE_ARCH_COMPAT_MMAP_BASES
-        /* Base adresses for compatible mmap() */
-        unsigned long mmap_compat_base;
-        unsigned long mmap_compat_legacy_base;
+                /* Base adresses for compatible mmap() */
+                unsigned long mmap_compat_base;
+                unsigned long mmap_compat_legacy_base;
 #endif
-        unsigned long task_size;                /* size of task vm space */
-        unsigned long highest_vm_end;           /* highest vma end address */
-        pgd_t * pgd;
-
-        /**
-         * @mm_users: The number of users including userspace.
-         *
-         * Use mmget()/mmget_not_zero()/mmput() to modify. When this drops
-         * to 0 (i.e. when the task exits and there are no other temporary
-         * reference holders), we also release a reference on @mm_count
-         * (which may then free the &struct mm_struct if @mm_count also
-         * drops to 0).
-         */
-        atomic_t mm_users;
-
-        /**
-         * @mm_count: The number of references to &struct mm_struct
-         * (@mm_users count as 1).
-         *
-         * Use mmgrab()/mmdrop() to modify. When this drops to 0, the
-         * &struct mm_struct is freed.
-         */
-        atomic_t mm_count;
+                unsigned long task_size;        /* size of task vm space */
+                unsigned long highest_vm_end;   /* highest vma end address */
+                pgd_t * pgd;
+
+                /**
+                 * @mm_users: The number of users including userspace.
+                 *
+                 * Use mmget()/mmget_not_zero()/mmput() to modify. When this
+                 * drops to 0 (i.e. when the task exits and there are no other
+                 * temporary reference holders), we also release a reference on
+                 * @mm_count (which may then free the &struct mm_struct if
+                 * @mm_count also drops to 0).
+                 */
+                atomic_t mm_users;
+
+                /**
+                 * @mm_count: The number of references to &struct mm_struct
+                 * (@mm_users count as 1).
+                 *
+                 * Use mmgrab()/mmdrop() to modify. When this drops to 0, the
+                 * &struct mm_struct is freed.
+                 */
+                atomic_t mm_count;
 
 #ifdef CONFIG_MMU
-        atomic_long_t pgtables_bytes;           /* PTE page table pages */
+                atomic_long_t pgtables_bytes;   /* PTE page table pages */
 #endif
-        int map_count;                          /* number of VMAs */
+                int map_count;                  /* number of VMAs */
 
-        spinlock_t page_table_lock;             /* Protects page tables and some counters */
-        struct rw_semaphore mmap_sem;
+                spinlock_t page_table_lock; /* Protects page tables and some
+                                             * counters
+                                             */
+                struct rw_semaphore mmap_sem;
 
-        struct list_head mmlist;                /* List of maybe swapped mm's.  These are globally strung
-                                                 * together off init_mm.mmlist, and are protected
-                                                 * by mmlist_lock
-                                                 */
+                struct list_head mmlist; /* List of maybe swapped mm's. These
+                                          * are globally strung together off
+                                          * init_mm.mmlist, and are protected
+                                          * by mmlist_lock
+                                          */
 
 
-        unsigned long hiwater_rss;      /* High-watermark of RSS usage */
-        unsigned long hiwater_vm;       /* High-water virtual memory usage */
+                unsigned long hiwater_rss; /* High-watermark of RSS usage */
+                unsigned long hiwater_vm;  /* High-water virtual memory usage */
 
-        unsigned long total_vm;         /* Total pages mapped */
-        unsigned long locked_vm;        /* Pages that have PG_mlocked set */
-        unsigned long pinned_vm;        /* Refcount permanently increased */
-        unsigned long data_vm;          /* VM_WRITE & ~VM_SHARED & ~VM_STACK */
-        unsigned long exec_vm;          /* VM_EXEC & ~VM_WRITE & ~VM_STACK */
-        unsigned long stack_vm;         /* VM_STACK */
-        unsigned long def_flags;
+                unsigned long total_vm;    /* Total pages mapped */
+                unsigned long locked_vm;   /* Pages that have PG_mlocked set */
+                unsigned long pinned_vm;   /* Refcount permanently increased */
+                unsigned long data_vm;     /* VM_WRITE & ~VM_SHARED & ~VM_STACK */
+                unsigned long exec_vm;     /* VM_EXEC & ~VM_WRITE & ~VM_STACK */
+                unsigned long stack_vm;    /* VM_STACK */
+                unsigned long def_flags;
 
-        spinlock_t arg_lock; /* protect the below fields */
-        unsigned long start_code, end_code, start_data, end_data;
-        unsigned long start_brk, brk, start_stack;
-        unsigned long arg_start, arg_end, env_start, env_end;
+                spinlock_t arg_lock; /* protect the below fields */
+                unsigned long start_code, end_code, start_data, end_data;
+                unsigned long start_brk, brk, start_stack;
+                unsigned long arg_start, arg_end, env_start, env_end;
 
-        unsigned long saved_auxv[AT_VECTOR_SIZE]; /* for /proc/PID/auxv */
+                unsigned long saved_auxv[AT_VECTOR_SIZE]; /* for /proc/PID/auxv */
 
-        /*
-         * Special counters, in some configurations protected by the
-         * page_table_lock, in other configurations by being atomic.
-         */
-        struct mm_rss_stat rss_stat;
-
-        struct linux_binfmt *binfmt;
+                /*
+                 * Special counters, in some configurations protected by the
+                 * page_table_lock, in other configurations by being atomic.
+                 */
+                struct mm_rss_stat rss_stat;
 
-        cpumask_var_t cpu_vm_mask_var;
+                struct linux_binfmt *binfmt;
 
-        /* Architecture-specific MM context */
-        mm_context_t context;
+                /* Architecture-specific MM context */
+                mm_context_t context;
 
-        unsigned long flags; /* Must use atomic bitops to access the bits */
+                unsigned long flags; /* Must use atomic bitops to access */
 
-        struct core_state *core_state; /* coredumping support */
+                struct core_state *core_state; /* coredumping support */
 #ifdef CONFIG_MEMBARRIER
-        atomic_t membarrier_state;
+                atomic_t membarrier_state;
 #endif
 #ifdef CONFIG_AIO
-        spinlock_t                      ioctx_lock;
-        struct kioctx_table __rcu       *ioctx_table;
+                spinlock_t                      ioctx_lock;
+                struct kioctx_table __rcu       *ioctx_table;
 #endif
 #ifdef CONFIG_MEMCG
-        /*
-         * "owner" points to a task that is regarded as the canonical
-         * user/owner of this mm. All of the following must be true in
-         * order for it to be changed:
-         *
-         * current == mm->owner
-         * current->mm != mm
-         * new_owner->mm == mm
-         * new_owner->alloc_lock is held
-         */
-        struct task_struct __rcu *owner;
+                /*
+                 * "owner" points to a task that is regarded as the canonical
+                 * user/owner of this mm. All of the following must be true in
+                 * order for it to be changed:
+                 *
+                 * current == mm->owner
+                 * current->mm != mm
+                 * new_owner->mm == mm
+                 * new_owner->alloc_lock is held
+                 */
+                struct task_struct __rcu *owner;
 #endif
-        struct user_namespace *user_ns;
+                struct user_namespace *user_ns;
 
-        /* store ref to file /proc/<pid>/exe symlink points to */
-        struct file __rcu *exe_file;
+                /* store ref to file /proc/<pid>/exe symlink points to */
+                struct file __rcu *exe_file;
 #ifdef CONFIG_MMU_NOTIFIER
-        struct mmu_notifier_mm *mmu_notifier_mm;
+                struct mmu_notifier_mm *mmu_notifier_mm;
 #endif
 #if defined(CONFIG_TRANSPARENT_HUGEPAGE) && !USE_SPLIT_PMD_PTLOCKS
-        pgtable_t pmd_huge_pte; /* protected by page_table_lock */
-#endif
-#ifdef CONFIG_CPUMASK_OFFSTACK
-        struct cpumask cpumask_allocation;
+                pgtable_t pmd_huge_pte; /* protected by page_table_lock */
 #endif
 #ifdef CONFIG_NUMA_BALANCING
-        /*
-         * numa_next_scan is the next time that the PTEs will be marked
-         * pte_numa. NUMA hinting faults will gather statistics and migrate
-         * pages to new nodes if necessary.
-         */
-        unsigned long numa_next_scan;
+                /*
+                 * numa_next_scan is the next time that the PTEs will be marked
+                 * pte_numa. NUMA hinting faults will gather statistics and
+                 * migrate pages to new nodes if necessary.
+                 */
+                unsigned long numa_next_scan;
 
-        /* Restart point for scanning and setting pte_numa */
-        unsigned long numa_scan_offset;
+                /* Restart point for scanning and setting pte_numa */
+                unsigned long numa_scan_offset;
 
-        /* numa_scan_seq prevents two threads setting pte_numa */
-        int numa_scan_seq;
+                /* numa_scan_seq prevents two threads setting pte_numa */
+                int numa_scan_seq;
 #endif
-        /*
-         * An operation with batched TLB flushing is going on. Anything that
-         * can move process memory needs to flush the TLB when moving a
-         * PROT_NONE or PROT_NUMA mapped page.
-         */
-        atomic_t tlb_flush_pending;
+                /*
+                 * An operation with batched TLB flushing is going on. Anything
+                 * that can move process memory needs to flush the TLB when
+                 * moving a PROT_NONE or PROT_NUMA mapped page.
+                 */
+                atomic_t tlb_flush_pending;
 #ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH
-        /* See flush_tlb_batched_pending() */
-        bool tlb_flush_batched;
+                /* See flush_tlb_batched_pending() */
+                bool tlb_flush_batched;
 #endif
-        struct uprobes_state uprobes_state;
+                struct uprobes_state uprobes_state;
 #ifdef CONFIG_HUGETLB_PAGE
-        atomic_long_t hugetlb_usage;
+                atomic_long_t hugetlb_usage;
 #endif
-        struct work_struct async_put_work;
+                struct work_struct async_put_work;
 
 #if IS_ENABLED(CONFIG_HMM)
-        /* HMM needs to track a few things per mm */
-        struct hmm *hmm;
+                /* HMM needs to track a few things per mm */
+                struct hmm *hmm;
 #endif
-} __randomize_layout;
+        } __randomize_layout;
+
+        /*
+         * The mm_cpumask needs to be at the end of mm_struct, because it
+         * is dynamically sized based on nr_cpu_ids.
+         */
+        unsigned long cpu_bitmap[];
+};
 
 extern struct mm_struct init_mm;
 
+/* Pointer magic because the dynamic array size confuses some compilers. */
 static inline void mm_init_cpumask(struct mm_struct *mm)
 {
-#ifdef CONFIG_CPUMASK_OFFSTACK
-        mm->cpu_vm_mask_var = &mm->cpumask_allocation;
-#endif
-        cpumask_clear(mm->cpu_vm_mask_var);
+        unsigned long cpu_bitmap = (unsigned long)mm;
+
+        cpu_bitmap += offsetof(struct mm_struct, cpu_bitmap);
+        cpumask_clear((struct cpumask *)cpu_bitmap);
 }
 
 /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
 static inline cpumask_t *mm_cpumask(struct mm_struct *mm)
 {
-        return mm->cpu_vm_mask_var;
+        return (struct cpumask *)&mm->cpu_bitmap;
 }
 
 struct mmu_gather;
diff --git a/include/linux/nmi.h b/include/linux/nmi.h
index b8d868d23e79..08f9247e9827 100644
--- a/include/linux/nmi.h
+++ b/include/linux/nmi.h
@@ -45,12 +45,18 @@ extern void touch_softlockup_watchdog(void);
 extern void touch_softlockup_watchdog_sync(void);
 extern void touch_all_softlockup_watchdogs(void);
 extern unsigned int  softlockup_panic;
-#else
+
+extern int lockup_detector_online_cpu(unsigned int cpu);
+extern int lockup_detector_offline_cpu(unsigned int cpu);
+#else /* CONFIG_SOFTLOCKUP_DETECTOR */
 static inline void touch_softlockup_watchdog_sched(void) { }
 static inline void touch_softlockup_watchdog(void) { }
 static inline void touch_softlockup_watchdog_sync(void) { }
 static inline void touch_all_softlockup_watchdogs(void) { }
-#endif
+
+#define lockup_detector_online_cpu      NULL
+#define lockup_detector_offline_cpu     NULL
+#endif /* CONFIG_SOFTLOCKUP_DETECTOR */
 
 #ifdef CONFIG_DETECT_HUNG_TASK
 void reset_hung_task_detector(void);
diff --git a/include/linux/pci.h b/include/linux/pci.h
index abd5d5e17aee..c133ccfa002e 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -368,7 +368,6 @@ struct pci_dev {
         unsigned int    transparent:1;          /* Subtractive decode bridge */
         unsigned int    multifunction:1;        /* Multi-function device */
 
-        unsigned int    is_added:1;
         unsigned int    is_busmaster:1;         /* Is busmaster */
         unsigned int    no_msi:1;               /* May not use MSI */
         unsigned int    no_64bit_msi:1;         /* May only use 32-bit MSIs */
diff --git a/include/linux/posix-timers.h b/include/linux/posix-timers.h
index c85704fcdbd2..ee7e987ea1b4 100644
--- a/include/linux/posix-timers.h
+++ b/include/linux/posix-timers.h
@@ -95,8 +95,8 @@ struct k_itimer {
         clockid_t               it_clock;
         timer_t                 it_id;
         int                     it_active;
-        int                     it_overrun;
-        int                     it_overrun_last;
+        s64                     it_overrun;
+        s64                     it_overrun_last;
         int                     it_requeue_pending;
         int                     it_sigev_notify;
         ktime_t                 it_interval;
diff --git a/include/linux/pti.h b/include/linux/pti.h
index 0174883a935a..1a941efcaa62 100644
--- a/include/linux/pti.h
+++ b/include/linux/pti.h
@@ -6,6 +6,7 @@
 #include <asm/pti.h>
 #else
 static inline void pti_init(void) { }
+static inline void pti_finalize(void) { }
 #endif
 
 #endif
diff --git a/include/linux/rculist.h b/include/linux/rculist.h
index 36df6ccbc874..4786c2235b98 100644
--- a/include/linux/rculist.h
+++ b/include/linux/rculist.h
@@ -396,7 +396,16 @@ static inline void list_splice_tail_init_rcu(struct list_head *list,
  * @member:     the name of the list_head within the struct.
  *
  * Continue to iterate over list of given type, continuing after
- * the current position.
+ * the current position which must have been in the list when the RCU read
+ * lock was taken.
+ * This would typically require either that you obtained the node from a
+ * previous walk of the list in the same RCU read-side critical section, or
+ * that you held some sort of non-RCU reference (such as a reference count)
+ * to keep the node alive *and* in the list.
+ *
+ * This iterator is similar to list_for_each_entry_from_rcu() except
+ * this starts after the given position and that one starts at the given
+ * position.
  */
 #define list_for_each_entry_continue_rcu(pos, head, member)             \
         for (pos = list_entry_rcu(pos->member.next, typeof(*pos), member); \
@@ -411,6 +420,14 @@ static inline void list_splice_tail_init_rcu(struct list_head *list,
  *
  * Iterate over the tail of a list starting from a given position,
  * which must have been in the list when the RCU read lock was taken.
+ * This would typically require either that you obtained the node from a
+ * previous walk of the list in the same RCU read-side critical section, or
+ * that you held some sort of non-RCU reference (such as a reference count)
+ * to keep the node alive *and* in the list.
+ *
+ * This iterator is similar to list_for_each_entry_continue_rcu() except
+ * this starts from the given position and that one starts from the position
+ * after the given position.
  */
 #define list_for_each_entry_from_rcu(pos, head, member)                 \
         for (; &(pos)->member != (head);                                        \
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index 65163aa0bb04..75e5b393cf44 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -64,7 +64,6 @@ void rcu_barrier_tasks(void);
 
 void __rcu_read_lock(void);
 void __rcu_read_unlock(void);
-void rcu_read_unlock_special(struct task_struct *t);
 void synchronize_rcu(void);
 
 /*
@@ -159,11 +158,11 @@ static inline void rcu_init_nohz(void) { }
         } while (0)
 
 /*
- * Note a voluntary context switch for RCU-tasks benefit.  This is a
- * macro rather than an inline function to avoid #include hell.
+ * Note a quasi-voluntary context switch for RCU-tasks's benefit.
+ * This is a macro rather than an inline function to avoid #include hell.
  */
 #ifdef CONFIG_TASKS_RCU
-#define rcu_note_voluntary_context_switch_lite(t) \
+#define rcu_tasks_qs(t) \
         do { \
                 if (READ_ONCE((t)->rcu_tasks_holdout)) \
                         WRITE_ONCE((t)->rcu_tasks_holdout, false); \
@@ -171,14 +170,14 @@ static inline void rcu_init_nohz(void) { }
 #define rcu_note_voluntary_context_switch(t) \
         do { \
                 rcu_all_qs(); \
-                rcu_note_voluntary_context_switch_lite(t); \
+                rcu_tasks_qs(t); \
         } while (0)
 void call_rcu_tasks(struct rcu_head *head, rcu_callback_t func);
 void synchronize_rcu_tasks(void);
 void exit_tasks_rcu_start(void);
 void exit_tasks_rcu_finish(void);
 #else /* #ifdef CONFIG_TASKS_RCU */
-#define rcu_note_voluntary_context_switch_lite(t)       do { } while (0)
+#define rcu_tasks_qs(t) do { } while (0)
 #define rcu_note_voluntary_context_switch(t)            rcu_all_qs()
 #define call_rcu_tasks call_rcu_sched
 #define synchronize_rcu_tasks synchronize_sched
@@ -195,8 +194,8 @@ static inline void exit_tasks_rcu_finish(void) { }
  */
 #define cond_resched_tasks_rcu_qs() \
 do { \
-        if (!cond_resched()) \
-                rcu_note_voluntary_context_switch_lite(current); \
+        rcu_tasks_qs(current); \
+        cond_resched(); \
 } while (0)
 
 /*
@@ -567,8 +566,8 @@ static inline void rcu_preempt_sleep_check(void) { }
  * This is simply an identity function, but it documents where a pointer
  * is handed off from RCU to some other synchronization mechanism, for
  * example, reference counting or locking.  In C11, it would map to
- * kill_dependency().  It could be used as follows:
- * ``
+ * kill_dependency().  It could be used as follows::
+ *
  *      rcu_read_lock();
  *      p = rcu_dereference(gp);
  *      long_lived = is_long_lived(p);
@@ -579,7 +578,6 @@ static inline void rcu_preempt_sleep_check(void) { }
  *                      p = rcu_pointer_handoff(p);
  *      }
  *      rcu_read_unlock();
- *``
  */
 #define rcu_pointer_handoff(p) (p)
 
diff --git a/include/linux/rcutiny.h b/include/linux/rcutiny.h
index 7b3c82e8a625..8d9a0ea8f0b5 100644
--- a/include/linux/rcutiny.h
+++ b/include/linux/rcutiny.h
@@ -93,7 +93,7 @@ static inline void kfree_call_rcu(struct rcu_head *head,
 #define rcu_note_context_switch(preempt) \
         do { \
                 rcu_sched_qs(); \
-                rcu_note_voluntary_context_switch_lite(current); \
+                rcu_tasks_qs(current); \
         } while (0)
 
 static inline int rcu_needs_cpu(u64 basemono, u64 *nextevt)
diff --git a/include/linux/refcount.h b/include/linux/refcount.h
index a685da2c4522..e28cce21bad6 100644
--- a/include/linux/refcount.h
+++ b/include/linux/refcount.h
@@ -3,9 +3,10 @@
 #define _LINUX_REFCOUNT_H
 
 #include <linux/atomic.h>
-#include <linux/mutex.h>
-#include <linux/spinlock.h>
-#include <linux/kernel.h>
+#include <linux/compiler.h>
+#include <linux/spinlock_types.h>
+
+struct mutex;
 
 /**
  * struct refcount_t - variant of atomic_t specialized for reference counts
@@ -42,17 +43,30 @@ static inline unsigned int refcount_read(const refcount_t *r)
         return atomic_read(&r->refs);
 }
 
+extern __must_check bool refcount_add_not_zero_checked(unsigned int i, refcount_t *r);
+extern void refcount_add_checked(unsigned int i, refcount_t *r);
+
+extern __must_check bool refcount_inc_not_zero_checked(refcount_t *r);
+extern void refcount_inc_checked(refcount_t *r);
+
+extern __must_check bool refcount_sub_and_test_checked(unsigned int i, refcount_t *r);
+
+extern __must_check bool refcount_dec_and_test_checked(refcount_t *r);
+extern void refcount_dec_checked(refcount_t *r);
+
 #ifdef CONFIG_REFCOUNT_FULL
-extern __must_check bool refcount_add_not_zero(unsigned int i, refcount_t *r);
-extern void refcount_add(unsigned int i, refcount_t *r);
 
-extern __must_check bool refcount_inc_not_zero(refcount_t *r);
-extern void refcount_inc(refcount_t *r);
+#define refcount_add_not_zero   refcount_add_not_zero_checked
+#define refcount_add            refcount_add_checked
+
+#define refcount_inc_not_zero   refcount_inc_not_zero_checked
+#define refcount_inc            refcount_inc_checked
+
+#define refcount_sub_and_test   refcount_sub_and_test_checked
 
-extern __must_check bool refcount_sub_and_test(unsigned int i, refcount_t *r);
+#define refcount_dec_and_test   refcount_dec_and_test_checked
+#define refcount_dec            refcount_dec_checked
 
-extern __must_check bool refcount_dec_and_test(refcount_t *r);
-extern void refcount_dec(refcount_t *r);
 #else
 # ifdef CONFIG_ARCH_HAS_REFCOUNT
 #  include <asm/refcount.h>
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 43731fe51c97..dac5086e3815 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -167,8 +167,8 @@ struct task_group;
  *   need_sleep = false;
  *   wake_up_state(p, TASK_UNINTERRUPTIBLE);
  *
- * Where wake_up_state() (and all other wakeup primitives) imply enough
- * barriers to order the store of the variable against wakeup.
+ * where wake_up_state() executes a full memory barrier before accessing the
+ * task state.
  *
  * Wakeup will do: if (@state & p->state) p->state = TASK_RUNNING, that is,
  * once it observes the TASK_UNINTERRUPTIBLE store the waking CPU can issue a
@@ -1017,7 +1017,6 @@ struct task_struct {
         u64                             last_sum_exec_runtime;
         struct callback_head            numa_work;
 
-        struct list_head                numa_entry;
         struct numa_group               *numa_group;
 
         /*
diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h
index 1c1a1512ec55..913488d828cb 100644
--- a/include/linux/sched/sysctl.h
+++ b/include/linux/sched/sysctl.h
@@ -40,7 +40,6 @@ extern unsigned int sysctl_numa_balancing_scan_size;
 #ifdef CONFIG_SCHED_DEBUG
 extern __read_mostly unsigned int sysctl_sched_migration_cost;
 extern __read_mostly unsigned int sysctl_sched_nr_migrate;
-extern __read_mostly unsigned int sysctl_sched_time_avg;
 
 int sched_proc_update_handler(struct ctl_table *table, int write,
                 void __user *buffer, size_t *length,
diff --git a/include/linux/sched_clock.h b/include/linux/sched_clock.h
index 411b52e424e1..abe28d5cb3f4 100644
--- a/include/linux/sched_clock.h
+++ b/include/linux/sched_clock.h
@@ -9,17 +9,16 @@
 #define LINUX_SCHED_CLOCK
 
 #ifdef CONFIG_GENERIC_SCHED_CLOCK
-extern void sched_clock_postinit(void);
+extern void generic_sched_clock_init(void);
 
 extern void sched_clock_register(u64 (*read)(void), int bits,
                                  unsigned long rate);
 #else
-static inline void sched_clock_postinit(void) { }
+static inline void generic_sched_clock_init(void) { }
 
 static inline void sched_clock_register(u64 (*read)(void), int bits,
                                         unsigned long rate)
 {
-        ;
 }
 #endif
 
diff --git a/include/linux/smpboot.h b/include/linux/smpboot.h
index c174844cf663..d0884b525001 100644
--- a/include/linux/smpboot.h
+++ b/include/linux/smpboot.h
@@ -25,8 +25,6 @@ struct smpboot_thread_data;
  *                      parked (cpu offline)
  * @unpark:             Optional unpark function, called when the thread is
  *                      unparked (cpu online)
- * @cpumask:            Internal state.  To update which threads are unparked,
- *                      call smpboot_update_cpumask_percpu_thread().
  * @selfparking:        Thread is not parked by the park function.
  * @thread_comm:        The base name of the thread
  */
@@ -40,23 +38,12 @@ struct smp_hotplug_thread {
         void                            (*cleanup)(unsigned int cpu, bool online);
         void                            (*park)(unsigned int cpu);
         void                            (*unpark)(unsigned int cpu);
-        cpumask_var_t                   cpumask;
         bool                            selfparking;
         const char                      *thread_comm;
 };
 
-int smpboot_register_percpu_thread_cpumask(struct smp_hotplug_thread *plug_thread,
-                                           const struct cpumask *cpumask);
-
-static inline int
-smpboot_register_percpu_thread(struct smp_hotplug_thread *plug_thread)
-{
-        return smpboot_register_percpu_thread_cpumask(plug_thread,
-                                                      cpu_possible_mask);
-}
+int smpboot_register_percpu_thread(struct smp_hotplug_thread *plug_thread);
 
 void smpboot_unregister_percpu_thread(struct smp_hotplug_thread *plug_thread);
-void smpboot_update_cpumask_percpu_thread(struct smp_hotplug_thread *plug_thread,
-                                          const struct cpumask *);
 
 #endif
diff --git a/include/linux/spinlock.h b/include/linux/spinlock.h
index fd57888d4942..3190997df9ca 100644
--- a/include/linux/spinlock.h
+++ b/include/linux/spinlock.h
@@ -114,29 +114,48 @@ do {								\
 #endif /*arch_spin_is_contended*/
 
 /*
- * This barrier must provide two things:
+ * smp_mb__after_spinlock() provides the equivalent of a full memory barrier
+ * between program-order earlier lock acquisitions and program-order later
+ * memory accesses.
  *
- *   - it must guarantee a STORE before the spin_lock() is ordered against a
- *     LOAD after it, see the comments at its two usage sites.
+ * This guarantees that the following two properties hold:
  *
- *   - it must ensure the critical section is RCsc.
+ *   1) Given the snippet:
  *
- * The latter is important for cases where we observe values written by other
- * CPUs in spin-loops, without barriers, while being subject to scheduling.
+ *        { X = 0;  Y = 0; }
  *
- * CPU0                 CPU1                    CPU2
+ *        CPU0                          CPU1
  *
- *                      for (;;) {
- *                        if (READ_ONCE(X))
- *                          break;
- *                      }
- * X=1
- *                      <sched-out>
- *                                              <sched-in>
- *                                              r = X;
+ *        WRITE_ONCE(X, 1);             WRITE_ONCE(Y, 1);
+ *        spin_lock(S);                 smp_mb();
+ *        smp_mb__after_spinlock();     r1 = READ_ONCE(X);
+ *        r0 = READ_ONCE(Y);
+ *        spin_unlock(S);
  *
- * without transitivity it could be that CPU1 observes X!=0 breaks the loop,
- * we get migrated and CPU2 sees X==0.
+ *      it is forbidden that CPU0 does not observe CPU1's store to Y (r0 = 0)
+ *      and CPU1 does not observe CPU0's store to X (r1 = 0); see the comments
+ *      preceding the call to smp_mb__after_spinlock() in __schedule() and in
+ *      try_to_wake_up().
+ *
+ *   2) Given the snippet:
+ *
+ *  { X = 0;  Y = 0; }
+ *
+ *  CPU0                CPU1                            CPU2
+ *
+ *  spin_lock(S);       spin_lock(S);                   r1 = READ_ONCE(Y);
+ *  WRITE_ONCE(X, 1);   smp_mb__after_spinlock();       smp_rmb();
+ *  spin_unlock(S);     r0 = READ_ONCE(X);              r2 = READ_ONCE(X);
+ *                      WRITE_ONCE(Y, 1);
+ *                      spin_unlock(S);
+ *
+ *      it is forbidden that CPU0's critical section executes before CPU1's
+ *      critical section (r0 = 1), CPU2 observes CPU1's store to Y (r1 = 1)
+ *      and CPU2 does not observe CPU0's store to X (r2 = 0); see the comments
+ *      preceding the calls to smp_rmb() in try_to_wake_up() for similar
+ *      snippets but "projected" onto two CPUs.
+ *
+ * Property (2) upgrades the lock to an RCsc lock.
  *
  * Since most load-store architectures implement ACQUIRE with an smp_mb() after
  * the LL/SC loop, they need no further barriers. Similarly all our TSO
diff --git a/include/linux/srcu.h b/include/linux/srcu.h
index 91494d7e8e41..3e72a291c401 100644
--- a/include/linux/srcu.h
+++ b/include/linux/srcu.h
@@ -195,6 +195,16 @@ static inline int srcu_read_lock(struct srcu_struct *sp) __acquires(sp)
         return retval;
 }
 
+/* Used by tracing, cannot be traced and cannot invoke lockdep. */
+static inline notrace int
+srcu_read_lock_notrace(struct srcu_struct *sp) __acquires(sp)
+{
+        int retval;
+
+        retval = __srcu_read_lock(sp);
+        return retval;
+}
+
 /**
  * srcu_read_unlock - unregister a old reader from an SRCU-protected structure.
  * @sp: srcu_struct in which to unregister the old reader.
@@ -209,6 +219,13 @@ static inline void srcu_read_unlock(struct srcu_struct *sp, int idx)
         __srcu_read_unlock(sp, idx);
 }
 
+/* Used by tracing, cannot be traced and cannot call lockdep. */
+static inline notrace void
+srcu_read_unlock_notrace(struct srcu_struct *sp, int idx) __releases(sp)
+{
+        __srcu_read_unlock(sp, idx);
+}
+
 /**
  * smp_mb__after_srcu_read_unlock - ensure full ordering after srcu_read_unlock
  *
diff --git a/include/linux/swait.h b/include/linux/swait.h
index bf8cb0dee23c..73e06e9986d4 100644
--- a/include/linux/swait.h
+++ b/include/linux/swait.h
@@ -16,7 +16,7 @@
  * wait-queues, but the semantics are actually completely different, and
  * every single user we have ever had has been buggy (or pointless).
  *
- * A "swake_up()" only wakes up _one_ waiter, which is not at all what
+ * A "swake_up_one()" only wakes up _one_ waiter, which is not at all what
  * "wake_up()" does, and has led to problems. In other cases, it has
  * been fine, because there's only ever one waiter (kvm), but in that
  * case gthe whole "simple" wait-queue is just pointless to begin with,
@@ -38,8 +38,8 @@
  *    all wakeups are TASK_NORMAL in order to avoid O(n) lookups for the right
  *    sleeper state.
  *
- *  - the exclusive mode; because this requires preserving the list order
- *    and this is hard.
+ *  - the !exclusive mode; because that leads to O(n) wakeups, everything is
+ *    exclusive.
  *
  *  - custom wake callback functions; because you cannot give any guarantees
  *    about random code. This also allows swait to be used in RT, such that
@@ -115,7 +115,7 @@ extern void __init_swait_queue_head(struct swait_queue_head *q, const char *name
  *      CPU0 - waker                    CPU1 - waiter
  *
  *                                      for (;;) {
- *      @cond = true;                     prepare_to_swait(&wq_head, &wait, state);
+ *      @cond = true;                     prepare_to_swait_exclusive(&wq_head, &wait, state);
  *      smp_mb();                         // smp_mb() from set_current_state()
  *      if (swait_active(wq_head))        if (@cond)
  *        wake_up(wq_head);                      break;
@@ -157,20 +157,20 @@ static inline bool swq_has_sleeper(struct swait_queue_head *wq)
         return swait_active(wq);
 }
 
-extern void swake_up(struct swait_queue_head *q);
+extern void swake_up_one(struct swait_queue_head *q);
 extern void swake_up_all(struct swait_queue_head *q);
 extern void swake_up_locked(struct swait_queue_head *q);
 
-extern void __prepare_to_swait(struct swait_queue_head *q, struct swait_queue *wait);
-extern void prepare_to_swait(struct swait_queue_head *q, struct swait_queue *wait, int state);
+extern void prepare_to_swait_exclusive(struct swait_queue_head *q, struct swait_queue *wait, int state);
 extern long prepare_to_swait_event(struct swait_queue_head *q, struct swait_queue *wait, int state);
 
 extern void __finish_swait(struct swait_queue_head *q, struct swait_queue *wait);
 extern void finish_swait(struct swait_queue_head *q, struct swait_queue *wait);
 
-/* as per ___wait_event() but for swait, therefore "exclusive == 0" */
+/* as per ___wait_event() but for swait, therefore "exclusive == 1" */
 #define ___swait_event(wq, condition, state, ret, cmd)                  \
 ({                                                                      \
+        __label__ __out;                                                \
         struct swait_queue __wait;                                      \
         long __ret = ret;                                               \
                                                                         \
@@ -183,20 +183,20 @@ extern void finish_swait(struct swait_queue_head *q, struct swait_queue *wait);
                                                                         \
                 if (___wait_is_interruptible(state) && __int) {         \
                         __ret = __int;                                  \
-                        break;                                          \
+                        goto __out;                                     \
                 }                                                       \
                                                                         \
                 cmd;                                                    \
         }                                                               \
         finish_swait(&wq, &__wait);                                     \
-        __ret;                                                          \
+__out:  __ret;                                                          \
 })
 
 #define __swait_event(wq, condition)                                    \
         (void)___swait_event(wq, condition, TASK_UNINTERRUPTIBLE, 0,    \
                             schedule())
 
-#define swait_event(wq, condition)                                      \
+#define swait_event_exclusive(wq, condition)                            \
 do {                                                                    \
         if (condition)                                                  \
                 break;                                                  \
@@ -208,7 +208,7 @@ do {									\
                       TASK_UNINTERRUPTIBLE, timeout,                    \
                       __ret = schedule_timeout(__ret))
 
-#define swait_event_timeout(wq, condition, timeout)                     \
+#define swait_event_timeout_exclusive(wq, condition, timeout)           \
 ({                                                                      \
         long __ret = timeout;                                           \
         if (!___wait_cond_timeout(condition))                           \
@@ -220,7 +220,7 @@ do {									\
         ___swait_event(wq, condition, TASK_INTERRUPTIBLE, 0,            \
                       schedule())
 
-#define swait_event_interruptible(wq, condition)                        \
+#define swait_event_interruptible_exclusive(wq, condition)              \
 ({                                                                      \
         int __ret = 0;                                                  \
         if (!(condition))                                               \
@@ -233,7 +233,7 @@ do {									\
                       TASK_INTERRUPTIBLE, timeout,                      \
                       __ret = schedule_timeout(__ret))
 
-#define swait_event_interruptible_timeout(wq, condition, timeout)       \
+#define swait_event_interruptible_timeout_exclusive(wq, condition, timeout)\
 ({                                                                      \
         long __ret = timeout;                                           \
         if (!___wait_cond_timeout(condition))                           \
@@ -246,7 +246,7 @@ do {									\
         (void)___swait_event(wq, condition, TASK_IDLE, 0, schedule())
 
 /**
- * swait_event_idle - wait without system load contribution
+ * swait_event_idle_exclusive - wait without system load contribution
  * @wq: the waitqueue to wait on
  * @condition: a C expression for the event to wait for
  *
@@ -257,7 +257,7 @@ do {									\
  * condition and doesn't want to contribute to system load. Signals are
  * ignored.
  */
-#define swait_event_idle(wq, condition)                                 \
+#define swait_event_idle_exclusive(wq, condition)                       \
 do {                                                                    \
         if (condition)                                                  \
                 break;                                                  \
@@ -270,7 +270,7 @@ do {									\
                        __ret = schedule_timeout(__ret))
 
 /**
- * swait_event_idle_timeout - wait up to timeout without load contribution
+ * swait_event_idle_timeout_exclusive - wait up to timeout without load contribution
  * @wq: the waitqueue to wait on
  * @condition: a C expression for the event to wait for
  * @timeout: timeout at which we'll give up in jiffies
@@ -288,7 +288,7 @@ do {									\
  * or the remaining jiffies (at least 1) if the @condition evaluated
  * to %true before the @timeout elapsed.
  */
-#define swait_event_idle_timeout(wq, condition, timeout)                \
+#define swait_event_idle_timeout_exclusive(wq, condition, timeout)      \
 ({                                                                      \
         long __ret = timeout;                                           \
         if (!___wait_cond_timeout(condition))                           \
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 5c1a0933768e..ebb2f24027e8 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -506,9 +506,9 @@ asmlinkage long sys_sync_file_range(int fd, loff_t offset, loff_t nbytes,
 /* fs/timerfd.c */
 asmlinkage long sys_timerfd_create(int clockid, int flags);
 asmlinkage long sys_timerfd_settime(int ufd, int flags,
-                                    const struct itimerspec __user *utmr,
-                                    struct itimerspec __user *otmr);
-asmlinkage long sys_timerfd_gettime(int ufd, struct itimerspec __user *otmr);
+                                    const struct __kernel_itimerspec __user *utmr,
+                                    struct __kernel_itimerspec __user *otmr);
+asmlinkage long sys_timerfd_gettime(int ufd, struct __kernel_itimerspec __user *otmr);
 
 /* fs/utimes.c */
 asmlinkage long sys_utimensat(int dfd, const char __user *filename,
@@ -573,10 +573,10 @@ asmlinkage long sys_timer_create(clockid_t which_clock,
                                  struct sigevent __user *timer_event_spec,
                                  timer_t __user * created_timer_id);
 asmlinkage long sys_timer_gettime(timer_t timer_id,
-                                struct itimerspec __user *setting);
+                                struct __kernel_itimerspec __user *setting);
 asmlinkage long sys_timer_getoverrun(timer_t timer_id);
 asmlinkage long sys_timer_settime(timer_t timer_id, int flags,
-                                const struct itimerspec __user *new_setting,
+                                const struct __kernel_itimerspec __user *new_setting,
                                 struct itimerspec __user *old_setting);
 asmlinkage long sys_timer_delete(timer_t timer_id);
 asmlinkage long sys_clock_settime(clockid_t which_clock,
diff --git a/include/linux/time.h b/include/linux/time.h
index aed74463592d..27d83fd2ae61 100644
--- a/include/linux/time.h
+++ b/include/linux/time.h
@@ -14,9 +14,9 @@ int get_timespec64(struct timespec64 *ts,
 int put_timespec64(const struct timespec64 *ts,
                 struct __kernel_timespec __user *uts);
 int get_itimerspec64(struct itimerspec64 *it,
-                        const struct itimerspec __user *uit);
+                        const struct __kernel_itimerspec __user *uit);
 int put_itimerspec64(const struct itimerspec64 *it,
-                        struct itimerspec __user *uit);
+                        struct __kernel_itimerspec __user *uit);
 
 extern time64_t mktime64(const unsigned int year, const unsigned int mon,
                         const unsigned int day, const unsigned int hour,
diff --git a/include/linux/time64.h b/include/linux/time64.h
index 0a7b2f79cec7..05634afba0db 100644
--- a/include/linux/time64.h
+++ b/include/linux/time64.h
@@ -12,6 +12,7 @@ typedef __u64 timeu64_t;
  */
 #ifndef CONFIG_64BIT_TIME
 #define __kernel_timespec timespec
+#define __kernel_itimerspec itimerspec
 #endif
 
 #include <uapi/linux/time.h>
diff --git a/include/linux/timekeeping.h b/include/linux/timekeeping.h
index 86bc2026efce..e79861418fd7 100644
--- a/include/linux/timekeeping.h
+++ b/include/linux/timekeeping.h
@@ -177,7 +177,7 @@ static inline time64_t ktime_get_clocktai_seconds(void)
 extern bool timekeeping_rtc_skipsuspend(void);
 extern bool timekeeping_rtc_skipresume(void);
 
-extern void timekeeping_inject_sleeptime64(struct timespec64 *delta);
+extern void timekeeping_inject_sleeptime64(const struct timespec64 *delta);
 
 /*
  * struct system_time_snapshot - simultaneous raw/real time capture with
@@ -243,7 +243,8 @@ extern void ktime_get_snapshot(struct system_time_snapshot *systime_snapshot);
 extern int persistent_clock_is_local;
 
 extern void read_persistent_clock64(struct timespec64 *ts);
-extern void read_boot_clock64(struct timespec64 *ts);
+void read_persistent_clock_and_boot_offset(struct timespec64 *wall_clock,
+                                           struct timespec64 *boot_offset);
 extern int update_persistent_clock64(struct timespec64 now);
 
 /*
diff --git a/include/linux/torture.h b/include/linux/torture.h
index 66272862070b..61dfd93b6ee4 100644
--- a/include/linux/torture.h
+++ b/include/linux/torture.h
@@ -64,6 +64,8 @@ struct torture_random_state {
         long trs_count;
 };
 #define DEFINE_TORTURE_RANDOM(name) struct torture_random_state name = { 0, 0 }
+#define DEFINE_TORTURE_RANDOM_PERCPU(name) \
+        DEFINE_PER_CPU(struct torture_random_state, name)
 unsigned long torture_random(struct torture_random_state *trsp);
 
 /* Task shuffler, which causes CPUs to occasionally go idle. */
@@ -79,7 +81,7 @@ void stutter_wait(const char *title);
 int torture_stutter_init(int s);
 
 /* Initialization and cleanup. */
-bool torture_init_begin(char *ttype, bool v);
+bool torture_init_begin(char *ttype, int v);
 void torture_init_end(void);
 bool torture_cleanup_begin(void);
 void torture_cleanup_end(void);
diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h
index 9324ac2d9ff2..43913ae79f64 100644
--- a/include/net/af_vsock.h
+++ b/include/net/af_vsock.h
@@ -64,7 +64,8 @@ struct vsock_sock {
         struct list_head pending_links;
         struct list_head accept_queue;
         bool rejected;
-        struct delayed_work dwork;
+        struct delayed_work connect_work;
+        struct delayed_work pending_work;
         struct delayed_work close_work;
         bool close_work_scheduled;
         u32 peer_shutdown;
@@ -77,7 +78,6 @@ struct vsock_sock {
 
 s64 vsock_stream_has_data(struct vsock_sock *vsk);
 s64 vsock_stream_has_space(struct vsock_sock *vsk);
-void vsock_pending_work(struct work_struct *work);
 struct sock *__vsock_create(struct net *net,
                             struct socket *sock,
                             struct sock *parent,
diff --git a/include/net/llc.h b/include/net/llc.h
index dc35f25eb679..890a87318014 100644
--- a/include/net/llc.h
+++ b/include/net/llc.h
@@ -116,6 +116,11 @@ static inline void llc_sap_hold(struct llc_sap *sap)
         refcount_inc(&sap->refcnt);
 }
 
+static inline bool llc_sap_hold_safe(struct llc_sap *sap)
+{
+        return refcount_inc_not_zero(&sap->refcnt);
+}
+
 void llc_sap_close(struct llc_sap *sap);
 
 static inline void llc_sap_put(struct llc_sap *sap)
diff --git a/include/trace/events/rcu.h b/include/trace/events/rcu.h
index 5936aac357ab..a8d07feff6a0 100644
--- a/include/trace/events/rcu.h
+++ b/include/trace/events/rcu.h
@@ -52,6 +52,7 @@ TRACE_EVENT(rcu_utilization,
  *      "cpuqs": CPU passes through a quiescent state.
  *      "cpuonl": CPU comes online.
  *      "cpuofl": CPU goes offline.
+ *      "cpuofl-bgp": CPU goes offline while blocking a grace period.
  *      "reqwait": GP kthread sleeps waiting for grace-period request.
  *      "reqwaitsig": GP kthread awakened by signal from reqwait state.
  *      "fqswait": GP kthread waiting until time to force quiescent states.
@@ -63,24 +64,24 @@ TRACE_EVENT(rcu_utilization,
  */
 TRACE_EVENT(rcu_grace_period,
 
-        TP_PROTO(const char *rcuname, unsigned long gpnum, const char *gpevent),
+        TP_PROTO(const char *rcuname, unsigned long gp_seq, const char *gpevent),
 
-        TP_ARGS(rcuname, gpnum, gpevent),
+        TP_ARGS(rcuname, gp_seq, gpevent),
 
         TP_STRUCT__entry(
                 __field(const char *, rcuname)
-                __field(unsigned long, gpnum)
+                __field(unsigned long, gp_seq)
                 __field(const char *, gpevent)
         ),
 
         TP_fast_assign(
                 __entry->rcuname = rcuname;
-                __entry->gpnum = gpnum;
+                __entry->gp_seq = gp_seq;
                 __entry->gpevent = gpevent;
         ),
 
         TP_printk("%s %lu %s",
-                  __entry->rcuname, __entry->gpnum, __entry->gpevent)
+                  __entry->rcuname, __entry->gp_seq, __entry->gpevent)
 );
 
 /*
@@ -90,8 +91,8 @@ TRACE_EVENT(rcu_grace_period,
  *
  * "Startleaf": Request a grace period based on leaf-node data.
  * "Prestarted": Someone beat us to the request
- * "Startedleaf": Leaf-node start proved sufficient.
- * "Startedleafroot": Leaf-node start proved sufficient after checking root.
+ * "Startedleaf": Leaf node marked for future GP.
+ * "Startedleafroot": All nodes from leaf to root marked for future GP.
  * "Startedroot": Requested a nocb grace period based on root-node data.
  * "NoGPkthread": The RCU grace-period kthread has not yet started.
  * "StartWait": Start waiting for the requested grace period.
@@ -102,17 +103,16 @@ TRACE_EVENT(rcu_grace_period,
  */
 TRACE_EVENT(rcu_future_grace_period,
 
-        TP_PROTO(const char *rcuname, unsigned long gpnum, unsigned long completed,
-                 unsigned long c, u8 level, int grplo, int grphi,
+        TP_PROTO(const char *rcuname, unsigned long gp_seq,
+                 unsigned long gp_seq_req, u8 level, int grplo, int grphi,
                  const char *gpevent),
 
-        TP_ARGS(rcuname, gpnum, completed, c, level, grplo, grphi, gpevent),
+        TP_ARGS(rcuname, gp_seq, gp_seq_req, level, grplo, grphi, gpevent),
 
         TP_STRUCT__entry(
                 __field(const char *, rcuname)
-                __field(unsigned long, gpnum)
-                __field(unsigned long, completed)
-                __field(unsigned long, c)
+                __field(unsigned long, gp_seq)
+                __field(unsigned long, gp_seq_req)
                 __field(u8, level)
                 __field(int, grplo)
                 __field(int, grphi)
@@ -121,19 +121,17 @@ TRACE_EVENT(rcu_future_grace_period,
 
         TP_fast_assign(
                 __entry->rcuname = rcuname;
-                __entry->gpnum = gpnum;
-                __entry->completed = completed;
-                __entry->c = c;
+                __entry->gp_seq = gp_seq;
+                __entry->gp_seq_req = gp_seq_req;
                 __entry->level = level;
                 __entry->grplo = grplo;
                 __entry->grphi = grphi;
                 __entry->gpevent = gpevent;
         ),
 
-        TP_printk("%s %lu %lu %lu %u %d %d %s",
-                  __entry->rcuname, __entry->gpnum, __entry->completed,
-                  __entry->c, __entry->level, __entry->grplo, __entry->grphi,
-                  __entry->gpevent)
+        TP_printk("%s %lu %lu %u %d %d %s",
+                  __entry->rcuname, __entry->gp_seq, __entry->gp_seq_req, __entry->level,
+                  __entry->grplo, __entry->grphi, __entry->gpevent)
 );
 
 /*
@@ -145,14 +143,14 @@ TRACE_EVENT(rcu_future_grace_period,
  */
 TRACE_EVENT(rcu_grace_period_init,
 
-        TP_PROTO(const char *rcuname, unsigned long gpnum, u8 level,
+        TP_PROTO(const char *rcuname, unsigned long gp_seq, u8 level,
                  int grplo, int grphi, unsigned long qsmask),
 
-        TP_ARGS(rcuname, gpnum, level, grplo, grphi, qsmask),
+        TP_ARGS(rcuname, gp_seq, level, grplo, grphi, qsmask),
 
         TP_STRUCT__entry(
                 __field(const char *, rcuname)
-                __field(unsigned long, gpnum)
+                __field(unsigned long, gp_seq)
                 __field(u8, level)
                 __field(int, grplo)
                 __field(int, grphi)
@@ -161,7 +159,7 @@ TRACE_EVENT(rcu_grace_period_init,
 
         TP_fast_assign(
                 __entry->rcuname = rcuname;
-                __entry->gpnum = gpnum;
+                __entry->gp_seq = gp_seq;
                 __entry->level = level;
                 __entry->grplo = grplo;
                 __entry->grphi = grphi;
@@ -169,7 +167,7 @@ TRACE_EVENT(rcu_grace_period_init,
         ),
 
         TP_printk("%s %lu %u %d %d %lx",
-                  __entry->rcuname, __entry->gpnum, __entry->level,
+                  __entry->rcuname, __entry->gp_seq, __entry->level,
                   __entry->grplo, __entry->grphi, __entry->qsmask)
 );
 
@@ -301,24 +299,24 @@ TRACE_EVENT(rcu_nocb_wake,
  */
 TRACE_EVENT(rcu_preempt_task,
 
-        TP_PROTO(const char *rcuname, int pid, unsigned long gpnum),
+        TP_PROTO(const char *rcuname, int pid, unsigned long gp_seq),
 
-        TP_ARGS(rcuname, pid, gpnum),
+        TP_ARGS(rcuname, pid, gp_seq),
 
         TP_STRUCT__entry(
                 __field(const char *, rcuname)
-                __field(unsigned long, gpnum)
+                __field(unsigned long, gp_seq)
                 __field(int, pid)
         ),
 
         TP_fast_assign(
                 __entry->rcuname = rcuname;
-                __entry->gpnum = gpnum;
+                __entry->gp_seq = gp_seq;
                 __entry->pid = pid;
         ),
 
         TP_printk("%s %lu %d",
-                  __entry->rcuname, __entry->gpnum, __entry->pid)
+                  __entry->rcuname, __entry->gp_seq, __entry->pid)
 );
 
 /*
@@ -328,23 +326,23 @@ TRACE_EVENT(rcu_preempt_task,
  */
 TRACE_EVENT(rcu_unlock_preempted_task,
 
-        TP_PROTO(const char *rcuname, unsigned long gpnum, int pid),
+        TP_PROTO(const char *rcuname, unsigned long gp_seq, int pid),
 
-        TP_ARGS(rcuname, gpnum, pid),
+        TP_ARGS(rcuname, gp_seq, pid),
 
         TP_STRUCT__entry(
                 __field(const char *, rcuname)
-                __field(unsigned long, gpnum)
+                __field(unsigned long, gp_seq)
                 __field(int, pid)
         ),
 
         TP_fast_assign(
                 __entry->rcuname = rcuname;
-                __entry->gpnum = gpnum;
+                __entry->gp_seq = gp_seq;
                 __entry->pid = pid;
         ),
 
-        TP_printk("%s %lu %d", __entry->rcuname, __entry->gpnum, __entry->pid)
+        TP_printk("%s %lu %d", __entry->rcuname, __entry->gp_seq, __entry->pid)
 );
 
 /*
@@ -357,15 +355,15 @@ TRACE_EVENT(rcu_unlock_preempted_task,
  */
 TRACE_EVENT(rcu_quiescent_state_report,
 
-        TP_PROTO(const char *rcuname, unsigned long gpnum,
+        TP_PROTO(const char *rcuname, unsigned long gp_seq,
                  unsigned long mask, unsigned long qsmask,
                  u8 level, int grplo, int grphi, int gp_tasks),
 
-        TP_ARGS(rcuname, gpnum, mask, qsmask, level, grplo, grphi, gp_tasks),
+        TP_ARGS(rcuname, gp_seq, mask, qsmask, level, grplo, grphi, gp_tasks),
 
         TP_STRUCT__entry(
                 __field(const char *, rcuname)
-                __field(unsigned long, gpnum)
+                __field(unsigned long, gp_seq)
                 __field(unsigned long, mask)
                 __field(unsigned long, qsmask)
                 __field(u8, level)
@@ -376,7 +374,7 @@ TRACE_EVENT(rcu_quiescent_state_report,
 
         TP_fast_assign(
                 __entry->rcuname = rcuname;
-                __entry->gpnum = gpnum;
+                __entry->gp_seq = gp_seq;
                 __entry->mask = mask;
                 __entry->qsmask = qsmask;
                 __entry->level = level;
@@ -386,41 +384,41 @@ TRACE_EVENT(rcu_quiescent_state_report,
         ),
 
         TP_printk("%s %lu %lx>%lx %u %d %d %u",
-                  __entry->rcuname, __entry->gpnum,
+                  __entry->rcuname, __entry->gp_seq,
                   __entry->mask, __entry->qsmask, __entry->level,
                   __entry->grplo, __entry->grphi, __entry->gp_tasks)
 );
 
 /*
  * Tracepoint for quiescent states detected by force_quiescent_state().
- * These trace events include the type of RCU, the grace-period number that
- * was blocked by the CPU, the CPU itself, and the type of quiescent state,
- * which can be "dti" for dyntick-idle mode, "ofl" for CPU offline, "kick"
- * when kicking a CPU that has been in dyntick-idle mode for too long, or
- * "rqc" if the CPU got a quiescent state via its rcu_qs_ctr.
+ * These trace events include the type of RCU, the grace-period number
+ * that was blocked by the CPU, the CPU itself, and the type of quiescent
+ * state, which can be "dti" for dyntick-idle mode, "kick" when kicking
+ * a CPU that has been in dyntick-idle mode for too long, or "rqc" if the
+ * CPU got a quiescent state via its rcu_qs_ctr.
  */
 TRACE_EVENT(rcu_fqs,
 
-        TP_PROTO(const char *rcuname, unsigned long gpnum, int cpu, const char *qsevent),
+        TP_PROTO(const char *rcuname, unsigned long gp_seq, int cpu, const char *qsevent),
 
-        TP_ARGS(rcuname, gpnum, cpu, qsevent),
+        TP_ARGS(rcuname, gp_seq, cpu, qsevent),
 
         TP_STRUCT__entry(
                 __field(const char *, rcuname)
-                __field(unsigned long, gpnum)
+                __field(unsigned long, gp_seq)
                 __field(int, cpu)
                 __field(const char *, qsevent)
         ),
 
         TP_fast_assign(
                 __entry->rcuname = rcuname;
-                __entry->gpnum = gpnum;
+                __entry->gp_seq = gp_seq;
                 __entry->cpu = cpu;
                 __entry->qsevent = qsevent;
         ),
 
         TP_printk("%s %lu %d %s",
-                  __entry->rcuname, __entry->gpnum,
+                  __entry->rcuname, __entry->gp_seq,
                   __entry->cpu, __entry->qsevent)
 );
 
@@ -753,23 +751,23 @@ TRACE_EVENT(rcu_barrier,
 
 #else /* #ifdef CONFIG_RCU_TRACE */
 
-#define trace_rcu_grace_period(rcuname, gpnum, gpevent) do { } while (0)
-#define trace_rcu_future_grace_period(rcuname, gpnum, completed, c, \
+#define trace_rcu_grace_period(rcuname, gp_seq, gpevent) do { } while (0)
+#define trace_rcu_future_grace_period(rcuname, gp_seq, gp_seq_req, \
                                       level, grplo, grphi, event) \
                                       do { } while (0)
-#define trace_rcu_grace_period_init(rcuname, gpnum, level, grplo, grphi, \
+#define trace_rcu_grace_period_init(rcuname, gp_seq, level, grplo, grphi, \
                                     qsmask) do { } while (0)
 #define trace_rcu_exp_grace_period(rcuname, gqseq, gpevent) \
         do { } while (0)
 #define trace_rcu_exp_funnel_lock(rcuname, level, grplo, grphi, gpevent) \
         do { } while (0)
 #define trace_rcu_nocb_wake(rcuname, cpu, reason) do { } while (0)
-#define trace_rcu_preempt_task(rcuname, pid, gpnum) do { } while (0)
-#define trace_rcu_unlock_preempted_task(rcuname, gpnum, pid) do { } while (0)
-#define trace_rcu_quiescent_state_report(rcuname, gpnum, mask, qsmask, level, \
+#define trace_rcu_preempt_task(rcuname, pid, gp_seq) do { } while (0)
+#define trace_rcu_unlock_preempted_task(rcuname, gp_seq, pid) do { } while (0)
+#define trace_rcu_quiescent_state_report(rcuname, gp_seq, mask, qsmask, level, \
                                          grplo, grphi, gp_tasks) do { } \
         while (0)
-#define trace_rcu_fqs(rcuname, gpnum, cpu, qsevent) do { } while (0)
+#define trace_rcu_fqs(rcuname, gp_seq, cpu, qsevent) do { } while (0)
 #define trace_rcu_dyntick(polarity, oldnesting, newnesting, dyntick) do { } while (0)
 #define trace_rcu_callback(rcuname, rhp, qlen_lazy, qlen) do { } while (0)
 #define trace_rcu_kfree_callback(rcuname, rhp, offset, qlen_lazy, qlen) \
diff --git a/include/uapi/linux/time.h b/include/uapi/linux/time.h
index fcf936656493..6b56a2208be7 100644
--- a/include/uapi/linux/time.h
+++ b/include/uapi/linux/time.h
@@ -49,6 +49,13 @@ struct __kernel_timespec {
 };
 #endif
 
+#ifndef __kernel_itimerspec
+struct __kernel_itimerspec {
+        struct __kernel_timespec it_interval;    /* timer period */
+        struct __kernel_timespec it_value;       /* timer expiration */
+};
+#endif
+
 /*
  * legacy timeval structure, only embedded in structures that
  * traditionally used 'timeval' to pass time intervals (not absolute
diff --git a/init/main.c b/init/main.c
index 3b4ada11ed52..38c68b593d0d 100644
--- a/init/main.c
+++ b/init/main.c
@@ -79,7 +79,7 @@
 #include <linux/pti.h>
 #include <linux/blkdev.h>
 #include <linux/elevator.h>
-#include <linux/sched_clock.h>
+#include <linux/sched/clock.h>
 #include <linux/sched/task.h>
 #include <linux/sched/task_stack.h>
 #include <linux/context_tracking.h>
@@ -561,8 +561,8 @@ asmlinkage __visible void __init start_kernel(void)
         setup_command_line(command_line);
         setup_nr_cpu_ids();
         setup_per_cpu_areas();
-        boot_cpu_state_init();
         smp_prepare_boot_cpu(); /* arch-specific boot-cpu hooks */
+        boot_cpu_hotplug_init();
 
         build_all_zonelists(NULL);
         page_alloc_init();
@@ -642,7 +642,6 @@ asmlinkage __visible void __init start_kernel(void)
         softirq_init();
         timekeeping_init();
         time_init();
-        sched_clock_postinit();
         printk_safe_init();
         perf_event_init();
         profile_init();
@@ -697,6 +696,7 @@ asmlinkage __visible void __init start_kernel(void)
         acpi_early_init();
         if (late_time_init)
                 late_time_init();
+        sched_clock_init();
         calibrate_delay();
         pid_idr_init();
         anon_vma_init();
@@ -1065,6 +1065,13 @@ static int __ref kernel_init(void *unused)
         jump_label_invalidate_initmem();
         free_initmem();
         mark_readonly();
+
+        /*
+         * Kernel mappings are now finalized - update the userspace page-table
+         * to finalize PTI.
+         */
+        pti_finalize();
+
         system_state = SYSTEM_RUNNING;
         numa_default_policy();
 
diff --git a/ipc/shm.c b/ipc/shm.c
index 051a3e1fb8df..fefa00d310fb 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -427,6 +427,17 @@ static int shm_split(struct vm_area_struct *vma, unsigned long addr)
         return 0;
 }
 
+static unsigned long shm_pagesize(struct vm_area_struct *vma)
+{
+        struct file *file = vma->vm_file;
+        struct shm_file_data *sfd = shm_file_data(file);
+
+        if (sfd->vm_ops->pagesize)
+                return sfd->vm_ops->pagesize(vma);
+
+        return PAGE_SIZE;
+}
+
 #ifdef CONFIG_NUMA
 static int shm_set_policy(struct vm_area_struct *vma, struct mempolicy *new)
 {
@@ -554,6 +565,7 @@ static const struct vm_operations_struct shm_vm_ops = {
         .close  = shm_close,    /* callback for when the vm-area is released */
         .fault  = shm_fault,
         .split  = shm_split,
+        .pagesize = shm_pagesize,
 #if defined(CONFIG_NUMA)
         .set_policy = shm_set_policy,
         .get_policy = shm_get_policy,
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index ceb1c4596c51..80d672a11088 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1279,8 +1279,12 @@ static void show_special(struct audit_context *context, int *call_panic)
                 break;
         case AUDIT_KERN_MODULE:
                 audit_log_format(ab, "name=");
-                audit_log_untrustedstring(ab, context->module.name);
-                kfree(context->module.name);
+                if (context->module.name) {
+                        audit_log_untrustedstring(ab, context->module.name);
+                        kfree(context->module.name);
+                } else
+                        audit_log_format(ab, "(null)");
+
                 break;
         }
         audit_log_end(ab);
@@ -2411,8 +2415,9 @@ void __audit_log_kern_module(char *name)
 {
         struct audit_context *context = audit_context();
 
-        context->module.name = kmalloc(strlen(name) + 1, GFP_KERNEL);
-        strcpy(context->module.name, name);
+        context->module.name = kstrdup(name, GFP_KERNEL);
+        if (!context->module.name)
+                audit_log_lost("out of memory in __audit_log_kern_module");
         context->type = AUDIT_KERN_MODULE;
 }
 
diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index 544e58f5f642..2aa55d030c77 100644
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -378,7 +378,7 @@ static int array_map_check_btf(const struct bpf_map *map, const struct btf *btf,
                 return -EINVAL;
 
         value_type = btf_type_id_size(btf, &btf_value_id, &value_size);
-        if (!value_type || value_size > map->value_size)
+        if (!value_type || value_size != map->value_size)
                 return -EINVAL;
 
         return 0;
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 9704934252b3..2590700237c1 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -1519,9 +1519,9 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
 {
         bool is_union = BTF_INFO_KIND(t->info) == BTF_KIND_UNION;
         const struct btf_member *member;
+        u32 meta_needed, last_offset;
         struct btf *btf = env->btf;
         u32 struct_size = t->size;
-        u32 meta_needed;
         u16 i;
 
         meta_needed = btf_type_vlen(t) * sizeof(*member);
@@ -1534,6 +1534,7 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
 
         btf_verifier_log_type(env, t, NULL);
 
+        last_offset = 0;
         for_each_member(i, t, member) {
                 if (!btf_name_offset_valid(btf, member->name_off)) {
                         btf_verifier_log_member(env, t, member,
@@ -1555,6 +1556,16 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
                         return -EINVAL;
                 }
 
+                /*
+                 * ">" instead of ">=" because the last member could be
+                 * "char a[0];"
+                 */
+                if (last_offset > member->offset) {
+                        btf_verifier_log_member(env, t, member,
+                                                "Invalid member bits_offset");
+                        return -EINVAL;
+                }
+
                 if (BITS_ROUNDUP_BYTES(member->offset) > struct_size) {
                         btf_verifier_log_member(env, t, member,
                                                 "Memmber bits_offset exceeds its struct size");
@@ -1562,6 +1573,7 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
                 }
 
                 btf_verifier_log_member(env, t, member, NULL);
+                last_offset = member->offset;
         }
 
         return meta_needed;
diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c
index e0918d180f08..46f5f29605d4 100644
--- a/kernel/bpf/cpumap.c
+++ b/kernel/bpf/cpumap.c
@@ -69,7 +69,7 @@ struct bpf_cpu_map {
 };
 
 static int bq_flush_to_queue(struct bpf_cpu_map_entry *rcpu,
-                             struct xdp_bulk_queue *bq);
+                             struct xdp_bulk_queue *bq, bool in_napi_ctx);
 
 static u64 cpu_map_bitmap_size(const union bpf_attr *attr)
 {
@@ -375,7 +375,7 @@ static void __cpu_map_entry_free(struct rcu_head *rcu)
                 struct xdp_bulk_queue *bq = per_cpu_ptr(rcpu->bulkq, cpu);
 
                 /* No concurrent bq_enqueue can run at this point */
-                bq_flush_to_queue(rcpu, bq);
+                bq_flush_to_queue(rcpu, bq, false);
         }
         free_percpu(rcpu->bulkq);
         /* Cannot kthread_stop() here, last put free rcpu resources */
@@ -558,7 +558,7 @@ const struct bpf_map_ops cpu_map_ops = {
 };
 
 static int bq_flush_to_queue(struct bpf_cpu_map_entry *rcpu,
-                             struct xdp_bulk_queue *bq)
+                             struct xdp_bulk_queue *bq, bool in_napi_ctx)
 {
         unsigned int processed = 0, drops = 0;
         const int to_cpu = rcpu->cpu;
@@ -578,7 +578,10 @@ static int bq_flush_to_queue(struct bpf_cpu_map_entry *rcpu,
                 err = __ptr_ring_produce(q, xdpf);
                 if (err) {
                         drops++;
-                        xdp_return_frame_rx_napi(xdpf);
+                        if (likely(in_napi_ctx))
+                                xdp_return_frame_rx_napi(xdpf);
+                        else
+                                xdp_return_frame(xdpf);
                 }
                 processed++;
         }
@@ -598,7 +601,7 @@ static int bq_enqueue(struct bpf_cpu_map_entry *rcpu, struct xdp_frame *xdpf)
         struct xdp_bulk_queue *bq = this_cpu_ptr(rcpu->bulkq);
 
         if (unlikely(bq->count == CPU_MAP_BULK_SIZE))
-                bq_flush_to_queue(rcpu, bq);
+                bq_flush_to_queue(rcpu, bq, true);
 
         /* Notice, xdp_buff/page MUST be queued here, long enough for
          * driver to code invoking us to finished, due to driver
@@ -661,7 +664,7 @@ void __cpu_map_flush(struct bpf_map *map)
 
                 /* Flush all frames in bulkq to real queue */
                 bq = this_cpu_ptr(rcpu->bulkq);
-                bq_flush_to_queue(rcpu, bq);
+                bq_flush_to_queue(rcpu, bq, true);
 
                 /* If already running, costs spin_lock_irqsave + smb_mb */
                 wake_up_process(rcpu->kthread);
diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
index d361fc1e3bf3..750d45edae79 100644
--- a/kernel/bpf/devmap.c
+++ b/kernel/bpf/devmap.c
@@ -217,7 +217,8 @@ void __dev_map_insert_ctx(struct bpf_map *map, u32 bit)
 }
 
 static int bq_xmit_all(struct bpf_dtab_netdev *obj,
-                       struct xdp_bulk_queue *bq, u32 flags)
+                       struct xdp_bulk_queue *bq, u32 flags,
+                       bool in_napi_ctx)
 {
         struct net_device *dev = obj->dev;
         int sent = 0, drops = 0, err = 0;
@@ -254,7 +255,10 @@ error:
                 struct xdp_frame *xdpf = bq->q[i];
 
                 /* RX path under NAPI protection, can return frames faster */
-                xdp_return_frame_rx_napi(xdpf);
+                if (likely(in_napi_ctx))
+                        xdp_return_frame_rx_napi(xdpf);
+                else
+                        xdp_return_frame(xdpf);
                 drops++;
         }
         goto out;
@@ -286,7 +290,7 @@ void __dev_map_flush(struct bpf_map *map)
                 __clear_bit(bit, bitmap);
 
                 bq = this_cpu_ptr(dev->bulkq);
-                bq_xmit_all(dev, bq, XDP_XMIT_FLUSH);
+                bq_xmit_all(dev, bq, XDP_XMIT_FLUSH, true);
         }
 }
 
@@ -316,7 +320,7 @@ static int bq_enqueue(struct bpf_dtab_netdev *obj, struct xdp_frame *xdpf,
         struct xdp_bulk_queue *bq = this_cpu_ptr(obj->bulkq);
 
         if (unlikely(bq->count == DEV_MAP_BULK_SIZE))
-                bq_xmit_all(obj, bq, 0);
+                bq_xmit_all(obj, bq, 0, true);
 
         /* Ingress dev_rx will be the same for all xdp_frame's in
          * bulk_queue, because bq stored per-CPU and must be flushed
@@ -385,7 +389,7 @@ static void dev_map_flush_old(struct bpf_dtab_netdev *dev)
                         __clear_bit(dev->bit, bitmap);
 
                         bq = per_cpu_ptr(dev->bulkq, cpu);
-                        bq_xmit_all(dev, bq, XDP_XMIT_FLUSH);
+                        bq_xmit_all(dev, bq, XDP_XMIT_FLUSH, false);
                 }
         }
 }
diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
index 98fb7938beea..c4d75c52b4fc 100644
--- a/kernel/bpf/sockmap.c
+++ b/kernel/bpf/sockmap.c
@@ -1048,12 +1048,12 @@ static int bpf_tcp_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
         timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
 
         while (msg_data_left(msg)) {
-                struct sk_msg_buff *m;
+                struct sk_msg_buff *m = NULL;
                 bool enospc = false;
                 int copy;
 
                 if (sk->sk_err) {
-                        err = sk->sk_err;
+                        err = -sk->sk_err;
                         goto out_err;
                 }
 
@@ -1116,8 +1116,11 @@ wait_for_sndbuf:
                 set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 wait_for_memory:
                 err = sk_stream_wait_memory(sk, &timeo);
-                if (err)
+                if (err) {
+                        if (m && m != psock->cork)
+                                free_start_sg(sk, m);
                         goto out_err;
+                }
         }
 out_err:
         if (err < 0)
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index a31a1ba0f8ea..b41c6cf2eb88 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -575,7 +575,7 @@ static struct bpf_map *bpf_map_inc_not_zero(struct bpf_map *map,
 {
         int refold;
 
-        refold = __atomic_add_unless(&map->refcnt, 1, 0);
+        refold = atomic_fetch_add_unless(&map->refcnt, 1, 0);
 
         if (refold >= BPF_MAX_REFCNT) {
                 __bpf_map_put(map, false);
@@ -1144,7 +1144,7 @@ struct bpf_prog *bpf_prog_inc_not_zero(struct bpf_prog *prog)
 {
         int refold;
 
-        refold = __atomic_add_unless(&prog->aux->refcnt, 1, 0);
+        refold = atomic_fetch_add_unless(&prog->aux->refcnt, 1, 0);
 
         if (refold >= BPF_MAX_REFCNT) {
                 __bpf_prog_put(prog, false);
diff --git a/kernel/compat.c b/kernel/compat.c
index 702aa846ddac..8e40efc2928a 100644
--- a/kernel/compat.c
+++ b/kernel/compat.c
@@ -324,35 +324,6 @@ COMPAT_SYSCALL_DEFINE3(sched_getaffinity, compat_pid_t,  pid, unsigned int, len,
         return ret;
 }
 
-/* Todo: Delete these extern declarations when get/put_compat_itimerspec64()
- * are moved to kernel/time/time.c .
- */
-extern int __compat_get_timespec64(struct timespec64 *ts64,
-                                   const struct compat_timespec __user *cts);
-extern int __compat_put_timespec64(const struct timespec64 *ts64,
-                                   struct compat_timespec __user *cts);
-
-int get_compat_itimerspec64(struct itimerspec64 *its,
-                        const struct compat_itimerspec __user *uits)
-{
-
-        if (__compat_get_timespec64(&its->it_interval, &uits->it_interval) ||
-            __compat_get_timespec64(&its->it_value, &uits->it_value))
-                return -EFAULT;
-        return 0;
-}
-EXPORT_SYMBOL_GPL(get_compat_itimerspec64);
-
-int put_compat_itimerspec64(const struct itimerspec64 *its,
-                        struct compat_itimerspec __user *uits)
-{
-        if (__compat_put_timespec64(&its->it_interval, &uits->it_interval) ||
-            __compat_put_timespec64(&its->it_value, &uits->it_value))
-                return -EFAULT;
-        return 0;
-}
-EXPORT_SYMBOL_GPL(put_compat_itimerspec64);
-
 /*
  * We currently only need the following fields from the sigevent
  * structure: sigev_value, sigev_signo, sig_notify and (sometimes
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 0db8938fbb23..dd8634dde1ae 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -1274,7 +1274,7 @@ static struct cpuhp_step cpuhp_hp_states[] = {
          * otherwise a RCU stall occurs.
          */
         [CPUHP_TIMERS_PREPARE] = {
-                .name                   = "timers:dead",
+                .name                   = "timers:prepare",
                 .startup.single         = timers_prepare_cpu,
                 .teardown.single        = timers_dead_cpu,
         },
@@ -1344,6 +1344,11 @@ static struct cpuhp_step cpuhp_hp_states[] = {
                 .startup.single         = perf_event_init_cpu,
                 .teardown.single        = perf_event_exit_cpu,
         },
+        [CPUHP_AP_WATCHDOG_ONLINE] = {
+                .name                   = "lockup_detector:online",
+                .startup.single         = lockup_detector_online_cpu,
+                .teardown.single        = lockup_detector_offline_cpu,
+        },
         [CPUHP_AP_WORKQUEUE_ONLINE] = {
                 .name                   = "workqueue:online",
                 .startup.single         = workqueue_online_cpu,
@@ -2010,7 +2015,7 @@ void __init boot_cpu_init(void)
 /*
  * Must be called _AFTER_ setting up the per_cpu areas
  */
-void __init boot_cpu_state_init(void)
+void __init boot_cpu_hotplug_init(void)
 {
         per_cpu_ptr(&cpuhp_state, smp_processor_id())->state = CPUHP_ONLINE;
 }
diff --git a/kernel/fork.c b/kernel/fork.c
index 1b27babc4c78..9d8d0e016fc6 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -2276,6 +2276,8 @@ static void sighand_ctor(void *data)
 
 void __init proc_caches_init(void)
 {
+        unsigned int mm_size;
+
         sighand_cachep = kmem_cache_create("sighand_cache",
                         sizeof(struct sighand_struct), 0,
                         SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_TYPESAFE_BY_RCU|
@@ -2292,15 +2294,16 @@ void __init proc_caches_init(void)
                         sizeof(struct fs_struct), 0,
                         SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT,
                         NULL);
+
         /*
-         * FIXME! The "sizeof(struct mm_struct)" currently includes the
-         * whole struct cpumask for the OFFSTACK case. We could change
-         * this to *only* allocate as much of it as required by the
-         * maximum number of CPU's we can ever have.  The cpumask_allocation
-         * is at the end of the structure, exactly for that reason.
+         * The mm_cpumask is located at the end of mm_struct, and is
+         * dynamically sized based on the maximum CPU number this system
+         * can have, taking hotplug into account (nr_cpu_ids).
          */
+        mm_size = sizeof(struct mm_struct) + cpumask_size();
+
         mm_cachep = kmem_cache_create_usercopy("mm_struct",
-                        sizeof(struct mm_struct), ARCH_MIN_MMSTRUCT_ALIGN,
+                        mm_size, ARCH_MIN_MMSTRUCT_ALIGN,
                         SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT,
                         offsetof(struct mm_struct, saved_auxv),
                         sizeof_field(struct mm_struct, saved_auxv),
diff --git a/kernel/irq/Kconfig b/kernel/irq/Kconfig
index c6766f326072..5f3e2baefca9 100644
--- a/kernel/irq/Kconfig
+++ b/kernel/irq/Kconfig
@@ -134,7 +134,6 @@ config GENERIC_IRQ_DEBUGFS
 endmenu
 
 config GENERIC_IRQ_MULTI_HANDLER
-        depends on !MULTI_IRQ_HANDLER
         bool
         help
           Allow to specify the low level IRQ handler at run time.
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index afc7f902d74a..578d0e5f1b5b 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -443,6 +443,7 @@ static void free_desc(unsigned int irq)
          * We free the descriptor, masks and stat fields via RCU. That
          * allows demultiplex interrupts to do rcu based management of
          * the child interrupts.
+         * This also allows us to use rcu in kstat_irqs_usr().
          */
         call_rcu(&desc->rcu, delayed_free_desc);
 }
@@ -928,17 +929,17 @@ unsigned int kstat_irqs(unsigned int irq)
  * kstat_irqs_usr - Get the statistics for an interrupt
  * @irq:        The interrupt number
  *
- * Returns the sum of interrupt counts on all cpus since boot for
- * @irq. Contrary to kstat_irqs() this can be called from any
- * preemptible context. It's protected against concurrent removal of
- * an interrupt descriptor when sparse irqs are enabled.
+ * Returns the sum of interrupt counts on all cpus since boot for @irq.
+ * Contrary to kstat_irqs() this can be called from any context.
+ * It uses rcu since a concurrent removal of an interrupt descriptor is
+ * observing an rcu grace period before delayed_free_desc()/irq_kobj_release().
  */
 unsigned int kstat_irqs_usr(unsigned int irq)
 {
         unsigned int sum;
 
-        irq_lock_sparse();
+        rcu_read_lock();
         sum = kstat_irqs(irq);
-        irq_unlock_sparse();
+        rcu_read_unlock();
         return sum;
 }
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index daeabd791d58..fb86146037a7 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -790,9 +790,19 @@ static irqreturn_t irq_forced_secondary_handler(int irq, void *dev_id)
 
 static int irq_wait_for_interrupt(struct irqaction *action)
 {
-        set_current_state(TASK_INTERRUPTIBLE);
+        for (;;) {
+                set_current_state(TASK_INTERRUPTIBLE);
 
-        while (!kthread_should_stop()) {
+                if (kthread_should_stop()) {
+                        /* may need to run one last time */
+                        if (test_and_clear_bit(IRQTF_RUNTHREAD,
+                                               &action->thread_flags)) {
+                                __set_current_state(TASK_RUNNING);
+                                return 0;
+                        }
+                        __set_current_state(TASK_RUNNING);
+                        return -1;
+                }
 
                 if (test_and_clear_bit(IRQTF_RUNTHREAD,
                                        &action->thread_flags)) {
@@ -800,10 +810,7 @@ static int irq_wait_for_interrupt(struct irqaction *action)
                         return 0;
                 }
                 schedule();
-                set_current_state(TASK_INTERRUPTIBLE);
         }
-        __set_current_state(TASK_RUNNING);
-        return -1;
 }
 
 /*
@@ -1024,11 +1031,8 @@ static int irq_thread(void *data)
         /*
          * This is the regular exit path. __free_irq() is stopping the
          * thread via kthread_stop() after calling
-         * synchronize_irq(). So neither IRQTF_RUNTHREAD nor the
-         * oneshot mask bit can be set. We cannot verify that as we
-         * cannot touch the oneshot mask at this point anymore as
-         * __setup_irq() might have given out currents thread_mask
-         * again.
+         * synchronize_hardirq(). So neither IRQTF_RUNTHREAD nor the
+         * oneshot mask bit can be set.
          */
         task_work_cancel(current, irq_thread_dtor);
         return 0;
@@ -1068,6 +1072,13 @@ static int irq_setup_forced_threading(struct irqaction *new)
         if (new->flags & (IRQF_NO_THREAD | IRQF_PERCPU | IRQF_ONESHOT))
                 return 0;
 
+        /*
+         * No further action required for interrupts which are requested as
+         * threaded interrupts already
+         */
+        if (new->handler == irq_default_primary_handler)
+                return 0;
+
         new->flags |= IRQF_ONESHOT;
 
         /*
@@ -1075,7 +1086,7 @@ static int irq_setup_forced_threading(struct irqaction *new)
          * thread handler. We force thread them as well by creating a
          * secondary action.
          */
-        if (new->handler != irq_default_primary_handler && new->thread_fn) {
+        if (new->handler && new->thread_fn) {
                 /* Allocate the secondary action */
                 new->secondary = kzalloc(sizeof(struct irqaction), GFP_KERNEL);
                 if (!new->secondary)
@@ -1244,8 +1255,10 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
 
         /*
          * Protects against a concurrent __free_irq() call which might wait
-         * for synchronize_irq() to complete without holding the optional
-         * chip bus lock and desc->lock.
+         * for synchronize_hardirq() to complete without holding the optional
+         * chip bus lock and desc->lock. Also protects against handing out
+         * a recycled oneshot thread_mask bit while it's still in use by
+         * its previous owner.
          */
         mutex_lock(&desc->request_mutex);
 
@@ -1564,9 +1577,6 @@ static struct irqaction *__free_irq(struct irq_desc *desc, void *dev_id)
 
         WARN(in_interrupt(), "Trying to free IRQ %d from IRQ context!\n", irq);
 
-        if (!desc)
-                return NULL;
-
         mutex_lock(&desc->request_mutex);
         chip_bus_lock(desc);
         raw_spin_lock_irqsave(&desc->lock, flags);
@@ -1613,11 +1623,11 @@ static struct irqaction *__free_irq(struct irq_desc *desc, void *dev_id)
         /*
          * Drop bus_lock here so the changes which were done in the chip
          * callbacks above are synced out to the irq chips which hang
-         * behind a slow bus (I2C, SPI) before calling synchronize_irq().
+         * behind a slow bus (I2C, SPI) before calling synchronize_hardirq().
          *
          * Aside of that the bus_lock can also be taken from the threaded
          * handler in irq_finalize_oneshot() which results in a deadlock
-         * because synchronize_irq() would wait forever for the thread to
+         * because kthread_stop() would wait forever for the thread to
          * complete, which is blocked on the bus lock.
          *
          * The still held desc->request_mutex() protects against a
@@ -1629,7 +1639,7 @@ static struct irqaction *__free_irq(struct irq_desc *desc, void *dev_id)
         unregister_handler_proc(irq, action);
 
         /* Make sure it's not being used on another CPU: */
-        synchronize_irq(irq);
+        synchronize_hardirq(irq);
 
 #ifdef CONFIG_DEBUG_SHIRQ
         /*
@@ -1638,7 +1648,7 @@ static struct irqaction *__free_irq(struct irq_desc *desc, void *dev_id)
          * is so by doing an extra call to the handler ....
          *
          * ( We do this after actually deregistering it, to make sure that a
-         *   'real' IRQ doesn't run in * parallel with our fake. )
+         *   'real' IRQ doesn't run in parallel with our fake. )
          */
         if (action->flags & IRQF_SHARED) {
                 local_irq_save(flags);
@@ -1647,6 +1657,12 @@ static struct irqaction *__free_irq(struct irq_desc *desc, void *dev_id)
         }
 #endif
 
+        /*
+         * The action has already been removed above, but the thread writes
+         * its oneshot mask bit when it completes. Though request_mutex is
+         * held across this which prevents __setup_irq() from handing out
+         * the same bit to a newly requested action.
+         */
         if (action->thread) {
                 kthread_stop(action->thread);
                 put_task_struct(action->thread);
diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
index 37eda10f5c36..da9addb8d655 100644
--- a/kernel/irq/proc.c
+++ b/kernel/irq/proc.c
@@ -475,22 +475,24 @@ int show_interrupts(struct seq_file *p, void *v)
                 seq_putc(p, '\n');
         }
 
-        irq_lock_sparse();
+        rcu_read_lock();
         desc = irq_to_desc(i);
         if (!desc)
                 goto outsparse;
 
-        raw_spin_lock_irqsave(&desc->lock, flags);
-        for_each_online_cpu(j)
-                any_count |= kstat_irqs_cpu(i, j);
-        action = desc->action;
-        if ((!action || irq_desc_is_chained(desc)) && !any_count)
-                goto out;
+        if (desc->kstat_irqs)
+                for_each_online_cpu(j)
+                        any_count |= *per_cpu_ptr(desc->kstat_irqs, j);
+
+        if ((!desc->action || irq_desc_is_chained(desc)) && !any_count)
+                goto outsparse;
 
         seq_printf(p, "%*d: ", prec, i);
         for_each_online_cpu(j)
-                seq_printf(p, "%10u ", kstat_irqs_cpu(i, j));
+                seq_printf(p, "%10u ", desc->kstat_irqs ?
+                                        *per_cpu_ptr(desc->kstat_irqs, j) : 0);
 
+        raw_spin_lock_irqsave(&desc->lock, flags);
         if (desc->irq_data.chip) {
                 if (desc->irq_data.chip->irq_print_chip)
                         desc->irq_data.chip->irq_print_chip(&desc->irq_data, p);
@@ -511,6 +513,7 @@ int show_interrupts(struct seq_file *p, void *v)
         if (desc->name)
                 seq_printf(p, "-%-8s", desc->name);
 
+        action = desc->action;
         if (action) {
                 seq_printf(p, "  %s", action->name);
                 while ((action = action->next) != NULL)
@@ -518,10 +521,9 @@ int show_interrupts(struct seq_file *p, void *v)
         }
 
         seq_putc(p, '\n');
-out:
         raw_spin_unlock_irqrestore(&desc->lock, flags);
 outsparse:
-        irq_unlock_sparse();
+        rcu_read_unlock();
         return 0;
 }
 #endif
diff --git a/kernel/kthread.c b/kernel/kthread.c
index 486dedbd9af5..087d18d771b5 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -190,7 +190,7 @@ static void __kthread_parkme(struct kthread *self)
                 if (!test_bit(KTHREAD_SHOULD_PARK, &self->flags))
                         break;
 
-                complete_all(&self->parked);
+                complete(&self->parked);
                 schedule();
         }
         __set_current_state(TASK_RUNNING);
@@ -471,7 +471,6 @@ void kthread_unpark(struct task_struct *k)
         if (test_bit(KTHREAD_IS_PER_CPU, &kthread->flags))
                 __kthread_bind(k, kthread->cpu, TASK_PARKED);
 
-        reinit_completion(&kthread->parked);
         clear_bit(KTHREAD_SHOULD_PARK, &kthread->flags);
         /*
          * __kthread_parkme() will either see !SHOULD_PARK or get the wakeup.
@@ -499,6 +498,9 @@ int kthread_park(struct task_struct *k)
         if (WARN_ON(k->flags & PF_EXITING))
                 return -ENOSYS;
 
+        if (WARN_ON_ONCE(test_bit(KTHREAD_SHOULD_PARK, &kthread->flags)))
+                return -EBUSY;
+
         set_bit(KTHREAD_SHOULD_PARK, &kthread->flags);
         if (k != current) {
                 wake_up_process(k);
diff --git a/kernel/locking/locktorture.c b/kernel/locking/locktorture.c
index 8402b3349dca..57bef4fbfb31 100644
--- a/kernel/locking/locktorture.c
+++ b/kernel/locking/locktorture.c
@@ -21,6 +21,9 @@
  *          Davidlohr Bueso <dave@stgolabs.net>
  *      Based on kernel/rcu/torture.c.
  */
+
+#define pr_fmt(fmt) fmt
+
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/kthread.h>
@@ -57,7 +60,7 @@ torture_param(int, shutdown_secs, 0, "Shutdown time (j), <= zero to disable.");
 torture_param(int, stat_interval, 60,
              "Number of seconds between stats printk()s");
 torture_param(int, stutter, 5, "Number of jiffies to run/halt test, 0=disable");
-torture_param(bool, verbose, true,
+torture_param(int, verbose, 1,
              "Enable verbose debugging printk()s");
 
 static char *torture_type = "spin_lock";
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 87331565e505..70178f6ffdc4 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -92,7 +92,7 @@ static void s2idle_enter(void)
         /* Push all the CPUs into the idle loop. */
         wake_up_all_idle_cpus();
         /* Make the current CPU wait so it can enter the idle loop too. */
-        swait_event(s2idle_wait_head,
+        swait_event_exclusive(s2idle_wait_head,
                     s2idle_state == S2IDLE_STATE_WAKE);
 
         cpuidle_pause();
@@ -160,7 +160,7 @@ void s2idle_wake(void)
         raw_spin_lock_irqsave(&s2idle_lock, flags);
         if (s2idle_state > S2IDLE_STATE_NONE) {
                 s2idle_state = S2IDLE_STATE_WAKE;
-                swake_up(&s2idle_wait_head);
+                swake_up_one(&s2idle_wait_head);
         }
         raw_spin_unlock_irqrestore(&s2idle_lock, flags);
 }
diff --git a/kernel/rcu/rcu.h b/kernel/rcu/rcu.h
index 40cea6735c2d..4d04683c31b2 100644
--- a/kernel/rcu/rcu.h
+++ b/kernel/rcu/rcu.h
@@ -91,7 +91,17 @@ static inline void rcu_seq_end(unsigned long *sp)
         WRITE_ONCE(*sp, rcu_seq_endval(sp));
 }
 
-/* Take a snapshot of the update side's sequence number. */
+/*
+ * rcu_seq_snap - Take a snapshot of the update side's sequence number.
+ *
+ * This function returns the earliest value of the grace-period sequence number
+ * that will indicate that a full grace period has elapsed since the current
+ * time.  Once the grace-period sequence number has reached this value, it will
+ * be safe to invoke all callbacks that have been registered prior to the
+ * current time. This value is the current grace-period number plus two to the
+ * power of the number of low-order bits reserved for state, then rounded up to
+ * the next value in which the state bits are all zero.
+ */
 static inline unsigned long rcu_seq_snap(unsigned long *sp)
 {
         unsigned long s;
@@ -108,6 +118,15 @@ static inline unsigned long rcu_seq_current(unsigned long *sp)
 }
 
 /*
+ * Given a snapshot from rcu_seq_snap(), determine whether or not the
+ * corresponding update-side operation has started.
+ */
+static inline bool rcu_seq_started(unsigned long *sp, unsigned long s)
+{
+        return ULONG_CMP_LT((s - 1) & ~RCU_SEQ_STATE_MASK, READ_ONCE(*sp));
+}
+
+/*
  * Given a snapshot from rcu_seq_snap(), determine whether or not a
  * full update-side operation has occurred.
  */
@@ -117,6 +136,45 @@ static inline bool rcu_seq_done(unsigned long *sp, unsigned long s)
 }
 
 /*
+ * Has a grace period completed since the time the old gp_seq was collected?
+ */
+static inline bool rcu_seq_completed_gp(unsigned long old, unsigned long new)
+{
+        return ULONG_CMP_LT(old, new & ~RCU_SEQ_STATE_MASK);
+}
+
+/*
+ * Has a grace period started since the time the old gp_seq was collected?
+ */
+static inline bool rcu_seq_new_gp(unsigned long old, unsigned long new)
+{
+        return ULONG_CMP_LT((old + RCU_SEQ_STATE_MASK) & ~RCU_SEQ_STATE_MASK,
+                            new);
+}
+
+/*
+ * Roughly how many full grace periods have elapsed between the collection
+ * of the two specified grace periods?
+ */
+static inline unsigned long rcu_seq_diff(unsigned long new, unsigned long old)
+{
+        unsigned long rnd_diff;
+
+        if (old == new)
+                return 0;
+        /*
+         * Compute the number of grace periods (still shifted up), plus
+         * one if either of new and old is not an exact grace period.
+         */
+        rnd_diff = (new & ~RCU_SEQ_STATE_MASK) -
+                   ((old + RCU_SEQ_STATE_MASK) & ~RCU_SEQ_STATE_MASK) +
+                   ((new & RCU_SEQ_STATE_MASK) || (old & RCU_SEQ_STATE_MASK));
+        if (ULONG_CMP_GE(RCU_SEQ_STATE_MASK, rnd_diff))
+                return 1; /* Definitely no grace period has elapsed. */
+        return ((rnd_diff - RCU_SEQ_STATE_MASK - 1) >> RCU_SEQ_CTR_SHIFT) + 2;
+}
+
+/*
  * debug_rcu_head_queue()/debug_rcu_head_unqueue() are used internally
  * by call_rcu() and rcu callback execution, and are therefore not part of the
  * RCU API. Leaving in rcupdate.h because they are used by all RCU flavors.
@@ -276,6 +334,9 @@ static inline void rcu_init_levelspread(int *levelspread, const int *levelcnt)
 /* Is this rcu_node a leaf? */
 #define rcu_is_leaf_node(rnp) ((rnp)->level == rcu_num_lvls - 1)
 
+/* Is this rcu_node the last leaf? */
+#define rcu_is_last_leaf_node(rsp, rnp) ((rnp) == &(rsp)->node[rcu_num_nodes - 1])
+
 /*
  * Do a full breadth-first scan of the rcu_node structures for the
  * specified rcu_state structure.
@@ -405,8 +466,7 @@ enum rcutorture_type {
 
 #if defined(CONFIG_TREE_RCU) || defined(CONFIG_PREEMPT_RCU)
 void rcutorture_get_gp_data(enum rcutorture_type test_type, int *flags,
-                            unsigned long *gpnum, unsigned long *completed);
-void rcutorture_record_test_transition(void);
+                            unsigned long *gp_seq);
 void rcutorture_record_progress(unsigned long vernum);
 void do_trace_rcu_torture_read(const char *rcutorturename,
                                struct rcu_head *rhp,
@@ -415,15 +475,11 @@ void do_trace_rcu_torture_read(const char *rcutorturename,
                                unsigned long c);
 #else
 static inline void rcutorture_get_gp_data(enum rcutorture_type test_type,
-                                          int *flags,
-                                          unsigned long *gpnum,
-                                          unsigned long *completed)
+                                          int *flags, unsigned long *gp_seq)
 {
         *flags = 0;
-        *gpnum = 0;
-        *completed = 0;
+        *gp_seq = 0;
 }
-static inline void rcutorture_record_test_transition(void) { }
 static inline void rcutorture_record_progress(unsigned long vernum) { }
 #ifdef CONFIG_RCU_TRACE
 void do_trace_rcu_torture_read(const char *rcutorturename,
@@ -441,31 +497,26 @@ void do_trace_rcu_torture_read(const char *rcutorturename,
 
 static inline void srcutorture_get_gp_data(enum rcutorture_type test_type,
                                            struct srcu_struct *sp, int *flags,
-                                           unsigned long *gpnum,
-                                           unsigned long *completed)
+                                           unsigned long *gp_seq)
 {
         if (test_type != SRCU_FLAVOR)
                 return;
         *flags = 0;
-        *completed = sp->srcu_idx;
-        *gpnum = *completed;
+        *gp_seq = sp->srcu_idx;
 }
 
 #elif defined(CONFIG_TREE_SRCU)
 
 void srcutorture_get_gp_data(enum rcutorture_type test_type,
                              struct srcu_struct *sp, int *flags,
-                             unsigned long *gpnum, unsigned long *completed);
+                             unsigned long *gp_seq);
 
 #endif
 
 #ifdef CONFIG_TINY_RCU
-static inline unsigned long rcu_batches_started(void) { return 0; }
-static inline unsigned long rcu_batches_started_bh(void) { return 0; }
-static inline unsigned long rcu_batches_started_sched(void) { return 0; }
-static inline unsigned long rcu_batches_completed(void) { return 0; }
-static inline unsigned long rcu_batches_completed_bh(void) { return 0; }
-static inline unsigned long rcu_batches_completed_sched(void) { return 0; }
+static inline unsigned long rcu_get_gp_seq(void) { return 0; }
+static inline unsigned long rcu_bh_get_gp_seq(void) { return 0; }
+static inline unsigned long rcu_sched_get_gp_seq(void) { return 0; }
 static inline unsigned long rcu_exp_batches_completed(void) { return 0; }
 static inline unsigned long rcu_exp_batches_completed_sched(void) { return 0; }
 static inline unsigned long
@@ -474,19 +525,16 @@ static inline void rcu_force_quiescent_state(void) { }
 static inline void rcu_bh_force_quiescent_state(void) { }
 static inline void rcu_sched_force_quiescent_state(void) { }
 static inline void show_rcu_gp_kthreads(void) { }
+static inline int rcu_get_gp_kthreads_prio(void) { return 0; }
 #else /* #ifdef CONFIG_TINY_RCU */
-extern unsigned long rcutorture_testseq;
-extern unsigned long rcutorture_vernum;
-unsigned long rcu_batches_started(void);
-unsigned long rcu_batches_started_bh(void);
-unsigned long rcu_batches_started_sched(void);
-unsigned long rcu_batches_completed(void);
-unsigned long rcu_batches_completed_bh(void);
-unsigned long rcu_batches_completed_sched(void);
+unsigned long rcu_get_gp_seq(void);
+unsigned long rcu_bh_get_gp_seq(void);
+unsigned long rcu_sched_get_gp_seq(void);
 unsigned long rcu_exp_batches_completed(void);
 unsigned long rcu_exp_batches_completed_sched(void);
 unsigned long srcu_batches_completed(struct srcu_struct *sp);
 void show_rcu_gp_kthreads(void);
+int rcu_get_gp_kthreads_prio(void);
 void rcu_force_quiescent_state(void);
 void rcu_bh_force_quiescent_state(void);
 void rcu_sched_force_quiescent_state(void);
diff --git a/kernel/rcu/rcuperf.c b/kernel/rcu/rcuperf.c
index e232846516b3..34244523550e 100644
--- a/kernel/rcu/rcuperf.c
+++ b/kernel/rcu/rcuperf.c
@@ -19,6 +19,9 @@
  *
  * Authors: Paul E. McKenney <paulmck@us.ibm.com>
  */
+
+#define pr_fmt(fmt) fmt
+
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -88,7 +91,7 @@ torture_param(int, nreaders, -1, "Number of RCU reader threads");
 torture_param(int, nwriters, -1, "Number of RCU updater threads");
 torture_param(bool, shutdown, !IS_ENABLED(MODULE),
               "Shutdown at end of performance tests.");
-torture_param(bool, verbose, true, "Enable verbose debugging printk()s");
+torture_param(int, verbose, 1, "Enable verbose debugging printk()s");
 torture_param(int, writer_holdoff, 0, "Holdoff (us) between GPs, zero to disable");
 
 static char *perf_type = "rcu";
@@ -135,8 +138,8 @@ struct rcu_perf_ops {
         void (*cleanup)(void);
         int (*readlock)(void);
         void (*readunlock)(int idx);
-        unsigned long (*started)(void);
-        unsigned long (*completed)(void);
+        unsigned long (*get_gp_seq)(void);
+        unsigned long (*gp_diff)(unsigned long new, unsigned long old);
         unsigned long (*exp_completed)(void);
         void (*async)(struct rcu_head *head, rcu_callback_t func);
         void (*gp_barrier)(void);
@@ -176,8 +179,8 @@ static struct rcu_perf_ops rcu_ops = {
         .init           = rcu_sync_perf_init,
         .readlock       = rcu_perf_read_lock,
         .readunlock     = rcu_perf_read_unlock,
-        .started        = rcu_batches_started,
-        .completed      = rcu_batches_completed,
+        .get_gp_seq     = rcu_get_gp_seq,
+        .gp_diff        = rcu_seq_diff,
         .exp_completed  = rcu_exp_batches_completed,
         .async          = call_rcu,
         .gp_barrier     = rcu_barrier,
@@ -206,8 +209,8 @@ static struct rcu_perf_ops rcu_bh_ops = {
         .init           = rcu_sync_perf_init,
         .readlock       = rcu_bh_perf_read_lock,
         .readunlock     = rcu_bh_perf_read_unlock,
-        .started        = rcu_batches_started_bh,
-        .completed      = rcu_batches_completed_bh,
+        .get_gp_seq     = rcu_bh_get_gp_seq,
+        .gp_diff        = rcu_seq_diff,
         .exp_completed  = rcu_exp_batches_completed_sched,
         .async          = call_rcu_bh,
         .gp_barrier     = rcu_barrier_bh,
@@ -263,8 +266,8 @@ static struct rcu_perf_ops srcu_ops = {
         .init           = rcu_sync_perf_init,
         .readlock       = srcu_perf_read_lock,
         .readunlock     = srcu_perf_read_unlock,
-        .started        = NULL,
-        .completed      = srcu_perf_completed,
+        .get_gp_seq     = srcu_perf_completed,
+        .gp_diff        = rcu_seq_diff,
         .exp_completed  = srcu_perf_completed,
         .async          = srcu_call_rcu,
         .gp_barrier     = srcu_rcu_barrier,
@@ -292,8 +295,8 @@ static struct rcu_perf_ops srcud_ops = {
         .cleanup        = srcu_sync_perf_cleanup,
         .readlock       = srcu_perf_read_lock,
         .readunlock     = srcu_perf_read_unlock,
-        .started        = NULL,
-        .completed      = srcu_perf_completed,
+        .get_gp_seq     = srcu_perf_completed,
+        .gp_diff        = rcu_seq_diff,
         .exp_completed  = srcu_perf_completed,
         .async          = srcu_call_rcu,
         .gp_barrier     = srcu_rcu_barrier,
@@ -322,8 +325,8 @@ static struct rcu_perf_ops sched_ops = {
         .init           = rcu_sync_perf_init,
         .readlock       = sched_perf_read_lock,
         .readunlock     = sched_perf_read_unlock,
-        .started        = rcu_batches_started_sched,
-        .completed      = rcu_batches_completed_sched,
+        .get_gp_seq     = rcu_sched_get_gp_seq,
+        .gp_diff        = rcu_seq_diff,
         .exp_completed  = rcu_exp_batches_completed_sched,
         .async          = call_rcu_sched,
         .gp_barrier     = rcu_barrier_sched,
@@ -350,8 +353,8 @@ static struct rcu_perf_ops tasks_ops = {
         .init           = rcu_sync_perf_init,
         .readlock       = tasks_perf_read_lock,
         .readunlock     = tasks_perf_read_unlock,
-        .started        = rcu_no_completed,
-        .completed      = rcu_no_completed,
+        .get_gp_seq     = rcu_no_completed,
+        .gp_diff        = rcu_seq_diff,
         .async          = call_rcu_tasks,
         .gp_barrier     = rcu_barrier_tasks,
         .sync           = synchronize_rcu_tasks,
@@ -359,9 +362,11 @@ static struct rcu_perf_ops tasks_ops = {
         .name           = "tasks"
 };
 
-static bool __maybe_unused torturing_tasks(void)
+static unsigned long rcuperf_seq_diff(unsigned long new, unsigned long old)
 {
-        return cur_ops == &tasks_ops;
+        if (!cur_ops->gp_diff)
+                return new - old;
+        return cur_ops->gp_diff(new, old);
 }
 
 /*
@@ -444,8 +449,7 @@ rcu_perf_writer(void *arg)
                         b_rcu_perf_writer_started =
                                 cur_ops->exp_completed() / 2;
                 } else {
-                        b_rcu_perf_writer_started =
-                                cur_ops->completed();
+                        b_rcu_perf_writer_started = cur_ops->get_gp_seq();
                 }
         }
 
@@ -502,7 +506,7 @@ retry:
                                                 cur_ops->exp_completed() / 2;
                                 } else {
                                         b_rcu_perf_writer_finished =
-                                                cur_ops->completed();
+                                                cur_ops->get_gp_seq();
                                 }
                                 if (shutdown) {
                                         smp_mb(); /* Assign before wake. */
@@ -527,7 +531,7 @@ retry:
         return 0;
 }
 
-static inline void
+static void
 rcu_perf_print_module_parms(struct rcu_perf_ops *cur_ops, const char *tag)
 {
         pr_alert("%s" PERF_FLAG
@@ -582,8 +586,8 @@ rcu_perf_cleanup(void)
                          t_rcu_perf_writer_finished -
                          t_rcu_perf_writer_started,
                          ngps,
-                         b_rcu_perf_writer_finished -
-                         b_rcu_perf_writer_started);
+                         rcuperf_seq_diff(b_rcu_perf_writer_finished,
+                                          b_rcu_perf_writer_started));
                 for (i = 0; i < nrealwriters; i++) {
                         if (!writer_durations)
                                 break;
@@ -671,12 +675,11 @@ rcu_perf_init(void)
                         break;
         }
         if (i == ARRAY_SIZE(perf_ops)) {
-                pr_alert("rcu-perf: invalid perf type: \"%s\"\n",
-                         perf_type);
+                pr_alert("rcu-perf: invalid perf type: \"%s\"\n", perf_type);
                 pr_alert("rcu-perf types:");
                 for (i = 0; i < ARRAY_SIZE(perf_ops); i++)
-                        pr_alert(" %s", perf_ops[i]->name);
-                pr_alert("\n");
+                        pr_cont(" %s", perf_ops[i]->name);
+                pr_cont("\n");
                 firsterr = -EINVAL;
                 goto unwind;
         }
diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
index 42fcb7f05fac..c596c6f1e457 100644
--- a/kernel/rcu/rcutorture.c
+++ b/kernel/rcu/rcutorture.c
@@ -22,6 +22,9 @@
  *
  * See also:  Documentation/RCU/torture.txt
  */
+
+#define pr_fmt(fmt) fmt
+
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -52,6 +55,7 @@
 #include <linux/torture.h>
 #include <linux/vmalloc.h>
 #include <linux/sched/debug.h>
+#include <linux/sched/sysctl.h>
 
 #include "rcu.h"
 
@@ -59,6 +63,19 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Paul E. McKenney <paulmck@us.ibm.com> and Josh Triplett <josh@joshtriplett.org>");
 
 
+/* Bits for ->extendables field, extendables param, and related definitions. */
+#define RCUTORTURE_RDR_SHIFT     8      /* Put SRCU index in upper bits. */
+#define RCUTORTURE_RDR_MASK      ((1 << RCUTORTURE_RDR_SHIFT) - 1)
+#define RCUTORTURE_RDR_BH        0x1    /* Extend readers by disabling bh. */
+#define RCUTORTURE_RDR_IRQ       0x2    /*  ... disabling interrupts. */
+#define RCUTORTURE_RDR_PREEMPT   0x4    /*  ... disabling preemption. */
+#define RCUTORTURE_RDR_RCU       0x8    /*  ... entering another RCU reader. */
+#define RCUTORTURE_RDR_NBITS     4      /* Number of bits defined above. */
+#define RCUTORTURE_MAX_EXTEND    (RCUTORTURE_RDR_BH | RCUTORTURE_RDR_IRQ | \
+                                  RCUTORTURE_RDR_PREEMPT)
+#define RCUTORTURE_RDR_MAX_LOOPS 0x7    /* Maximum reader extensions. */
+                                        /* Must be power of two minus one. */
+
 torture_param(int, cbflood_inter_holdoff, HZ,
               "Holdoff between floods (jiffies)");
 torture_param(int, cbflood_intra_holdoff, 1,
@@ -66,6 +83,8 @@ torture_param(int, cbflood_intra_holdoff, 1,
 torture_param(int, cbflood_n_burst, 3, "# bursts in flood, zero to disable");
 torture_param(int, cbflood_n_per_burst, 20000,
               "# callbacks per burst in flood");
+torture_param(int, extendables, RCUTORTURE_MAX_EXTEND,
+              "Extend readers by disabling bh (1), irqs (2), or preempt (4)");
 torture_param(int, fqs_duration, 0,
               "Duration of fqs bursts (us), 0 to disable");
 torture_param(int, fqs_holdoff, 0, "Holdoff time within fqs bursts (us)");
@@ -84,7 +103,7 @@ torture_param(int, object_debug, 0,
              "Enable debug-object double call_rcu() testing");
 torture_param(int, onoff_holdoff, 0, "Time after boot before CPU hotplugs (s)");
 torture_param(int, onoff_interval, 0,
-             "Time between CPU hotplugs (s), 0=disable");
+             "Time between CPU hotplugs (jiffies), 0=disable");
 torture_param(int, shuffle_interval, 3, "Number of seconds between shuffles");
 torture_param(int, shutdown_secs, 0, "Shutdown time (s), <= zero to disable.");
 torture_param(int, stall_cpu, 0, "Stall duration (s), zero to disable.");
@@ -101,7 +120,7 @@ torture_param(int, test_boost_interval, 7,
              "Interval between boost tests, seconds.");
 torture_param(bool, test_no_idle_hz, true,
              "Test support for tickless idle CPUs");
-torture_param(bool, verbose, true,
+torture_param(int, verbose, 1,
              "Enable verbose debugging printk()s");
 
 static char *torture_type = "rcu";
@@ -148,9 +167,9 @@ static long n_rcu_torture_boost_ktrerror;
 static long n_rcu_torture_boost_rterror;
 static long n_rcu_torture_boost_failure;
 static long n_rcu_torture_boosts;
-static long n_rcu_torture_timers;
+static atomic_long_t n_rcu_torture_timers;
 static long n_barrier_attempts;
-static long n_barrier_successes;
+static long n_barrier_successes; /* did rcu_barrier test succeed? */
 static atomic_long_t n_cbfloods;
 static struct list_head rcu_torture_removed;
 
@@ -261,8 +280,8 @@ struct rcu_torture_ops {
         int (*readlock)(void);
         void (*read_delay)(struct torture_random_state *rrsp);
         void (*readunlock)(int idx);
-        unsigned long (*started)(void);
-        unsigned long (*completed)(void);
+        unsigned long (*get_gp_seq)(void);
+        unsigned long (*gp_diff)(unsigned long new, unsigned long old);
         void (*deferred_free)(struct rcu_torture *p);
         void (*sync)(void);
         void (*exp_sync)(void);
@@ -274,6 +293,8 @@ struct rcu_torture_ops {
         void (*stats)(void);
         int irq_capable;
         int can_boost;
+        int extendables;
+        int ext_irq_conflict;
         const char *name;
 };
 
@@ -302,10 +323,10 @@ static void rcu_read_delay(struct torture_random_state *rrsp)
          * force_quiescent_state. */
 
         if (!(torture_random(rrsp) % (nrealreaders * 2000 * longdelay_ms))) {
-                started = cur_ops->completed();
+                started = cur_ops->get_gp_seq();
                 ts = rcu_trace_clock_local();
                 mdelay(longdelay_ms);
-                completed = cur_ops->completed();
+                completed = cur_ops->get_gp_seq();
                 do_trace_rcu_torture_read(cur_ops->name, NULL, ts,
                                           started, completed);
         }
@@ -397,8 +418,8 @@ static struct rcu_torture_ops rcu_ops = {
         .readlock       = rcu_torture_read_lock,
         .read_delay     = rcu_read_delay,
         .readunlock     = rcu_torture_read_unlock,
-        .started        = rcu_batches_started,
-        .completed      = rcu_batches_completed,
+        .get_gp_seq     = rcu_get_gp_seq,
+        .gp_diff        = rcu_seq_diff,
         .deferred_free  = rcu_torture_deferred_free,
         .sync           = synchronize_rcu,
         .exp_sync       = synchronize_rcu_expedited,
@@ -439,8 +460,8 @@ static struct rcu_torture_ops rcu_bh_ops = {
         .readlock       = rcu_bh_torture_read_lock,
         .read_delay     = rcu_read_delay,  /* just reuse rcu's version. */
         .readunlock     = rcu_bh_torture_read_unlock,
-        .started        = rcu_batches_started_bh,
-        .completed      = rcu_batches_completed_bh,
+        .get_gp_seq     = rcu_bh_get_gp_seq,
+        .gp_diff        = rcu_seq_diff,
         .deferred_free  = rcu_bh_torture_deferred_free,
         .sync           = synchronize_rcu_bh,
         .exp_sync       = synchronize_rcu_bh_expedited,
@@ -449,6 +470,8 @@ static struct rcu_torture_ops rcu_bh_ops = {
         .fqs            = rcu_bh_force_quiescent_state,
         .stats          = NULL,
         .irq_capable    = 1,
+        .extendables    = (RCUTORTURE_RDR_BH | RCUTORTURE_RDR_IRQ),
+        .ext_irq_conflict = RCUTORTURE_RDR_RCU,
         .name           = "rcu_bh"
 };
 
@@ -483,8 +506,7 @@ static struct rcu_torture_ops rcu_busted_ops = {
         .readlock       = rcu_torture_read_lock,
         .read_delay     = rcu_read_delay,  /* just reuse rcu's version. */
         .readunlock     = rcu_torture_read_unlock,
-        .started        = rcu_no_completed,
-        .completed      = rcu_no_completed,
+        .get_gp_seq     = rcu_no_completed,
         .deferred_free  = rcu_busted_torture_deferred_free,
         .sync           = synchronize_rcu_busted,
         .exp_sync       = synchronize_rcu_busted,
@@ -572,8 +594,7 @@ static struct rcu_torture_ops srcu_ops = {
         .readlock       = srcu_torture_read_lock,
         .read_delay     = srcu_read_delay,
         .readunlock     = srcu_torture_read_unlock,
-        .started        = NULL,
-        .completed      = srcu_torture_completed,
+        .get_gp_seq     = srcu_torture_completed,
         .deferred_free  = srcu_torture_deferred_free,
         .sync           = srcu_torture_synchronize,
         .exp_sync       = srcu_torture_synchronize_expedited,
@@ -610,8 +631,7 @@ static struct rcu_torture_ops srcud_ops = {
         .readlock       = srcu_torture_read_lock,
         .read_delay     = srcu_read_delay,
         .readunlock     = srcu_torture_read_unlock,
-        .started        = NULL,
-        .completed      = srcu_torture_completed,
+        .get_gp_seq     = srcu_torture_completed,
         .deferred_free  = srcu_torture_deferred_free,
         .sync           = srcu_torture_synchronize,
         .exp_sync       = srcu_torture_synchronize_expedited,
@@ -622,6 +642,26 @@ static struct rcu_torture_ops srcud_ops = {
         .name           = "srcud"
 };
 
+/* As above, but broken due to inappropriate reader extension. */
+static struct rcu_torture_ops busted_srcud_ops = {
+        .ttype          = SRCU_FLAVOR,
+        .init           = srcu_torture_init,
+        .cleanup        = srcu_torture_cleanup,
+        .readlock       = srcu_torture_read_lock,
+        .read_delay     = rcu_read_delay,
+        .readunlock     = srcu_torture_read_unlock,
+        .get_gp_seq     = srcu_torture_completed,
+        .deferred_free  = srcu_torture_deferred_free,
+        .sync           = srcu_torture_synchronize,
+        .exp_sync       = srcu_torture_synchronize_expedited,
+        .call           = srcu_torture_call,
+        .cb_barrier     = srcu_torture_barrier,
+        .stats          = srcu_torture_stats,
+        .irq_capable    = 1,
+        .extendables    = RCUTORTURE_MAX_EXTEND,
+        .name           = "busted_srcud"
+};
+
 /*
  * Definitions for sched torture testing.
  */
@@ -648,8 +688,8 @@ static struct rcu_torture_ops sched_ops = {
         .readlock       = sched_torture_read_lock,
         .read_delay     = rcu_read_delay,  /* just reuse rcu's version. */
         .readunlock     = sched_torture_read_unlock,
-        .started        = rcu_batches_started_sched,
-        .completed      = rcu_batches_completed_sched,
+        .get_gp_seq     = rcu_sched_get_gp_seq,
+        .gp_diff        = rcu_seq_diff,
         .deferred_free  = rcu_sched_torture_deferred_free,
         .sync           = synchronize_sched,
         .exp_sync       = synchronize_sched_expedited,
@@ -660,6 +700,7 @@ static struct rcu_torture_ops sched_ops = {
         .fqs            = rcu_sched_force_quiescent_state,
         .stats          = NULL,
         .irq_capable    = 1,
+        .extendables    = RCUTORTURE_MAX_EXTEND,
         .name           = "sched"
 };
 
@@ -687,8 +728,7 @@ static struct rcu_torture_ops tasks_ops = {
         .readlock       = tasks_torture_read_lock,
         .read_delay     = rcu_read_delay,  /* just reuse rcu's version. */
         .readunlock     = tasks_torture_read_unlock,
-        .started        = rcu_no_completed,
-        .completed      = rcu_no_completed,
+        .get_gp_seq     = rcu_no_completed,
         .deferred_free  = rcu_tasks_torture_deferred_free,
         .sync           = synchronize_rcu_tasks,
         .exp_sync       = synchronize_rcu_tasks,
@@ -700,6 +740,13 @@ static struct rcu_torture_ops tasks_ops = {
         .name           = "tasks"
 };
 
+static unsigned long rcutorture_seq_diff(unsigned long new, unsigned long old)
+{
+        if (!cur_ops->gp_diff)
+                return new - old;
+        return cur_ops->gp_diff(new, old);
+}
+
 static bool __maybe_unused torturing_tasks(void)
 {
         return cur_ops == &tasks_ops;
@@ -726,6 +773,44 @@ static void rcu_torture_boost_cb(struct rcu_head *head)
         smp_store_release(&rbip->inflight, 0);
 }
 
+static int old_rt_runtime = -1;
+
+static void rcu_torture_disable_rt_throttle(void)
+{
+        /*
+         * Disable RT throttling so that rcutorture's boost threads don't get
+         * throttled. Only possible if rcutorture is built-in otherwise the
+         * user should manually do this by setting the sched_rt_period_us and
+         * sched_rt_runtime sysctls.
+         */
+        if (!IS_BUILTIN(CONFIG_RCU_TORTURE_TEST) || old_rt_runtime != -1)
+                return;
+
+        old_rt_runtime = sysctl_sched_rt_runtime;
+        sysctl_sched_rt_runtime = -1;
+}
+
+static void rcu_torture_enable_rt_throttle(void)
+{
+        if (!IS_BUILTIN(CONFIG_RCU_TORTURE_TEST) || old_rt_runtime == -1)
+                return;
+
+        sysctl_sched_rt_runtime = old_rt_runtime;
+        old_rt_runtime = -1;
+}
+
+static bool rcu_torture_boost_failed(unsigned long start, unsigned long end)
+{
+        if (end - start > test_boost_duration * HZ - HZ / 2) {
+                VERBOSE_TOROUT_STRING("rcu_torture_boost boosting failed");
+                n_rcu_torture_boost_failure++;
+
+                return true; /* failed */
+        }
+
+        return false; /* passed */
+}
+
 static int rcu_torture_boost(void *arg)
 {
         unsigned long call_rcu_time;
@@ -746,6 +831,21 @@ static int rcu_torture_boost(void *arg)
         init_rcu_head_on_stack(&rbi.rcu);
         /* Each pass through the following loop does one boost-test cycle. */
         do {
+                /* Track if the test failed already in this test interval? */
+                bool failed = false;
+
+                /* Increment n_rcu_torture_boosts once per boost-test */
+                while (!kthread_should_stop()) {
+                        if (mutex_trylock(&boost_mutex)) {
+                                n_rcu_torture_boosts++;
+                                mutex_unlock(&boost_mutex);
+                                break;
+                        }
+                        schedule_timeout_uninterruptible(1);
+                }
+                if (kthread_should_stop())
+                        goto checkwait;
+
                 /* Wait for the next test interval. */
                 oldstarttime = boost_starttime;
                 while (ULONG_CMP_LT(jiffies, oldstarttime)) {
@@ -764,11 +864,10 @@ static int rcu_torture_boost(void *arg)
                                 /* RCU core before ->inflight = 1. */
                                 smp_store_release(&rbi.inflight, 1);
                                 call_rcu(&rbi.rcu, rcu_torture_boost_cb);
-                                if (jiffies - call_rcu_time >
-                                         test_boost_duration * HZ - HZ / 2) {
-                                        VERBOSE_TOROUT_STRING("rcu_torture_boost boosting failed");
-                                        n_rcu_torture_boost_failure++;
-                                }
+                                /* Check if the boost test failed */
+                                failed = failed ||
+                                         rcu_torture_boost_failed(call_rcu_time,
+                                                                 jiffies);
                                 call_rcu_time = jiffies;
                         }
                         stutter_wait("rcu_torture_boost");
@@ -777,6 +876,14 @@ static int rcu_torture_boost(void *arg)
                 }
 
                 /*
+                 * If boost never happened, then inflight will always be 1, in
+                 * this case the boost check would never happen in the above
+                 * loop so do another one here.
+                 */
+                if (!failed && smp_load_acquire(&rbi.inflight))
+                        rcu_torture_boost_failed(call_rcu_time, jiffies);
+
+                /*
                  * Set the start time of the next test interval.
                  * Yes, this is vulnerable to long delays, but such
                  * delays simply cause a false negative for the next
@@ -788,7 +895,6 @@ static int rcu_torture_boost(void *arg)
                         if (mutex_trylock(&boost_mutex)) {
                                 boost_starttime = jiffies +
                                                   test_boost_interval * HZ;
-                                n_rcu_torture_boosts++;
                                 mutex_unlock(&boost_mutex);
                                 break;
                         }
@@ -1010,7 +1116,7 @@ rcu_torture_writer(void *arg)
                                 break;
                         }
                 }
-                rcutorture_record_progress(++rcu_torture_current_version);
+                rcu_torture_current_version++;
                 /* Cycle through nesting levels of rcu_expedite_gp() calls. */
                 if (can_expedite &&
                     !(torture_random(&rand) & 0xff & (!!expediting - 1))) {
@@ -1084,27 +1190,133 @@ static void rcu_torture_timer_cb(struct rcu_head *rhp)
 }
 
 /*
- * RCU torture reader from timer handler.  Dereferences rcu_torture_current,
- * incrementing the corresponding element of the pipeline array.  The
- * counter in the element should never be greater than 1, otherwise, the
- * RCU implementation is broken.
+ * Do one extension of an RCU read-side critical section using the
+ * current reader state in readstate (set to zero for initial entry
+ * to extended critical section), set the new state as specified by
+ * newstate (set to zero for final exit from extended critical section),
+ * and random-number-generator state in trsp.  If this is neither the
+ * beginning or end of the critical section and if there was actually a
+ * change, do a ->read_delay().
  */
-static void rcu_torture_timer(struct timer_list *unused)
+static void rcutorture_one_extend(int *readstate, int newstate,
+                                  struct torture_random_state *trsp)
+{
+        int idxnew = -1;
+        int idxold = *readstate;
+        int statesnew = ~*readstate & newstate;
+        int statesold = *readstate & ~newstate;
+
+        WARN_ON_ONCE(idxold < 0);
+        WARN_ON_ONCE((idxold >> RCUTORTURE_RDR_SHIFT) > 1);
+
+        /* First, put new protection in place to avoid critical-section gap. */
+        if (statesnew & RCUTORTURE_RDR_BH)
+                local_bh_disable();
+        if (statesnew & RCUTORTURE_RDR_IRQ)
+                local_irq_disable();
+        if (statesnew & RCUTORTURE_RDR_PREEMPT)
+                preempt_disable();
+        if (statesnew & RCUTORTURE_RDR_RCU)
+                idxnew = cur_ops->readlock() << RCUTORTURE_RDR_SHIFT;
+
+        /* Next, remove old protection, irq first due to bh conflict. */
+        if (statesold & RCUTORTURE_RDR_IRQ)
+                local_irq_enable();
+        if (statesold & RCUTORTURE_RDR_BH)
+                local_bh_enable();
+        if (statesold & RCUTORTURE_RDR_PREEMPT)
+                preempt_enable();
+        if (statesold & RCUTORTURE_RDR_RCU)
+                cur_ops->readunlock(idxold >> RCUTORTURE_RDR_SHIFT);
+
+        /* Delay if neither beginning nor end and there was a change. */
+        if ((statesnew || statesold) && *readstate && newstate)
+                cur_ops->read_delay(trsp);
+
+        /* Update the reader state. */
+        if (idxnew == -1)
+                idxnew = idxold & ~RCUTORTURE_RDR_MASK;
+        WARN_ON_ONCE(idxnew < 0);
+        WARN_ON_ONCE((idxnew >> RCUTORTURE_RDR_SHIFT) > 1);
+        *readstate = idxnew | newstate;
+        WARN_ON_ONCE((*readstate >> RCUTORTURE_RDR_SHIFT) < 0);
+        WARN_ON_ONCE((*readstate >> RCUTORTURE_RDR_SHIFT) > 1);
+}
+
+/* Return the biggest extendables mask given current RCU and boot parameters. */
+static int rcutorture_extend_mask_max(void)
+{
+        int mask;
+
+        WARN_ON_ONCE(extendables & ~RCUTORTURE_MAX_EXTEND);
+        mask = extendables & RCUTORTURE_MAX_EXTEND & cur_ops->extendables;
+        mask = mask | RCUTORTURE_RDR_RCU;
+        return mask;
+}
+
+/* Return a random protection state mask, but with at least one bit set. */
+static int
+rcutorture_extend_mask(int oldmask, struct torture_random_state *trsp)
+{
+        int mask = rcutorture_extend_mask_max();
+        unsigned long randmask1 = torture_random(trsp) >> 8;
+        unsigned long randmask2 = randmask1 >> 1;
+
+        WARN_ON_ONCE(mask >> RCUTORTURE_RDR_SHIFT);
+        /* Half the time lots of bits, half the time only one bit. */
+        if (randmask1 & 0x1)
+                mask = mask & randmask2;
+        else
+                mask = mask & (1 << (randmask2 % RCUTORTURE_RDR_NBITS));
+        if ((mask & RCUTORTURE_RDR_IRQ) &&
+            !(mask & RCUTORTURE_RDR_BH) &&
+            (oldmask & RCUTORTURE_RDR_BH))
+                mask |= RCUTORTURE_RDR_BH; /* Can't enable bh w/irq disabled. */
+        if ((mask & RCUTORTURE_RDR_IRQ) &&
+            !(mask & cur_ops->ext_irq_conflict) &&
+            (oldmask & cur_ops->ext_irq_conflict))
+                mask |= cur_ops->ext_irq_conflict; /* Or if readers object. */
+        return mask ?: RCUTORTURE_RDR_RCU;
+}
+
+/*
+ * Do a randomly selected number of extensions of an existing RCU read-side
+ * critical section.
+ */
+static void rcutorture_loop_extend(int *readstate,
+                                   struct torture_random_state *trsp)
+{
+        int i;
+        int mask = rcutorture_extend_mask_max();
+
+        WARN_ON_ONCE(!*readstate); /* -Existing- RCU read-side critsect! */
+        if (!((mask - 1) & mask))
+                return;  /* Current RCU flavor not extendable. */
+        i = (torture_random(trsp) >> 3) & RCUTORTURE_RDR_MAX_LOOPS;
+        while (i--) {
+                mask = rcutorture_extend_mask(*readstate, trsp);
+                rcutorture_one_extend(readstate, mask, trsp);
+        }
+}
+
+/*
+ * Do one read-side critical section, returning false if there was
+ * no data to read.  Can be invoked both from process context and
+ * from a timer handler.
+ */
+static bool rcu_torture_one_read(struct torture_random_state *trsp)
 {
-        int idx;
         unsigned long started;
         unsigned long completed;
-        static DEFINE_TORTURE_RANDOM(rand);
-        static DEFINE_SPINLOCK(rand_lock);
+        int newstate;
         struct rcu_torture *p;
         int pipe_count;
+        int readstate = 0;
         unsigned long long ts;
 
-        idx = cur_ops->readlock();
-        if (cur_ops->started)
-                started = cur_ops->started();
-        else
-                started = cur_ops->completed();
+        newstate = rcutorture_extend_mask(readstate, trsp);
+        rcutorture_one_extend(&readstate, newstate, trsp);
+        started = cur_ops->get_gp_seq();
         ts = rcu_trace_clock_local();
         p = rcu_dereference_check(rcu_torture_current,
                                   rcu_read_lock_bh_held() ||
@@ -1112,39 +1324,50 @@ static void rcu_torture_timer(struct timer_list *unused)
                                   srcu_read_lock_held(srcu_ctlp) ||
                                   torturing_tasks());
         if (p == NULL) {
-                /* Leave because rcu_torture_writer is not yet underway */
-                cur_ops->readunlock(idx);
-                return;
+                /* Wait for rcu_torture_writer to get underway */
+                rcutorture_one_extend(&readstate, 0, trsp);
+                return false;
         }
         if (p->rtort_mbtest == 0)
                 atomic_inc(&n_rcu_torture_mberror);
-        spin_lock(&rand_lock);
-        cur_ops->read_delay(&rand);
-        n_rcu_torture_timers++;
-        spin_unlock(&rand_lock);
+        rcutorture_loop_extend(&readstate, trsp);
         preempt_disable();
         pipe_count = p->rtort_pipe_count;
         if (pipe_count > RCU_TORTURE_PIPE_LEN) {
                 /* Should not happen, but... */
                 pipe_count = RCU_TORTURE_PIPE_LEN;
         }
-        completed = cur_ops->completed();
+        completed = cur_ops->get_gp_seq();
         if (pipe_count > 1) {
-                do_trace_rcu_torture_read(cur_ops->name, &p->rtort_rcu, ts,
-                                          started, completed);
+                do_trace_rcu_torture_read(cur_ops->name, &p->rtort_rcu,
+                                          ts, started, completed);
                 rcu_ftrace_dump(DUMP_ALL);
         }
         __this_cpu_inc(rcu_torture_count[pipe_count]);
-        completed = completed - started;
-        if (cur_ops->started)
-                completed++;
+        completed = rcutorture_seq_diff(completed, started);
         if (completed > RCU_TORTURE_PIPE_LEN) {
                 /* Should not happen, but... */
                 completed = RCU_TORTURE_PIPE_LEN;
         }
         __this_cpu_inc(rcu_torture_batch[completed]);
         preempt_enable();
-        cur_ops->readunlock(idx);
+        rcutorture_one_extend(&readstate, 0, trsp);
+        WARN_ON_ONCE(readstate & RCUTORTURE_RDR_MASK);
+        return true;
+}
+
+static DEFINE_TORTURE_RANDOM_PERCPU(rcu_torture_timer_rand);
+
+/*
+ * RCU torture reader from timer handler.  Dereferences rcu_torture_current,
+ * incrementing the corresponding element of the pipeline array.  The
+ * counter in the element should never be greater than 1, otherwise, the
+ * RCU implementation is broken.
+ */
+static void rcu_torture_timer(struct timer_list *unused)
+{
+        atomic_long_inc(&n_rcu_torture_timers);
+        (void)rcu_torture_one_read(this_cpu_ptr(&rcu_torture_timer_rand));
 
         /* Test call_rcu() invocation from interrupt handler. */
         if (cur_ops->call) {
@@ -1164,14 +1387,8 @@ static void rcu_torture_timer(struct timer_list *unused)
 static int
 rcu_torture_reader(void *arg)
 {
-        unsigned long started;
-        unsigned long completed;
-        int idx;
         DEFINE_TORTURE_RANDOM(rand);
-        struct rcu_torture *p;
-        int pipe_count;
         struct timer_list t;
-        unsigned long long ts;
 
         VERBOSE_TOROUT_STRING("rcu_torture_reader task started");
         set_user_nice(current, MAX_NICE);
@@ -1183,49 +1400,8 @@ rcu_torture_reader(void *arg)
                         if (!timer_pending(&t))
                                 mod_timer(&t, jiffies + 1);
                 }
-                idx = cur_ops->readlock();
-                if (cur_ops->started)
-                        started = cur_ops->started();
-                else
-                        started = cur_ops->completed();
-                ts = rcu_trace_clock_local();
-                p = rcu_dereference_check(rcu_torture_current,
-                                          rcu_read_lock_bh_held() ||
-                                          rcu_read_lock_sched_held() ||
-                                          srcu_read_lock_held(srcu_ctlp) ||
-                                          torturing_tasks());
-                if (p == NULL) {
-                        /* Wait for rcu_torture_writer to get underway */
-                        cur_ops->readunlock(idx);
+                if (!rcu_torture_one_read(&rand))
                         schedule_timeout_interruptible(HZ);
-                        continue;
-                }
-                if (p->rtort_mbtest == 0)
-                        atomic_inc(&n_rcu_torture_mberror);
-                cur_ops->read_delay(&rand);
-                preempt_disable();
-                pipe_count = p->rtort_pipe_count;
-                if (pipe_count > RCU_TORTURE_PIPE_LEN) {
-                        /* Should not happen, but... */
-                        pipe_count = RCU_TORTURE_PIPE_LEN;
-                }
-                completed = cur_ops->completed();
-                if (pipe_count > 1) {
-                        do_trace_rcu_torture_read(cur_ops->name, &p->rtort_rcu,
-                                                  ts, started, completed);
-                        rcu_ftrace_dump(DUMP_ALL);
-                }
-                __this_cpu_inc(rcu_torture_count[pipe_count]);
-                completed = completed - started;
-                if (cur_ops->started)
-                        completed++;
-                if (completed > RCU_TORTURE_PIPE_LEN) {
-                        /* Should not happen, but... */
-                        completed = RCU_TORTURE_PIPE_LEN;
-                }
-                __this_cpu_inc(rcu_torture_batch[completed]);
-                preempt_enable();
-                cur_ops->readunlock(idx);
                 stutter_wait("rcu_torture_reader");
         } while (!torture_must_stop());
         if (irqreader && cur_ops->irq_capable) {
@@ -1282,7 +1458,7 @@ rcu_torture_stats_print(void)
         pr_cont("rtbf: %ld rtb: %ld nt: %ld ",
                 n_rcu_torture_boost_failure,
                 n_rcu_torture_boosts,
-                n_rcu_torture_timers);
+                atomic_long_read(&n_rcu_torture_timers));
         torture_onoff_stats();
         pr_cont("barrier: %ld/%ld:%ld ",
                 n_barrier_successes,
@@ -1324,18 +1500,16 @@ rcu_torture_stats_print(void)
         if (rtcv_snap == rcu_torture_current_version &&
             rcu_torture_current != NULL) {
                 int __maybe_unused flags = 0;
-                unsigned long __maybe_unused gpnum = 0;
-                unsigned long __maybe_unused completed = 0;
+                unsigned long __maybe_unused gp_seq = 0;
 
                 rcutorture_get_gp_data(cur_ops->ttype,
-                                       &flags, &gpnum, &completed);
+                                       &flags, &gp_seq);
                 srcutorture_get_gp_data(cur_ops->ttype, srcu_ctlp,
-                                        &flags, &gpnum, &completed);
+                                        &flags, &gp_seq);
                 wtp = READ_ONCE(writer_task);
-                pr_alert("??? Writer stall state %s(%d) g%lu c%lu f%#x ->state %#lx cpu %d\n",
+                pr_alert("??? Writer stall state %s(%d) g%lu f%#x ->state %#lx cpu %d\n",
                          rcu_torture_writer_state_getname(),
-                         rcu_torture_writer_state,
-                         gpnum, completed, flags,
+                         rcu_torture_writer_state, gp_seq, flags,
                          wtp == NULL ? ~0UL : wtp->state,
                          wtp == NULL ? -1 : (int)task_cpu(wtp));
                 if (!splatted && wtp) {
@@ -1365,7 +1539,7 @@ rcu_torture_stats(void *arg)
         return 0;
 }
 
-static inline void
+static void
 rcu_torture_print_module_parms(struct rcu_torture_ops *cur_ops, const char *tag)
 {
         pr_alert("%s" TORTURE_FLAG
@@ -1397,6 +1571,7 @@ static int rcutorture_booster_cleanup(unsigned int cpu)
         mutex_lock(&boost_mutex);
         t = boost_tasks[cpu];
         boost_tasks[cpu] = NULL;
+        rcu_torture_enable_rt_throttle();
         mutex_unlock(&boost_mutex);
 
         /* This must be outside of the mutex, otherwise deadlock! */
@@ -1413,6 +1588,7 @@ static int rcutorture_booster_init(unsigned int cpu)
 
         /* Don't allow time recalculation while creating a new task. */
         mutex_lock(&boost_mutex);
+        rcu_torture_disable_rt_throttle();
         VERBOSE_TOROUT_STRING("Creating rcu_torture_boost task");
         boost_tasks[cpu] = kthread_create_on_node(rcu_torture_boost, NULL,
                                                   cpu_to_node(cpu),
@@ -1446,7 +1622,7 @@ static int rcu_torture_stall(void *args)
                 VERBOSE_TOROUT_STRING("rcu_torture_stall end holdoff");
         }
         if (!kthread_should_stop()) {
-                stop_at = get_seconds() + stall_cpu;
+                stop_at = ktime_get_seconds() + stall_cpu;
                 /* RCU CPU stall is expected behavior in following code. */
                 rcu_read_lock();
                 if (stall_cpu_irqsoff)
@@ -1455,7 +1631,8 @@ static int rcu_torture_stall(void *args)
                         preempt_disable();
                 pr_alert("rcu_torture_stall start on CPU %d.\n",
                          smp_processor_id());
-                while (ULONG_CMP_LT(get_seconds(), stop_at))
+                while (ULONG_CMP_LT((unsigned long)ktime_get_seconds(),
+                                    stop_at))
                         continue;  /* Induce RCU CPU stall warning. */
                 if (stall_cpu_irqsoff)
                         local_irq_enable();
@@ -1546,8 +1723,9 @@ static int rcu_torture_barrier(void *arg)
                                atomic_read(&barrier_cbs_invoked),
                                n_barrier_cbs);
                         WARN_ON_ONCE(1);
+                } else {
+                        n_barrier_successes++;
                 }
-                n_barrier_successes++;
                 schedule_timeout_interruptible(HZ / 10);
         } while (!torture_must_stop());
         torture_kthread_stopping("rcu_torture_barrier");
@@ -1610,17 +1788,39 @@ static void rcu_torture_barrier_cleanup(void)
         }
 }
 
+static bool rcu_torture_can_boost(void)
+{
+        static int boost_warn_once;
+        int prio;
+
+        if (!(test_boost == 1 && cur_ops->can_boost) && test_boost != 2)
+                return false;
+
+        prio = rcu_get_gp_kthreads_prio();
+        if (!prio)
+                return false;
+
+        if (prio < 2) {
+                if (boost_warn_once  == 1)
+                        return false;
+
+                pr_alert("%s: WARN: RCU kthread priority too low to test boosting.  Skipping RCU boost test. Try passing rcutree.kthread_prio > 1 on the kernel command line.\n", KBUILD_MODNAME);
+                boost_warn_once = 1;
+                return false;
+        }
+
+        return true;
+}
+
 static enum cpuhp_state rcutor_hp;
 
 static void
 rcu_torture_cleanup(void)
 {
         int flags = 0;
-        unsigned long gpnum = 0;
-        unsigned long completed = 0;
+        unsigned long gp_seq = 0;
         int i;
 
-        rcutorture_record_test_transition();
         if (torture_cleanup_begin()) {
                 if (cur_ops->cb_barrier != NULL)
                         cur_ops->cb_barrier();
@@ -1648,17 +1848,15 @@ rcu_torture_cleanup(void)
                 fakewriter_tasks = NULL;
         }
 
-        rcutorture_get_gp_data(cur_ops->ttype, &flags, &gpnum, &completed);
-        srcutorture_get_gp_data(cur_ops->ttype, srcu_ctlp,
-                                &flags, &gpnum, &completed);
-        pr_alert("%s:  End-test grace-period state: g%lu c%lu f%#x\n",
-                 cur_ops->name, gpnum, completed, flags);
+        rcutorture_get_gp_data(cur_ops->ttype, &flags, &gp_seq);
+        srcutorture_get_gp_data(cur_ops->ttype, srcu_ctlp, &flags, &gp_seq);
+        pr_alert("%s:  End-test grace-period state: g%lu f%#x\n",
+                 cur_ops->name, gp_seq, flags);
         torture_stop_kthread(rcu_torture_stats, stats_task);
         torture_stop_kthread(rcu_torture_fqs, fqs_task);
         for (i = 0; i < ncbflooders; i++)
                 torture_stop_kthread(rcu_torture_cbflood, cbflood_task[i]);
-        if ((test_boost == 1 && cur_ops->can_boost) ||
-            test_boost == 2)
+        if (rcu_torture_can_boost())
                 cpuhp_remove_state(rcutor_hp);
 
         /*
@@ -1746,7 +1944,7 @@ rcu_torture_init(void)
         int firsterr = 0;
         static struct rcu_torture_ops *torture_ops[] = {
                 &rcu_ops, &rcu_bh_ops, &rcu_busted_ops, &srcu_ops, &srcud_ops,
-                &sched_ops, &tasks_ops,
+                &busted_srcud_ops, &sched_ops, &tasks_ops,
         };
 
         if (!torture_init_begin(torture_type, verbose))
@@ -1763,8 +1961,8 @@ rcu_torture_init(void)
                          torture_type);
                 pr_alert("rcu-torture types:");
                 for (i = 0; i < ARRAY_SIZE(torture_ops); i++)
-                        pr_alert(" %s", torture_ops[i]->name);
-                pr_alert("\n");
+                        pr_cont(" %s", torture_ops[i]->name);
+                pr_cont("\n");
                 firsterr = -EINVAL;
                 goto unwind;
         }
@@ -1882,8 +2080,7 @@ rcu_torture_init(void)
                 test_boost_interval = 1;
         if (test_boost_duration < 2)
                 test_boost_duration = 2;
-        if ((test_boost == 1 && cur_ops->can_boost) ||
-            test_boost == 2) {
+        if (rcu_torture_can_boost()) {
 
                 boost_starttime = jiffies + test_boost_interval * HZ;
 
@@ -1897,7 +2094,7 @@ rcu_torture_init(void)
         firsterr = torture_shutdown_init(shutdown_secs, rcu_torture_cleanup);
         if (firsterr)
                 goto unwind;
-        firsterr = torture_onoff_init(onoff_holdoff * HZ, onoff_interval * HZ);
+        firsterr = torture_onoff_init(onoff_holdoff * HZ, onoff_interval);
         if (firsterr)
                 goto unwind;
         firsterr = rcu_torture_stall_init();
@@ -1926,7 +2123,6 @@ rcu_torture_init(void)
                                 goto unwind;
                 }
         }
-        rcutorture_record_test_transition();
         torture_init_end();
         return 0;
 
diff --git a/kernel/rcu/srcutiny.c b/kernel/rcu/srcutiny.c
index 622792abe41a..04fc2ed71af8 100644
--- a/kernel/rcu/srcutiny.c
+++ b/kernel/rcu/srcutiny.c
@@ -110,7 +110,7 @@ void __srcu_read_unlock(struct srcu_struct *sp, int idx)
 
         WRITE_ONCE(sp->srcu_lock_nesting[idx], newval);
         if (!newval && READ_ONCE(sp->srcu_gp_waiting))
-                swake_up(&sp->srcu_wq);
+                swake_up_one(&sp->srcu_wq);
 }
 EXPORT_SYMBOL_GPL(__srcu_read_unlock);
 
@@ -140,7 +140,7 @@ void srcu_drive_gp(struct work_struct *wp)
         idx = sp->srcu_idx;
         WRITE_ONCE(sp->srcu_idx, !sp->srcu_idx);
         WRITE_ONCE(sp->srcu_gp_waiting, true);  /* srcu_read_unlock() wakes! */
-        swait_event(sp->srcu_wq, !READ_ONCE(sp->srcu_lock_nesting[idx]));
+        swait_event_exclusive(sp->srcu_wq, !READ_ONCE(sp->srcu_lock_nesting[idx]));
         WRITE_ONCE(sp->srcu_gp_waiting, false); /* srcu_read_unlock() cheap. */
 
         /* Invoke the callbacks we removed above. */
diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c
index b4123d7a2cec..6c9866a854b1 100644
--- a/kernel/rcu/srcutree.c
+++ b/kernel/rcu/srcutree.c
@@ -26,6 +26,8 @@
  *
  */
 
+#define pr_fmt(fmt) "rcu: " fmt
+
 #include <linux/export.h>
 #include <linux/mutex.h>
 #include <linux/percpu.h>
@@ -390,7 +392,8 @@ void _cleanup_srcu_struct(struct srcu_struct *sp, bool quiesced)
                 }
         if (WARN_ON(rcu_seq_state(READ_ONCE(sp->srcu_gp_seq)) != SRCU_STATE_IDLE) ||
             WARN_ON(srcu_readers_active(sp))) {
-                pr_info("%s: Active srcu_struct %p state: %d\n", __func__, sp, rcu_seq_state(READ_ONCE(sp->srcu_gp_seq)));
+                pr_info("%s: Active srcu_struct %p state: %d\n",
+                        __func__, sp, rcu_seq_state(READ_ONCE(sp->srcu_gp_seq)));
                 return; /* Caller forgot to stop doing call_srcu()? */
         }
         free_percpu(sp->sda);
@@ -641,6 +644,9 @@ static void srcu_funnel_exp_start(struct srcu_struct *sp, struct srcu_node *snp,
  * period s.  Losers must either ensure that their desired grace-period
  * number is recorded on at least their leaf srcu_node structure, or they
  * must take steps to invoke their own callbacks.
+ *
+ * Note that this function also does the work of srcu_funnel_exp_start(),
+ * in some cases by directly invoking it.
  */
 static void srcu_funnel_gp_start(struct srcu_struct *sp, struct srcu_data *sdp,
                                  unsigned long s, bool do_norm)
@@ -823,17 +829,17 @@ static void srcu_leak_callback(struct rcu_head *rhp)
  * more than one CPU, this means that when "func()" is invoked, each CPU
  * is guaranteed to have executed a full memory barrier since the end of
  * its last corresponding SRCU read-side critical section whose beginning
- * preceded the call to call_rcu().  It also means that each CPU executing
+ * preceded the call to call_srcu().  It also means that each CPU executing
  * an SRCU read-side critical section that continues beyond the start of
- * "func()" must have executed a memory barrier after the call_rcu()
+ * "func()" must have executed a memory barrier after the call_srcu()
  * but before the beginning of that SRCU read-side critical section.
  * Note that these guarantees include CPUs that are offline, idle, or
  * executing in user mode, as well as CPUs that are executing in the kernel.
  *
- * Furthermore, if CPU A invoked call_rcu() and CPU B invoked the
+ * Furthermore, if CPU A invoked call_srcu() and CPU B invoked the
  * resulting SRCU callback function "func()", then both CPU A and CPU
  * B are guaranteed to execute a full memory barrier during the time
- * interval between the call to call_rcu() and the invocation of "func()".
+ * interval between the call to call_srcu() and the invocation of "func()".
  * This guarantee applies even if CPU A and CPU B are the same CPU (but
  * again only if the system has more than one CPU).
  *
@@ -1246,13 +1252,12 @@ static void process_srcu(struct work_struct *work)
 
 void srcutorture_get_gp_data(enum rcutorture_type test_type,
                              struct srcu_struct *sp, int *flags,
-                             unsigned long *gpnum, unsigned long *completed)
+                             unsigned long *gp_seq)
 {
         if (test_type != SRCU_FLAVOR)
                 return;
         *flags = 0;
-        *completed = rcu_seq_ctr(sp->srcu_gp_seq);
-        *gpnum = rcu_seq_ctr(sp->srcu_gp_seq_needed);
+        *gp_seq = rcu_seq_current(&sp->srcu_gp_seq);
 }
 EXPORT_SYMBOL_GPL(srcutorture_get_gp_data);
 
@@ -1263,16 +1268,17 @@ void srcu_torture_stats_print(struct srcu_struct *sp, char *tt, char *tf)
         unsigned long s0 = 0, s1 = 0;
 
         idx = sp->srcu_idx & 0x1;
-        pr_alert("%s%s Tree SRCU per-CPU(idx=%d):", tt, tf, idx);
+        pr_alert("%s%s Tree SRCU g%ld per-CPU(idx=%d):",
+                 tt, tf, rcu_seq_current(&sp->srcu_gp_seq), idx);
         for_each_possible_cpu(cpu) {
                 unsigned long l0, l1;
                 unsigned long u0, u1;
                 long c0, c1;
-                struct srcu_data *counts;
+                struct srcu_data *sdp;
 
-                counts = per_cpu_ptr(sp->sda, cpu);
-                u0 = counts->srcu_unlock_count[!idx];
-                u1 = counts->srcu_unlock_count[idx];
+                sdp = per_cpu_ptr(sp->sda, cpu);
+                u0 = sdp->srcu_unlock_count[!idx];
+                u1 = sdp->srcu_unlock_count[idx];
 
                 /*
                  * Make sure that a lock is always counted if the corresponding
@@ -1280,12 +1286,13 @@ void srcu_torture_stats_print(struct srcu_struct *sp, char *tt, char *tf)
                  */
                 smp_rmb();
 
-                l0 = counts->srcu_lock_count[!idx];
-                l1 = counts->srcu_lock_count[idx];
+                l0 = sdp->srcu_lock_count[!idx];
+                l1 = sdp->srcu_lock_count[idx];
 
                 c0 = l0 - u0;
                 c1 = l1 - u1;
-                pr_cont(" %d(%ld,%ld)", cpu, c0, c1);
+                pr_cont(" %d(%ld,%ld %1p)",
+                        cpu, c0, c1, rcu_segcblist_head(&sdp->srcu_cblist));
                 s0 += c0;
                 s1 += c1;
         }
diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
index a64eee0db39e..befc9321a89c 100644
--- a/kernel/rcu/tiny.c
+++ b/kernel/rcu/tiny.c
@@ -122,10 +122,8 @@ void rcu_check_callbacks(int user)
 {
         if (user)
                 rcu_sched_qs();
-        else if (!in_softirq())
+        if (user || !in_softirq())
                 rcu_bh_qs();
-        if (user)
-                rcu_note_voluntary_context_switch(current);
 }
 
 /*
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index aa7cade1b9f3..0b760c1369f7 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -27,6 +27,9 @@
  * For detailed explanation of Read-Copy Update mechanism see -
  *      Documentation/RCU
  */
+
+#define pr_fmt(fmt) "rcu: " fmt
+
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -95,13 +98,13 @@ struct rcu_state sname##_state = { \
         .rda = &sname##_data, \
         .call = cr, \
         .gp_state = RCU_GP_IDLE, \
-        .gpnum = 0UL - 300UL, \
-        .completed = 0UL - 300UL, \
+        .gp_seq = (0UL - 300UL) << RCU_SEQ_CTR_SHIFT, \
         .barrier_mutex = __MUTEX_INITIALIZER(sname##_state.barrier_mutex), \
         .name = RCU_STATE_NAME(sname), \
         .abbr = sabbr, \
         .exp_mutex = __MUTEX_INITIALIZER(sname##_state.exp_mutex), \
         .exp_wake_mutex = __MUTEX_INITIALIZER(sname##_state.exp_wake_mutex), \
+        .ofl_lock = __SPIN_LOCK_UNLOCKED(sname##_state.ofl_lock), \
 }
 
 RCU_STATE_INITIALIZER(rcu_sched, 's', call_rcu_sched);
@@ -155,6 +158,9 @@ EXPORT_SYMBOL_GPL(rcu_scheduler_active);
  */
 static int rcu_scheduler_fully_active __read_mostly;
 
+static void
+rcu_report_qs_rnp(unsigned long mask, struct rcu_state *rsp,
+                  struct rcu_node *rnp, unsigned long gps, unsigned long flags);
 static void rcu_init_new_rnp(struct rcu_node *rnp_leaf);
 static void rcu_cleanup_dead_rnp(struct rcu_node *rnp_leaf);
 static void rcu_boost_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu);
@@ -177,6 +183,13 @@ module_param(gp_init_delay, int, 0444);
 static int gp_cleanup_delay;
 module_param(gp_cleanup_delay, int, 0444);
 
+/* Retreive RCU kthreads priority for rcutorture */
+int rcu_get_gp_kthreads_prio(void)
+{
+        return kthread_prio;
+}
+EXPORT_SYMBOL_GPL(rcu_get_gp_kthreads_prio);
+
 /*
  * Number of grace periods between delays, normalized by the duration of
  * the delay.  The longer the delay, the more the grace periods between
@@ -189,18 +202,6 @@ module_param(gp_cleanup_delay, int, 0444);
 #define PER_RCU_NODE_PERIOD 3   /* Number of grace periods between delays. */
 
 /*
- * Track the rcutorture test sequence number and the update version
- * number within a given test.  The rcutorture_testseq is incremented
- * on every rcutorture module load and unload, so has an odd value
- * when a test is running.  The rcutorture_vernum is set to zero
- * when rcutorture starts and is incremented on each rcutorture update.
- * These variables enable correlating rcutorture output with the
- * RCU tracing information.
- */
-unsigned long rcutorture_testseq;
-unsigned long rcutorture_vernum;
-
-/*
  * Compute the mask of online CPUs for the specified rcu_node structure.
  * This will not be stable unless the rcu_node structure's ->lock is
  * held, but the bit corresponding to the current CPU will be stable
@@ -218,7 +219,7 @@ unsigned long rcu_rnp_online_cpus(struct rcu_node *rnp)
  */
 static int rcu_gp_in_progress(struct rcu_state *rsp)
 {
-        return READ_ONCE(rsp->completed) != READ_ONCE(rsp->gpnum);
+        return rcu_seq_state(rcu_seq_current(&rsp->gp_seq));
 }
 
 /*
@@ -233,7 +234,7 @@ void rcu_sched_qs(void)
         if (!__this_cpu_read(rcu_sched_data.cpu_no_qs.s))
                 return;
         trace_rcu_grace_period(TPS("rcu_sched"),
-                               __this_cpu_read(rcu_sched_data.gpnum),
+                               __this_cpu_read(rcu_sched_data.gp_seq),
                                TPS("cpuqs"));
         __this_cpu_write(rcu_sched_data.cpu_no_qs.b.norm, false);
         if (!__this_cpu_read(rcu_sched_data.cpu_no_qs.b.exp))
@@ -248,7 +249,7 @@ void rcu_bh_qs(void)
         RCU_LOCKDEP_WARN(preemptible(), "rcu_bh_qs() invoked with preemption enabled!!!");
         if (__this_cpu_read(rcu_bh_data.cpu_no_qs.s)) {
                 trace_rcu_grace_period(TPS("rcu_bh"),
-                                       __this_cpu_read(rcu_bh_data.gpnum),
+                                       __this_cpu_read(rcu_bh_data.gp_seq),
                                        TPS("cpuqs"));
                 __this_cpu_write(rcu_bh_data.cpu_no_qs.b.norm, false);
         }
@@ -380,20 +381,6 @@ static bool rcu_dynticks_in_eqs_since(struct rcu_dynticks *rdtp, int snap)
 }
 
 /*
- * Do a double-increment of the ->dynticks counter to emulate a
- * momentary idle-CPU quiescent state.
- */
-static void rcu_dynticks_momentary_idle(void)
-{
-        struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks);
-        int special = atomic_add_return(2 * RCU_DYNTICK_CTRL_CTR,
-                                        &rdtp->dynticks);
-
-        /* It is illegal to call this from idle state. */
-        WARN_ON_ONCE(!(special & RCU_DYNTICK_CTRL_CTR));
-}
-
-/*
  * Set the special (bottom) bit of the specified CPU so that it
  * will take special action (such as flushing its TLB) on the
  * next exit from an extended quiescent state.  Returns true if
@@ -424,12 +411,17 @@ bool rcu_eqs_special_set(int cpu)
  *
  * We inform the RCU core by emulating a zero-duration dyntick-idle period.
  *
- * The caller must have disabled interrupts.
+ * The caller must have disabled interrupts and must not be idle.
  */
 static void rcu_momentary_dyntick_idle(void)
 {
+        struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks);
+        int special;
+
         raw_cpu_write(rcu_dynticks.rcu_need_heavy_qs, false);
-        rcu_dynticks_momentary_idle();
+        special = atomic_add_return(2 * RCU_DYNTICK_CTRL_CTR, &rdtp->dynticks);
+        /* It is illegal to call this from idle state. */
+        WARN_ON_ONCE(!(special & RCU_DYNTICK_CTRL_CTR));
 }
 
 /*
@@ -451,7 +443,7 @@ void rcu_note_context_switch(bool preempt)
                 rcu_momentary_dyntick_idle();
         this_cpu_inc(rcu_dynticks.rcu_qs_ctr);
         if (!preempt)
-                rcu_note_voluntary_context_switch_lite(current);
+                rcu_tasks_qs(current);
 out:
         trace_rcu_utilization(TPS("End context switch"));
         barrier(); /* Avoid RCU read-side critical sections leaking up. */
@@ -513,8 +505,38 @@ static ulong jiffies_till_first_fqs = ULONG_MAX;
 static ulong jiffies_till_next_fqs = ULONG_MAX;
 static bool rcu_kick_kthreads;
 
-module_param(jiffies_till_first_fqs, ulong, 0644);
-module_param(jiffies_till_next_fqs, ulong, 0644);
+static int param_set_first_fqs_jiffies(const char *val, const struct kernel_param *kp)
+{
+        ulong j;
+        int ret = kstrtoul(val, 0, &j);
+
+        if (!ret)
+                WRITE_ONCE(*(ulong *)kp->arg, (j > HZ) ? HZ : j);
+        return ret;
+}
+
+static int param_set_next_fqs_jiffies(const char *val, const struct kernel_param *kp)
+{
+        ulong j;
+        int ret = kstrtoul(val, 0, &j);
+
+        if (!ret)
+                WRITE_ONCE(*(ulong *)kp->arg, (j > HZ) ? HZ : (j ?: 1));
+        return ret;
+}
+
+static struct kernel_param_ops first_fqs_jiffies_ops = {
+        .set = param_set_first_fqs_jiffies,
+        .get = param_get_ulong,
+};
+
+static struct kernel_param_ops next_fqs_jiffies_ops = {
+        .set = param_set_next_fqs_jiffies,
+        .get = param_get_ulong,
+};
+
+module_param_cb(jiffies_till_first_fqs, &first_fqs_jiffies_ops, &jiffies_till_first_fqs, 0644);
+module_param_cb(jiffies_till_next_fqs, &next_fqs_jiffies_ops, &jiffies_till_next_fqs, 0644);
 module_param(rcu_kick_kthreads, bool, 0644);
 
 /*
@@ -529,58 +551,31 @@ static void force_quiescent_state(struct rcu_state *rsp);
 static int rcu_pending(void);
 
 /*
- * Return the number of RCU batches started thus far for debug & stats.
+ * Return the number of RCU GPs completed thus far for debug & stats.
  */
-unsigned long rcu_batches_started(void)
+unsigned long rcu_get_gp_seq(void)
 {
-        return rcu_state_p->gpnum;
+        return READ_ONCE(rcu_state_p->gp_seq);
 }
-EXPORT_SYMBOL_GPL(rcu_batches_started);
+EXPORT_SYMBOL_GPL(rcu_get_gp_seq);
 
 /*
- * Return the number of RCU-sched batches started thus far for debug & stats.
+ * Return the number of RCU-sched GPs completed thus far for debug & stats.
  */
-unsigned long rcu_batches_started_sched(void)
+unsigned long rcu_sched_get_gp_seq(void)
 {
-        return rcu_sched_state.gpnum;
+        return READ_ONCE(rcu_sched_state.gp_seq);
 }
-EXPORT_SYMBOL_GPL(rcu_batches_started_sched);
+EXPORT_SYMBOL_GPL(rcu_sched_get_gp_seq);
 
 /*
- * Return the number of RCU BH batches started thus far for debug & stats.
+ * Return the number of RCU-bh GPs completed thus far for debug & stats.
  */
-unsigned long rcu_batches_started_bh(void)
+unsigned long rcu_bh_get_gp_seq(void)
 {
-        return rcu_bh_state.gpnum;
+        return READ_ONCE(rcu_bh_state.gp_seq);
 }
-EXPORT_SYMBOL_GPL(rcu_batches_started_bh);
-
-/*
- * Return the number of RCU batches completed thus far for debug & stats.
- */
-unsigned long rcu_batches_completed(void)
-{
-        return rcu_state_p->completed;
-}
-EXPORT_SYMBOL_GPL(rcu_batches_completed);
-
-/*
- * Return the number of RCU-sched batches completed thus far for debug & stats.
- */
-unsigned long rcu_batches_completed_sched(void)
-{
-        return rcu_sched_state.completed;
-}
-EXPORT_SYMBOL_GPL(rcu_batches_completed_sched);
-
-/*
- * Return the number of RCU BH batches completed thus far for debug & stats.
- */
-unsigned long rcu_batches_completed_bh(void)
-{
-        return rcu_bh_state.completed;
-}
-EXPORT_SYMBOL_GPL(rcu_batches_completed_bh);
+EXPORT_SYMBOL_GPL(rcu_bh_get_gp_seq);
 
 /*
  * Return the number of RCU expedited batches completed thus far for
@@ -636,35 +631,42 @@ EXPORT_SYMBOL_GPL(rcu_sched_force_quiescent_state);
  */
 void show_rcu_gp_kthreads(void)
 {
+        int cpu;
+        struct rcu_data *rdp;
+        struct rcu_node *rnp;
         struct rcu_state *rsp;
 
         for_each_rcu_flavor(rsp) {
                 pr_info("%s: wait state: %d ->state: %#lx\n",
                         rsp->name, rsp->gp_state, rsp->gp_kthread->state);
+                rcu_for_each_node_breadth_first(rsp, rnp) {
+                        if (ULONG_CMP_GE(rsp->gp_seq, rnp->gp_seq_needed))
+                                continue;
+                        pr_info("\trcu_node %d:%d ->gp_seq %lu ->gp_seq_needed %lu\n",
+                                rnp->grplo, rnp->grphi, rnp->gp_seq,
+                                rnp->gp_seq_needed);
+                        if (!rcu_is_leaf_node(rnp))
+                                continue;
+                        for_each_leaf_node_possible_cpu(rnp, cpu) {
+                                rdp = per_cpu_ptr(rsp->rda, cpu);
+                                if (rdp->gpwrap ||
+                                    ULONG_CMP_GE(rsp->gp_seq,
+                                                 rdp->gp_seq_needed))
+                                        continue;
+                                pr_info("\tcpu %d ->gp_seq_needed %lu\n",
+                                        cpu, rdp->gp_seq_needed);
+                        }
+                }
                 /* sched_show_task(rsp->gp_kthread); */
         }
 }
 EXPORT_SYMBOL_GPL(show_rcu_gp_kthreads);
 
 /*
- * Record the number of times rcutorture tests have been initiated and
- * terminated.  This information allows the debugfs tracing stats to be
- * correlated to the rcutorture messages, even when the rcutorture module
- * is being repeatedly loaded and unloaded.  In other words, we cannot
- * store this state in rcutorture itself.
- */
-void rcutorture_record_test_transition(void)
-{
-        rcutorture_testseq++;
-        rcutorture_vernum = 0;
-}
-EXPORT_SYMBOL_GPL(rcutorture_record_test_transition);
-
-/*
  * Send along grace-period-related data for rcutorture diagnostics.
  */
 void rcutorture_get_gp_data(enum rcutorture_type test_type, int *flags,
-                            unsigned long *gpnum, unsigned long *completed)
+                            unsigned long *gp_seq)
 {
         struct rcu_state *rsp = NULL;
 
@@ -684,23 +686,11 @@ void rcutorture_get_gp_data(enum rcutorture_type test_type, int *flags,
         if (rsp == NULL)
                 return;
         *flags = READ_ONCE(rsp->gp_flags);
-        *gpnum = READ_ONCE(rsp->gpnum);
-        *completed = READ_ONCE(rsp->completed);
+        *gp_seq = rcu_seq_current(&rsp->gp_seq);
 }
 EXPORT_SYMBOL_GPL(rcutorture_get_gp_data);
 
 /*
- * Record the number of writer passes through the current rcutorture test.
- * This is also used to correlate debugfs tracing stats with the rcutorture
- * messages.
- */
-void rcutorture_record_progress(unsigned long vernum)
-{
-        rcutorture_vernum++;
-}
-EXPORT_SYMBOL_GPL(rcutorture_record_progress);
-
-/*
  * Return the root node of the specified rcu_state structure.
  */
 static struct rcu_node *rcu_get_root(struct rcu_state *rsp)
@@ -1059,41 +1049,41 @@ void rcu_request_urgent_qs_task(struct task_struct *t)
 #if defined(CONFIG_PROVE_RCU) && defined(CONFIG_HOTPLUG_CPU)
 
 /*
- * Is the current CPU online?  Disable preemption to avoid false positives
- * that could otherwise happen due to the current CPU number being sampled,
- * this task being preempted, its old CPU being taken offline, resuming
- * on some other CPU, then determining that its old CPU is now offline.
- * It is OK to use RCU on an offline processor during initial boot, hence
- * the check for rcu_scheduler_fully_active.  Note also that it is OK
- * for a CPU coming online to use RCU for one jiffy prior to marking itself
- * online in the cpu_online_mask.  Similarly, it is OK for a CPU going
- * offline to continue to use RCU for one jiffy after marking itself
- * offline in the cpu_online_mask.  This leniency is necessary given the
- * non-atomic nature of the online and offline processing, for example,
- * the fact that a CPU enters the scheduler after completing the teardown
- * of the CPU.
+ * Is the current CPU online as far as RCU is concerned?
  *
- * This is also why RCU internally marks CPUs online during in the
- * preparation phase and offline after the CPU has been taken down.
+ * Disable preemption to avoid false positives that could otherwise
+ * happen due to the current CPU number being sampled, this task being
+ * preempted, its old CPU being taken offline, resuming on some other CPU,
+ * then determining that its old CPU is now offline.  Because there are
+ * multiple flavors of RCU, and because this function can be called in the
+ * midst of updating the flavors while a given CPU coming online or going
+ * offline, it is necessary to check all flavors.  If any of the flavors
+ * believe that given CPU is online, it is considered to be online.
  *
- * Disable checking if in an NMI handler because we cannot safely report
- * errors from NMI handlers anyway.
+ * Disable checking if in an NMI handler because we cannot safely
+ * report errors from NMI handlers anyway.  In addition, it is OK to use
+ * RCU on an offline processor during initial boot, hence the check for
+ * rcu_scheduler_fully_active.
  */
 bool rcu_lockdep_current_cpu_online(void)
 {
         struct rcu_data *rdp;
         struct rcu_node *rnp;
-        bool ret;
+        struct rcu_state *rsp;
 
-        if (in_nmi())
+        if (in_nmi() || !rcu_scheduler_fully_active)
                 return true;
         preempt_disable();
-        rdp = this_cpu_ptr(&rcu_sched_data);
-        rnp = rdp->mynode;
-        ret = (rdp->grpmask & rcu_rnp_online_cpus(rnp)) ||
-              !rcu_scheduler_fully_active;
+        for_each_rcu_flavor(rsp) {
+                rdp = this_cpu_ptr(rsp->rda);
+                rnp = rdp->mynode;
+                if (rdp->grpmask & rcu_rnp_online_cpus(rnp)) {
+                        preempt_enable();
+                        return true;
+                }
+        }
         preempt_enable();
-        return ret;
+        return false;
 }
 EXPORT_SYMBOL_GPL(rcu_lockdep_current_cpu_online);
 
@@ -1115,17 +1105,18 @@ static int rcu_is_cpu_rrupt_from_idle(void)
 /*
  * We are reporting a quiescent state on behalf of some other CPU, so
  * it is our responsibility to check for and handle potential overflow
- * of the rcu_node ->gpnum counter with respect to the rcu_data counters.
+ * of the rcu_node ->gp_seq counter with respect to the rcu_data counters.
  * After all, the CPU might be in deep idle state, and thus executing no
  * code whatsoever.
  */
 static void rcu_gpnum_ovf(struct rcu_node *rnp, struct rcu_data *rdp)
 {
         raw_lockdep_assert_held_rcu_node(rnp);
-        if (ULONG_CMP_LT(READ_ONCE(rdp->gpnum) + ULONG_MAX / 4, rnp->gpnum))
+        if (ULONG_CMP_LT(rcu_seq_current(&rdp->gp_seq) + ULONG_MAX / 4,
+                         rnp->gp_seq))
                 WRITE_ONCE(rdp->gpwrap, true);
-        if (ULONG_CMP_LT(rdp->rcu_iw_gpnum + ULONG_MAX / 4, rnp->gpnum))
-                rdp->rcu_iw_gpnum = rnp->gpnum + ULONG_MAX / 4;
+        if (ULONG_CMP_LT(rdp->rcu_iw_gp_seq + ULONG_MAX / 4, rnp->gp_seq))
+                rdp->rcu_iw_gp_seq = rnp->gp_seq + ULONG_MAX / 4;
 }
 
 /*
@@ -1137,7 +1128,7 @@ static int dyntick_save_progress_counter(struct rcu_data *rdp)
 {
         rdp->dynticks_snap = rcu_dynticks_snap(rdp->dynticks);
         if (rcu_dynticks_in_eqs(rdp->dynticks_snap)) {
-                trace_rcu_fqs(rdp->rsp->name, rdp->gpnum, rdp->cpu, TPS("dti"));
+                trace_rcu_fqs(rdp->rsp->name, rdp->gp_seq, rdp->cpu, TPS("dti"));
                 rcu_gpnum_ovf(rdp->mynode, rdp);
                 return 1;
         }
@@ -1159,7 +1150,7 @@ static void rcu_iw_handler(struct irq_work *iwp)
         rnp = rdp->mynode;
         raw_spin_lock_rcu_node(rnp);
         if (!WARN_ON_ONCE(!rdp->rcu_iw_pending)) {
-                rdp->rcu_iw_gpnum = rnp->gpnum;
+                rdp->rcu_iw_gp_seq = rnp->gp_seq;
                 rdp->rcu_iw_pending = false;
         }
         raw_spin_unlock_rcu_node(rnp);
@@ -1187,7 +1178,7 @@ static int rcu_implicit_dynticks_qs(struct rcu_data *rdp)
          * of the current RCU grace period.
          */
         if (rcu_dynticks_in_eqs_since(rdp->dynticks, rdp->dynticks_snap)) {
-                trace_rcu_fqs(rdp->rsp->name, rdp->gpnum, rdp->cpu, TPS("dti"));
+                trace_rcu_fqs(rdp->rsp->name, rdp->gp_seq, rdp->cpu, TPS("dti"));
                 rdp->dynticks_fqs++;
                 rcu_gpnum_ovf(rnp, rdp);
                 return 1;
@@ -1203,8 +1194,8 @@ static int rcu_implicit_dynticks_qs(struct rcu_data *rdp)
         ruqp = per_cpu_ptr(&rcu_dynticks.rcu_urgent_qs, rdp->cpu);
         if (time_after(jiffies, rdp->rsp->gp_start + jtsq) &&
             READ_ONCE(rdp->rcu_qs_ctr_snap) != per_cpu(rcu_dynticks.rcu_qs_ctr, rdp->cpu) &&
-            READ_ONCE(rdp->gpnum) == rnp->gpnum && !rdp->gpwrap) {
-                trace_rcu_fqs(rdp->rsp->name, rdp->gpnum, rdp->cpu, TPS("rqc"));
+            rcu_seq_current(&rdp->gp_seq) == rnp->gp_seq && !rdp->gpwrap) {
+                trace_rcu_fqs(rdp->rsp->name, rdp->gp_seq, rdp->cpu, TPS("rqc"));
                 rcu_gpnum_ovf(rnp, rdp);
                 return 1;
         } else if (time_after(jiffies, rdp->rsp->gp_start + jtsq)) {
@@ -1212,12 +1203,25 @@ static int rcu_implicit_dynticks_qs(struct rcu_data *rdp)
                 smp_store_release(ruqp, true);
         }
 
-        /* Check for the CPU being offline. */
-        if (!(rdp->grpmask & rcu_rnp_online_cpus(rnp))) {
-                trace_rcu_fqs(rdp->rsp->name, rdp->gpnum, rdp->cpu, TPS("ofl"));
-                rdp->offline_fqs++;
-                rcu_gpnum_ovf(rnp, rdp);
-                return 1;
+        /* If waiting too long on an offline CPU, complain. */
+        if (!(rdp->grpmask & rcu_rnp_online_cpus(rnp)) &&
+            time_after(jiffies, rdp->rsp->gp_start + HZ)) {
+                bool onl;
+                struct rcu_node *rnp1;
+
+                WARN_ON(1);  /* Offline CPUs are supposed to report QS! */
+                pr_info("%s: grp: %d-%d level: %d ->gp_seq %ld ->completedqs %ld\n",
+                        __func__, rnp->grplo, rnp->grphi, rnp->level,
+                        (long)rnp->gp_seq, (long)rnp->completedqs);
+                for (rnp1 = rnp; rnp1; rnp1 = rnp1->parent)
+                        pr_info("%s: %d:%d ->qsmask %#lx ->qsmaskinit %#lx ->qsmaskinitnext %#lx ->rcu_gp_init_mask %#lx\n",
+                                __func__, rnp1->grplo, rnp1->grphi, rnp1->qsmask, rnp1->qsmaskinit, rnp1->qsmaskinitnext, rnp1->rcu_gp_init_mask);
+                onl = !!(rdp->grpmask & rcu_rnp_online_cpus(rnp));
+                pr_info("%s %d: %c online: %ld(%d) offline: %ld(%d)\n",
+                        __func__, rdp->cpu, ".o"[onl],
+                        (long)rdp->rcu_onl_gp_seq, rdp->rcu_onl_gp_flags,
+                        (long)rdp->rcu_ofl_gp_seq, rdp->rcu_ofl_gp_flags);
+                return 1; /* Break things loose after complaining. */
         }
 
         /*
@@ -1256,11 +1260,11 @@ static int rcu_implicit_dynticks_qs(struct rcu_data *rdp)
         if (jiffies - rdp->rsp->gp_start > rcu_jiffies_till_stall_check() / 2) {
                 resched_cpu(rdp->cpu);
                 if (IS_ENABLED(CONFIG_IRQ_WORK) &&
-                    !rdp->rcu_iw_pending && rdp->rcu_iw_gpnum != rnp->gpnum &&
+                    !rdp->rcu_iw_pending && rdp->rcu_iw_gp_seq != rnp->gp_seq &&
                     (rnp->ffmask & rdp->grpmask)) {
                         init_irq_work(&rdp->rcu_iw, rcu_iw_handler);
                         rdp->rcu_iw_pending = true;
-                        rdp->rcu_iw_gpnum = rnp->gpnum;
+                        rdp->rcu_iw_gp_seq = rnp->gp_seq;
                         irq_work_queue_on(&rdp->rcu_iw, rdp->cpu);
                 }
         }
@@ -1274,9 +1278,9 @@ static void record_gp_stall_check_time(struct rcu_state *rsp)
         unsigned long j1;
 
         rsp->gp_start = j;
-        smp_wmb(); /* Record start time before stall time. */
         j1 = rcu_jiffies_till_stall_check();
-        WRITE_ONCE(rsp->jiffies_stall, j + j1);
+        /* Record ->gp_start before ->jiffies_stall. */
+        smp_store_release(&rsp->jiffies_stall, j + j1); /* ^^^ */
         rsp->jiffies_resched = j + j1 / 2;
         rsp->n_force_qs_gpstart = READ_ONCE(rsp->n_force_qs);
 }
@@ -1302,9 +1306,9 @@ static void rcu_check_gp_kthread_starvation(struct rcu_state *rsp)
         j = jiffies;
         gpa = READ_ONCE(rsp->gp_activity);
         if (j - gpa > 2 * HZ) {
-                pr_err("%s kthread starved for %ld jiffies! g%lu c%lu f%#x %s(%d) ->state=%#lx ->cpu=%d\n",
+                pr_err("%s kthread starved for %ld jiffies! g%ld f%#x %s(%d) ->state=%#lx ->cpu=%d\n",
                        rsp->name, j - gpa,
-                       rsp->gpnum, rsp->completed,
+                       (long)rcu_seq_current(&rsp->gp_seq),
                        rsp->gp_flags,
                        gp_state_getname(rsp->gp_state), rsp->gp_state,
                        rsp->gp_kthread ? rsp->gp_kthread->state : ~0,
@@ -1359,16 +1363,15 @@ static void rcu_stall_kick_kthreads(struct rcu_state *rsp)
         }
 }
 
-static inline void panic_on_rcu_stall(void)
+static void panic_on_rcu_stall(void)
 {
         if (sysctl_panic_on_rcu_stall)
                 panic("RCU Stall\n");
 }
 
-static void print_other_cpu_stall(struct rcu_state *rsp, unsigned long gpnum)
+static void print_other_cpu_stall(struct rcu_state *rsp, unsigned long gp_seq)
 {
         int cpu;
-        long delta;
         unsigned long flags;
         unsigned long gpa;
         unsigned long j;
@@ -1381,25 +1384,12 @@ static void print_other_cpu_stall(struct rcu_state *rsp, unsigned long gpnum)
         if (rcu_cpu_stall_suppress)
                 return;
 
-        /* Only let one CPU complain about others per time interval. */
-
-        raw_spin_lock_irqsave_rcu_node(rnp, flags);
-        delta = jiffies - READ_ONCE(rsp->jiffies_stall);
-        if (delta < RCU_STALL_RAT_DELAY || !rcu_gp_in_progress(rsp)) {
-                raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
-                return;
-        }
-        WRITE_ONCE(rsp->jiffies_stall,
-                   jiffies + 3 * rcu_jiffies_till_stall_check() + 3);
-        raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
-
         /*
          * OK, time to rat on our buddy...
          * See Documentation/RCU/stallwarn.txt for info on how to debug
          * RCU CPU stall warnings.
          */
-        pr_err("INFO: %s detected stalls on CPUs/tasks:",
-               rsp->name);
+        pr_err("INFO: %s detected stalls on CPUs/tasks:", rsp->name);
         print_cpu_stall_info_begin();
         rcu_for_each_leaf_node(rsp, rnp) {
                 raw_spin_lock_irqsave_rcu_node(rnp, flags);
@@ -1418,17 +1408,16 @@ static void print_other_cpu_stall(struct rcu_state *rsp, unsigned long gpnum)
         for_each_possible_cpu(cpu)
                 totqlen += rcu_segcblist_n_cbs(&per_cpu_ptr(rsp->rda,
                                                             cpu)->cblist);
-        pr_cont("(detected by %d, t=%ld jiffies, g=%ld, c=%ld, q=%lu)\n",
+        pr_cont("(detected by %d, t=%ld jiffies, g=%ld, q=%lu)\n",
                smp_processor_id(), (long)(jiffies - rsp->gp_start),
-               (long)rsp->gpnum, (long)rsp->completed, totqlen);
+               (long)rcu_seq_current(&rsp->gp_seq), totqlen);
         if (ndetected) {
                 rcu_dump_cpu_stacks(rsp);
 
                 /* Complain about tasks blocking the grace period. */
                 rcu_print_detail_task_stall(rsp);
         } else {
-                if (READ_ONCE(rsp->gpnum) != gpnum ||
-                    READ_ONCE(rsp->completed) == gpnum) {
+                if (rcu_seq_current(&rsp->gp_seq) != gp_seq) {
                         pr_err("INFO: Stall ended before state dump start\n");
                 } else {
                         j = jiffies;
@@ -1441,6 +1430,10 @@ static void print_other_cpu_stall(struct rcu_state *rsp, unsigned long gpnum)
                         sched_show_task(current);
                 }
         }
+        /* Rewrite if needed in case of slow consoles. */
+        if (ULONG_CMP_GE(jiffies, READ_ONCE(rsp->jiffies_stall)))
+                WRITE_ONCE(rsp->jiffies_stall,
+                           jiffies + 3 * rcu_jiffies_till_stall_check() + 3);
 
         rcu_check_gp_kthread_starvation(rsp);
 
@@ -1476,15 +1469,16 @@ static void print_cpu_stall(struct rcu_state *rsp)
         for_each_possible_cpu(cpu)
                 totqlen += rcu_segcblist_n_cbs(&per_cpu_ptr(rsp->rda,
                                                             cpu)->cblist);
-        pr_cont(" (t=%lu jiffies g=%ld c=%ld q=%lu)\n",
+        pr_cont(" (t=%lu jiffies g=%ld q=%lu)\n",
                 jiffies - rsp->gp_start,
-                (long)rsp->gpnum, (long)rsp->completed, totqlen);
+                (long)rcu_seq_current(&rsp->gp_seq), totqlen);
 
         rcu_check_gp_kthread_starvation(rsp);
 
         rcu_dump_cpu_stacks(rsp);
 
         raw_spin_lock_irqsave_rcu_node(rnp, flags);
+        /* Rewrite if needed in case of slow consoles. */
         if (ULONG_CMP_GE(jiffies, READ_ONCE(rsp->jiffies_stall)))
                 WRITE_ONCE(rsp->jiffies_stall,
                            jiffies + 3 * rcu_jiffies_till_stall_check() + 3);
@@ -1504,10 +1498,11 @@ static void print_cpu_stall(struct rcu_state *rsp)
 
 static void check_cpu_stall(struct rcu_state *rsp, struct rcu_data *rdp)
 {
-        unsigned long completed;
-        unsigned long gpnum;
+        unsigned long gs1;
+        unsigned long gs2;
         unsigned long gps;
         unsigned long j;
+        unsigned long jn;
         unsigned long js;
         struct rcu_node *rnp;
 
@@ -1520,43 +1515,46 @@ static void check_cpu_stall(struct rcu_state *rsp, struct rcu_data *rdp)
         /*
          * Lots of memory barriers to reject false positives.
          *
-         * The idea is to pick up rsp->gpnum, then rsp->jiffies_stall,
-         * then rsp->gp_start, and finally rsp->completed.  These values
-         * are updated in the opposite order with memory barriers (or
-         * equivalent) during grace-period initialization and cleanup.
-         * Now, a false positive can occur if we get an new value of
-         * rsp->gp_start and a old value of rsp->jiffies_stall.  But given
-         * the memory barriers, the only way that this can happen is if one
-         * grace period ends and another starts between these two fetches.
-         * Detect this by comparing rsp->completed with the previous fetch
-         * from rsp->gpnum.
+         * The idea is to pick up rsp->gp_seq, then rsp->jiffies_stall,
+         * then rsp->gp_start, and finally another copy of rsp->gp_seq.
+         * These values are updated in the opposite order with memory
+         * barriers (or equivalent) during grace-period initialization
+         * and cleanup.  Now, a false positive can occur if we get an new
+         * value of rsp->gp_start and a old value of rsp->jiffies_stall.
+         * But given the memory barriers, the only way that this can happen
+         * is if one grace period ends and another starts between these
+         * two fetches.  This is detected by comparing the second fetch
+         * of rsp->gp_seq with the previous fetch from rsp->gp_seq.
          *
          * Given this check, comparisons of jiffies, rsp->jiffies_stall,
          * and rsp->gp_start suffice to forestall false positives.
          */
-        gpnum = READ_ONCE(rsp->gpnum);
-        smp_rmb(); /* Pick up ->gpnum first... */
+        gs1 = READ_ONCE(rsp->gp_seq);
+        smp_rmb(); /* Pick up ->gp_seq first... */
         js = READ_ONCE(rsp->jiffies_stall);
         smp_rmb(); /* ...then ->jiffies_stall before the rest... */
         gps = READ_ONCE(rsp->gp_start);
-        smp_rmb(); /* ...and finally ->gp_start before ->completed. */
-        completed = READ_ONCE(rsp->completed);
-        if (ULONG_CMP_GE(completed, gpnum) ||
+        smp_rmb(); /* ...and finally ->gp_start before ->gp_seq again. */
+        gs2 = READ_ONCE(rsp->gp_seq);
+        if (gs1 != gs2 ||
             ULONG_CMP_LT(j, js) ||
             ULONG_CMP_GE(gps, js))
                 return; /* No stall or GP completed since entering function. */
         rnp = rdp->mynode;
+        jn = jiffies + 3 * rcu_jiffies_till_stall_check() + 3;
         if (rcu_gp_in_progress(rsp) &&
-            (READ_ONCE(rnp->qsmask) & rdp->grpmask)) {
+            (READ_ONCE(rnp->qsmask) & rdp->grpmask) &&
+            cmpxchg(&rsp->jiffies_stall, js, jn) == js) {
 
                 /* We haven't checked in, so go dump stack. */
                 print_cpu_stall(rsp);
 
         } else if (rcu_gp_in_progress(rsp) &&
-                   ULONG_CMP_GE(j, js + RCU_STALL_RAT_DELAY)) {
+                   ULONG_CMP_GE(j, js + RCU_STALL_RAT_DELAY) &&
+                   cmpxchg(&rsp->jiffies_stall, js, jn) == js) {
 
                 /* They had a few time units to dump stack, so complain. */
-                print_other_cpu_stall(rsp, gpnum);
+                print_other_cpu_stall(rsp, gs2);
         }
 }
 
@@ -1577,123 +1575,99 @@ void rcu_cpu_stall_reset(void)
                 WRITE_ONCE(rsp->jiffies_stall, jiffies + ULONG_MAX / 2);
 }
 
-/*
- * Determine the value that ->completed will have at the end of the
- * next subsequent grace period.  This is used to tag callbacks so that
- * a CPU can invoke callbacks in a timely fashion even if that CPU has
- * been dyntick-idle for an extended period with callbacks under the
- * influence of RCU_FAST_NO_HZ.
- *
- * The caller must hold rnp->lock with interrupts disabled.
- */
-static unsigned long rcu_cbs_completed(struct rcu_state *rsp,
-                                       struct rcu_node *rnp)
-{
-        raw_lockdep_assert_held_rcu_node(rnp);
-
-        /*
-         * If RCU is idle, we just wait for the next grace period.
-         * But we can only be sure that RCU is idle if we are looking
-         * at the root rcu_node structure -- otherwise, a new grace
-         * period might have started, but just not yet gotten around
-         * to initializing the current non-root rcu_node structure.
-         */
-        if (rcu_get_root(rsp) == rnp && rnp->gpnum == rnp->completed)
-                return rnp->completed + 1;
-
-        /*
-         * If the current rcu_node structure believes that RCU is
-         * idle, and if the rcu_state structure does not yet reflect
-         * the start of a new grace period, then the next grace period
-         * will suffice.  The memory barrier is needed to accurately
-         * sample the rsp->gpnum, and pairs with the second lock
-         * acquisition in rcu_gp_init(), which is augmented with
-         * smp_mb__after_unlock_lock() for this purpose.
-         */
-        if (rnp->gpnum == rnp->completed) {
-                smp_mb(); /* See above block comment. */
-                if (READ_ONCE(rsp->gpnum) == rnp->completed)
-                        return rnp->completed + 1;
-        }
-
-        /*
-         * Otherwise, wait for a possible partial grace period and
-         * then the subsequent full grace period.
-         */
-        return rnp->completed + 2;
-}
-
 /* Trace-event wrapper function for trace_rcu_future_grace_period.  */
 static void trace_rcu_this_gp(struct rcu_node *rnp, struct rcu_data *rdp,
-                              unsigned long c, const char *s)
+                              unsigned long gp_seq_req, const char *s)
 {
-        trace_rcu_future_grace_period(rdp->rsp->name, rnp->gpnum,
-                                      rnp->completed, c, rnp->level,
-                                      rnp->grplo, rnp->grphi, s);
+        trace_rcu_future_grace_period(rdp->rsp->name, rnp->gp_seq, gp_seq_req,
+                                      rnp->level, rnp->grplo, rnp->grphi, s);
 }
 
 /*
+ * rcu_start_this_gp - Request the start of a particular grace period
+ * @rnp_start: The leaf node of the CPU from which to start.
+ * @rdp: The rcu_data corresponding to the CPU from which to start.
+ * @gp_seq_req: The gp_seq of the grace period to start.
+ *
  * Start the specified grace period, as needed to handle newly arrived
  * callbacks.  The required future grace periods are recorded in each
- * rcu_node structure's ->need_future_gp[] field.  Returns true if there
+ * rcu_node structure's ->gp_seq_needed field.  Returns true if there
  * is reason to awaken the grace-period kthread.
  *
  * The caller must hold the specified rcu_node structure's ->lock, which
  * is why the caller is responsible for waking the grace-period kthread.
+ *
+ * Returns true if the GP thread needs to be awakened else false.
  */
-static bool rcu_start_this_gp(struct rcu_node *rnp, struct rcu_data *rdp,
-                              unsigned long c)
+static bool rcu_start_this_gp(struct rcu_node *rnp_start, struct rcu_data *rdp,
+                              unsigned long gp_seq_req)
 {
         bool ret = false;
         struct rcu_state *rsp = rdp->rsp;
-        struct rcu_node *rnp_root;
+        struct rcu_node *rnp;
 
         /*
          * Use funnel locking to either acquire the root rcu_node
          * structure's lock or bail out if the need for this grace period
-         * has already been recorded -- or has already started.  If there
-         * is already a grace period in progress in a non-leaf node, no
-         * recording is needed because the end of the grace period will
-         * scan the leaf rcu_node structures.  Note that rnp->lock must
-         * not be released.
+         * has already been recorded -- or if that grace period has in
+         * fact already started.  If there is already a grace period in
+         * progress in a non-leaf node, no recording is needed because the
+         * end of the grace period will scan the leaf rcu_node structures.
+         * Note that rnp_start->lock must not be released.
          */
-        raw_lockdep_assert_held_rcu_node(rnp);
-        trace_rcu_this_gp(rnp, rdp, c, TPS("Startleaf"));
-        for (rnp_root = rnp; 1; rnp_root = rnp_root->parent) {
-                if (rnp_root != rnp)
-                        raw_spin_lock_rcu_node(rnp_root);
-                WARN_ON_ONCE(ULONG_CMP_LT(rnp_root->gpnum +
-                                          need_future_gp_mask(), c));
-                if (need_future_gp_element(rnp_root, c) ||
-                    ULONG_CMP_GE(rnp_root->gpnum, c) ||
-                    (rnp != rnp_root &&
-                     rnp_root->gpnum != rnp_root->completed)) {
-                        trace_rcu_this_gp(rnp_root, rdp, c, TPS("Prestarted"));
+        raw_lockdep_assert_held_rcu_node(rnp_start);
+        trace_rcu_this_gp(rnp_start, rdp, gp_seq_req, TPS("Startleaf"));
+        for (rnp = rnp_start; 1; rnp = rnp->parent) {
+                if (rnp != rnp_start)
+                        raw_spin_lock_rcu_node(rnp);
+                if (ULONG_CMP_GE(rnp->gp_seq_needed, gp_seq_req) ||
+                    rcu_seq_started(&rnp->gp_seq, gp_seq_req) ||
+                    (rnp != rnp_start &&
+                     rcu_seq_state(rcu_seq_current(&rnp->gp_seq)))) {
+                        trace_rcu_this_gp(rnp, rdp, gp_seq_req,
+                                          TPS("Prestarted"));
                         goto unlock_out;
                 }
-                need_future_gp_element(rnp_root, c) = true;
-                if (rnp_root != rnp && rnp_root->parent != NULL)
-                        raw_spin_unlock_rcu_node(rnp_root);
-                if (!rnp_root->parent)
+                rnp->gp_seq_needed = gp_seq_req;
+                if (rcu_seq_state(rcu_seq_current(&rnp->gp_seq))) {
+                        /*
+                         * We just marked the leaf or internal node, and a
+                         * grace period is in progress, which means that
+                         * rcu_gp_cleanup() will see the marking.  Bail to
+                         * reduce contention.
+                         */
+                        trace_rcu_this_gp(rnp_start, rdp, gp_seq_req,
+                                          TPS("Startedleaf"));
+                        goto unlock_out;
+                }
+                if (rnp != rnp_start && rnp->parent != NULL)
+                        raw_spin_unlock_rcu_node(rnp);
+                if (!rnp->parent)
                         break;  /* At root, and perhaps also leaf. */
         }
 
         /* If GP already in progress, just leave, otherwise start one. */
-        if (rnp_root->gpnum != rnp_root->completed) {
-                trace_rcu_this_gp(rnp_root, rdp, c, TPS("Startedleafroot"));
+        if (rcu_gp_in_progress(rsp)) {
+                trace_rcu_this_gp(rnp, rdp, gp_seq_req, TPS("Startedleafroot"));
                 goto unlock_out;
         }
-        trace_rcu_this_gp(rnp_root, rdp, c, TPS("Startedroot"));
+        trace_rcu_this_gp(rnp, rdp, gp_seq_req, TPS("Startedroot"));
         WRITE_ONCE(rsp->gp_flags, rsp->gp_flags | RCU_GP_FLAG_INIT);
+        rsp->gp_req_activity = jiffies;
         if (!rsp->gp_kthread) {
-                trace_rcu_this_gp(rnp_root, rdp, c, TPS("NoGPkthread"));
+                trace_rcu_this_gp(rnp, rdp, gp_seq_req, TPS("NoGPkthread"));
                 goto unlock_out;
         }
-        trace_rcu_grace_period(rsp->name, READ_ONCE(rsp->gpnum), TPS("newreq"));
+        trace_rcu_grace_period(rsp->name, READ_ONCE(rsp->gp_seq), TPS("newreq"));
         ret = true;  /* Caller must wake GP kthread. */
 unlock_out:
-        if (rnp != rnp_root)
-                raw_spin_unlock_rcu_node(rnp_root);
+        /* Push furthest requested GP to leaf node and rcu_data structure. */
+        if (ULONG_CMP_LT(gp_seq_req, rnp->gp_seq_needed)) {
+                rnp_start->gp_seq_needed = rnp->gp_seq_needed;
+                rdp->gp_seq_needed = rnp->gp_seq_needed;
+        }
+        if (rnp != rnp_start)
+                raw_spin_unlock_rcu_node(rnp);
         return ret;
 }
 
@@ -1703,13 +1677,13 @@ unlock_out:
  */
 static bool rcu_future_gp_cleanup(struct rcu_state *rsp, struct rcu_node *rnp)
 {
-        unsigned long c = rnp->completed;
         bool needmore;
         struct rcu_data *rdp = this_cpu_ptr(rsp->rda);
 
-        need_future_gp_element(rnp, c) = false;
-        needmore = need_any_future_gp(rnp);
-        trace_rcu_this_gp(rnp, rdp, c,
+        needmore = ULONG_CMP_LT(rnp->gp_seq, rnp->gp_seq_needed);
+        if (!needmore)
+                rnp->gp_seq_needed = rnp->gp_seq; /* Avoid counter wrap. */
+        trace_rcu_this_gp(rnp, rdp, rnp->gp_seq,
                           needmore ? TPS("CleanupMore") : TPS("Cleanup"));
         return needmore;
 }
@@ -1727,25 +1701,25 @@ static void rcu_gp_kthread_wake(struct rcu_state *rsp)
             !READ_ONCE(rsp->gp_flags) ||
             !rsp->gp_kthread)
                 return;
-        swake_up(&rsp->gp_wq);
+        swake_up_one(&rsp->gp_wq);
 }
 
 /*
- * If there is room, assign a ->completed number to any callbacks on
- * this CPU that have not already been assigned.  Also accelerate any
- * callbacks that were previously assigned a ->completed number that has
- * since proven to be too conservative, which can happen if callbacks get
- * assigned a ->completed number while RCU is idle, but with reference to
- * a non-root rcu_node structure.  This function is idempotent, so it does
- * not hurt to call it repeatedly.  Returns an flag saying that we should
- * awaken the RCU grace-period kthread.
+ * If there is room, assign a ->gp_seq number to any callbacks on this
+ * CPU that have not already been assigned.  Also accelerate any callbacks
+ * that were previously assigned a ->gp_seq number that has since proven
+ * to be too conservative, which can happen if callbacks get assigned a
+ * ->gp_seq number while RCU is idle, but with reference to a non-root
+ * rcu_node structure.  This function is idempotent, so it does not hurt
+ * to call it repeatedly.  Returns an flag saying that we should awaken
+ * the RCU grace-period kthread.
  *
  * The caller must hold rnp->lock with interrupts disabled.
  */
 static bool rcu_accelerate_cbs(struct rcu_state *rsp, struct rcu_node *rnp,
                                struct rcu_data *rdp)
 {
-        unsigned long c;
+        unsigned long gp_seq_req;
         bool ret = false;
 
         raw_lockdep_assert_held_rcu_node(rnp);
@@ -1764,22 +1738,50 @@ static bool rcu_accelerate_cbs(struct rcu_state *rsp, struct rcu_node *rnp,
          * accelerating callback invocation to an earlier grace-period
          * number.
          */
-        c = rcu_cbs_completed(rsp, rnp);
-        if (rcu_segcblist_accelerate(&rdp->cblist, c))
-                ret = rcu_start_this_gp(rnp, rdp, c);
+        gp_seq_req = rcu_seq_snap(&rsp->gp_seq);
+        if (rcu_segcblist_accelerate(&rdp->cblist, gp_seq_req))
+                ret = rcu_start_this_gp(rnp, rdp, gp_seq_req);
 
         /* Trace depending on how much we were able to accelerate. */
         if (rcu_segcblist_restempty(&rdp->cblist, RCU_WAIT_TAIL))
-                trace_rcu_grace_period(rsp->name, rdp->gpnum, TPS("AccWaitCB"));
+                trace_rcu_grace_period(rsp->name, rdp->gp_seq, TPS("AccWaitCB"));
         else
-                trace_rcu_grace_period(rsp->name, rdp->gpnum, TPS("AccReadyCB"));
+                trace_rcu_grace_period(rsp->name, rdp->gp_seq, TPS("AccReadyCB"));
         return ret;
 }
 
 /*
+ * Similar to rcu_accelerate_cbs(), but does not require that the leaf
+ * rcu_node structure's ->lock be held.  It consults the cached value
+ * of ->gp_seq_needed in the rcu_data structure, and if that indicates
+ * that a new grace-period request be made, invokes rcu_accelerate_cbs()
+ * while holding the leaf rcu_node structure's ->lock.
+ */
+static void rcu_accelerate_cbs_unlocked(struct rcu_state *rsp,
+                                        struct rcu_node *rnp,
+                                        struct rcu_data *rdp)
+{
+        unsigned long c;
+        bool needwake;
+
+        lockdep_assert_irqs_disabled();
+        c = rcu_seq_snap(&rsp->gp_seq);
+        if (!rdp->gpwrap && ULONG_CMP_GE(rdp->gp_seq_needed, c)) {
+                /* Old request still live, so mark recent callbacks. */
+                (void)rcu_segcblist_accelerate(&rdp->cblist, c);
+                return;
+        }
+        raw_spin_lock_rcu_node(rnp); /* irqs already disabled. */
+        needwake = rcu_accelerate_cbs(rsp, rnp, rdp);
+        raw_spin_unlock_rcu_node(rnp); /* irqs remain disabled. */
+        if (needwake)
+                rcu_gp_kthread_wake(rsp);
+}
+
+/*
  * Move any callbacks whose grace period has completed to the
  * RCU_DONE_TAIL sublist, then compact the remaining sublists and
- * assign ->completed numbers to any callbacks in the RCU_NEXT_TAIL
+ * assign ->gp_seq numbers to any callbacks in the RCU_NEXT_TAIL
  * sublist.  This function is idempotent, so it does not hurt to
  * invoke it repeatedly.  As long as it is not invoked -too- often...
  * Returns true if the RCU grace-period kthread needs to be awakened.
@@ -1796,10 +1798,10 @@ static bool rcu_advance_cbs(struct rcu_state *rsp, struct rcu_node *rnp,
                 return false;
 
         /*
-         * Find all callbacks whose ->completed numbers indicate that they
+         * Find all callbacks whose ->gp_seq numbers indicate that they
          * are ready to invoke, and put them into the RCU_DONE_TAIL sublist.
          */
-        rcu_segcblist_advance(&rdp->cblist, rnp->completed);
+        rcu_segcblist_advance(&rdp->cblist, rnp->gp_seq);
 
         /* Classify any remaining callbacks. */
         return rcu_accelerate_cbs(rsp, rnp, rdp);
@@ -1819,39 +1821,38 @@ static bool __note_gp_changes(struct rcu_state *rsp, struct rcu_node *rnp,
 
         raw_lockdep_assert_held_rcu_node(rnp);
 
-        /* Handle the ends of any preceding grace periods first. */
-        if (rdp->completed == rnp->completed &&
-            !unlikely(READ_ONCE(rdp->gpwrap))) {
-
-                /* No grace period end, so just accelerate recent callbacks. */
-                ret = rcu_accelerate_cbs(rsp, rnp, rdp);
+        if (rdp->gp_seq == rnp->gp_seq)
+                return false; /* Nothing to do. */
 
+        /* Handle the ends of any preceding grace periods first. */
+        if (rcu_seq_completed_gp(rdp->gp_seq, rnp->gp_seq) ||
+            unlikely(READ_ONCE(rdp->gpwrap))) {
+                ret = rcu_advance_cbs(rsp, rnp, rdp); /* Advance callbacks. */
+                trace_rcu_grace_period(rsp->name, rdp->gp_seq, TPS("cpuend"));
         } else {
-
-                /* Advance callbacks. */
-                ret = rcu_advance_cbs(rsp, rnp, rdp);
-
-                /* Remember that we saw this grace-period completion. */
-                rdp->completed = rnp->completed;
-                trace_rcu_grace_period(rsp->name, rdp->gpnum, TPS("cpuend"));
+                ret = rcu_accelerate_cbs(rsp, rnp, rdp); /* Recent callbacks. */
         }
 
-        if (rdp->gpnum != rnp->gpnum || unlikely(READ_ONCE(rdp->gpwrap))) {
+        /* Now handle the beginnings of any new-to-this-CPU grace periods. */
+        if (rcu_seq_new_gp(rdp->gp_seq, rnp->gp_seq) ||
+            unlikely(READ_ONCE(rdp->gpwrap))) {
                 /*
                  * If the current grace period is waiting for this CPU,
                  * set up to detect a quiescent state, otherwise don't
                  * go looking for one.
                  */
-                rdp->gpnum = rnp->gpnum;
-                trace_rcu_grace_period(rsp->name, rdp->gpnum, TPS("cpustart"));
+                trace_rcu_grace_period(rsp->name, rnp->gp_seq, TPS("cpustart"));
                 need_gp = !!(rnp->qsmask & rdp->grpmask);
                 rdp->cpu_no_qs.b.norm = need_gp;
                 rdp->rcu_qs_ctr_snap = __this_cpu_read(rcu_dynticks.rcu_qs_ctr);
                 rdp->core_needs_qs = need_gp;
                 zero_cpu_stall_ticks(rdp);
-                WRITE_ONCE(rdp->gpwrap, false);
-                rcu_gpnum_ovf(rnp, rdp);
         }
+        rdp->gp_seq = rnp->gp_seq;  /* Remember new grace-period state. */
+        if (ULONG_CMP_GE(rnp->gp_seq_needed, rdp->gp_seq_needed) || rdp->gpwrap)
+                rdp->gp_seq_needed = rnp->gp_seq_needed;
+        WRITE_ONCE(rdp->gpwrap, false);
+        rcu_gpnum_ovf(rnp, rdp);
         return ret;
 }
 
@@ -1863,8 +1864,7 @@ static void note_gp_changes(struct rcu_state *rsp, struct rcu_data *rdp)
 
         local_irq_save(flags);
         rnp = rdp->mynode;
-        if ((rdp->gpnum == READ_ONCE(rnp->gpnum) &&
-             rdp->completed == READ_ONCE(rnp->completed) &&
+        if ((rdp->gp_seq == rcu_seq_current(&rnp->gp_seq) &&
              !unlikely(READ_ONCE(rdp->gpwrap))) || /* w/out lock. */
             !raw_spin_trylock_rcu_node(rnp)) { /* irqs already off, so later. */
                 local_irq_restore(flags);
@@ -1879,7 +1879,8 @@ static void note_gp_changes(struct rcu_state *rsp, struct rcu_data *rdp)
 static void rcu_gp_slow(struct rcu_state *rsp, int delay)
 {
         if (delay > 0 &&
-            !(rsp->gpnum % (rcu_num_nodes * PER_RCU_NODE_PERIOD * delay)))
+            !(rcu_seq_ctr(rsp->gp_seq) %
+              (rcu_num_nodes * PER_RCU_NODE_PERIOD * delay)))
                 schedule_timeout_uninterruptible(delay);
 }
 
@@ -1888,7 +1889,9 @@ static void rcu_gp_slow(struct rcu_state *rsp, int delay)
  */
 static bool rcu_gp_init(struct rcu_state *rsp)
 {
+        unsigned long flags;
         unsigned long oldmask;
+        unsigned long mask;
         struct rcu_data *rdp;
         struct rcu_node *rnp = rcu_get_root(rsp);
 
@@ -1912,9 +1915,9 @@ static bool rcu_gp_init(struct rcu_state *rsp)
 
         /* Advance to a new grace period and initialize state. */
         record_gp_stall_check_time(rsp);
-        /* Record GP times before starting GP, hence smp_store_release(). */
-        smp_store_release(&rsp->gpnum, rsp->gpnum + 1);
-        trace_rcu_grace_period(rsp->name, rsp->gpnum, TPS("start"));
+        /* Record GP times before starting GP, hence rcu_seq_start(). */
+        rcu_seq_start(&rsp->gp_seq);
+        trace_rcu_grace_period(rsp->name, rsp->gp_seq, TPS("start"));
         raw_spin_unlock_irq_rcu_node(rnp);
 
         /*
@@ -1923,13 +1926,15 @@ static bool rcu_gp_init(struct rcu_state *rsp)
          * for subsequent online CPUs, and that quiescent-state forcing
          * will handle subsequent offline CPUs.
          */
+        rsp->gp_state = RCU_GP_ONOFF;
         rcu_for_each_leaf_node(rsp, rnp) {
-                rcu_gp_slow(rsp, gp_preinit_delay);
+                spin_lock(&rsp->ofl_lock);
                 raw_spin_lock_irq_rcu_node(rnp);
                 if (rnp->qsmaskinit == rnp->qsmaskinitnext &&
                     !rnp->wait_blkd_tasks) {
                         /* Nothing to do on this leaf rcu_node structure. */
                         raw_spin_unlock_irq_rcu_node(rnp);
+                        spin_unlock(&rsp->ofl_lock);
                         continue;
                 }
 
@@ -1939,12 +1944,14 @@ static bool rcu_gp_init(struct rcu_state *rsp)
 
                 /* If zero-ness of ->qsmaskinit changed, propagate up tree. */
                 if (!oldmask != !rnp->qsmaskinit) {
-                        if (!oldmask) /* First online CPU for this rcu_node. */
-                                rcu_init_new_rnp(rnp);
-                        else if (rcu_preempt_has_tasks(rnp)) /* blocked tasks */
-                                rnp->wait_blkd_tasks = true;
-                        else /* Last offline CPU and can propagate. */
+                        if (!oldmask) { /* First online CPU for rcu_node. */
+                                if (!rnp->wait_blkd_tasks) /* Ever offline? */
+                                        rcu_init_new_rnp(rnp);
+                        } else if (rcu_preempt_has_tasks(rnp)) {
+                                rnp->wait_blkd_tasks = true; /* blocked tasks */
+                        } else { /* Last offline CPU and can propagate. */
                                 rcu_cleanup_dead_rnp(rnp);
+                        }
                 }
 
                 /*
@@ -1953,18 +1960,19 @@ static bool rcu_gp_init(struct rcu_state *rsp)
                  * still offline, propagate up the rcu_node tree and
                  * clear ->wait_blkd_tasks.  Otherwise, if one of this
                  * rcu_node structure's CPUs has since come back online,
-                 * simply clear ->wait_blkd_tasks (but rcu_cleanup_dead_rnp()
-                 * checks for this, so just call it unconditionally).
+                 * simply clear ->wait_blkd_tasks.
                  */
                 if (rnp->wait_blkd_tasks &&
-                    (!rcu_preempt_has_tasks(rnp) ||
-                     rnp->qsmaskinit)) {
+                    (!rcu_preempt_has_tasks(rnp) || rnp->qsmaskinit)) {
                         rnp->wait_blkd_tasks = false;
-                        rcu_cleanup_dead_rnp(rnp);
+                        if (!rnp->qsmaskinit)
+                                rcu_cleanup_dead_rnp(rnp);
                 }
 
                 raw_spin_unlock_irq_rcu_node(rnp);
+                spin_unlock(&rsp->ofl_lock);
         }
+        rcu_gp_slow(rsp, gp_preinit_delay); /* Races with CPU hotplug. */
 
         /*
          * Set the quiescent-state-needed bits in all the rcu_node
@@ -1978,22 +1986,27 @@ static bool rcu_gp_init(struct rcu_state *rsp)
          * The grace period cannot complete until the initialization
          * process finishes, because this kthread handles both.
          */
+        rsp->gp_state = RCU_GP_INIT;
         rcu_for_each_node_breadth_first(rsp, rnp) {
                 rcu_gp_slow(rsp, gp_init_delay);
-                raw_spin_lock_irq_rcu_node(rnp);
+                raw_spin_lock_irqsave_rcu_node(rnp, flags);
                 rdp = this_cpu_ptr(rsp->rda);
-                rcu_preempt_check_blocked_tasks(rnp);
+                rcu_preempt_check_blocked_tasks(rsp, rnp);
                 rnp->qsmask = rnp->qsmaskinit;
-                WRITE_ONCE(rnp->gpnum, rsp->gpnum);
-                if (WARN_ON_ONCE(rnp->completed != rsp->completed))
-                        WRITE_ONCE(rnp->completed, rsp->completed);
+                WRITE_ONCE(rnp->gp_seq, rsp->gp_seq);
                 if (rnp == rdp->mynode)
                         (void)__note_gp_changes(rsp, rnp, rdp);
                 rcu_preempt_boost_start_gp(rnp);
-                trace_rcu_grace_period_init(rsp->name, rnp->gpnum,
+                trace_rcu_grace_period_init(rsp->name, rnp->gp_seq,
                                             rnp->level, rnp->grplo,
                                             rnp->grphi, rnp->qsmask);
-                raw_spin_unlock_irq_rcu_node(rnp);
+                /* Quiescent states for tasks on any now-offline CPUs. */
+                mask = rnp->qsmask & ~rnp->qsmaskinitnext;
+                rnp->rcu_gp_init_mask = mask;
+                if ((mask || rnp->wait_blkd_tasks) && rcu_is_leaf_node(rnp))
+                        rcu_report_qs_rnp(mask, rsp, rnp, rnp->gp_seq, flags);
+                else
+                        raw_spin_unlock_irq_rcu_node(rnp);
                 cond_resched_tasks_rcu_qs();
                 WRITE_ONCE(rsp->gp_activity, jiffies);
         }
@@ -2002,7 +2015,7 @@ static bool rcu_gp_init(struct rcu_state *rsp)
 }
 
 /*
- * Helper function for swait_event_idle() wakeup at force-quiescent-state
+ * Helper function for swait_event_idle_exclusive() wakeup at force-quiescent-state
  * time.
  */
 static bool rcu_gp_fqs_check_wake(struct rcu_state *rsp, int *gfp)
@@ -2053,6 +2066,7 @@ static void rcu_gp_cleanup(struct rcu_state *rsp)
 {
         unsigned long gp_duration;
         bool needgp = false;
+        unsigned long new_gp_seq;
         struct rcu_data *rdp;
         struct rcu_node *rnp = rcu_get_root(rsp);
         struct swait_queue_head *sq;
@@ -2074,19 +2088,22 @@ static void rcu_gp_cleanup(struct rcu_state *rsp)
         raw_spin_unlock_irq_rcu_node(rnp);
 
         /*
-         * Propagate new ->completed value to rcu_node structures so
-         * that other CPUs don't have to wait until the start of the next
-         * grace period to process their callbacks.  This also avoids
-         * some nasty RCU grace-period initialization races by forcing
-         * the end of the current grace period to be completely recorded in
-         * all of the rcu_node structures before the beginning of the next
-         * grace period is recorded in any of the rcu_node structures.
+         * Propagate new ->gp_seq value to rcu_node structures so that
+         * other CPUs don't have to wait until the start of the next grace
+         * period to process their callbacks.  This also avoids some nasty
+         * RCU grace-period initialization races by forcing the end of
+         * the current grace period to be completely recorded in all of
+         * the rcu_node structures before the beginning of the next grace
+         * period is recorded in any of the rcu_node structures.
          */
+        new_gp_seq = rsp->gp_seq;
+        rcu_seq_end(&new_gp_seq);
         rcu_for_each_node_breadth_first(rsp, rnp) {
                 raw_spin_lock_irq_rcu_node(rnp);
-                WARN_ON_ONCE(rcu_preempt_blocked_readers_cgp(rnp));
+                if (WARN_ON_ONCE(rcu_preempt_blocked_readers_cgp(rnp)))
+                        dump_blkd_tasks(rsp, rnp, 10);
                 WARN_ON_ONCE(rnp->qsmask);
-                WRITE_ONCE(rnp->completed, rsp->gpnum);
+                WRITE_ONCE(rnp->gp_seq, new_gp_seq);
                 rdp = this_cpu_ptr(rsp->rda);
                 if (rnp == rdp->mynode)
                         needgp = __note_gp_changes(rsp, rnp, rdp) || needgp;
@@ -2100,26 +2117,28 @@ static void rcu_gp_cleanup(struct rcu_state *rsp)
                 rcu_gp_slow(rsp, gp_cleanup_delay);
         }
         rnp = rcu_get_root(rsp);
-        raw_spin_lock_irq_rcu_node(rnp); /* Order GP before ->completed update. */
+        raw_spin_lock_irq_rcu_node(rnp); /* GP before rsp->gp_seq update. */
 
         /* Declare grace period done. */
-        WRITE_ONCE(rsp->completed, rsp->gpnum);
-        trace_rcu_grace_period(rsp->name, rsp->completed, TPS("end"));
+        rcu_seq_end(&rsp->gp_seq);
+        trace_rcu_grace_period(rsp->name, rsp->gp_seq, TPS("end"));
         rsp->gp_state = RCU_GP_IDLE;
         /* Check for GP requests since above loop. */
         rdp = this_cpu_ptr(rsp->rda);
-        if (need_any_future_gp(rnp)) {
-                trace_rcu_this_gp(rnp, rdp, rsp->completed - 1,
+        if (!needgp && ULONG_CMP_LT(rnp->gp_seq, rnp->gp_seq_needed)) {
+                trace_rcu_this_gp(rnp, rdp, rnp->gp_seq_needed,
                                   TPS("CleanupMore"));
                 needgp = true;
         }
         /* Advance CBs to reduce false positives below. */
         if (!rcu_accelerate_cbs(rsp, rnp, rdp) && needgp) {
                 WRITE_ONCE(rsp->gp_flags, RCU_GP_FLAG_INIT);
-                trace_rcu_grace_period(rsp->name, READ_ONCE(rsp->gpnum),
+                rsp->gp_req_activity = jiffies;
+                trace_rcu_grace_period(rsp->name, READ_ONCE(rsp->gp_seq),
                                        TPS("newreq"));
+        } else {
+                WRITE_ONCE(rsp->gp_flags, rsp->gp_flags & RCU_GP_FLAG_INIT);
         }
-        WRITE_ONCE(rsp->gp_flags, rsp->gp_flags & RCU_GP_FLAG_INIT);
         raw_spin_unlock_irq_rcu_node(rnp);
 }
 
@@ -2141,10 +2160,10 @@ static int __noreturn rcu_gp_kthread(void *arg)
                 /* Handle grace-period start. */
                 for (;;) {
                         trace_rcu_grace_period(rsp->name,
-                                               READ_ONCE(rsp->gpnum),
+                                               READ_ONCE(rsp->gp_seq),
                                                TPS("reqwait"));
                         rsp->gp_state = RCU_GP_WAIT_GPS;
-                        swait_event_idle(rsp->gp_wq, READ_ONCE(rsp->gp_flags) &
+                        swait_event_idle_exclusive(rsp->gp_wq, READ_ONCE(rsp->gp_flags) &
                                                      RCU_GP_FLAG_INIT);
                         rsp->gp_state = RCU_GP_DONE_GPS;
                         /* Locking provides needed memory barrier. */
@@ -2154,17 +2173,13 @@ static int __noreturn rcu_gp_kthread(void *arg)
                         WRITE_ONCE(rsp->gp_activity, jiffies);
                         WARN_ON(signal_pending(current));
                         trace_rcu_grace_period(rsp->name,
-                                               READ_ONCE(rsp->gpnum),
+                                               READ_ONCE(rsp->gp_seq),
                                                TPS("reqwaitsig"));
                 }
 
                 /* Handle quiescent-state forcing. */
                 first_gp_fqs = true;
                 j = jiffies_till_first_fqs;
-                if (j > HZ) {
-                        j = HZ;
-                        jiffies_till_first_fqs = HZ;
-                }
                 ret = 0;
                 for (;;) {
                         if (!ret) {
@@ -2173,10 +2188,10 @@ static int __noreturn rcu_gp_kthread(void *arg)
                                            jiffies + 3 * j);
                         }
                         trace_rcu_grace_period(rsp->name,
-                                               READ_ONCE(rsp->gpnum),
+                                               READ_ONCE(rsp->gp_seq),
                                                TPS("fqswait"));
                         rsp->gp_state = RCU_GP_WAIT_FQS;
-                        ret = swait_event_idle_timeout(rsp->gp_wq,
+                        ret = swait_event_idle_timeout_exclusive(rsp->gp_wq,
                                         rcu_gp_fqs_check_wake(rsp, &gf), j);
                         rsp->gp_state = RCU_GP_DOING_FQS;
                         /* Locking provides needed memory barriers. */
@@ -2188,31 +2203,24 @@ static int __noreturn rcu_gp_kthread(void *arg)
                         if (ULONG_CMP_GE(jiffies, rsp->jiffies_force_qs) ||
                             (gf & RCU_GP_FLAG_FQS)) {
                                 trace_rcu_grace_period(rsp->name,
-                                                       READ_ONCE(rsp->gpnum),
+                                                       READ_ONCE(rsp->gp_seq),
                                                        TPS("fqsstart"));
                                 rcu_gp_fqs(rsp, first_gp_fqs);
                                 first_gp_fqs = false;
                                 trace_rcu_grace_period(rsp->name,
-                                                       READ_ONCE(rsp->gpnum),
+                                                       READ_ONCE(rsp->gp_seq),
                                                        TPS("fqsend"));
                                 cond_resched_tasks_rcu_qs();
                                 WRITE_ONCE(rsp->gp_activity, jiffies);
                                 ret = 0; /* Force full wait till next FQS. */
                                 j = jiffies_till_next_fqs;
-                                if (j > HZ) {
-                                        j = HZ;
-                                        jiffies_till_next_fqs = HZ;
-                                } else if (j < 1) {
-                                        j = 1;
-                                        jiffies_till_next_fqs = 1;
-                                }
                         } else {
                                 /* Deal with stray signal. */
                                 cond_resched_tasks_rcu_qs();
                                 WRITE_ONCE(rsp->gp_activity, jiffies);
                                 WARN_ON(signal_pending(current));
                                 trace_rcu_grace_period(rsp->name,
-                                                       READ_ONCE(rsp->gpnum),
+                                                       READ_ONCE(rsp->gp_seq),
                                                        TPS("fqswaitsig"));
                                 ret = 1; /* Keep old FQS timing. */
                                 j = jiffies;
@@ -2256,8 +2264,12 @@ static void rcu_report_qs_rsp(struct rcu_state *rsp, unsigned long flags)
  * must be represented by the same rcu_node structure (which need not be a
  * leaf rcu_node structure, though it often will be).  The gps parameter
  * is the grace-period snapshot, which means that the quiescent states
- * are valid only if rnp->gpnum is equal to gps.  That structure's lock
+ * are valid only if rnp->gp_seq is equal to gps.  That structure's lock
  * must be held upon entry, and it is released before return.
+ *
+ * As a special case, if mask is zero, the bit-already-cleared check is
+ * disabled.  This allows propagating quiescent state due to resumed tasks
+ * during grace-period initialization.
  */
 static void
 rcu_report_qs_rnp(unsigned long mask, struct rcu_state *rsp,
@@ -2271,7 +2283,7 @@ rcu_report_qs_rnp(unsigned long mask, struct rcu_state *rsp,
 
         /* Walk up the rcu_node hierarchy. */
         for (;;) {
-                if (!(rnp->qsmask & mask) || rnp->gpnum != gps) {
+                if ((!(rnp->qsmask & mask) && mask) || rnp->gp_seq != gps) {
 
                         /*
                          * Our bit has already been cleared, or the
@@ -2284,7 +2296,7 @@ rcu_report_qs_rnp(unsigned long mask, struct rcu_state *rsp,
                 WARN_ON_ONCE(!rcu_is_leaf_node(rnp) &&
                              rcu_preempt_blocked_readers_cgp(rnp));
                 rnp->qsmask &= ~mask;
-                trace_rcu_quiescent_state_report(rsp->name, rnp->gpnum,
+                trace_rcu_quiescent_state_report(rsp->name, rnp->gp_seq,
                                                  mask, rnp->qsmask, rnp->level,
                                                  rnp->grplo, rnp->grphi,
                                                  !!rnp->gp_tasks);
@@ -2294,6 +2306,7 @@ rcu_report_qs_rnp(unsigned long mask, struct rcu_state *rsp,
                         raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
                         return;
                 }
+                rnp->completedqs = rnp->gp_seq;
                 mask = rnp->grpmask;
                 if (rnp->parent == NULL) {
 
@@ -2323,8 +2336,9 @@ rcu_report_qs_rnp(unsigned long mask, struct rcu_state *rsp,
  * irqs disabled, and this lock is released upon return, but irqs remain
  * disabled.
  */
-static void rcu_report_unblock_qs_rnp(struct rcu_state *rsp,
-                                      struct rcu_node *rnp, unsigned long flags)
+static void __maybe_unused
+rcu_report_unblock_qs_rnp(struct rcu_state *rsp,
+                          struct rcu_node *rnp, unsigned long flags)
         __releases(rnp->lock)
 {
         unsigned long gps;
@@ -2332,12 +2346,15 @@ static void rcu_report_unblock_qs_rnp(struct rcu_state *rsp,
         struct rcu_node *rnp_p;
 
         raw_lockdep_assert_held_rcu_node(rnp);
-        if (rcu_state_p == &rcu_sched_state || rsp != rcu_state_p ||
-            rnp->qsmask != 0 || rcu_preempt_blocked_readers_cgp(rnp)) {
+        if (WARN_ON_ONCE(rcu_state_p == &rcu_sched_state) ||
+            WARN_ON_ONCE(rsp != rcu_state_p) ||
+            WARN_ON_ONCE(rcu_preempt_blocked_readers_cgp(rnp)) ||
+            rnp->qsmask != 0) {
                 raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
                 return;  /* Still need more quiescent states! */
         }
 
+        rnp->completedqs = rnp->gp_seq;
         rnp_p = rnp->parent;
         if (rnp_p == NULL) {
                 /*
@@ -2348,8 +2365,8 @@ static void rcu_report_unblock_qs_rnp(struct rcu_state *rsp,
                 return;
         }
 
-        /* Report up the rest of the hierarchy, tracking current ->gpnum. */
-        gps = rnp->gpnum;
+        /* Report up the rest of the hierarchy, tracking current ->gp_seq. */
+        gps = rnp->gp_seq;
         mask = rnp->grpmask;
         raw_spin_unlock_rcu_node(rnp);  /* irqs remain disabled. */
         raw_spin_lock_rcu_node(rnp_p);  /* irqs already disabled. */
@@ -2370,8 +2387,8 @@ rcu_report_qs_rdp(int cpu, struct rcu_state *rsp, struct rcu_data *rdp)
 
         rnp = rdp->mynode;
         raw_spin_lock_irqsave_rcu_node(rnp, flags);
-        if (rdp->cpu_no_qs.b.norm || rdp->gpnum != rnp->gpnum ||
-            rnp->completed == rnp->gpnum || rdp->gpwrap) {
+        if (rdp->cpu_no_qs.b.norm || rdp->gp_seq != rnp->gp_seq ||
+            rdp->gpwrap) {
 
                 /*
                  * The grace period in which this quiescent state was
@@ -2396,7 +2413,7 @@ rcu_report_qs_rdp(int cpu, struct rcu_state *rsp, struct rcu_data *rdp)
                  */
                 needwake = rcu_accelerate_cbs(rsp, rnp, rdp);
 
-                rcu_report_qs_rnp(mask, rsp, rnp, rnp->gpnum, flags);
+                rcu_report_qs_rnp(mask, rsp, rnp, rnp->gp_seq, flags);
                 /* ^^^ Released rnp->lock */
                 if (needwake)
                         rcu_gp_kthread_wake(rsp);
@@ -2441,17 +2458,16 @@ rcu_check_quiescent_state(struct rcu_state *rsp, struct rcu_data *rdp)
  */
 static void rcu_cleanup_dying_cpu(struct rcu_state *rsp)
 {
-        RCU_TRACE(unsigned long mask;)
+        RCU_TRACE(bool blkd;)
         RCU_TRACE(struct rcu_data *rdp = this_cpu_ptr(rsp->rda);)
         RCU_TRACE(struct rcu_node *rnp = rdp->mynode;)
 
         if (!IS_ENABLED(CONFIG_HOTPLUG_CPU))
                 return;
 
-        RCU_TRACE(mask = rdp->grpmask;)
-        trace_rcu_grace_period(rsp->name,
-                               rnp->gpnum + 1 - !!(rnp->qsmask & mask),
-                               TPS("cpuofl"));
+        RCU_TRACE(blkd = !!(rnp->qsmask & rdp->grpmask);)
+        trace_rcu_grace_period(rsp->name, rnp->gp_seq,
+                               blkd ? TPS("cpuofl") : TPS("cpuofl-bgp"));
 }
 
 /*
@@ -2463,7 +2479,7 @@ static void rcu_cleanup_dying_cpu(struct rcu_state *rsp)
  * This function therefore goes up the tree of rcu_node structures,
  * clearing the corresponding bits in the ->qsmaskinit fields.  Note that
  * the leaf rcu_node structure's ->qsmaskinit field has already been
- * updated
+ * updated.
  *
  * This function does check that the specified rcu_node structure has
  * all CPUs offline and no blocked tasks, so it is OK to invoke it
@@ -2476,9 +2492,10 @@ static void rcu_cleanup_dead_rnp(struct rcu_node *rnp_leaf)
         long mask;
         struct rcu_node *rnp = rnp_leaf;
 
-        raw_lockdep_assert_held_rcu_node(rnp);
+        raw_lockdep_assert_held_rcu_node(rnp_leaf);
         if (!IS_ENABLED(CONFIG_HOTPLUG_CPU) ||
-            rnp->qsmaskinit || rcu_preempt_has_tasks(rnp))
+            WARN_ON_ONCE(rnp_leaf->qsmaskinit) ||
+            WARN_ON_ONCE(rcu_preempt_has_tasks(rnp_leaf)))
                 return;
         for (;;) {
                 mask = rnp->grpmask;
@@ -2487,7 +2504,8 @@ static void rcu_cleanup_dead_rnp(struct rcu_node *rnp_leaf)
                         break;
                 raw_spin_lock_rcu_node(rnp); /* irqs already disabled. */
                 rnp->qsmaskinit &= ~mask;
-                rnp->qsmask &= ~mask;
+                /* Between grace periods, so better already be zero! */
+                WARN_ON_ONCE(rnp->qsmask);
                 if (rnp->qsmaskinit) {
                         raw_spin_unlock_rcu_node(rnp);
                         /* irqs remain disabled. */
@@ -2630,6 +2648,7 @@ void rcu_check_callbacks(int user)
 
                 rcu_sched_qs();
                 rcu_bh_qs();
+                rcu_note_voluntary_context_switch(current);
 
         } else if (!in_softirq()) {
 
@@ -2645,8 +2664,7 @@ void rcu_check_callbacks(int user)
         rcu_preempt_check_callbacks();
         if (rcu_pending())
                 invoke_rcu_core();
-        if (user)
-                rcu_note_voluntary_context_switch(current);
+
         trace_rcu_utilization(TPS("End scheduler-tick"));
 }
 
@@ -2681,17 +2699,8 @@ static void force_qs_rnp(struct rcu_state *rsp, int (*f)(struct rcu_data *rsp))
                                 /* rcu_initiate_boost() releases rnp->lock */
                                 continue;
                         }
-                        if (rnp->parent &&
-                            (rnp->parent->qsmask & rnp->grpmask)) {
-                                /*
-                                 * Race between grace-period
-                                 * initialization and task exiting RCU
-                                 * read-side critical section: Report.
-                                 */
-                                rcu_report_unblock_qs_rnp(rsp, rnp, flags);
-                                /* rcu_report_unblock_qs_rnp() rlses ->lock */
-                                continue;
-                        }
+                        raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
+                        continue;
                 }
                 for_each_leaf_node_possible_cpu(rnp, cpu) {
                         unsigned long bit = leaf_node_cpu_bit(rnp, cpu);
@@ -2701,8 +2710,8 @@ static void force_qs_rnp(struct rcu_state *rsp, int (*f)(struct rcu_data *rsp))
                         }
                 }
                 if (mask != 0) {
-                        /* Idle/offline CPUs, report (releases rnp->lock. */
-                        rcu_report_qs_rnp(mask, rsp, rnp, rnp->gpnum, flags);
+                        /* Idle/offline CPUs, report (releases rnp->lock). */
+                        rcu_report_qs_rnp(mask, rsp, rnp, rnp->gp_seq, flags);
                 } else {
                         /* Nothing to do here, so just drop the lock. */
                         raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
@@ -2747,6 +2756,65 @@ static void force_quiescent_state(struct rcu_state *rsp)
 }
 
 /*
+ * This function checks for grace-period requests that fail to motivate
+ * RCU to come out of its idle mode.
+ */
+static void
+rcu_check_gp_start_stall(struct rcu_state *rsp, struct rcu_node *rnp,
+                         struct rcu_data *rdp)
+{
+        const unsigned long gpssdelay = rcu_jiffies_till_stall_check() * HZ;
+        unsigned long flags;
+        unsigned long j;
+        struct rcu_node *rnp_root = rcu_get_root(rsp);
+        static atomic_t warned = ATOMIC_INIT(0);
+
+        if (!IS_ENABLED(CONFIG_PROVE_RCU) || rcu_gp_in_progress(rsp) ||
+            ULONG_CMP_GE(rnp_root->gp_seq, rnp_root->gp_seq_needed))
+                return;
+        j = jiffies; /* Expensive access, and in common case don't get here. */
+        if (time_before(j, READ_ONCE(rsp->gp_req_activity) + gpssdelay) ||
+            time_before(j, READ_ONCE(rsp->gp_activity) + gpssdelay) ||
+            atomic_read(&warned))
+                return;
+
+        raw_spin_lock_irqsave_rcu_node(rnp, flags);
+        j = jiffies;
+        if (rcu_gp_in_progress(rsp) ||
+            ULONG_CMP_GE(rnp_root->gp_seq, rnp_root->gp_seq_needed) ||
+            time_before(j, READ_ONCE(rsp->gp_req_activity) + gpssdelay) ||
+            time_before(j, READ_ONCE(rsp->gp_activity) + gpssdelay) ||
+            atomic_read(&warned)) {
+                raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
+                return;
+        }
+        /* Hold onto the leaf lock to make others see warned==1. */
+
+        if (rnp_root != rnp)
+                raw_spin_lock_rcu_node(rnp_root); /* irqs already disabled. */
+        j = jiffies;
+        if (rcu_gp_in_progress(rsp) ||
+            ULONG_CMP_GE(rnp_root->gp_seq, rnp_root->gp_seq_needed) ||
+            time_before(j, rsp->gp_req_activity + gpssdelay) ||
+            time_before(j, rsp->gp_activity + gpssdelay) ||
+            atomic_xchg(&warned, 1)) {
+                raw_spin_unlock_rcu_node(rnp_root); /* irqs remain disabled. */
+                raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
+                return;
+        }
+        pr_alert("%s: g%ld->%ld gar:%lu ga:%lu f%#x gs:%d %s->state:%#lx\n",
+                 __func__, (long)READ_ONCE(rsp->gp_seq),
+                 (long)READ_ONCE(rnp_root->gp_seq_needed),
+                 j - rsp->gp_req_activity, j - rsp->gp_activity,
+                 rsp->gp_flags, rsp->gp_state, rsp->name,
+                 rsp->gp_kthread ? rsp->gp_kthread->state : 0x1ffffL);
+        WARN_ON(1);
+        if (rnp_root != rnp)
+                raw_spin_unlock_rcu_node(rnp_root);
+        raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
+}
+
+/*
  * This does the RCU core processing work for the specified rcu_state
  * and rcu_data structures.  This may be called only from the CPU to
  * whom the rdp belongs.
@@ -2755,9 +2823,8 @@ static void
 __rcu_process_callbacks(struct rcu_state *rsp)
 {
         unsigned long flags;
-        bool needwake;
         struct rcu_data *rdp = raw_cpu_ptr(rsp->rda);
-        struct rcu_node *rnp;
+        struct rcu_node *rnp = rdp->mynode;
 
         WARN_ON_ONCE(!rdp->beenonline);
 
@@ -2768,18 +2835,13 @@ __rcu_process_callbacks(struct rcu_state *rsp)
         if (!rcu_gp_in_progress(rsp) &&
             rcu_segcblist_is_enabled(&rdp->cblist)) {
                 local_irq_save(flags);
-                if (rcu_segcblist_restempty(&rdp->cblist, RCU_NEXT_READY_TAIL)) {
-                        local_irq_restore(flags);
-                } else {
-                        rnp = rdp->mynode;
-                        raw_spin_lock_rcu_node(rnp); /* irqs disabled. */
-                        needwake = rcu_accelerate_cbs(rsp, rnp, rdp);
-                        raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
-                        if (needwake)
-                                rcu_gp_kthread_wake(rsp);
-                }
+                if (!rcu_segcblist_restempty(&rdp->cblist, RCU_NEXT_READY_TAIL))
+                        rcu_accelerate_cbs_unlocked(rsp, rnp, rdp);
+                local_irq_restore(flags);
         }
 
+        rcu_check_gp_start_stall(rsp, rnp, rdp);
+
         /* If there are callbacks ready, invoke them. */
         if (rcu_segcblist_ready_cbs(&rdp->cblist))
                 invoke_rcu_callbacks(rsp, rdp);
@@ -2833,8 +2895,6 @@ static void invoke_rcu_core(void)
 static void __call_rcu_core(struct rcu_state *rsp, struct rcu_data *rdp,
                             struct rcu_head *head, unsigned long flags)
 {
-        bool needwake;
-
         /*
          * If called from an extended quiescent state, invoke the RCU
          * core in order to force a re-evaluation of RCU's idleness.
@@ -2861,13 +2921,7 @@ static void __call_rcu_core(struct rcu_state *rsp, struct rcu_data *rdp,
 
                 /* Start a new grace period if one not already started. */
                 if (!rcu_gp_in_progress(rsp)) {
-                        struct rcu_node *rnp = rdp->mynode;
-
-                        raw_spin_lock_rcu_node(rnp);
-                        needwake = rcu_accelerate_cbs(rsp, rnp, rdp);
-                        raw_spin_unlock_rcu_node(rnp);
-                        if (needwake)
-                                rcu_gp_kthread_wake(rsp);
+                        rcu_accelerate_cbs_unlocked(rsp, rdp->mynode, rdp);
                 } else {
                         /* Give the grace period a kick. */
                         rdp->blimit = LONG_MAX;
@@ -3037,7 +3091,7 @@ EXPORT_SYMBOL_GPL(kfree_call_rcu);
  * when there was in fact only one the whole time, as this just adds
  * some overhead: RCU still operates correctly.
  */
-static inline int rcu_blocking_is_gp(void)
+static int rcu_blocking_is_gp(void)
 {
         int ret;
 
@@ -3136,16 +3190,10 @@ unsigned long get_state_synchronize_rcu(void)
 {
         /*
          * Any prior manipulation of RCU-protected data must happen
-         * before the load from ->gpnum.
+         * before the load from ->gp_seq.
          */
         smp_mb();  /* ^^^ */
-
-        /*
-         * Make sure this load happens before the purportedly
-         * time-consuming work between get_state_synchronize_rcu()
-         * and cond_synchronize_rcu().
-         */
-        return smp_load_acquire(&rcu_state_p->gpnum);
+        return rcu_seq_snap(&rcu_state_p->gp_seq);
 }
 EXPORT_SYMBOL_GPL(get_state_synchronize_rcu);
 
@@ -3165,15 +3213,10 @@ EXPORT_SYMBOL_GPL(get_state_synchronize_rcu);
  */
 void cond_synchronize_rcu(unsigned long oldstate)
 {
-        unsigned long newstate;
-
-        /*
-         * Ensure that this load happens before any RCU-destructive
-         * actions the caller might carry out after we return.
-         */
-        newstate = smp_load_acquire(&rcu_state_p->completed);
-        if (ULONG_CMP_GE(oldstate, newstate))
+        if (!rcu_seq_done(&rcu_state_p->gp_seq, oldstate))
                 synchronize_rcu();
+        else
+                smp_mb(); /* Ensure GP ends before subsequent accesses. */
 }
 EXPORT_SYMBOL_GPL(cond_synchronize_rcu);
 
@@ -3188,16 +3231,10 @@ unsigned long get_state_synchronize_sched(void)
 {
         /*
          * Any prior manipulation of RCU-protected data must happen
-         * before the load from ->gpnum.
+         * before the load from ->gp_seq.
          */
         smp_mb();  /* ^^^ */
-
-        /*
-         * Make sure this load happens before the purportedly
-         * time-consuming work between get_state_synchronize_sched()
-         * and cond_synchronize_sched().
-         */
-        return smp_load_acquire(&rcu_sched_state.gpnum);
+        return rcu_seq_snap(&rcu_sched_state.gp_seq);
 }
 EXPORT_SYMBOL_GPL(get_state_synchronize_sched);
 
@@ -3217,15 +3254,10 @@ EXPORT_SYMBOL_GPL(get_state_synchronize_sched);
  */
 void cond_synchronize_sched(unsigned long oldstate)
 {
-        unsigned long newstate;
-
-        /*
-         * Ensure that this load happens before any RCU-destructive
-         * actions the caller might carry out after we return.
-         */
-        newstate = smp_load_acquire(&rcu_sched_state.completed);
-        if (ULONG_CMP_GE(oldstate, newstate))
+        if (!rcu_seq_done(&rcu_sched_state.gp_seq, oldstate))
                 synchronize_sched();
+        else
+                smp_mb(); /* Ensure GP ends before subsequent accesses. */
 }
 EXPORT_SYMBOL_GPL(cond_synchronize_sched);
 
@@ -3261,12 +3293,8 @@ static int __rcu_pending(struct rcu_state *rsp, struct rcu_data *rdp)
             !rcu_segcblist_restempty(&rdp->cblist, RCU_NEXT_READY_TAIL))
                 return 1;
 
-        /* Has another RCU grace period completed?  */
-        if (READ_ONCE(rnp->completed) != rdp->completed) /* outside lock */
-                return 1;
-
-        /* Has a new RCU grace period started? */
-        if (READ_ONCE(rnp->gpnum) != rdp->gpnum ||
+        /* Have RCU grace period completed or started?  */
+        if (rcu_seq_current(&rnp->gp_seq) != rdp->gp_seq ||
             unlikely(READ_ONCE(rdp->gpwrap))) /* outside lock */
                 return 1;
 
@@ -3298,7 +3326,7 @@ static int rcu_pending(void)
  * non-NULL, store an indication of whether all callbacks are lazy.
  * (If there are no callbacks, all of them are deemed to be lazy.)
  */
-static bool __maybe_unused rcu_cpu_has_callbacks(bool *all_lazy)
+static bool rcu_cpu_has_callbacks(bool *all_lazy)
 {
         bool al = true;
         bool hc = false;
@@ -3484,17 +3512,22 @@ EXPORT_SYMBOL_GPL(rcu_barrier_sched);
 static void rcu_init_new_rnp(struct rcu_node *rnp_leaf)
 {
         long mask;
+        long oldmask;
         struct rcu_node *rnp = rnp_leaf;
 
-        raw_lockdep_assert_held_rcu_node(rnp);
+        raw_lockdep_assert_held_rcu_node(rnp_leaf);
+        WARN_ON_ONCE(rnp->wait_blkd_tasks);
         for (;;) {
                 mask = rnp->grpmask;
                 rnp = rnp->parent;
                 if (rnp == NULL)
                         return;
                 raw_spin_lock_rcu_node(rnp); /* Interrupts already disabled. */
+                oldmask = rnp->qsmaskinit;
                 rnp->qsmaskinit |= mask;
                 raw_spin_unlock_rcu_node(rnp); /* Interrupts remain disabled. */
+                if (oldmask)
+                        return;
         }
 }
 
@@ -3511,6 +3544,10 @@ rcu_boot_init_percpu_data(int cpu, struct rcu_state *rsp)
         rdp->dynticks = &per_cpu(rcu_dynticks, cpu);
         WARN_ON_ONCE(rdp->dynticks->dynticks_nesting != 1);
         WARN_ON_ONCE(rcu_dynticks_in_eqs(rcu_dynticks_snap(rdp->dynticks)));
+        rdp->rcu_ofl_gp_seq = rsp->gp_seq;
+        rdp->rcu_ofl_gp_flags = RCU_GP_CLEANED;
+        rdp->rcu_onl_gp_seq = rsp->gp_seq;
+        rdp->rcu_onl_gp_flags = RCU_GP_CLEANED;
         rdp->cpu = cpu;
         rdp->rsp = rsp;
         rcu_boot_init_nocb_percpu_data(rdp);
@@ -3518,9 +3555,9 @@ rcu_boot_init_percpu_data(int cpu, struct rcu_state *rsp)
 
 /*
  * Initialize a CPU's per-CPU RCU data.  Note that only one online or
- * offline event can be happening at a given time.  Note also that we
- * can accept some slop in the rsp->completed access due to the fact
- * that this CPU cannot possibly have any RCU callbacks in flight yet.
+ * offline event can be happening at a given time.  Note also that we can
+ * accept some slop in the rsp->gp_seq access due to the fact that this
+ * CPU cannot possibly have any RCU callbacks in flight yet.
  */
 static void
 rcu_init_percpu_data(int cpu, struct rcu_state *rsp)
@@ -3549,14 +3586,14 @@ rcu_init_percpu_data(int cpu, struct rcu_state *rsp)
         rnp = rdp->mynode;
         raw_spin_lock_rcu_node(rnp);            /* irqs already disabled. */
         rdp->beenonline = true;  /* We have now been online. */
-        rdp->gpnum = rnp->completed; /* Make CPU later note any new GP. */
-        rdp->completed = rnp->completed;
+        rdp->gp_seq = rnp->gp_seq;
+        rdp->gp_seq_needed = rnp->gp_seq;
         rdp->cpu_no_qs.b.norm = true;
         rdp->rcu_qs_ctr_snap = per_cpu(rcu_dynticks.rcu_qs_ctr, cpu);
         rdp->core_needs_qs = false;
         rdp->rcu_iw_pending = false;
-        rdp->rcu_iw_gpnum = rnp->gpnum - 1;
-        trace_rcu_grace_period(rsp->name, rdp->gpnum, TPS("cpuonl"));
+        rdp->rcu_iw_gp_seq = rnp->gp_seq - 1;
+        trace_rcu_grace_period(rsp->name, rdp->gp_seq, TPS("cpuonl"));
         raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
 }
 
@@ -3705,7 +3742,15 @@ void rcu_cpu_starting(unsigned int cpu)
                 nbits = bitmap_weight(&oldmask, BITS_PER_LONG);
                 /* Allow lockless access for expedited grace periods. */
                 smp_store_release(&rsp->ncpus, rsp->ncpus + nbits); /* ^^^ */
-                raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
+                rcu_gpnum_ovf(rnp, rdp); /* Offline-induced counter wrap? */
+                rdp->rcu_onl_gp_seq = READ_ONCE(rsp->gp_seq);
+                rdp->rcu_onl_gp_flags = READ_ONCE(rsp->gp_flags);
+                if (rnp->qsmask & mask) { /* RCU waiting on incoming CPU? */
+                        /* Report QS -after- changing ->qsmaskinitnext! */
+                        rcu_report_qs_rnp(mask, rsp, rnp, rnp->gp_seq, flags);
+                } else {
+                        raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
+                }
         }
         smp_mb(); /* Ensure RCU read-side usage follows above initialization. */
 }
@@ -3713,7 +3758,7 @@ void rcu_cpu_starting(unsigned int cpu)
 #ifdef CONFIG_HOTPLUG_CPU
 /*
  * The CPU is exiting the idle loop into the arch_cpu_idle_dead()
- * function.  We now remove it from the rcu_node tree's ->qsmaskinit
+ * function.  We now remove it from the rcu_node tree's ->qsmaskinitnext
  * bit masks.
  */
 static void rcu_cleanup_dying_idle_cpu(int cpu, struct rcu_state *rsp)
@@ -3725,9 +3770,18 @@ static void rcu_cleanup_dying_idle_cpu(int cpu, struct rcu_state *rsp)
 
         /* Remove outgoing CPU from mask in the leaf rcu_node structure. */
         mask = rdp->grpmask;
+        spin_lock(&rsp->ofl_lock);
         raw_spin_lock_irqsave_rcu_node(rnp, flags); /* Enforce GP memory-order guarantee. */
+        rdp->rcu_ofl_gp_seq = READ_ONCE(rsp->gp_seq);
+        rdp->rcu_ofl_gp_flags = READ_ONCE(rsp->gp_flags);
+        if (rnp->qsmask & mask) { /* RCU waiting on outgoing CPU? */
+                /* Report quiescent state -before- changing ->qsmaskinitnext! */
+                rcu_report_qs_rnp(mask, rsp, rnp, rnp->gp_seq, flags);
+                raw_spin_lock_irqsave_rcu_node(rnp, flags);
+        }
         rnp->qsmaskinitnext &= ~mask;
         raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
+        spin_unlock(&rsp->ofl_lock);
 }
 
 /*
@@ -3839,12 +3893,16 @@ static int __init rcu_spawn_gp_kthread(void)
         struct task_struct *t;
 
         /* Force priority into range. */
-        if (IS_ENABLED(CONFIG_RCU_BOOST) && kthread_prio < 1)
+        if (IS_ENABLED(CONFIG_RCU_BOOST) && kthread_prio < 2
+            && IS_BUILTIN(CONFIG_RCU_TORTURE_TEST))
+                kthread_prio = 2;
+        else if (IS_ENABLED(CONFIG_RCU_BOOST) && kthread_prio < 1)
                 kthread_prio = 1;
         else if (kthread_prio < 0)
                 kthread_prio = 0;
         else if (kthread_prio > 99)
                 kthread_prio = 99;
+
         if (kthread_prio != kthread_prio_in)
                 pr_alert("rcu_spawn_gp_kthread(): Limited prio to %d from %d\n",
                          kthread_prio, kthread_prio_in);
@@ -3928,8 +3986,9 @@ static void __init rcu_init_one(struct rcu_state *rsp)
                         raw_spin_lock_init(&rnp->fqslock);
                         lockdep_set_class_and_name(&rnp->fqslock,
                                                    &rcu_fqs_class[i], fqs[i]);
-                        rnp->gpnum = rsp->gpnum;
-                        rnp->completed = rsp->completed;
+                        rnp->gp_seq = rsp->gp_seq;
+                        rnp->gp_seq_needed = rsp->gp_seq;
+                        rnp->completedqs = rsp->gp_seq;
                         rnp->qsmask = 0;
                         rnp->qsmaskinit = 0;
                         rnp->grplo = j * cpustride;
@@ -3997,7 +4056,7 @@ static void __init rcu_init_geometry(void)
         if (rcu_fanout_leaf == RCU_FANOUT_LEAF &&
             nr_cpu_ids == NR_CPUS)
                 return;
-        pr_info("RCU: Adjusting geometry for rcu_fanout_leaf=%d, nr_cpu_ids=%u\n",
+        pr_info("Adjusting geometry for rcu_fanout_leaf=%d, nr_cpu_ids=%u\n",
                 rcu_fanout_leaf, nr_cpu_ids);
 
         /*
diff --git a/kernel/rcu/tree.h b/kernel/rcu/tree.h
index 78e051dffc5b..4e74df768c57 100644
--- a/kernel/rcu/tree.h
+++ b/kernel/rcu/tree.h
@@ -81,18 +81,16 @@ struct rcu_node {
         raw_spinlock_t __private lock;  /* Root rcu_node's lock protects */
                                         /*  some rcu_state fields as well as */
                                         /*  following. */
-        unsigned long gpnum;    /* Current grace period for this node. */
-                                /*  This will either be equal to or one */
-                                /*  behind the root rcu_node's gpnum. */
-        unsigned long completed; /* Last GP completed for this node. */
-                                /*  This will either be equal to or one */
-                                /*  behind the root rcu_node's gpnum. */
+        unsigned long gp_seq;   /* Track rsp->rcu_gp_seq. */
+        unsigned long gp_seq_needed; /* Track rsp->rcu_gp_seq_needed. */
+        unsigned long completedqs; /* All QSes done for this node. */
         unsigned long qsmask;   /* CPUs or groups that need to switch in */
                                 /*  order for current grace period to proceed.*/
                                 /*  In leaf rcu_node, each bit corresponds to */
                                 /*  an rcu_data structure, otherwise, each */
                                 /*  bit corresponds to a child rcu_node */
                                 /*  structure. */
+        unsigned long rcu_gp_init_mask; /* Mask of offline CPUs at GP init. */
         unsigned long qsmaskinit;
                                 /* Per-GP initial value for qsmask. */
                                 /*  Initialized from ->qsmaskinitnext at the */
@@ -158,7 +156,6 @@ struct rcu_node {
         struct swait_queue_head nocb_gp_wq[2];
                                 /* Place for rcu_nocb_kthread() to wait GP. */
 #endif /* #ifdef CONFIG_RCU_NOCB_CPU */
-        u8 need_future_gp[4];   /* Counts of upcoming GP requests. */
         raw_spinlock_t fqslock ____cacheline_internodealigned_in_smp;
 
         spinlock_t exp_lock ____cacheline_internodealigned_in_smp;
@@ -168,22 +165,6 @@ struct rcu_node {
         bool exp_need_flush;    /* Need to flush workitem? */
 } ____cacheline_internodealigned_in_smp;
 
-/* Accessors for ->need_future_gp[] array. */
-#define need_future_gp_mask() \
-        (ARRAY_SIZE(((struct rcu_node *)NULL)->need_future_gp) - 1)
-#define need_future_gp_element(rnp, c) \
-        ((rnp)->need_future_gp[(c) & need_future_gp_mask()])
-#define need_any_future_gp(rnp)                                         \
-({                                                                      \
-        int __i;                                                        \
-        bool __nonzero = false;                                         \
-                                                                        \
-        for (__i = 0; __i < ARRAY_SIZE((rnp)->need_future_gp); __i++)   \
-                __nonzero = __nonzero ||                                \
-                            READ_ONCE((rnp)->need_future_gp[__i]);      \
-        __nonzero;                                                      \
-})
-
 /*
  * Bitmasks in an rcu_node cover the interval [grplo, grphi] of CPU IDs, and
  * are indexed relative to this interval rather than the global CPU ID space.
@@ -206,16 +187,14 @@ union rcu_noqs {
 /* Per-CPU data for read-copy update. */
 struct rcu_data {
         /* 1) quiescent-state and grace-period handling : */
-        unsigned long   completed;      /* Track rsp->completed gp number */
-                                        /*  in order to detect GP end. */
-        unsigned long   gpnum;          /* Highest gp number that this CPU */
-                                        /*  is aware of having started. */
+        unsigned long   gp_seq;         /* Track rsp->rcu_gp_seq counter. */
+        unsigned long   gp_seq_needed;  /* Track rsp->rcu_gp_seq_needed ctr. */
         unsigned long   rcu_qs_ctr_snap;/* Snapshot of rcu_qs_ctr to check */
                                         /*  for rcu_all_qs() invocations. */
         union rcu_noqs  cpu_no_qs;      /* No QSes yet for this CPU. */
         bool            core_needs_qs;  /* Core waits for quiesc state. */
         bool            beenonline;     /* CPU online at least once. */
-        bool            gpwrap;         /* Possible gpnum/completed wrap. */
+        bool            gpwrap;         /* Possible ->gp_seq wrap. */
         struct rcu_node *mynode;        /* This CPU's leaf of hierarchy */
         unsigned long grpmask;          /* Mask to apply to leaf qsmask. */
         unsigned long   ticks_this_gp;  /* The number of scheduling-clock */
@@ -239,7 +218,6 @@ struct rcu_data {
 
         /* 4) reasons this CPU needed to be kicked by force_quiescent_state */
         unsigned long dynticks_fqs;     /* Kicked due to dynticks idle. */
-        unsigned long offline_fqs;      /* Kicked due to being offline. */
         unsigned long cond_resched_completed;
                                         /* Grace period that needs help */
                                         /*  from cond_resched(). */
@@ -278,12 +256,16 @@ struct rcu_data {
                                         /* Leader CPU takes GP-end wakeups. */
 #endif /* #ifdef CONFIG_RCU_NOCB_CPU */
 
-        /* 7) RCU CPU stall data. */
+        /* 7) Diagnostic data, including RCU CPU stall warnings. */
         unsigned int softirq_snap;      /* Snapshot of softirq activity. */
         /* ->rcu_iw* fields protected by leaf rcu_node ->lock. */
         struct irq_work rcu_iw;         /* Check for non-irq activity. */
         bool rcu_iw_pending;            /* Is ->rcu_iw pending? */
-        unsigned long rcu_iw_gpnum;     /* ->gpnum associated with ->rcu_iw. */
+        unsigned long rcu_iw_gp_seq;    /* ->gp_seq associated with ->rcu_iw. */
+        unsigned long rcu_ofl_gp_seq;   /* ->gp_seq at last offline. */
+        short rcu_ofl_gp_flags;         /* ->gp_flags at last offline. */
+        unsigned long rcu_onl_gp_seq;   /* ->gp_seq at last online. */
+        short rcu_onl_gp_flags;         /* ->gp_flags at last online. */
 
         int cpu;
         struct rcu_state *rsp;
@@ -340,8 +322,7 @@ struct rcu_state {
 
         u8      boost ____cacheline_internodealigned_in_smp;
                                                 /* Subject to priority boost. */
-        unsigned long gpnum;                    /* Current gp number. */
-        unsigned long completed;                /* # of last completed gp. */
+        unsigned long gp_seq;                   /* Grace-period sequence #. */
         struct task_struct *gp_kthread;         /* Task for grace periods. */
         struct swait_queue_head gp_wq;          /* Where GP task waits. */
         short gp_flags;                         /* Commands for GP task. */
@@ -373,6 +354,8 @@ struct rcu_state {
                                                 /*  but in jiffies. */
         unsigned long gp_activity;              /* Time of last GP kthread */
                                                 /*  activity in jiffies. */
+        unsigned long gp_req_activity;          /* Time of last GP request */
+                                                /*  in jiffies. */
         unsigned long jiffies_stall;            /* Time at which to check */
                                                 /*  for CPU stalls. */
         unsigned long jiffies_resched;          /* Time at which to resched */
@@ -384,6 +367,10 @@ struct rcu_state {
         const char *name;                       /* Name of structure. */
         char abbr;                              /* Abbreviated name. */
         struct list_head flavors;               /* List of RCU flavors. */
+
+        spinlock_t ofl_lock ____cacheline_internodealigned_in_smp;
+                                                /* Synchronize offline with */
+                                                /*  GP pre-initialization. */
 };
 
 /* Values for rcu_state structure's gp_flags field. */
@@ -394,16 +381,20 @@ struct rcu_state {
 #define RCU_GP_IDLE      0      /* Initial state and no GP in progress. */
 #define RCU_GP_WAIT_GPS  1      /* Wait for grace-period start. */
 #define RCU_GP_DONE_GPS  2      /* Wait done for grace-period start. */
-#define RCU_GP_WAIT_FQS  3      /* Wait for force-quiescent-state time. */
-#define RCU_GP_DOING_FQS 4      /* Wait done for force-quiescent-state time. */
-#define RCU_GP_CLEANUP   5      /* Grace-period cleanup started. */
-#define RCU_GP_CLEANED   6      /* Grace-period cleanup complete. */
+#define RCU_GP_ONOFF     3      /* Grace-period initialization hotplug. */
+#define RCU_GP_INIT      4      /* Grace-period initialization. */
+#define RCU_GP_WAIT_FQS  5      /* Wait for force-quiescent-state time. */
+#define RCU_GP_DOING_FQS 6      /* Wait done for force-quiescent-state time. */
+#define RCU_GP_CLEANUP   7      /* Grace-period cleanup started. */
+#define RCU_GP_CLEANED   8      /* Grace-period cleanup complete. */
 
 #ifndef RCU_TREE_NONCORE
 static const char * const gp_state_names[] = {
         "RCU_GP_IDLE",
         "RCU_GP_WAIT_GPS",
         "RCU_GP_DONE_GPS",
+        "RCU_GP_ONOFF",
+        "RCU_GP_INIT",
         "RCU_GP_WAIT_FQS",
         "RCU_GP_DOING_FQS",
         "RCU_GP_CLEANUP",
@@ -449,10 +440,13 @@ static bool rcu_preempt_has_tasks(struct rcu_node *rnp);
 static void rcu_print_detail_task_stall(struct rcu_state *rsp);
 static int rcu_print_task_stall(struct rcu_node *rnp);
 static int rcu_print_task_exp_stall(struct rcu_node *rnp);
-static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp);
+static void rcu_preempt_check_blocked_tasks(struct rcu_state *rsp,
+                                            struct rcu_node *rnp);
 static void rcu_preempt_check_callbacks(void);
 void call_rcu(struct rcu_head *head, rcu_callback_t func);
 static void __init __rcu_init_preempt(void);
+static void dump_blkd_tasks(struct rcu_state *rsp, struct rcu_node *rnp,
+                            int ncheck);
 static void rcu_initiate_boost(struct rcu_node *rnp, unsigned long flags);
 static void rcu_preempt_boost_start_gp(struct rcu_node *rnp);
 static void invoke_rcu_callbacks_kthread(void);
@@ -489,7 +483,6 @@ static void __init rcu_spawn_nocb_kthreads(void);
 #ifdef CONFIG_RCU_NOCB_CPU
 static void __init rcu_organize_nocb_kthreads(struct rcu_state *rsp);
 #endif /* #ifdef CONFIG_RCU_NOCB_CPU */
-static void __maybe_unused rcu_kick_nohz_cpu(int cpu);
 static bool init_nocb_callback_list(struct rcu_data *rdp);
 static void rcu_bind_gp_kthread(void);
 static bool rcu_nohz_full_cpu(struct rcu_state *rsp);
diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h
index d40708e8c5d6..0b2c2ad69629 100644
--- a/kernel/rcu/tree_exp.h
+++ b/kernel/rcu/tree_exp.h
@@ -212,7 +212,7 @@ static void __rcu_report_exp_rnp(struct rcu_state *rsp, struct rcu_node *rnp,
                         raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
                         if (wake) {
                                 smp_mb(); /* EGP done before wake_up(). */
-                                swake_up(&rsp->expedited_wq);
+                                swake_up_one(&rsp->expedited_wq);
                         }
                         break;
                 }
@@ -472,6 +472,7 @@ retry_ipi:
 static void sync_rcu_exp_select_cpus(struct rcu_state *rsp,
                                      smp_call_func_t func)
 {
+        int cpu;
         struct rcu_node *rnp;
 
         trace_rcu_exp_grace_period(rsp->name, rcu_exp_gp_seq_endval(rsp), TPS("reset"));
@@ -486,13 +487,20 @@ static void sync_rcu_exp_select_cpus(struct rcu_state *rsp,
                 rnp->rew.rew_func = func;
                 rnp->rew.rew_rsp = rsp;
                 if (!READ_ONCE(rcu_par_gp_wq) ||
-                    rcu_scheduler_active != RCU_SCHEDULER_RUNNING) {
-                        /* No workqueues yet. */
+                    rcu_scheduler_active != RCU_SCHEDULER_RUNNING ||
+                    rcu_is_last_leaf_node(rsp, rnp)) {
+                        /* No workqueues yet or last leaf, do direct call. */
                         sync_rcu_exp_select_node_cpus(&rnp->rew.rew_work);
                         continue;
                 }
                 INIT_WORK(&rnp->rew.rew_work, sync_rcu_exp_select_node_cpus);
-                queue_work_on(rnp->grplo, rcu_par_gp_wq, &rnp->rew.rew_work);
+                preempt_disable();
+                cpu = cpumask_next(rnp->grplo - 1, cpu_online_mask);
+                /* If all offline, queue the work on an unbound CPU. */
+                if (unlikely(cpu > rnp->grphi))
+                        cpu = WORK_CPU_UNBOUND;
+                queue_work_on(cpu, rcu_par_gp_wq, &rnp->rew.rew_work);
+                preempt_enable();
                 rnp->exp_need_flush = true;
         }
 
@@ -518,7 +526,7 @@ static void synchronize_sched_expedited_wait(struct rcu_state *rsp)
         jiffies_start = jiffies;
 
         for (;;) {
-                ret = swait_event_timeout(
+                ret = swait_event_timeout_exclusive(
                                 rsp->expedited_wq,
                                 sync_rcu_preempt_exp_done_unlocked(rnp_root),
                                 jiffies_stall);
diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
index 7fd12039e512..a97c20ea9bce 100644
--- a/kernel/rcu/tree_plugin.h
+++ b/kernel/rcu/tree_plugin.h
@@ -74,8 +74,8 @@ static void __init rcu_bootup_announce_oddness(void)
                 pr_info("\tRCU event tracing is enabled.\n");
         if ((IS_ENABLED(CONFIG_64BIT) && RCU_FANOUT != 64) ||
             (!IS_ENABLED(CONFIG_64BIT) && RCU_FANOUT != 32))
-                pr_info("\tCONFIG_RCU_FANOUT set to non-default value of %d\n",
-                       RCU_FANOUT);
+                pr_info("\tCONFIG_RCU_FANOUT set to non-default value of %d.\n",
+                        RCU_FANOUT);
         if (rcu_fanout_exact)
                 pr_info("\tHierarchical RCU autobalancing is disabled.\n");
         if (IS_ENABLED(CONFIG_RCU_FAST_NO_HZ))
@@ -88,11 +88,13 @@ static void __init rcu_bootup_announce_oddness(void)
                 pr_info("\tBuild-time adjustment of leaf fanout to %d.\n",
                         RCU_FANOUT_LEAF);
         if (rcu_fanout_leaf != RCU_FANOUT_LEAF)
-                pr_info("\tBoot-time adjustment of leaf fanout to %d.\n", rcu_fanout_leaf);
+                pr_info("\tBoot-time adjustment of leaf fanout to %d.\n",
+                        rcu_fanout_leaf);
         if (nr_cpu_ids != NR_CPUS)
                 pr_info("\tRCU restricting CPUs from NR_CPUS=%d to nr_cpu_ids=%u.\n", NR_CPUS, nr_cpu_ids);
 #ifdef CONFIG_RCU_BOOST
-        pr_info("\tRCU priority boosting: priority %d delay %d ms.\n", kthread_prio, CONFIG_RCU_BOOST_DELAY);
+        pr_info("\tRCU priority boosting: priority %d delay %d ms.\n",
+                kthread_prio, CONFIG_RCU_BOOST_DELAY);
 #endif
         if (blimit != DEFAULT_RCU_BLIMIT)
                 pr_info("\tBoot-time adjustment of callback invocation limit to %ld.\n", blimit);
@@ -127,6 +129,7 @@ static struct rcu_data __percpu *const rcu_data_p = &rcu_preempt_data;
 
 static void rcu_report_exp_rnp(struct rcu_state *rsp, struct rcu_node *rnp,
                                bool wake);
+static void rcu_read_unlock_special(struct task_struct *t);
 
 /*
  * Tell them what RCU they are running.
@@ -183,6 +186,9 @@ static void rcu_preempt_ctxt_queue(struct rcu_node *rnp, struct rcu_data *rdp)
         raw_lockdep_assert_held_rcu_node(rnp);
         WARN_ON_ONCE(rdp->mynode != rnp);
         WARN_ON_ONCE(!rcu_is_leaf_node(rnp));
+        /* RCU better not be waiting on newly onlined CPUs! */
+        WARN_ON_ONCE(rnp->qsmaskinitnext & ~rnp->qsmaskinit & rnp->qsmask &
+                     rdp->grpmask);
 
         /*
          * Decide where to queue the newly blocked task.  In theory,
@@ -260,8 +266,10 @@ static void rcu_preempt_ctxt_queue(struct rcu_node *rnp, struct rcu_data *rdp)
          * ->exp_tasks pointers, respectively, to reference the newly
          * blocked tasks.
          */
-        if (!rnp->gp_tasks && (blkd_state & RCU_GP_BLKD))
+        if (!rnp->gp_tasks && (blkd_state & RCU_GP_BLKD)) {
                 rnp->gp_tasks = &t->rcu_node_entry;
+                WARN_ON_ONCE(rnp->completedqs == rnp->gp_seq);
+        }
         if (!rnp->exp_tasks && (blkd_state & RCU_EXP_BLKD))
                 rnp->exp_tasks = &t->rcu_node_entry;
         WARN_ON_ONCE(!(blkd_state & RCU_GP_BLKD) !=
@@ -286,20 +294,24 @@ static void rcu_preempt_ctxt_queue(struct rcu_node *rnp, struct rcu_data *rdp)
 }
 
 /*
- * Record a preemptible-RCU quiescent state for the specified CPU.  Note
- * that this just means that the task currently running on the CPU is
- * not in a quiescent state.  There might be any number of tasks blocked
- * while in an RCU read-side critical section.
+ * Record a preemptible-RCU quiescent state for the specified CPU.
+ * Note that this does not necessarily mean that the task currently running
+ * on the CPU is in a quiescent state:  Instead, it means that the current
+ * grace period need not wait on any RCU read-side critical section that
+ * starts later on this CPU.  It also means that if the current task is
+ * in an RCU read-side critical section, it has already added itself to
+ * some leaf rcu_node structure's ->blkd_tasks list.  In addition to the
+ * current task, there might be any number of other tasks blocked while
+ * in an RCU read-side critical section.
  *
- * As with the other rcu_*_qs() functions, callers to this function
- * must disable preemption.
+ * Callers to this function must disable preemption.
  */
 static void rcu_preempt_qs(void)
 {
         RCU_LOCKDEP_WARN(preemptible(), "rcu_preempt_qs() invoked with preemption enabled!!!\n");
         if (__this_cpu_read(rcu_data_p->cpu_no_qs.s)) {
                 trace_rcu_grace_period(TPS("rcu_preempt"),
-                                       __this_cpu_read(rcu_data_p->gpnum),
+                                       __this_cpu_read(rcu_data_p->gp_seq),
                                        TPS("cpuqs"));
                 __this_cpu_write(rcu_data_p->cpu_no_qs.b.norm, false);
                 barrier(); /* Coordinate with rcu_preempt_check_callbacks(). */
@@ -348,8 +360,8 @@ static void rcu_preempt_note_context_switch(bool preempt)
                 trace_rcu_preempt_task(rdp->rsp->name,
                                        t->pid,
                                        (rnp->qsmask & rdp->grpmask)
-                                       ? rnp->gpnum
-                                       : rnp->gpnum + 1);
+                                       ? rnp->gp_seq
+                                       : rcu_seq_snap(&rnp->gp_seq));
                 rcu_preempt_ctxt_queue(rnp, rdp);
         } else if (t->rcu_read_lock_nesting < 0 &&
                    t->rcu_read_unlock_special.s) {
@@ -456,7 +468,7 @@ static bool rcu_preempt_has_tasks(struct rcu_node *rnp)
  * notify RCU core processing or task having blocked during the RCU
  * read-side critical section.
  */
-void rcu_read_unlock_special(struct task_struct *t)
+static void rcu_read_unlock_special(struct task_struct *t)
 {
         bool empty_exp;
         bool empty_norm;
@@ -535,13 +547,15 @@ void rcu_read_unlock_special(struct task_struct *t)
                 WARN_ON_ONCE(rnp != t->rcu_blocked_node);
                 WARN_ON_ONCE(!rcu_is_leaf_node(rnp));
                 empty_norm = !rcu_preempt_blocked_readers_cgp(rnp);
+                WARN_ON_ONCE(rnp->completedqs == rnp->gp_seq &&
+                             (!empty_norm || rnp->qsmask));
                 empty_exp = sync_rcu_preempt_exp_done(rnp);
                 smp_mb(); /* ensure expedited fastpath sees end of RCU c-s. */
                 np = rcu_next_node_entry(t, rnp);
                 list_del_init(&t->rcu_node_entry);
                 t->rcu_blocked_node = NULL;
                 trace_rcu_unlock_preempted_task(TPS("rcu_preempt"),
-                                                rnp->gpnum, t->pid);
+                                                rnp->gp_seq, t->pid);
                 if (&t->rcu_node_entry == rnp->gp_tasks)
                         rnp->gp_tasks = np;
                 if (&t->rcu_node_entry == rnp->exp_tasks)
@@ -562,7 +576,7 @@ void rcu_read_unlock_special(struct task_struct *t)
                 empty_exp_now = sync_rcu_preempt_exp_done(rnp);
                 if (!empty_norm && !rcu_preempt_blocked_readers_cgp(rnp)) {
                         trace_rcu_quiescent_state_report(TPS("preempt_rcu"),
-                                                         rnp->gpnum,
+                                                         rnp->gp_seq,
                                                          0, rnp->qsmask,
                                                          rnp->level,
                                                          rnp->grplo,
@@ -686,24 +700,27 @@ static int rcu_print_task_exp_stall(struct rcu_node *rnp)
  * Check that the list of blocked tasks for the newly completed grace
  * period is in fact empty.  It is a serious bug to complete a grace
  * period that still has RCU readers blocked!  This function must be
- * invoked -before- updating this rnp's ->gpnum, and the rnp's ->lock
+ * invoked -before- updating this rnp's ->gp_seq, and the rnp's ->lock
  * must be held by the caller.
  *
  * Also, if there are blocked tasks on the list, they automatically
  * block the newly created grace period, so set up ->gp_tasks accordingly.
  */
-static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp)
+static void
+rcu_preempt_check_blocked_tasks(struct rcu_state *rsp, struct rcu_node *rnp)
 {
         struct task_struct *t;
 
         RCU_LOCKDEP_WARN(preemptible(), "rcu_preempt_check_blocked_tasks() invoked with preemption enabled!!!\n");
-        WARN_ON_ONCE(rcu_preempt_blocked_readers_cgp(rnp));
-        if (rcu_preempt_has_tasks(rnp)) {
+        if (WARN_ON_ONCE(rcu_preempt_blocked_readers_cgp(rnp)))
+                dump_blkd_tasks(rsp, rnp, 10);
+        if (rcu_preempt_has_tasks(rnp) &&
+            (rnp->qsmaskinit || rnp->wait_blkd_tasks)) {
                 rnp->gp_tasks = rnp->blkd_tasks.next;
                 t = container_of(rnp->gp_tasks, struct task_struct,
                                  rcu_node_entry);
                 trace_rcu_unlock_preempted_task(TPS("rcu_preempt-GPS"),
-                                                rnp->gpnum, t->pid);
+                                                rnp->gp_seq, t->pid);
         }
         WARN_ON_ONCE(rnp->qsmask);
 }
@@ -717,6 +734,7 @@ static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp)
  */
 static void rcu_preempt_check_callbacks(void)
 {
+        struct rcu_state *rsp = &rcu_preempt_state;
         struct task_struct *t = current;
 
         if (t->rcu_read_lock_nesting == 0) {
@@ -725,7 +743,9 @@ static void rcu_preempt_check_callbacks(void)
         }
         if (t->rcu_read_lock_nesting > 0 &&
             __this_cpu_read(rcu_data_p->core_needs_qs) &&
-            __this_cpu_read(rcu_data_p->cpu_no_qs.b.norm))
+            __this_cpu_read(rcu_data_p->cpu_no_qs.b.norm) &&
+            !t->rcu_read_unlock_special.b.need_qs &&
+            time_after(jiffies, rsp->gp_start + HZ))
                 t->rcu_read_unlock_special.b.need_qs = true;
 }
 
@@ -841,6 +861,47 @@ void exit_rcu(void)
         __rcu_read_unlock();
 }
 
+/*
+ * Dump the blocked-tasks state, but limit the list dump to the
+ * specified number of elements.
+ */
+static void
+dump_blkd_tasks(struct rcu_state *rsp, struct rcu_node *rnp, int ncheck)
+{
+        int cpu;
+        int i;
+        struct list_head *lhp;
+        bool onl;
+        struct rcu_data *rdp;
+        struct rcu_node *rnp1;
+
+        raw_lockdep_assert_held_rcu_node(rnp);
+        pr_info("%s: grp: %d-%d level: %d ->gp_seq %ld ->completedqs %ld\n",
+                __func__, rnp->grplo, rnp->grphi, rnp->level,
+                (long)rnp->gp_seq, (long)rnp->completedqs);
+        for (rnp1 = rnp; rnp1; rnp1 = rnp1->parent)
+                pr_info("%s: %d:%d ->qsmask %#lx ->qsmaskinit %#lx ->qsmaskinitnext %#lx\n",
+                        __func__, rnp1->grplo, rnp1->grphi, rnp1->qsmask, rnp1->qsmaskinit, rnp1->qsmaskinitnext);
+        pr_info("%s: ->gp_tasks %p ->boost_tasks %p ->exp_tasks %p\n",
+                __func__, rnp->gp_tasks, rnp->boost_tasks, rnp->exp_tasks);
+        pr_info("%s: ->blkd_tasks", __func__);
+        i = 0;
+        list_for_each(lhp, &rnp->blkd_tasks) {
+                pr_cont(" %p", lhp);
+                if (++i >= 10)
+                        break;
+        }
+        pr_cont("\n");
+        for (cpu = rnp->grplo; cpu <= rnp->grphi; cpu++) {
+                rdp = per_cpu_ptr(rsp->rda, cpu);
+                onl = !!(rdp->grpmask & rcu_rnp_online_cpus(rnp));
+                pr_info("\t%d: %c online: %ld(%d) offline: %ld(%d)\n",
+                        cpu, ".o"[onl],
+                        (long)rdp->rcu_onl_gp_seq, rdp->rcu_onl_gp_flags,
+                        (long)rdp->rcu_ofl_gp_seq, rdp->rcu_ofl_gp_flags);
+        }
+}
+
 #else /* #ifdef CONFIG_PREEMPT_RCU */
 
 static struct rcu_state *const rcu_state_p = &rcu_sched_state;
@@ -911,7 +972,8 @@ static int rcu_print_task_exp_stall(struct rcu_node *rnp)
  * so there is no need to check for blocked tasks.  So check only for
  * bogus qsmask values.
  */
-static void rcu_preempt_check_blocked_tasks(struct rcu_node *rnp)
+static void
+rcu_preempt_check_blocked_tasks(struct rcu_state *rsp, struct rcu_node *rnp)
 {
         WARN_ON_ONCE(rnp->qsmask);
 }
@@ -949,6 +1011,15 @@ void exit_rcu(void)
 {
 }
 
+/*
+ * Dump the guaranteed-empty blocked-tasks state.  Trust but verify.
+ */
+static void
+dump_blkd_tasks(struct rcu_state *rsp, struct rcu_node *rnp, int ncheck)
+{
+        WARN_ON_ONCE(!list_empty(&rnp->blkd_tasks));
+}
+
 #endif /* #else #ifdef CONFIG_PREEMPT_RCU */
 
 #ifdef CONFIG_RCU_BOOST
@@ -1433,7 +1504,8 @@ static bool __maybe_unused rcu_try_advance_all_cbs(void)
                  * completed since we last checked and there are
                  * callbacks not yet ready to invoke.
                  */
-                if ((rdp->completed != rnp->completed ||
+                if ((rcu_seq_completed_gp(rdp->gp_seq,
+                                          rcu_seq_current(&rnp->gp_seq)) ||
                      unlikely(READ_ONCE(rdp->gpwrap))) &&
                     rcu_segcblist_pend_cbs(&rdp->cblist))
                         note_gp_changes(rsp, rdp);
@@ -1720,16 +1792,16 @@ static void print_cpu_stall_info(struct rcu_state *rsp, int cpu)
          */
         touch_nmi_watchdog();
 
-        if (rsp->gpnum == rdp->gpnum) {
+        ticks_value = rcu_seq_ctr(rsp->gp_seq - rdp->gp_seq);
+        if (ticks_value) {
+                ticks_title = "GPs behind";
+        } else {
                 ticks_title = "ticks this GP";
                 ticks_value = rdp->ticks_this_gp;
-        } else {
-                ticks_title = "GPs behind";
-                ticks_value = rsp->gpnum - rdp->gpnum;
         }
         print_cpu_stall_fast_no_hz(fast_no_hz, cpu);
-        delta = rdp->mynode->gpnum - rdp->rcu_iw_gpnum;
-        pr_err("\t%d-%c%c%c%c: (%lu %s) idle=%03x/%ld/%ld softirq=%u/%u fqs=%ld %s\n",
+        delta = rcu_seq_ctr(rdp->mynode->gp_seq - rdp->rcu_iw_gp_seq);
+        pr_err("\t%d-%c%c%c%c: (%lu %s) idle=%03x/%ld/%#lx softirq=%u/%u fqs=%ld %s\n",
                cpu,
                "O."[!!cpu_online(cpu)],
                "o."[!!(rdp->grpmask & rdp->mynode->qsmaskinit)],
@@ -1817,7 +1889,7 @@ static void rcu_nocb_gp_cleanup(struct swait_queue_head *sq)
 
 static struct swait_queue_head *rcu_nocb_gp_get(struct rcu_node *rnp)
 {
-        return &rnp->nocb_gp_wq[rnp->completed & 0x1];
+        return &rnp->nocb_gp_wq[rcu_seq_ctr(rnp->gp_seq) & 0x1];
 }
 
 static void rcu_init_one_nocb(struct rcu_node *rnp)
@@ -1854,8 +1926,8 @@ static void __wake_nocb_leader(struct rcu_data *rdp, bool force,
                 WRITE_ONCE(rdp_leader->nocb_leader_sleep, false);
                 del_timer(&rdp->nocb_timer);
                 raw_spin_unlock_irqrestore(&rdp->nocb_lock, flags);
-                smp_mb(); /* ->nocb_leader_sleep before swake_up(). */
-                swake_up(&rdp_leader->nocb_wq);
+                smp_mb(); /* ->nocb_leader_sleep before swake_up_one(). */
+                swake_up_one(&rdp_leader->nocb_wq);
         } else {
                 raw_spin_unlock_irqrestore(&rdp->nocb_lock, flags);
         }
@@ -2069,12 +2141,17 @@ static void rcu_nocb_wait_gp(struct rcu_data *rdp)
         bool needwake;
         struct rcu_node *rnp = rdp->mynode;
 
-        raw_spin_lock_irqsave_rcu_node(rnp, flags);
-        c = rcu_cbs_completed(rdp->rsp, rnp);
-        needwake = rcu_start_this_gp(rnp, rdp, c);
-        raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
-        if (needwake)
-                rcu_gp_kthread_wake(rdp->rsp);
+        local_irq_save(flags);
+        c = rcu_seq_snap(&rdp->rsp->gp_seq);
+        if (!rdp->gpwrap && ULONG_CMP_GE(rdp->gp_seq_needed, c)) {
+                local_irq_restore(flags);
+        } else {
+                raw_spin_lock_rcu_node(rnp); /* irqs already disabled. */
+                needwake = rcu_start_this_gp(rnp, rdp, c);
+                raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
+                if (needwake)
+                        rcu_gp_kthread_wake(rdp->rsp);
+        }
 
         /*
          * Wait for the grace period.  Do so interruptibly to avoid messing
@@ -2082,9 +2159,9 @@ static void rcu_nocb_wait_gp(struct rcu_data *rdp)
          */
         trace_rcu_this_gp(rnp, rdp, c, TPS("StartWait"));
         for (;;) {
-                swait_event_interruptible(
-                        rnp->nocb_gp_wq[c & 0x1],
-                        (d = ULONG_CMP_GE(READ_ONCE(rnp->completed), c)));
+                swait_event_interruptible_exclusive(
+                        rnp->nocb_gp_wq[rcu_seq_ctr(c) & 0x1],
+                        (d = rcu_seq_done(&rnp->gp_seq, c)));
                 if (likely(d))
                         break;
                 WARN_ON(signal_pending(current));
@@ -2111,7 +2188,7 @@ wait_again:
         /* Wait for callbacks to appear. */
         if (!rcu_nocb_poll) {
                 trace_rcu_nocb_wake(my_rdp->rsp->name, my_rdp->cpu, TPS("Sleep"));
-                swait_event_interruptible(my_rdp->nocb_wq,
+                swait_event_interruptible_exclusive(my_rdp->nocb_wq,
                                 !READ_ONCE(my_rdp->nocb_leader_sleep));
                 raw_spin_lock_irqsave(&my_rdp->nocb_lock, flags);
                 my_rdp->nocb_leader_sleep = true;
@@ -2176,7 +2253,7 @@ wait_again:
                 raw_spin_unlock_irqrestore(&rdp->nocb_lock, flags);
                 if (rdp != my_rdp && tail == &rdp->nocb_follower_head) {
                         /* List was empty, so wake up the follower.  */
-                        swake_up(&rdp->nocb_wq);
+                        swake_up_one(&rdp->nocb_wq);
                 }
         }
 
@@ -2193,7 +2270,7 @@ static void nocb_follower_wait(struct rcu_data *rdp)
 {
         for (;;) {
                 trace_rcu_nocb_wake(rdp->rsp->name, rdp->cpu, TPS("FollowerSleep"));
-                swait_event_interruptible(rdp->nocb_wq,
+                swait_event_interruptible_exclusive(rdp->nocb_wq,
                                          READ_ONCE(rdp->nocb_follower_head));
                 if (smp_load_acquire(&rdp->nocb_follower_head)) {
                         /* ^^^ Ensure CB invocation follows _head test. */
@@ -2569,23 +2646,6 @@ static bool init_nocb_callback_list(struct rcu_data *rdp)
 #endif /* #else #ifdef CONFIG_RCU_NOCB_CPU */
 
 /*
- * An adaptive-ticks CPU can potentially execute in kernel mode for an
- * arbitrarily long period of time with the scheduling-clock tick turned
- * off.  RCU will be paying attention to this CPU because it is in the
- * kernel, but the CPU cannot be guaranteed to be executing the RCU state
- * machine because the scheduling-clock tick has been disabled.  Therefore,
- * if an adaptive-ticks CPU is failing to respond to the current grace
- * period and has not be idle from an RCU perspective, kick it.
- */
-static void __maybe_unused rcu_kick_nohz_cpu(int cpu)
-{
-#ifdef CONFIG_NO_HZ_FULL
-        if (tick_nohz_full_cpu(cpu))
-                smp_send_reschedule(cpu);
-#endif /* #ifdef CONFIG_NO_HZ_FULL */
-}
-
-/*
  * Is this CPU a NO_HZ_FULL CPU that should ignore RCU so that the
  * grace-period kthread will do force_quiescent_state() processing?
  * The idea is to avoid waking up RCU core processing on such a
@@ -2610,8 +2670,6 @@ static bool rcu_nohz_full_cpu(struct rcu_state *rsp)
  */
 static void rcu_bind_gp_kthread(void)
 {
-        int __maybe_unused cpu;
-
         if (!tick_nohz_full_enabled())
                 return;
         housekeeping_affine(current, HK_FLAG_RCU);
diff --git a/kernel/rcu/update.c b/kernel/rcu/update.c
index 4c230a60ece4..39cb23d22109 100644
--- a/kernel/rcu/update.c
+++ b/kernel/rcu/update.c
@@ -507,14 +507,15 @@ early_initcall(check_cpu_stall_init);
 #ifdef CONFIG_TASKS_RCU
 
 /*
- * Simple variant of RCU whose quiescent states are voluntary context switch,
- * user-space execution, and idle.  As such, grace periods can take one good
- * long time.  There are no read-side primitives similar to rcu_read_lock()
- * and rcu_read_unlock() because this implementation is intended to get
- * the system into a safe state for some of the manipulations involved in
- * tracing and the like.  Finally, this implementation does not support
- * high call_rcu_tasks() rates from multiple CPUs.  If this is required,
- * per-CPU callback lists will be needed.
+ * Simple variant of RCU whose quiescent states are voluntary context
+ * switch, cond_resched_rcu_qs(), user-space execution, and idle.
+ * As such, grace periods can take one good long time.  There are no
+ * read-side primitives similar to rcu_read_lock() and rcu_read_unlock()
+ * because this implementation is intended to get the system into a safe
+ * state for some of the manipulations involved in tracing and the like.
+ * Finally, this implementation does not support high call_rcu_tasks()
+ * rates from multiple CPUs.  If this is required, per-CPU callback lists
+ * will be needed.
  */
 
 /* Global list of callbacks and associated lock. */
@@ -542,11 +543,11 @@ static struct task_struct *rcu_tasks_kthread_ptr;
  * period elapses, in other words after all currently executing RCU
  * read-side critical sections have completed. call_rcu_tasks() assumes
  * that the read-side critical sections end at a voluntary context
- * switch (not a preemption!), entry into idle, or transition to usermode
- * execution.  As such, there are no read-side primitives analogous to
- * rcu_read_lock() and rcu_read_unlock() because this primitive is intended
- * to determine that all tasks have passed through a safe state, not so
- * much for data-strcuture synchronization.
+ * switch (not a preemption!), cond_resched_rcu_qs(), entry into idle,
+ * or transition to usermode execution.  As such, there are no read-side
+ * primitives analogous to rcu_read_lock() and rcu_read_unlock() because
+ * this primitive is intended to determine that all tasks have passed
+ * through a safe state, not so much for data-strcuture synchronization.
  *
  * See the description of call_rcu() for more detailed information on
  * memory ordering guarantees.
@@ -667,6 +668,7 @@ static int __noreturn rcu_tasks_kthread(void *arg)
         struct rcu_head *list;
         struct rcu_head *next;
         LIST_HEAD(rcu_tasks_holdouts);
+        int fract;
 
         /* Run on housekeeping CPUs by default.  Sysadm can move if desired. */
         housekeeping_affine(current, HK_FLAG_RCU);
@@ -748,13 +750,25 @@ static int __noreturn rcu_tasks_kthread(void *arg)
                  * holdouts.  When the list is empty, we are done.
                  */
                 lastreport = jiffies;
-                while (!list_empty(&rcu_tasks_holdouts)) {
+
+                /* Start off with HZ/10 wait and slowly back off to 1 HZ wait*/
+                fract = 10;
+
+                for (;;) {
                         bool firstreport;
                         bool needreport;
                         int rtst;
                         struct task_struct *t1;
 
-                        schedule_timeout_interruptible(HZ);
+                        if (list_empty(&rcu_tasks_holdouts))
+                                break;
+
+                        /* Slowly back off waiting for holdouts */
+                        schedule_timeout_interruptible(HZ/fract);
+
+                        if (fract > 1)
+                                fract--;
+
                         rtst = READ_ONCE(rcu_task_stall_timeout);
                         needreport = rtst > 0 &&
                                      time_after(jiffies, lastreport + rtst);
@@ -800,6 +814,7 @@ static int __noreturn rcu_tasks_kthread(void *arg)
                         list = next;
                         cond_resched();
                 }
+                /* Paranoid sleep to keep this from entering a tight loop */
                 schedule_timeout_uninterruptible(HZ/10);
         }
 }
diff --git a/kernel/sched/Makefile b/kernel/sched/Makefile
index d9a02b318108..7fe183404c38 100644
--- a/kernel/sched/Makefile
+++ b/kernel/sched/Makefile
@@ -20,7 +20,7 @@ obj-y += core.o loadavg.o clock.o cputime.o
 obj-y += idle.o fair.o rt.o deadline.o
 obj-y += wait.o wait_bit.o swait.o completion.o
 
-obj-$(CONFIG_SMP) += cpupri.o cpudeadline.o topology.o stop_task.o
+obj-$(CONFIG_SMP) += cpupri.o cpudeadline.o topology.o stop_task.o pelt.o
 obj-$(CONFIG_SCHED_AUTOGROUP) += autogroup.o
 obj-$(CONFIG_SCHEDSTATS) += stats.o
 obj-$(CONFIG_SCHED_DEBUG) += debug.o
diff --git a/kernel/sched/clock.c b/kernel/sched/clock.c
index 10c83e73837a..e3e3b979f9bd 100644
--- a/kernel/sched/clock.c
+++ b/kernel/sched/clock.c
@@ -53,6 +53,7 @@
  *
  */
 #include "sched.h"
+#include <linux/sched_clock.h>
 
 /*
  * Scheduler clock - returns current time in nanosec units.
@@ -66,12 +67,7 @@ unsigned long long __weak sched_clock(void)
 }
 EXPORT_SYMBOL_GPL(sched_clock);
 
-__read_mostly int sched_clock_running;
-
-void sched_clock_init(void)
-{
-        sched_clock_running = 1;
-}
+static DEFINE_STATIC_KEY_FALSE(sched_clock_running);
 
 #ifdef CONFIG_HAVE_UNSTABLE_SCHED_CLOCK
 /*
@@ -195,17 +191,40 @@ void clear_sched_clock_stable(void)
 
         smp_mb(); /* matches sched_clock_init_late() */
 
-        if (sched_clock_running == 2)
+        if (static_key_count(&sched_clock_running.key) == 2)
                 __clear_sched_clock_stable();
 }
 
+static void __sched_clock_gtod_offset(void)
+{
+        struct sched_clock_data *scd = this_scd();
+
+        __scd_stamp(scd);
+        __gtod_offset = (scd->tick_raw + __sched_clock_offset) - scd->tick_gtod;
+}
+
+void __init sched_clock_init(void)
+{
+        /*
+         * Set __gtod_offset such that once we mark sched_clock_running,
+         * sched_clock_tick() continues where sched_clock() left off.
+         *
+         * Even if TSC is buggered, we're still UP at this point so it
+         * can't really be out of sync.
+         */
+        local_irq_disable();
+        __sched_clock_gtod_offset();
+        local_irq_enable();
+
+        static_branch_inc(&sched_clock_running);
+}
 /*
  * We run this as late_initcall() such that it runs after all built-in drivers,
  * notably: acpi_processor and intel_idle, which can mark the TSC as unstable.
  */
 static int __init sched_clock_init_late(void)
 {
-        sched_clock_running = 2;
+        static_branch_inc(&sched_clock_running);
         /*
          * Ensure that it is impossible to not do a static_key update.
          *
@@ -350,8 +369,8 @@ u64 sched_clock_cpu(int cpu)
         if (sched_clock_stable())
                 return sched_clock() + __sched_clock_offset;
 
-        if (unlikely(!sched_clock_running))
-                return 0ull;
+        if (!static_branch_unlikely(&sched_clock_running))
+                return sched_clock();
 
         preempt_disable_notrace();
         scd = cpu_sdc(cpu);
@@ -373,7 +392,7 @@ void sched_clock_tick(void)
         if (sched_clock_stable())
                 return;
 
-        if (unlikely(!sched_clock_running))
+        if (!static_branch_unlikely(&sched_clock_running))
                 return;
 
         lockdep_assert_irqs_disabled();
@@ -385,8 +404,6 @@ void sched_clock_tick(void)
 
 void sched_clock_tick_stable(void)
 {
-        u64 gtod, clock;
-
         if (!sched_clock_stable())
                 return;
 
@@ -398,9 +415,7 @@ void sched_clock_tick_stable(void)
          * TSC to be unstable, any computation will be computing crap.
          */
         local_irq_disable();
-        gtod = ktime_get_ns();
-        clock = sched_clock();
-        __gtod_offset = (clock + __sched_clock_offset) - gtod;
+        __sched_clock_gtod_offset();
         local_irq_enable();
 }
 
@@ -434,9 +449,17 @@ EXPORT_SYMBOL_GPL(sched_clock_idle_wakeup_event);
 
 #else /* CONFIG_HAVE_UNSTABLE_SCHED_CLOCK */
 
+void __init sched_clock_init(void)
+{
+        static_branch_inc(&sched_clock_running);
+        local_irq_disable();
+        generic_sched_clock_init();
+        local_irq_enable();
+}
+
 u64 sched_clock_cpu(int cpu)
 {
-        if (unlikely(!sched_clock_running))
+        if (!static_branch_unlikely(&sched_clock_running))
                 return 0;
 
         return sched_clock();
diff --git a/kernel/sched/completion.c b/kernel/sched/completion.c
index e426b0cb9ac6..a1ad5b7d5521 100644
--- a/kernel/sched/completion.c
+++ b/kernel/sched/completion.c
@@ -22,8 +22,8 @@
  *
  * See also complete_all(), wait_for_completion() and related routines.
  *
- * It may be assumed that this function implies a write memory barrier before
- * changing the task state if and only if any tasks are woken up.
+ * If this function wakes up a task, it executes a full memory barrier before
+ * accessing the task state.
  */
 void complete(struct completion *x)
 {
@@ -44,8 +44,8 @@ EXPORT_SYMBOL(complete);
  *
  * This will wake up all threads waiting on this particular completion event.
  *
- * It may be assumed that this function implies a write memory barrier before
- * changing the task state if and only if any tasks are woken up.
+ * If this function wakes up a task, it executes a full memory barrier before
+ * accessing the task state.
  *
  * Since complete_all() sets the completion of @x permanently to done
  * to allow multiple waiters to finish, a call to reinit_completion()
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index fe365c9a08e9..c45de46fdf10 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -17,6 +17,8 @@
 #include "../workqueue_internal.h"
 #include "../smpboot.h"
 
+#include "pelt.h"
+
 #define CREATE_TRACE_POINTS
 #include <trace/events/sched.h>
 
@@ -45,14 +47,6 @@ const_debug unsigned int sysctl_sched_features =
 const_debug unsigned int sysctl_sched_nr_migrate = 32;
 
 /*
- * period over which we average the RT time consumption, measured
- * in ms.
- *
- * default: 1s
- */
-const_debug unsigned int sysctl_sched_time_avg = MSEC_PER_SEC;
-
-/*
  * period over which we measure -rt task CPU usage in us.
  * default: 1s
  */
@@ -183,9 +177,9 @@ static void update_rq_clock_task(struct rq *rq, s64 delta)
 
         rq->clock_task += delta;
 
-#if defined(CONFIG_IRQ_TIME_ACCOUNTING) || defined(CONFIG_PARAVIRT_TIME_ACCOUNTING)
+#ifdef HAVE_SCHED_AVG_IRQ
         if ((irq_delta + steal) && sched_feat(NONTASK_CAPACITY))
-                sched_rt_avg_update(rq, irq_delta + steal);
+                update_irq_load_avg(rq, irq_delta + steal);
 #endif
 }
 
@@ -412,8 +406,8 @@ void wake_q_add(struct wake_q_head *head, struct task_struct *task)
          * its already queued (either by us or someone else) and will get the
          * wakeup due to that.
          *
-         * This cmpxchg() implies a full barrier, which pairs with the write
-         * barrier implied by the wakeup in wake_up_q().
+         * This cmpxchg() executes a full barrier, which pairs with the full
+         * barrier executed by the wakeup in wake_up_q().
          */
         if (cmpxchg(&node->next, NULL, WAKE_Q_TAIL))
                 return;
@@ -441,8 +435,8 @@ void wake_up_q(struct wake_q_head *head)
                 task->wake_q.next = NULL;
 
                 /*
-                 * wake_up_process() implies a wmb() to pair with the queueing
-                 * in wake_q_add() so as not to miss wakeups.
+                 * wake_up_process() executes a full barrier, which pairs with
+                 * the queueing in wake_q_add() so as not to miss wakeups.
                  */
                 wake_up_process(task);
                 put_task_struct(task);
@@ -649,23 +643,6 @@ bool sched_can_stop_tick(struct rq *rq)
         return true;
 }
 #endif /* CONFIG_NO_HZ_FULL */
-
-void sched_avg_update(struct rq *rq)
-{
-        s64 period = sched_avg_period();
-
-        while ((s64)(rq_clock(rq) - rq->age_stamp) > period) {
-                /*
-                 * Inline assembly required to prevent the compiler
-                 * optimising this loop into a divmod call.
-                 * See __iter_div_u64_rem() for another example of this.
-                 */
-                asm("" : "+rm" (rq->age_stamp));
-                rq->age_stamp += period;
-                rq->rt_avg /= 2;
-        }
-}
-
 #endif /* CONFIG_SMP */
 
 #if defined(CONFIG_RT_GROUP_SCHED) || (defined(CONFIG_FAIR_GROUP_SCHED) && \
@@ -1199,6 +1176,7 @@ void set_task_cpu(struct task_struct *p, unsigned int new_cpu)
         __set_task_cpu(p, new_cpu);
 }
 
+#ifdef CONFIG_NUMA_BALANCING
 static void __migrate_swap_task(struct task_struct *p, int cpu)
 {
         if (task_on_rq_queued(p)) {
@@ -1280,16 +1258,17 @@ unlock:
 /*
  * Cross migrate two tasks
  */
-int migrate_swap(struct task_struct *cur, struct task_struct *p)
+int migrate_swap(struct task_struct *cur, struct task_struct *p,
+                int target_cpu, int curr_cpu)
 {
         struct migration_swap_arg arg;
         int ret = -EINVAL;
 
         arg = (struct migration_swap_arg){
                 .src_task = cur,
-                .src_cpu = task_cpu(cur),
+                .src_cpu = curr_cpu,
                 .dst_task = p,
-                .dst_cpu = task_cpu(p),
+                .dst_cpu = target_cpu,
         };
 
         if (arg.src_cpu == arg.dst_cpu)
@@ -1314,6 +1293,7 @@ int migrate_swap(struct task_struct *cur, struct task_struct *p)
 out:
         return ret;
 }
+#endif /* CONFIG_NUMA_BALANCING */
 
 /*
  * wait_task_inactive - wait for a thread to unschedule.
@@ -1879,8 +1859,7 @@ static void ttwu_queue(struct task_struct *p, int cpu, int wake_flags)
  *     rq(c1)->lock (if not at the same time, then in that order).
  *  C) LOCK of the rq(c1)->lock scheduling in task
  *
- * Transitivity guarantees that B happens after A and C after B.
- * Note: we only require RCpc transitivity.
+ * Release/acquire chaining guarantees that B happens after A and C after B.
  * Note: the CPU doing B need not be c0 or c1
  *
  * Example:
@@ -1942,16 +1921,9 @@ static void ttwu_queue(struct task_struct *p, int cpu, int wake_flags)
  *   UNLOCK rq(0)->lock
  *
  *
- * However; for wakeups there is a second guarantee we must provide, namely we
- * must observe the state that lead to our wakeup. That is, not only must our
- * task observe its own prior state, it must also observe the stores prior to
- * its wakeup.
- *
- * This means that any means of doing remote wakeups must order the CPU doing
- * the wakeup against the CPU the task is going to end up running on. This,
- * however, is already required for the regular Program-Order guarantee above,
- * since the waking CPU is the one issueing the ACQUIRE (smp_cond_load_acquire).
- *
+ * However, for wakeups there is a second guarantee we must provide, namely we
+ * must ensure that CONDITION=1 done by the caller can not be reordered with
+ * accesses to the task state; see try_to_wake_up() and set_current_state().
  */
 
 /**
@@ -1967,6 +1939,9 @@ static void ttwu_queue(struct task_struct *p, int cpu, int wake_flags)
  * Atomic against schedule() which would dequeue a task, also see
  * set_current_state().
  *
+ * This function executes a full memory barrier before accessing the task
+ * state; see set_current_state().
+ *
  * Return: %true if @p->state changes (an actual wakeup was done),
  *         %false otherwise.
  */
@@ -1998,21 +1973,20 @@ try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
          * be possible to, falsely, observe p->on_rq == 0 and get stuck
          * in smp_cond_load_acquire() below.
          *
-         * sched_ttwu_pending()                 try_to_wake_up()
-         *   [S] p->on_rq = 1;                  [L] P->state
-         *       UNLOCK rq->lock  -----.
-         *                              \
-         *                               +---   RMB
-         * schedule()                   /
-         *       LOCK rq->lock    -----'
-         *       UNLOCK rq->lock
+         * sched_ttwu_pending()                 try_to_wake_up()
+         *   STORE p->on_rq = 1                   LOAD p->state
+         *   UNLOCK rq->lock
+         *
+         * __schedule() (switch to task 'p')
+         *   LOCK rq->lock                        smp_rmb();
+         *   smp_mb__after_spinlock();
+         *   UNLOCK rq->lock
          *
          * [task p]
-         *   [S] p->state = UNINTERRUPTIBLE     [L] p->on_rq
+         *   STORE p->state = UNINTERRUPTIBLE     LOAD p->on_rq
          *
-         * Pairs with the UNLOCK+LOCK on rq->lock from the
-         * last wakeup of our task and the schedule that got our task
-         * current.
+         * Pairs with the LOCK+smp_mb__after_spinlock() on rq->lock in
+         * __schedule().  See the comment for smp_mb__after_spinlock().
          */
         smp_rmb();
         if (p->on_rq && ttwu_remote(p, wake_flags))
@@ -2026,15 +2000,17 @@ try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
          * One must be running (->on_cpu == 1) in order to remove oneself
          * from the runqueue.
          *
-         *  [S] ->on_cpu = 1;   [L] ->on_rq
-         *      UNLOCK rq->lock
-         *                      RMB
-         *      LOCK   rq->lock
-         *  [S] ->on_rq = 0;    [L] ->on_cpu
+         * __schedule() (switch to task 'p')    try_to_wake_up()
+         *   STORE p->on_cpu = 1                  LOAD p->on_rq
+         *   UNLOCK rq->lock
+         *
+         * __schedule() (put 'p' to sleep)
+         *   LOCK rq->lock                        smp_rmb();
+         *   smp_mb__after_spinlock();
+         *   STORE p->on_rq = 0                   LOAD p->on_cpu
          *
-         * Pairs with the full barrier implied in the UNLOCK+LOCK on rq->lock
-         * from the consecutive calls to schedule(); the first switching to our
-         * task, the second putting it to sleep.
+         * Pairs with the LOCK+smp_mb__after_spinlock() on rq->lock in
+         * __schedule().  See the comment for smp_mb__after_spinlock().
          */
         smp_rmb();
 
@@ -2140,8 +2116,7 @@ out:
  *
  * Return: 1 if the process was woken up, 0 if it was already running.
  *
- * It may be assumed that this function implies a write memory barrier before
- * changing the task state if and only if any tasks are woken up.
+ * This function executes a full memory barrier before accessing the task state.
  */
 int wake_up_process(struct task_struct *p)
 {
@@ -2317,7 +2292,6 @@ static inline void init_schedstats(void) {}
 int sched_fork(unsigned long clone_flags, struct task_struct *p)
 {
         unsigned long flags;
-        int cpu = get_cpu();
 
         __sched_fork(clone_flags, p);
         /*
@@ -2353,14 +2327,12 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p)
                 p->sched_reset_on_fork = 0;
         }
 
-        if (dl_prio(p->prio)) {
-                put_cpu();
+        if (dl_prio(p->prio))
                 return -EAGAIN;
-        } else if (rt_prio(p->prio)) {
+        else if (rt_prio(p->prio))
                 p->sched_class = &rt_sched_class;
-        } else {
+        else
                 p->sched_class = &fair_sched_class;
-        }
 
         init_entity_runnable_average(&p->se);
 
@@ -2376,7 +2348,7 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p)
          * We're setting the CPU for the first time, we don't migrate,
          * so use __set_task_cpu().
          */
-        __set_task_cpu(p, cpu);
+        __set_task_cpu(p, smp_processor_id());
         if (p->sched_class->task_fork)
                 p->sched_class->task_fork(p);
         raw_spin_unlock_irqrestore(&p->pi_lock, flags);
@@ -2393,8 +2365,6 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p)
         plist_node_init(&p->pushable_tasks, MAX_PRIO);
         RB_CLEAR_NODE(&p->pushable_dl_tasks);
 #endif
-
-        put_cpu();
         return 0;
 }
 
@@ -5714,13 +5684,6 @@ void set_rq_offline(struct rq *rq)
         }
 }
 
-static void set_cpu_rq_start_time(unsigned int cpu)
-{
-        struct rq *rq = cpu_rq(cpu);
-
-        rq->age_stamp = sched_clock_cpu(cpu);
-}
-
 /*
  * used to mark begin/end of suspend/resume:
  */
@@ -5838,7 +5801,6 @@ static void sched_rq_cpu_starting(unsigned int cpu)
 
 int sched_cpu_starting(unsigned int cpu)
 {
-        set_cpu_rq_start_time(cpu);
         sched_rq_cpu_starting(cpu);
         sched_tick_start(cpu);
         return 0;
@@ -5954,7 +5916,6 @@ void __init sched_init(void)
         int i, j;
         unsigned long alloc_size = 0, ptr;
 
-        sched_clock_init();
         wait_bit_init();
 
 #ifdef CONFIG_FAIR_GROUP_SCHED
@@ -6106,7 +6067,6 @@ void __init sched_init(void)
 
 #ifdef CONFIG_SMP
         idle_thread_set_boot_cpu();
-        set_cpu_rq_start_time(smp_processor_id());
 #endif
         init_sched_fair_class();
 
@@ -6785,6 +6745,16 @@ static int cpu_cfs_stat_show(struct seq_file *sf, void *v)
         seq_printf(sf, "nr_throttled %d\n", cfs_b->nr_throttled);
         seq_printf(sf, "throttled_time %llu\n", cfs_b->throttled_time);
 
+        if (schedstat_enabled() && tg != &root_task_group) {
+                u64 ws = 0;
+                int i;
+
+                for_each_possible_cpu(i)
+                        ws += schedstat_val(tg->se[i]->statistics.wait_sum);
+
+                seq_printf(sf, "wait_sum %llu\n", ws);
+        }
+
         return 0;
 }
 #endif /* CONFIG_CFS_BANDWIDTH */
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index c907fde01eaa..3fffad3bc8a8 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -53,9 +53,7 @@ struct sugov_cpu {
         unsigned int            iowait_boost_max;
         u64                     last_update;
 
-        /* The fields below are only needed when sharing a policy: */
-        unsigned long           util_cfs;
-        unsigned long           util_dl;
+        unsigned long           bw_dl;
         unsigned long           max;
 
         /* The field below is for single-CPU policies only: */
@@ -179,33 +177,90 @@ static unsigned int get_next_freq(struct sugov_policy *sg_policy,
         return cpufreq_driver_resolve_freq(policy, freq);
 }
 
-static void sugov_get_util(struct sugov_cpu *sg_cpu)
+/*
+ * This function computes an effective utilization for the given CPU, to be
+ * used for frequency selection given the linear relation: f = u * f_max.
+ *
+ * The scheduler tracks the following metrics:
+ *
+ *   cpu_util_{cfs,rt,dl,irq}()
+ *   cpu_bw_dl()
+ *
+ * Where the cfs,rt and dl util numbers are tracked with the same metric and
+ * synchronized windows and are thus directly comparable.
+ *
+ * The cfs,rt,dl utilization are the running times measured with rq->clock_task
+ * which excludes things like IRQ and steal-time. These latter are then accrued
+ * in the irq utilization.
+ *
+ * The DL bandwidth number otoh is not a measured metric but a value computed
+ * based on the task model parameters and gives the minimal utilization
+ * required to meet deadlines.
+ */
+static unsigned long sugov_get_util(struct sugov_cpu *sg_cpu)
 {
         struct rq *rq = cpu_rq(sg_cpu->cpu);
+        unsigned long util, irq, max;
 
-        sg_cpu->max = arch_scale_cpu_capacity(NULL, sg_cpu->cpu);
-        sg_cpu->util_cfs = cpu_util_cfs(rq);
-        sg_cpu->util_dl  = cpu_util_dl(rq);
-}
-
-static unsigned long sugov_aggregate_util(struct sugov_cpu *sg_cpu)
-{
-        struct rq *rq = cpu_rq(sg_cpu->cpu);
+        sg_cpu->max = max = arch_scale_cpu_capacity(NULL, sg_cpu->cpu);
+        sg_cpu->bw_dl = cpu_bw_dl(rq);
 
         if (rt_rq_is_runnable(&rq->rt))
-                return sg_cpu->max;
+                return max;
+
+        /*
+         * Early check to see if IRQ/steal time saturates the CPU, can be
+         * because of inaccuracies in how we track these -- see
+         * update_irq_load_avg().
+         */
+        irq = cpu_util_irq(rq);
+        if (unlikely(irq >= max))
+                return max;
+
+        /*
+         * Because the time spend on RT/DL tasks is visible as 'lost' time to
+         * CFS tasks and we use the same metric to track the effective
+         * utilization (PELT windows are synchronized) we can directly add them
+         * to obtain the CPU's actual utilization.
+         */
+        util = cpu_util_cfs(rq);
+        util += cpu_util_rt(rq);
+
+        /*
+         * We do not make cpu_util_dl() a permanent part of this sum because we
+         * want to use cpu_bw_dl() later on, but we need to check if the
+         * CFS+RT+DL sum is saturated (ie. no idle time) such that we select
+         * f_max when there is no idle time.
+         *
+         * NOTE: numerical errors or stop class might cause us to not quite hit
+         * saturation when we should -- something for later.
+         */
+        if ((util + cpu_util_dl(rq)) >= max)
+                return max;
+
+        /*
+         * There is still idle time; further improve the number by using the
+         * irq metric. Because IRQ/steal time is hidden from the task clock we
+         * need to scale the task numbers:
+         *
+         *              1 - irq
+         *   U' = irq + ------- * U
+         *                max
+         */
+        util = scale_irq_capacity(util, irq, max);
+        util += irq;
 
         /*
-         * Utilization required by DEADLINE must always be granted while, for
-         * FAIR, we use blocked utilization of IDLE CPUs as a mechanism to
-         * gracefully reduce the frequency when no tasks show up for longer
+         * Bandwidth required by DEADLINE must always be granted while, for
+         * FAIR and RT, we use blocked utilization of IDLE CPUs as a mechanism
+         * to gracefully reduce the frequency when no tasks show up for longer
          * periods of time.
          *
-         * Ideally we would like to set util_dl as min/guaranteed freq and
-         * util_cfs + util_dl as requested freq. However, cpufreq is not yet
-         * ready for such an interface. So, we only do the latter for now.
+         * Ideally we would like to set bw_dl as min/guaranteed freq and util +
+         * bw_dl as requested freq. However, cpufreq is not yet ready for such
+         * an interface. So, we only do the latter for now.
          */
-        return min(sg_cpu->max, (sg_cpu->util_dl + sg_cpu->util_cfs));
+        return min(max, util + sg_cpu->bw_dl);
 }
 
 /**
@@ -360,7 +415,7 @@ static inline bool sugov_cpu_is_busy(struct sugov_cpu *sg_cpu) { return false; }
  */
 static inline void ignore_dl_rate_limit(struct sugov_cpu *sg_cpu, struct sugov_policy *sg_policy)
 {
-        if (cpu_util_dl(cpu_rq(sg_cpu->cpu)) > sg_cpu->util_dl)
+        if (cpu_bw_dl(cpu_rq(sg_cpu->cpu)) > sg_cpu->bw_dl)
                 sg_policy->need_freq_update = true;
 }
 
@@ -383,9 +438,8 @@ static void sugov_update_single(struct update_util_data *hook, u64 time,
 
         busy = sugov_cpu_is_busy(sg_cpu);
 
-        sugov_get_util(sg_cpu);
+        util = sugov_get_util(sg_cpu);
         max = sg_cpu->max;
-        util = sugov_aggregate_util(sg_cpu);
         sugov_iowait_apply(sg_cpu, time, &util, &max);
         next_f = get_next_freq(sg_policy, util, max);
         /*
@@ -424,9 +478,8 @@ static unsigned int sugov_next_freq_shared(struct sugov_cpu *sg_cpu, u64 time)
                 struct sugov_cpu *j_sg_cpu = &per_cpu(sugov_cpu, j);
                 unsigned long j_util, j_max;
 
-                sugov_get_util(j_sg_cpu);
+                j_util = sugov_get_util(j_sg_cpu);
                 j_max = j_sg_cpu->max;
-                j_util = sugov_aggregate_util(j_sg_cpu);
                 sugov_iowait_apply(j_sg_cpu, time, &j_util, &j_max);
 
                 if (j_util * max > j_max * util) {
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index b5fbdde6afa9..997ea7b839fa 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -16,6 +16,7 @@
  *                    Fabio Checconi <fchecconi@gmail.com>
  */
 #include "sched.h"
+#include "pelt.h"
 
 struct dl_bandwidth def_dl_bandwidth;
 
@@ -1179,8 +1180,6 @@ static void update_curr_dl(struct rq *rq)
         curr->se.exec_start = now;
         cgroup_account_cputime(curr, delta_exec);
 
-        sched_rt_avg_update(rq, delta_exec);
-
         if (dl_entity_is_special(dl_se))
                 return;
 
@@ -1761,6 +1760,9 @@ pick_next_task_dl(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
 
         deadline_queue_push_tasks(rq);
 
+        if (rq->curr->sched_class != &dl_sched_class)
+                update_dl_rq_load_avg(rq_clock_task(rq), rq, 0);
+
         return p;
 }
 
@@ -1768,6 +1770,7 @@ static void put_prev_task_dl(struct rq *rq, struct task_struct *p)
 {
         update_curr_dl(rq);
 
+        update_dl_rq_load_avg(rq_clock_task(rq), rq, 1);
         if (on_dl_rq(&p->dl) && p->nr_cpus_allowed > 1)
                 enqueue_pushable_dl_task(rq, p);
 }
@@ -1784,6 +1787,7 @@ static void task_tick_dl(struct rq *rq, struct task_struct *p, int queued)
 {
         update_curr_dl(rq);
 
+        update_dl_rq_load_avg(rq_clock_task(rq), rq, 1);
         /*
          * Even when we have runtime, update_curr_dl() might have resulted in us
          * not being the leftmost task anymore. In that case NEED_RESCHED will
diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
index e593b4118578..60caf1fb94e0 100644
--- a/kernel/sched/debug.c
+++ b/kernel/sched/debug.c
@@ -111,20 +111,19 @@ static int sched_feat_set(char *cmp)
                 cmp += 3;
         }
 
-        for (i = 0; i < __SCHED_FEAT_NR; i++) {
-                if (strcmp(cmp, sched_feat_names[i]) == 0) {
-                        if (neg) {
-                                sysctl_sched_features &= ~(1UL << i);
-                                sched_feat_disable(i);
-                        } else {
-                                sysctl_sched_features |= (1UL << i);
-                                sched_feat_enable(i);
-                        }
-                        break;
-                }
+        i = match_string(sched_feat_names, __SCHED_FEAT_NR, cmp);
+        if (i < 0)
+                return i;
+
+        if (neg) {
+                sysctl_sched_features &= ~(1UL << i);
+                sched_feat_disable(i);
+        } else {
+                sysctl_sched_features |= (1UL << i);
+                sched_feat_enable(i);
         }
 
-        return i;
+        return 0;
 }
 
 static ssize_t
@@ -133,7 +132,7 @@ sched_feat_write(struct file *filp, const char __user *ubuf,
 {
         char buf[64];
         char *cmp;
-        int i;
+        int ret;
         struct inode *inode;
 
         if (cnt > 63)
@@ -148,10 +147,10 @@ sched_feat_write(struct file *filp, const char __user *ubuf,
         /* Ensure the static_key remains in a consistent state */
         inode = file_inode(filp);
         inode_lock(inode);
-        i = sched_feat_set(cmp);
+        ret = sched_feat_set(cmp);
         inode_unlock(inode);
-        if (i == __SCHED_FEAT_NR)
-                return -EINVAL;
+        if (ret < 0)
+                return ret;
 
         *ppos += cnt;
 
@@ -623,8 +622,6 @@ void print_dl_rq(struct seq_file *m, int cpu, struct dl_rq *dl_rq)
 #undef PU
 }
 
-extern __read_mostly int sched_clock_running;
-
 static void print_cpu(struct seq_file *m, int cpu)
 {
         struct rq *rq = cpu_rq(cpu);
@@ -843,8 +840,8 @@ void print_numa_stats(struct seq_file *m, int node, unsigned long tsf,
                 unsigned long tpf, unsigned long gsf, unsigned long gpf)
 {
         SEQ_printf(m, "numa_faults node=%d ", node);
-        SEQ_printf(m, "task_private=%lu task_shared=%lu ", tsf, tpf);
-        SEQ_printf(m, "group_private=%lu group_shared=%lu\n", gsf, gpf);
+        SEQ_printf(m, "task_private=%lu task_shared=%lu ", tpf, tsf);
+        SEQ_printf(m, "group_private=%lu group_shared=%lu\n", gpf, gsf);
 }
 #endif
 
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 2f0a0be4d344..309c93fcc604 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -255,9 +255,6 @@ static inline struct rq *rq_of(struct cfs_rq *cfs_rq)
         return cfs_rq->rq;
 }
 
-/* An entity is a task if it doesn't "own" a runqueue */
-#define entity_is_task(se)      (!se->my_q)
-
 static inline struct task_struct *task_of(struct sched_entity *se)
 {
         SCHED_WARN_ON(!entity_is_task(se));
@@ -419,7 +416,6 @@ static inline struct rq *rq_of(struct cfs_rq *cfs_rq)
         return container_of(cfs_rq, struct rq, cfs);
 }
 
-#define entity_is_task(se)      1
 
 #define for_each_sched_entity(se) \
                 for (; se; se = NULL)
@@ -692,7 +688,7 @@ static u64 sched_vslice(struct cfs_rq *cfs_rq, struct sched_entity *se)
 }
 
 #ifdef CONFIG_SMP
-
+#include "pelt.h"
 #include "sched-pelt.h"
 
 static int select_idle_sibling(struct task_struct *p, int prev_cpu, int cpu);
@@ -735,11 +731,12 @@ static void attach_entity_cfs_rq(struct sched_entity *se);
  * To solve this problem, we also cap the util_avg of successive tasks to
  * only 1/2 of the left utilization budget:
  *
- *   util_avg_cap = (1024 - cfs_rq->avg.util_avg) / 2^n
+ *   util_avg_cap = (cpu_scale - cfs_rq->avg.util_avg) / 2^n
  *
- * where n denotes the nth task.
+ * where n denotes the nth task and cpu_scale the CPU capacity.
  *
- * For example, a simplest series from the beginning would be like:
+ * For example, for a CPU with 1024 of capacity, a simplest series from
+ * the beginning would be like:
  *
  *  task  util_avg: 512, 256, 128,  64,  32,   16,    8, ...
  * cfs_rq util_avg: 512, 768, 896, 960, 992, 1008, 1016, ...
@@ -751,7 +748,8 @@ void post_init_entity_util_avg(struct sched_entity *se)
 {
         struct cfs_rq *cfs_rq = cfs_rq_of(se);
         struct sched_avg *sa = &se->avg;
-        long cap = (long)(SCHED_CAPACITY_SCALE - cfs_rq->avg.util_avg) / 2;
+        long cpu_scale = arch_scale_cpu_capacity(NULL, cpu_of(rq_of(cfs_rq)));
+        long cap = (long)(cpu_scale - cfs_rq->avg.util_avg) / 2;
 
         if (cap > 0) {
                 if (cfs_rq->avg.util_avg != 0) {
@@ -1314,7 +1312,7 @@ static unsigned long score_nearby_nodes(struct task_struct *p, int nid,
                  * of each group. Skip other nodes.
                  */
                 if (sched_numa_topology_type == NUMA_BACKPLANE &&
-                                        dist > maxdist)
+                                        dist >= maxdist)
                         continue;
 
                 /* Add up the faults from nearby nodes. */
@@ -1452,15 +1450,12 @@ static unsigned long capacity_of(int cpu);
 
 /* Cached statistics for all CPUs within a node */
 struct numa_stats {
-        unsigned long nr_running;
         unsigned long load;
 
         /* Total compute capacity of CPUs on a node */
         unsigned long compute_capacity;
 
-        /* Approximate capacity in terms of runnable tasks on a node */
-        unsigned long task_capacity;
-        int has_free_capacity;
+        unsigned int nr_running;
 };
 
 /*
@@ -1487,8 +1482,7 @@ static void update_numa_stats(struct numa_stats *ns, int nid)
          * the @ns structure is NULL'ed and task_numa_compare() will
          * not find this node attractive.
          *
-         * We'll either bail at !has_free_capacity, or we'll detect a huge
-         * imbalance and bail there.
+         * We'll detect a huge imbalance and bail there.
          */
         if (!cpus)
                 return;
@@ -1497,9 +1491,8 @@ static void update_numa_stats(struct numa_stats *ns, int nid)
         smt = DIV_ROUND_UP(SCHED_CAPACITY_SCALE * cpus, ns->compute_capacity);
         capacity = cpus / smt; /* cores */
 
-        ns->task_capacity = min_t(unsigned, capacity,
+        capacity = min_t(unsigned, capacity,
                 DIV_ROUND_CLOSEST(ns->compute_capacity, SCHED_CAPACITY_SCALE));
-        ns->has_free_capacity = (ns->nr_running < ns->task_capacity);
 }
 
 struct task_numa_env {
@@ -1548,28 +1541,12 @@ static bool load_too_imbalanced(long src_load, long dst_load,
         src_capacity = env->src_stats.compute_capacity;
         dst_capacity = env->dst_stats.compute_capacity;
 
-        /* We care about the slope of the imbalance, not the direction. */
-        if (dst_load < src_load)
-                swap(dst_load, src_load);
+        imb = abs(dst_load * src_capacity - src_load * dst_capacity);
 
-        /* Is the difference below the threshold? */
-        imb = dst_load * src_capacity * 100 -
-              src_load * dst_capacity * env->imbalance_pct;
-        if (imb <= 0)
-                return false;
-
-        /*
-         * The imbalance is above the allowed threshold.
-         * Compare it with the old imbalance.
-         */
         orig_src_load = env->src_stats.load;
         orig_dst_load = env->dst_stats.load;
 
-        if (orig_dst_load < orig_src_load)
-                swap(orig_dst_load, orig_src_load);
-
-        old_imb = orig_dst_load * src_capacity * 100 -
-                  orig_src_load * dst_capacity * env->imbalance_pct;
+        old_imb = abs(orig_dst_load * src_capacity - orig_src_load * dst_capacity);
 
         /* Would this change make things worse? */
         return (imb > old_imb);
@@ -1582,9 +1559,8 @@ static bool load_too_imbalanced(long src_load, long dst_load,
  * be exchanged with the source task
  */
 static void task_numa_compare(struct task_numa_env *env,
-                              long taskimp, long groupimp)
+                              long taskimp, long groupimp, bool maymove)
 {
-        struct rq *src_rq = cpu_rq(env->src_cpu);
         struct rq *dst_rq = cpu_rq(env->dst_cpu);
         struct task_struct *cur;
         long src_load, dst_load;
@@ -1605,97 +1581,73 @@ static void task_numa_compare(struct task_numa_env *env,
         if (cur == env->p)
                 goto unlock;
 
+        if (!cur) {
+                if (maymove || imp > env->best_imp)
+                        goto assign;
+                else
+                        goto unlock;
+        }
+
         /*
          * "imp" is the fault differential for the source task between the
          * source and destination node. Calculate the total differential for
          * the source task and potential destination task. The more negative
-         * the value is, the more rmeote accesses that would be expected to
+         * the value is, the more remote accesses that would be expected to
          * be incurred if the tasks were swapped.
          */
-        if (cur) {
-                /* Skip this swap candidate if cannot move to the source CPU: */
-                if (!cpumask_test_cpu(env->src_cpu, &cur->cpus_allowed))
-                        goto unlock;
+        /* Skip this swap candidate if cannot move to the source cpu */
+        if (!cpumask_test_cpu(env->src_cpu, &cur->cpus_allowed))
+                goto unlock;
 
+        /*
+         * If dst and source tasks are in the same NUMA group, or not
+         * in any group then look only at task weights.
+         */
+        if (cur->numa_group == env->p->numa_group) {
+                imp = taskimp + task_weight(cur, env->src_nid, dist) -
+                      task_weight(cur, env->dst_nid, dist);
                 /*
-                 * If dst and source tasks are in the same NUMA group, or not
-                 * in any group then look only at task weights.
+                 * Add some hysteresis to prevent swapping the
+                 * tasks within a group over tiny differences.
                  */
-                if (cur->numa_group == env->p->numa_group) {
-                        imp = taskimp + task_weight(cur, env->src_nid, dist) -
-                              task_weight(cur, env->dst_nid, dist);
-                        /*
-                         * Add some hysteresis to prevent swapping the
-                         * tasks within a group over tiny differences.
-                         */
-                        if (cur->numa_group)
-                                imp -= imp/16;
-                } else {
-                        /*
-                         * Compare the group weights. If a task is all by
-                         * itself (not part of a group), use the task weight
-                         * instead.
-                         */
-                        if (cur->numa_group)
-                                imp += group_weight(cur, env->src_nid, dist) -
-                                       group_weight(cur, env->dst_nid, dist);
-                        else
-                                imp += task_weight(cur, env->src_nid, dist) -
-                                       task_weight(cur, env->dst_nid, dist);
-                }
+                if (cur->numa_group)
+                        imp -= imp / 16;
+        } else {
+                /*
+                 * Compare the group weights. If a task is all by itself
+                 * (not part of a group), use the task weight instead.
+                 */
+                if (cur->numa_group && env->p->numa_group)
+                        imp += group_weight(cur, env->src_nid, dist) -
+                               group_weight(cur, env->dst_nid, dist);
+                else
+                        imp += task_weight(cur, env->src_nid, dist) -
+                               task_weight(cur, env->dst_nid, dist);
         }
 
-        if (imp <= env->best_imp && moveimp <= env->best_imp)
+        if (imp <= env->best_imp)
                 goto unlock;
 
-        if (!cur) {
-                /* Is there capacity at our destination? */
-                if (env->src_stats.nr_running <= env->src_stats.task_capacity &&
-                    !env->dst_stats.has_free_capacity)
-                        goto unlock;
-
-                goto balance;
-        }
-
-        /* Balance doesn't matter much if we're running a task per CPU: */
-        if (imp > env->best_imp && src_rq->nr_running == 1 &&
-                        dst_rq->nr_running == 1)
+        if (maymove && moveimp > imp && moveimp > env->best_imp) {
+                imp = moveimp - 1;
+                cur = NULL;
                 goto assign;
+        }
 
         /*
          * In the overloaded case, try and keep the load balanced.
          */
-balance:
-        load = task_h_load(env->p);
+        load = task_h_load(env->p) - task_h_load(cur);
+        if (!load)
+                goto assign;
+
         dst_load = env->dst_stats.load + load;
         src_load = env->src_stats.load - load;
 
-        if (moveimp > imp && moveimp > env->best_imp) {
-                /*
-                 * If the improvement from just moving env->p direction is
-                 * better than swapping tasks around, check if a move is
-                 * possible. Store a slightly smaller score than moveimp,
-                 * so an actually idle CPU will win.
-                 */
-                if (!load_too_imbalanced(src_load, dst_load, env)) {
-                        imp = moveimp - 1;
-                        cur = NULL;
-                        goto assign;
-                }
-        }
-
-        if (imp <= env->best_imp)
-                goto unlock;
-
-        if (cur) {
-                load = task_h_load(cur);
-                dst_load -= load;
-                src_load += load;
-        }
-
         if (load_too_imbalanced(src_load, dst_load, env))
                 goto unlock;
 
+assign:
         /*
          * One idle CPU per node is evaluated for a task numa move.
          * Call select_idle_sibling to maybe find a better one.
@@ -1711,7 +1663,6 @@ balance:
                 local_irq_enable();
         }
 
-assign:
         task_numa_assign(env, cur, imp);
 unlock:
         rcu_read_unlock();
@@ -1720,43 +1671,30 @@ unlock:
 static void task_numa_find_cpu(struct task_numa_env *env,
                                 long taskimp, long groupimp)
 {
+        long src_load, dst_load, load;
+        bool maymove = false;
         int cpu;
 
+        load = task_h_load(env->p);
+        dst_load = env->dst_stats.load + load;
+        src_load = env->src_stats.load - load;
+
+        /*
+         * If the improvement from just moving env->p direction is better
+         * than swapping tasks around, check if a move is possible.
+         */
+        maymove = !load_too_imbalanced(src_load, dst_load, env);
+
         for_each_cpu(cpu, cpumask_of_node(env->dst_nid)) {
                 /* Skip this CPU if the source task cannot migrate */
                 if (!cpumask_test_cpu(cpu, &env->p->cpus_allowed))
                         continue;
 
                 env->dst_cpu = cpu;
-                task_numa_compare(env, taskimp, groupimp);
+                task_numa_compare(env, taskimp, groupimp, maymove);
         }
 }
 
-/* Only move tasks to a NUMA node less busy than the current node. */
-static bool numa_has_capacity(struct task_numa_env *env)
-{
-        struct numa_stats *src = &env->src_stats;
-        struct numa_stats *dst = &env->dst_stats;
-
-        if (src->has_free_capacity && !dst->has_free_capacity)
-                return false;
-
-        /*
-         * Only consider a task move if the source has a higher load
-         * than the destination, corrected for CPU capacity on each node.
-         *
-         *      src->load                dst->load
-         * --------------------- vs ---------------------
-         * src->compute_capacity    dst->compute_capacity
-         */
-        if (src->load * dst->compute_capacity * env->imbalance_pct >
-
-            dst->load * src->compute_capacity * 100)
-                return true;
-
-        return false;
-}
-
 static int task_numa_migrate(struct task_struct *p)
 {
         struct task_numa_env env = {
@@ -1797,7 +1735,7 @@ static int task_numa_migrate(struct task_struct *p)
          * elsewhere, so there is no point in (re)trying.
          */
         if (unlikely(!sd)) {
-                p->numa_preferred_nid = task_node(p);
+                sched_setnuma(p, task_node(p));
                 return -EINVAL;
         }
 
@@ -1811,8 +1749,7 @@ static int task_numa_migrate(struct task_struct *p)
         update_numa_stats(&env.dst_stats, env.dst_nid);
 
         /* Try to find a spot on the preferred nid. */
-        if (numa_has_capacity(&env))
-                task_numa_find_cpu(&env, taskimp, groupimp);
+        task_numa_find_cpu(&env, taskimp, groupimp);
 
         /*
          * Look at other nodes in these cases:
@@ -1842,8 +1779,7 @@ static int task_numa_migrate(struct task_struct *p)
                         env.dist = dist;
                         env.dst_nid = nid;
                         update_numa_stats(&env.dst_stats, env.dst_nid);
-                        if (numa_has_capacity(&env))
-                                task_numa_find_cpu(&env, taskimp, groupimp);
+                        task_numa_find_cpu(&env, taskimp, groupimp);
                 }
         }
 
@@ -1856,15 +1792,13 @@ static int task_numa_migrate(struct task_struct *p)
          * trying for a better one later. Do not set the preferred node here.
          */
         if (p->numa_group) {
-                struct numa_group *ng = p->numa_group;
-
                 if (env.best_cpu == -1)
                         nid = env.src_nid;
                 else
-                        nid = env.dst_nid;
+                        nid = cpu_to_node(env.best_cpu);
 
-                if (ng->active_nodes > 1 && numa_is_active_node(env.dst_nid, ng))
-                        sched_setnuma(p, env.dst_nid);
+                if (nid != p->numa_preferred_nid)
+                        sched_setnuma(p, nid);
         }
 
         /* No better CPU than the current one was found. */
@@ -1884,7 +1818,8 @@ static int task_numa_migrate(struct task_struct *p)
                 return ret;
         }
 
-        ret = migrate_swap(p, env.best_task);
+        ret = migrate_swap(p, env.best_task, env.best_cpu, env.src_cpu);
+
         if (ret != 0)
                 trace_sched_stick_numa(p, env.src_cpu, task_cpu(env.best_task));
         put_task_struct(env.best_task);
@@ -2144,8 +2079,8 @@ static int preferred_group_nid(struct task_struct *p, int nid)
 
 static void task_numa_placement(struct task_struct *p)
 {
-        int seq, nid, max_nid = -1, max_group_nid = -1;
-        unsigned long max_faults = 0, max_group_faults = 0;
+        int seq, nid, max_nid = -1;
+        unsigned long max_faults = 0;
         unsigned long fault_types[2] = { 0, 0 };
         unsigned long total_faults;
         u64 runtime, period;
@@ -2224,33 +2159,30 @@ static void task_numa_placement(struct task_struct *p)
                         }
                 }
 
-                if (faults > max_faults) {
-                        max_faults = faults;
+                if (!p->numa_group) {
+                        if (faults > max_faults) {
+                                max_faults = faults;
+                                max_nid = nid;
+                        }
+                } else if (group_faults > max_faults) {
+                        max_faults = group_faults;
                         max_nid = nid;
                 }
-
-                if (group_faults > max_group_faults) {
-                        max_group_faults = group_faults;
-                        max_group_nid = nid;
-                }
         }
 
-        update_task_scan_period(p, fault_types[0], fault_types[1]);
-
         if (p->numa_group) {
                 numa_group_count_active_nodes(p->numa_group);
                 spin_unlock_irq(group_lock);
-                max_nid = preferred_group_nid(p, max_group_nid);
+                max_nid = preferred_group_nid(p, max_nid);
         }
 
         if (max_faults) {
                 /* Set the new preferred node */
                 if (max_nid != p->numa_preferred_nid)
                         sched_setnuma(p, max_nid);
-
-                if (task_node(p) != p->numa_preferred_nid)
-                        numa_migrate_preferred(p);
         }
+
+        update_task_scan_period(p, fault_types[0], fault_types[1]);
 }
 
 static inline int get_numa_group(struct numa_group *grp)
@@ -2450,14 +2382,14 @@ void task_numa_fault(int last_cpupid, int mem_node, int pages, int flags)
                                 numa_is_active_node(mem_node, ng))
                 local = 1;
 
-        task_numa_placement(p);
-
         /*
          * Retry task to preferred node migration periodically, in case it
          * case it previously failed, or the scheduler moved us.
          */
-        if (time_after(jiffies, p->numa_migrate_retry))
+        if (time_after(jiffies, p->numa_migrate_retry)) {
+                task_numa_placement(p);
                 numa_migrate_preferred(p);
+        }
 
         if (migrated)
                 p->numa_pages_migrated += pages;
@@ -2749,19 +2681,6 @@ account_entity_dequeue(struct cfs_rq *cfs_rq, struct sched_entity *se)
 } while (0)
 
 #ifdef CONFIG_SMP
-/*
- * XXX we want to get rid of these helpers and use the full load resolution.
- */
-static inline long se_weight(struct sched_entity *se)
-{
-        return scale_load_down(se->load.weight);
-}
-
-static inline long se_runnable(struct sched_entity *se)
-{
-        return scale_load_down(se->runnable_weight);
-}
-
 static inline void
 enqueue_runnable_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se)
 {
@@ -3062,314 +2981,6 @@ static inline void cfs_rq_util_change(struct cfs_rq *cfs_rq, int flags)
 }
 
 #ifdef CONFIG_SMP
-/*
- * Approximate:
- *   val * y^n,    where y^32 ~= 0.5 (~1 scheduling period)
- */
-static u64 decay_load(u64 val, u64 n)
-{
-        unsigned int local_n;
-
-        if (unlikely(n > LOAD_AVG_PERIOD * 63))
-                return 0;
-
-        /* after bounds checking we can collapse to 32-bit */
-        local_n = n;
-
-        /*
-         * As y^PERIOD = 1/2, we can combine
-         *    y^n = 1/2^(n/PERIOD) * y^(n%PERIOD)
-         * With a look-up table which covers y^n (n<PERIOD)
-         *
-         * To achieve constant time decay_load.
-         */
-        if (unlikely(local_n >= LOAD_AVG_PERIOD)) {
-                val >>= local_n / LOAD_AVG_PERIOD;
-                local_n %= LOAD_AVG_PERIOD;
-        }
-
-        val = mul_u64_u32_shr(val, runnable_avg_yN_inv[local_n], 32);
-        return val;
-}
-
-static u32 __accumulate_pelt_segments(u64 periods, u32 d1, u32 d3)
-{
-        u32 c1, c2, c3 = d3; /* y^0 == 1 */
-
-        /*
-         * c1 = d1 y^p
-         */
-        c1 = decay_load((u64)d1, periods);
-
-        /*
-         *            p-1
-         * c2 = 1024 \Sum y^n
-         *            n=1
-         *
-         *              inf        inf
-         *    = 1024 ( \Sum y^n - \Sum y^n - y^0 )
-         *              n=0        n=p
-         */
-        c2 = LOAD_AVG_MAX - decay_load(LOAD_AVG_MAX, periods) - 1024;
-
-        return c1 + c2 + c3;
-}
-
-/*
- * Accumulate the three separate parts of the sum; d1 the remainder
- * of the last (incomplete) period, d2 the span of full periods and d3
- * the remainder of the (incomplete) current period.
- *
- *           d1          d2           d3
- *           ^           ^            ^
- *           |           |            |
- *         |<->|<----------------->|<--->|
- * ... |---x---|------| ... |------|-----x (now)
- *
- *                           p-1
- * u' = (u + d1) y^p + 1024 \Sum y^n + d3 y^0
- *                           n=1
- *
- *    = u y^p +                                 (Step 1)
- *
- *                     p-1
- *      d1 y^p + 1024 \Sum y^n + d3 y^0         (Step 2)
- *                     n=1
- */
-static __always_inline u32
-accumulate_sum(u64 delta, int cpu, struct sched_avg *sa,
-               unsigned long load, unsigned long runnable, int running)
-{
-        unsigned long scale_freq, scale_cpu;
-        u32 contrib = (u32)delta; /* p == 0 -> delta < 1024 */
-        u64 periods;
-
-        scale_freq = arch_scale_freq_capacity(cpu);
-        scale_cpu = arch_scale_cpu_capacity(NULL, cpu);
-
-        delta += sa->period_contrib;
-        periods = delta / 1024; /* A period is 1024us (~1ms) */
-
-        /*
-         * Step 1: decay old *_sum if we crossed period boundaries.
-         */
-        if (periods) {
-                sa->load_sum = decay_load(sa->load_sum, periods);
-                sa->runnable_load_sum =
-                        decay_load(sa->runnable_load_sum, periods);
-                sa->util_sum = decay_load((u64)(sa->util_sum), periods);
-
-                /*
-                 * Step 2
-                 */
-                delta %= 1024;
-                contrib = __accumulate_pelt_segments(periods,
-                                1024 - sa->period_contrib, delta);
-        }
-        sa->period_contrib = delta;
-
-        contrib = cap_scale(contrib, scale_freq);
-        if (load)
-                sa->load_sum += load * contrib;
-        if (runnable)
-                sa->runnable_load_sum += runnable * contrib;
-        if (running)
-                sa->util_sum += contrib * scale_cpu;
-
-        return periods;
-}
-
-/*
- * We can represent the historical contribution to runnable average as the
- * coefficients of a geometric series.  To do this we sub-divide our runnable
- * history into segments of approximately 1ms (1024us); label the segment that
- * occurred N-ms ago p_N, with p_0 corresponding to the current period, e.g.
- *
- * [<- 1024us ->|<- 1024us ->|<- 1024us ->| ...
- *      p0            p1           p2
- *     (now)       (~1ms ago)  (~2ms ago)
- *
- * Let u_i denote the fraction of p_i that the entity was runnable.
- *
- * We then designate the fractions u_i as our co-efficients, yielding the
- * following representation of historical load:
- *   u_0 + u_1*y + u_2*y^2 + u_3*y^3 + ...
- *
- * We choose y based on the with of a reasonably scheduling period, fixing:
- *   y^32 = 0.5
- *
- * This means that the contribution to load ~32ms ago (u_32) will be weighted
- * approximately half as much as the contribution to load within the last ms
- * (u_0).
- *
- * When a period "rolls over" and we have new u_0`, multiplying the previous
- * sum again by y is sufficient to update:
- *   load_avg = u_0` + y*(u_0 + u_1*y + u_2*y^2 + ... )
- *            = u_0 + u_1*y + u_2*y^2 + ... [re-labeling u_i --> u_{i+1}]
- */
-static __always_inline int
-___update_load_sum(u64 now, int cpu, struct sched_avg *sa,
-                  unsigned long load, unsigned long runnable, int running)
-{
-        u64 delta;
-
-        delta = now - sa->last_update_time;
-        /*
-         * This should only happen when time goes backwards, which it
-         * unfortunately does during sched clock init when we swap over to TSC.
-         */
-        if ((s64)delta < 0) {
-                sa->last_update_time = now;
-                return 0;
-        }
-
-        /*
-         * Use 1024ns as the unit of measurement since it's a reasonable
-         * approximation of 1us and fast to compute.
-         */
-        delta >>= 10;
-        if (!delta)
-                return 0;
-
-        sa->last_update_time += delta << 10;
-
-        /*
-         * running is a subset of runnable (weight) so running can't be set if
-         * runnable is clear. But there are some corner cases where the current
-         * se has been already dequeued but cfs_rq->curr still points to it.
-         * This means that weight will be 0 but not running for a sched_entity
-         * but also for a cfs_rq if the latter becomes idle. As an example,
-         * this happens during idle_balance() which calls
-         * update_blocked_averages()
-         */
-        if (!load)
-                runnable = running = 0;
-
-        /*
-         * Now we know we crossed measurement unit boundaries. The *_avg
-         * accrues by two steps:
-         *
-         * Step 1: accumulate *_sum since last_update_time. If we haven't
-         * crossed period boundaries, finish.
-         */
-        if (!accumulate_sum(delta, cpu, sa, load, runnable, running))
-                return 0;
-
-        return 1;
-}
-
-static __always_inline void
-___update_load_avg(struct sched_avg *sa, unsigned long load, unsigned long runnable)
-{
-        u32 divider = LOAD_AVG_MAX - 1024 + sa->period_contrib;
-
-        /*
-         * Step 2: update *_avg.
-         */
-        sa->load_avg = div_u64(load * sa->load_sum, divider);
-        sa->runnable_load_avg = div_u64(runnable * sa->runnable_load_sum, divider);
-        sa->util_avg = sa->util_sum / divider;
-}
-
-/*
- * When a task is dequeued, its estimated utilization should not be update if
- * its util_avg has not been updated at least once.
- * This flag is used to synchronize util_avg updates with util_est updates.
- * We map this information into the LSB bit of the utilization saved at
- * dequeue time (i.e. util_est.dequeued).
- */
-#define UTIL_AVG_UNCHANGED 0x1
-
-static inline void cfs_se_util_change(struct sched_avg *avg)
-{
-        unsigned int enqueued;
-
-        if (!sched_feat(UTIL_EST))
-                return;
-
-        /* Avoid store if the flag has been already set */
-        enqueued = avg->util_est.enqueued;
-        if (!(enqueued & UTIL_AVG_UNCHANGED))
-                return;
-
-        /* Reset flag to report util_avg has been updated */
-        enqueued &= ~UTIL_AVG_UNCHANGED;
-        WRITE_ONCE(avg->util_est.enqueued, enqueued);
-}
-
-/*
- * sched_entity:
- *
- *   task:
- *     se_runnable() == se_weight()
- *
- *   group: [ see update_cfs_group() ]
- *     se_weight()   = tg->weight * grq->load_avg / tg->load_avg
- *     se_runnable() = se_weight(se) * grq->runnable_load_avg / grq->load_avg
- *
- *   load_sum := runnable_sum
- *   load_avg = se_weight(se) * runnable_avg
- *
- *   runnable_load_sum := runnable_sum
- *   runnable_load_avg = se_runnable(se) * runnable_avg
- *
- * XXX collapse load_sum and runnable_load_sum
- *
- * cfq_rs:
- *
- *   load_sum = \Sum se_weight(se) * se->avg.load_sum
- *   load_avg = \Sum se->avg.load_avg
- *
- *   runnable_load_sum = \Sum se_runnable(se) * se->avg.runnable_load_sum
- *   runnable_load_avg = \Sum se->avg.runable_load_avg
- */
-
-static int
-__update_load_avg_blocked_se(u64 now, int cpu, struct sched_entity *se)
-{
-        if (entity_is_task(se))
-                se->runnable_weight = se->load.weight;
-
-        if (___update_load_sum(now, cpu, &se->avg, 0, 0, 0)) {
-                ___update_load_avg(&se->avg, se_weight(se), se_runnable(se));
-                return 1;
-        }
-
-        return 0;
-}
-
-static int
-__update_load_avg_se(u64 now, int cpu, struct cfs_rq *cfs_rq, struct sched_entity *se)
-{
-        if (entity_is_task(se))
-                se->runnable_weight = se->load.weight;
-
-        if (___update_load_sum(now, cpu, &se->avg, !!se->on_rq, !!se->on_rq,
-                                cfs_rq->curr == se)) {
-
-                ___update_load_avg(&se->avg, se_weight(se), se_runnable(se));
-                cfs_se_util_change(&se->avg);
-                return 1;
-        }
-
-        return 0;
-}
-
-static int
-__update_load_avg_cfs_rq(u64 now, int cpu, struct cfs_rq *cfs_rq)
-{
-        if (___update_load_sum(now, cpu, &cfs_rq->avg,
-                                scale_load_down(cfs_rq->load.weight),
-                                scale_load_down(cfs_rq->runnable_weight),
-                                cfs_rq->curr != NULL)) {
-
-                ___update_load_avg(&cfs_rq->avg, 1, 1);
-                return 1;
-        }
-
-        return 0;
-}
-
 #ifdef CONFIG_FAIR_GROUP_SCHED
 /**
  * update_tg_load_avg - update the tg's load avg
@@ -4037,12 +3648,6 @@ util_est_dequeue(struct cfs_rq *cfs_rq, struct task_struct *p, bool task_sleep)
 
 #else /* CONFIG_SMP */
 
-static inline int
-update_cfs_rq_load_avg(u64 now, struct cfs_rq *cfs_rq)
-{
-        return 0;
-}
-
 #define UPDATE_TG       0x0
 #define SKIP_AGE_LOAD   0x0
 #define DO_ATTACH       0x0
@@ -4726,7 +4331,6 @@ static inline int throttled_lb_pair(struct task_group *tg,
                throttled_hierarchy(dest_cfs_rq);
 }
 
-/* updated child weight may affect parent so we have to do this bottom up */
 static int tg_unthrottle_up(struct task_group *tg, void *data)
 {
         struct rq *rq = data;
@@ -5653,8 +5257,6 @@ static void cpu_load_update(struct rq *this_rq, unsigned long this_load,
 
                 this_rq->cpu_load[i] = (old_load * (scale - 1) + new_load) >> i;
         }
-
-        sched_avg_update(this_rq);
 }
 
 /* Used instead of source_load when we know the type == 0 */
@@ -7294,8 +6896,8 @@ static int task_hot(struct task_struct *p, struct lb_env *env)
 static int migrate_degrades_locality(struct task_struct *p, struct lb_env *env)
 {
         struct numa_group *numa_group = rcu_dereference(p->numa_group);
-        unsigned long src_faults, dst_faults;
-        int src_nid, dst_nid;
+        unsigned long src_weight, dst_weight;
+        int src_nid, dst_nid, dist;
 
         if (!static_branch_likely(&sched_numa_balancing))
                 return -1;
@@ -7322,18 +6924,19 @@ static int migrate_degrades_locality(struct task_struct *p, struct lb_env *env)
                 return 0;
 
         /* Leaving a core idle is often worse than degrading locality. */
-        if (env->idle != CPU_NOT_IDLE)
+        if (env->idle == CPU_IDLE)
                 return -1;
 
+        dist = node_distance(src_nid, dst_nid);
         if (numa_group) {
-                src_faults = group_faults(p, src_nid);
-                dst_faults = group_faults(p, dst_nid);
+                src_weight = group_weight(p, src_nid, dist);
+                dst_weight = group_weight(p, dst_nid, dist);
         } else {
-                src_faults = task_faults(p, src_nid);
-                dst_faults = task_faults(p, dst_nid);
+                src_weight = task_weight(p, src_nid, dist);
+                dst_weight = task_weight(p, dst_nid, dist);
         }
 
-        return dst_faults < src_faults;
+        return dst_weight < src_weight;
 }
 
 #else
@@ -7620,6 +7223,22 @@ static inline bool cfs_rq_has_blocked(struct cfs_rq *cfs_rq)
         return false;
 }
 
+static inline bool others_have_blocked(struct rq *rq)
+{
+        if (READ_ONCE(rq->avg_rt.util_avg))
+                return true;
+
+        if (READ_ONCE(rq->avg_dl.util_avg))
+                return true;
+
+#if defined(CONFIG_IRQ_TIME_ACCOUNTING) || defined(CONFIG_PARAVIRT_TIME_ACCOUNTING)
+        if (READ_ONCE(rq->avg_irq.util_avg))
+                return true;
+#endif
+
+        return false;
+}
+
 #ifdef CONFIG_FAIR_GROUP_SCHED
 
 static inline bool cfs_rq_is_decayed(struct cfs_rq *cfs_rq)
@@ -7679,6 +7298,12 @@ static void update_blocked_averages(int cpu)
                 if (cfs_rq_has_blocked(cfs_rq))
                         done = false;
         }
+        update_rt_rq_load_avg(rq_clock_task(rq), rq, 0);
+        update_dl_rq_load_avg(rq_clock_task(rq), rq, 0);
+        update_irq_load_avg(rq, 0);
+        /* Don't need periodic decay once load/util_avg are null */
+        if (others_have_blocked(rq))
+                done = false;
 
 #ifdef CONFIG_NO_HZ_COMMON
         rq->last_blocked_load_update_tick = jiffies;
@@ -7744,9 +7369,12 @@ static inline void update_blocked_averages(int cpu)
         rq_lock_irqsave(rq, &rf);
         update_rq_clock(rq);
         update_cfs_rq_load_avg(cfs_rq_clock_task(cfs_rq), cfs_rq);
+        update_rt_rq_load_avg(rq_clock_task(rq), rq, 0);
+        update_dl_rq_load_avg(rq_clock_task(rq), rq, 0);
+        update_irq_load_avg(rq, 0);
 #ifdef CONFIG_NO_HZ_COMMON
         rq->last_blocked_load_update_tick = jiffies;
-        if (!cfs_rq_has_blocked(cfs_rq))
+        if (!cfs_rq_has_blocked(cfs_rq) && !others_have_blocked(rq))
                 rq->has_blocked_load = 0;
 #endif
         rq_unlock_irqrestore(rq, &rf);
@@ -7856,39 +7484,32 @@ static inline int get_sd_load_idx(struct sched_domain *sd,
 static unsigned long scale_rt_capacity(int cpu)
 {
         struct rq *rq = cpu_rq(cpu);
-        u64 total, used, age_stamp, avg;
-        s64 delta;
+        unsigned long max = arch_scale_cpu_capacity(NULL, cpu);
+        unsigned long used, free;
+        unsigned long irq;
 
-        /*
-         * Since we're reading these variables without serialization make sure
-         * we read them once before doing sanity checks on them.
-         */
-        age_stamp = READ_ONCE(rq->age_stamp);
-        avg = READ_ONCE(rq->rt_avg);
-        delta = __rq_clock_broken(rq) - age_stamp;
+        irq = cpu_util_irq(rq);
 
-        if (unlikely(delta < 0))
-                delta = 0;
+        if (unlikely(irq >= max))
+                return 1;
 
-        total = sched_avg_period() + delta;
+        used = READ_ONCE(rq->avg_rt.util_avg);
+        used += READ_ONCE(rq->avg_dl.util_avg);
 
-        used = div_u64(avg, total);
+        if (unlikely(used >= max))
+                return 1;
 
-        if (likely(used < SCHED_CAPACITY_SCALE))
-                return SCHED_CAPACITY_SCALE - used;
+        free = max - used;
 
-        return 1;
+        return scale_irq_capacity(free, irq, max);
 }
 
 static void update_cpu_capacity(struct sched_domain *sd, int cpu)
 {
-        unsigned long capacity = arch_scale_cpu_capacity(sd, cpu);
+        unsigned long capacity = scale_rt_capacity(cpu);
         struct sched_group *sdg = sd->groups;
 
-        cpu_rq(cpu)->cpu_capacity_orig = capacity;
-
-        capacity *= scale_rt_capacity(cpu);
-        capacity >>= SCHED_CAPACITY_SHIFT;
+        cpu_rq(cpu)->cpu_capacity_orig = arch_scale_cpu_capacity(sd, cpu);
 
         if (!capacity)
                 capacity = 1;
diff --git a/kernel/sched/pelt.c b/kernel/sched/pelt.c
new file mode 100644
index 000000000000..35475c0c5419
--- /dev/null
+++ b/kernel/sched/pelt.c
@@ -0,0 +1,399 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Per Entity Load Tracking
+ *
+ *  Copyright (C) 2007 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
+ *
+ *  Interactivity improvements by Mike Galbraith
+ *  (C) 2007 Mike Galbraith <efault@gmx.de>
+ *
+ *  Various enhancements by Dmitry Adamushko.
+ *  (C) 2007 Dmitry Adamushko <dmitry.adamushko@gmail.com>
+ *
+ *  Group scheduling enhancements by Srivatsa Vaddagiri
+ *  Copyright IBM Corporation, 2007
+ *  Author: Srivatsa Vaddagiri <vatsa@linux.vnet.ibm.com>
+ *
+ *  Scaled math optimizations by Thomas Gleixner
+ *  Copyright (C) 2007, Thomas Gleixner <tglx@linutronix.de>
+ *
+ *  Adaptive scheduling granularity, math enhancements by Peter Zijlstra
+ *  Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra
+ *
+ *  Move PELT related code from fair.c into this pelt.c file
+ *  Author: Vincent Guittot <vincent.guittot@linaro.org>
+ */
+
+#include <linux/sched.h>
+#include "sched.h"
+#include "sched-pelt.h"
+#include "pelt.h"
+
+/*
+ * Approximate:
+ *   val * y^n,    where y^32 ~= 0.5 (~1 scheduling period)
+ */
+static u64 decay_load(u64 val, u64 n)
+{
+        unsigned int local_n;
+
+        if (unlikely(n > LOAD_AVG_PERIOD * 63))
+                return 0;
+
+        /* after bounds checking we can collapse to 32-bit */
+        local_n = n;
+
+        /*
+         * As y^PERIOD = 1/2, we can combine
+         *    y^n = 1/2^(n/PERIOD) * y^(n%PERIOD)
+         * With a look-up table which covers y^n (n<PERIOD)
+         *
+         * To achieve constant time decay_load.
+         */
+        if (unlikely(local_n >= LOAD_AVG_PERIOD)) {
+                val >>= local_n / LOAD_AVG_PERIOD;
+                local_n %= LOAD_AVG_PERIOD;
+        }
+
+        val = mul_u64_u32_shr(val, runnable_avg_yN_inv[local_n], 32);
+        return val;
+}
+
+static u32 __accumulate_pelt_segments(u64 periods, u32 d1, u32 d3)
+{
+        u32 c1, c2, c3 = d3; /* y^0 == 1 */
+
+        /*
+         * c1 = d1 y^p
+         */
+        c1 = decay_load((u64)d1, periods);
+
+        /*
+         *            p-1
+         * c2 = 1024 \Sum y^n
+         *            n=1
+         *
+         *              inf        inf
+         *    = 1024 ( \Sum y^n - \Sum y^n - y^0 )
+         *              n=0        n=p
+         */
+        c2 = LOAD_AVG_MAX - decay_load(LOAD_AVG_MAX, periods) - 1024;
+
+        return c1 + c2 + c3;
+}
+
+#define cap_scale(v, s) ((v)*(s) >> SCHED_CAPACITY_SHIFT)
+
+/*
+ * Accumulate the three separate parts of the sum; d1 the remainder
+ * of the last (incomplete) period, d2 the span of full periods and d3
+ * the remainder of the (incomplete) current period.
+ *
+ *           d1          d2           d3
+ *           ^           ^            ^
+ *           |           |            |
+ *         |<->|<----------------->|<--->|
+ * ... |---x---|------| ... |------|-----x (now)
+ *
+ *                           p-1
+ * u' = (u + d1) y^p + 1024 \Sum y^n + d3 y^0
+ *                           n=1
+ *
+ *    = u y^p +                                 (Step 1)
+ *
+ *                     p-1
+ *      d1 y^p + 1024 \Sum y^n + d3 y^0         (Step 2)
+ *                     n=1
+ */
+static __always_inline u32
+accumulate_sum(u64 delta, int cpu, struct sched_avg *sa,
+               unsigned long load, unsigned long runnable, int running)
+{
+        unsigned long scale_freq, scale_cpu;
+        u32 contrib = (u32)delta; /* p == 0 -> delta < 1024 */
+        u64 periods;
+
+        scale_freq = arch_scale_freq_capacity(cpu);
+        scale_cpu = arch_scale_cpu_capacity(NULL, cpu);
+
+        delta += sa->period_contrib;
+        periods = delta / 1024; /* A period is 1024us (~1ms) */
+
+        /*
+         * Step 1: decay old *_sum if we crossed period boundaries.
+         */
+        if (periods) {
+                sa->load_sum = decay_load(sa->load_sum, periods);
+                sa->runnable_load_sum =
+                        decay_load(sa->runnable_load_sum, periods);
+                sa->util_sum = decay_load((u64)(sa->util_sum), periods);
+
+                /*
+                 * Step 2
+                 */
+                delta %= 1024;
+                contrib = __accumulate_pelt_segments(periods,
+                                1024 - sa->period_contrib, delta);
+        }
+        sa->period_contrib = delta;
+
+        contrib = cap_scale(contrib, scale_freq);
+        if (load)
+                sa->load_sum += load * contrib;
+        if (runnable)
+                sa->runnable_load_sum += runnable * contrib;
+        if (running)
+                sa->util_sum += contrib * scale_cpu;
+
+        return periods;
+}
+
+/*
+ * We can represent the historical contribution to runnable average as the
+ * coefficients of a geometric series.  To do this we sub-divide our runnable
+ * history into segments of approximately 1ms (1024us); label the segment that
+ * occurred N-ms ago p_N, with p_0 corresponding to the current period, e.g.
+ *
+ * [<- 1024us ->|<- 1024us ->|<- 1024us ->| ...
+ *      p0            p1           p2
+ *     (now)       (~1ms ago)  (~2ms ago)
+ *
+ * Let u_i denote the fraction of p_i that the entity was runnable.
+ *
+ * We then designate the fractions u_i as our co-efficients, yielding the
+ * following representation of historical load:
+ *   u_0 + u_1*y + u_2*y^2 + u_3*y^3 + ...
+ *
+ * We choose y based on the with of a reasonably scheduling period, fixing:
+ *   y^32 = 0.5
+ *
+ * This means that the contribution to load ~32ms ago (u_32) will be weighted
+ * approximately half as much as the contribution to load within the last ms
+ * (u_0).
+ *
+ * When a period "rolls over" and we have new u_0`, multiplying the previous
+ * sum again by y is sufficient to update:
+ *   load_avg = u_0` + y*(u_0 + u_1*y + u_2*y^2 + ... )
+ *            = u_0 + u_1*y + u_2*y^2 + ... [re-labeling u_i --> u_{i+1}]
+ */
+static __always_inline int
+___update_load_sum(u64 now, int cpu, struct sched_avg *sa,
+                  unsigned long load, unsigned long runnable, int running)
+{
+        u64 delta;
+
+        delta = now - sa->last_update_time;
+        /*
+         * This should only happen when time goes backwards, which it
+         * unfortunately does during sched clock init when we swap over to TSC.
+         */
+        if ((s64)delta < 0) {
+                sa->last_update_time = now;
+                return 0;
+        }
+
+        /*
+         * Use 1024ns as the unit of measurement since it's a reasonable
+         * approximation of 1us and fast to compute.
+         */
+        delta >>= 10;
+        if (!delta)
+                return 0;
+
+        sa->last_update_time += delta << 10;
+
+        /*
+         * running is a subset of runnable (weight) so running can't be set if
+         * runnable is clear. But there are some corner cases where the current
+         * se has been already dequeued but cfs_rq->curr still points to it.
+         * This means that weight will be 0 but not running for a sched_entity
+         * but also for a cfs_rq if the latter becomes idle. As an example,
+         * this happens during idle_balance() which calls
+         * update_blocked_averages()
+         */
+        if (!load)
+                runnable = running = 0;
+
+        /*
+         * Now we know we crossed measurement unit boundaries. The *_avg
+         * accrues by two steps:
+         *
+         * Step 1: accumulate *_sum since last_update_time. If we haven't
+         * crossed period boundaries, finish.
+         */
+        if (!accumulate_sum(delta, cpu, sa, load, runnable, running))
+                return 0;
+
+        return 1;
+}
+
+static __always_inline void
+___update_load_avg(struct sched_avg *sa, unsigned long load, unsigned long runnable)
+{
+        u32 divider = LOAD_AVG_MAX - 1024 + sa->period_contrib;
+
+        /*
+         * Step 2: update *_avg.
+         */
+        sa->load_avg = div_u64(load * sa->load_sum, divider);
+        sa->runnable_load_avg = div_u64(runnable * sa->runnable_load_sum, divider);
+        WRITE_ONCE(sa->util_avg, sa->util_sum / divider);
+}
+
+/*
+ * sched_entity:
+ *
+ *   task:
+ *     se_runnable() == se_weight()
+ *
+ *   group: [ see update_cfs_group() ]
+ *     se_weight()   = tg->weight * grq->load_avg / tg->load_avg
+ *     se_runnable() = se_weight(se) * grq->runnable_load_avg / grq->load_avg
+ *
+ *   load_sum := runnable_sum
+ *   load_avg = se_weight(se) * runnable_avg
+ *
+ *   runnable_load_sum := runnable_sum
+ *   runnable_load_avg = se_runnable(se) * runnable_avg
+ *
+ * XXX collapse load_sum and runnable_load_sum
+ *
+ * cfq_rq:
+ *
+ *   load_sum = \Sum se_weight(se) * se->avg.load_sum
+ *   load_avg = \Sum se->avg.load_avg
+ *
+ *   runnable_load_sum = \Sum se_runnable(se) * se->avg.runnable_load_sum
+ *   runnable_load_avg = \Sum se->avg.runable_load_avg
+ */
+
+int __update_load_avg_blocked_se(u64 now, int cpu, struct sched_entity *se)
+{
+        if (entity_is_task(se))
+                se->runnable_weight = se->load.weight;
+
+        if (___update_load_sum(now, cpu, &se->avg, 0, 0, 0)) {
+                ___update_load_avg(&se->avg, se_weight(se), se_runnable(se));
+                return 1;
+        }
+
+        return 0;
+}
+
+int __update_load_avg_se(u64 now, int cpu, struct cfs_rq *cfs_rq, struct sched_entity *se)
+{
+        if (entity_is_task(se))
+                se->runnable_weight = se->load.weight;
+
+        if (___update_load_sum(now, cpu, &se->avg, !!se->on_rq, !!se->on_rq,
+                                cfs_rq->curr == se)) {
+
+                ___update_load_avg(&se->avg, se_weight(se), se_runnable(se));
+                cfs_se_util_change(&se->avg);
+                return 1;
+        }
+
+        return 0;
+}
+
+int __update_load_avg_cfs_rq(u64 now, int cpu, struct cfs_rq *cfs_rq)
+{
+        if (___update_load_sum(now, cpu, &cfs_rq->avg,
+                                scale_load_down(cfs_rq->load.weight),
+                                scale_load_down(cfs_rq->runnable_weight),
+                                cfs_rq->curr != NULL)) {
+
+                ___update_load_avg(&cfs_rq->avg, 1, 1);
+                return 1;
+        }
+
+        return 0;
+}
+
+/*
+ * rt_rq:
+ *
+ *   util_sum = \Sum se->avg.util_sum but se->avg.util_sum is not tracked
+ *   util_sum = cpu_scale * load_sum
+ *   runnable_load_sum = load_sum
+ *
+ *   load_avg and runnable_load_avg are not supported and meaningless.
+ *
+ */
+
+int update_rt_rq_load_avg(u64 now, struct rq *rq, int running)
+{
+        if (___update_load_sum(now, rq->cpu, &rq->avg_rt,
+                                running,
+                                running,
+                                running)) {
+
+                ___update_load_avg(&rq->avg_rt, 1, 1);
+                return 1;
+        }
+
+        return 0;
+}
+
+/*
+ * dl_rq:
+ *
+ *   util_sum = \Sum se->avg.util_sum but se->avg.util_sum is not tracked
+ *   util_sum = cpu_scale * load_sum
+ *   runnable_load_sum = load_sum
+ *
+ */
+
+int update_dl_rq_load_avg(u64 now, struct rq *rq, int running)
+{
+        if (___update_load_sum(now, rq->cpu, &rq->avg_dl,
+                                running,
+                                running,
+                                running)) {
+
+                ___update_load_avg(&rq->avg_dl, 1, 1);
+                return 1;
+        }
+
+        return 0;
+}
+
+#if defined(CONFIG_IRQ_TIME_ACCOUNTING) || defined(CONFIG_PARAVIRT_TIME_ACCOUNTING)
+/*
+ * irq:
+ *
+ *   util_sum = \Sum se->avg.util_sum but se->avg.util_sum is not tracked
+ *   util_sum = cpu_scale * load_sum
+ *   runnable_load_sum = load_sum
+ *
+ */
+
+int update_irq_load_avg(struct rq *rq, u64 running)
+{
+        int ret = 0;
+        /*
+         * We know the time that has been used by interrupt since last update
+         * but we don't when. Let be pessimistic and assume that interrupt has
+         * happened just before the update. This is not so far from reality
+         * because interrupt will most probably wake up task and trig an update
+         * of rq clock during which the metric si updated.
+         * We start to decay with normal context time and then we add the
+         * interrupt context time.
+         * We can safely remove running from rq->clock because
+         * rq->clock += delta with delta >= running
+         */
+        ret = ___update_load_sum(rq->clock - running, rq->cpu, &rq->avg_irq,
+                                0,
+                                0,
+                                0);
+        ret += ___update_load_sum(rq->clock, rq->cpu, &rq->avg_irq,
+                                1,
+                                1,
+                                1);
+
+        if (ret)
+                ___update_load_avg(&rq->avg_irq, 1, 1);
+
+        return ret;
+}
+#endif
diff --git a/kernel/sched/pelt.h b/kernel/sched/pelt.h
new file mode 100644
index 000000000000..d2894db28955
--- /dev/null
+++ b/kernel/sched/pelt.h
@@ -0,0 +1,72 @@
+#ifdef CONFIG_SMP
+
+int __update_load_avg_blocked_se(u64 now, int cpu, struct sched_entity *se);
+int __update_load_avg_se(u64 now, int cpu, struct cfs_rq *cfs_rq, struct sched_entity *se);
+int __update_load_avg_cfs_rq(u64 now, int cpu, struct cfs_rq *cfs_rq);
+int update_rt_rq_load_avg(u64 now, struct rq *rq, int running);
+int update_dl_rq_load_avg(u64 now, struct rq *rq, int running);
+
+#if defined(CONFIG_IRQ_TIME_ACCOUNTING) || defined(CONFIG_PARAVIRT_TIME_ACCOUNTING)
+int update_irq_load_avg(struct rq *rq, u64 running);
+#else
+static inline int
+update_irq_load_avg(struct rq *rq, u64 running)
+{
+        return 0;
+}
+#endif
+
+/*
+ * When a task is dequeued, its estimated utilization should not be update if
+ * its util_avg has not been updated at least once.
+ * This flag is used to synchronize util_avg updates with util_est updates.
+ * We map this information into the LSB bit of the utilization saved at
+ * dequeue time (i.e. util_est.dequeued).
+ */
+#define UTIL_AVG_UNCHANGED 0x1
+
+static inline void cfs_se_util_change(struct sched_avg *avg)
+{
+        unsigned int enqueued;
+
+        if (!sched_feat(UTIL_EST))
+                return;
+
+        /* Avoid store if the flag has been already set */
+        enqueued = avg->util_est.enqueued;
+        if (!(enqueued & UTIL_AVG_UNCHANGED))
+                return;
+
+        /* Reset flag to report util_avg has been updated */
+        enqueued &= ~UTIL_AVG_UNCHANGED;
+        WRITE_ONCE(avg->util_est.enqueued, enqueued);
+}
+
+#else
+
+static inline int
+update_cfs_rq_load_avg(u64 now, struct cfs_rq *cfs_rq)
+{
+        return 0;
+}
+
+static inline int
+update_rt_rq_load_avg(u64 now, struct rq *rq, int running)
+{
+        return 0;
+}
+
+static inline int
+update_dl_rq_load_avg(u64 now, struct rq *rq, int running)
+{
+        return 0;
+}
+
+static inline int
+update_irq_load_avg(struct rq *rq, u64 running)
+{
+        return 0;
+}
+#endif
+
+
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index eaaec8364f96..2e2955a8cf8f 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -5,6 +5,8 @@
  */
 #include "sched.h"
 
+#include "pelt.h"
+
 int sched_rr_timeslice = RR_TIMESLICE;
 int sysctl_sched_rr_timeslice = (MSEC_PER_SEC / HZ) * RR_TIMESLICE;
 
@@ -973,8 +975,6 @@ static void update_curr_rt(struct rq *rq)
         curr->se.exec_start = now;
         cgroup_account_cputime(curr, delta_exec);
 
-        sched_rt_avg_update(rq, delta_exec);
-
         if (!rt_bandwidth_enabled())
                 return;
 
@@ -1578,6 +1578,14 @@ pick_next_task_rt(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
 
         rt_queue_push_tasks(rq);
 
+        /*
+         * If prev task was rt, put_prev_task() has already updated the
+         * utilization. We only care of the case where we start to schedule a
+         * rt task
+         */
+        if (rq->curr->sched_class != &rt_sched_class)
+                update_rt_rq_load_avg(rq_clock_task(rq), rq, 0);
+
         return p;
 }
 
@@ -1585,6 +1593,8 @@ static void put_prev_task_rt(struct rq *rq, struct task_struct *p)
 {
         update_curr_rt(rq);
 
+        update_rt_rq_load_avg(rq_clock_task(rq), rq, 1);
+
         /*
          * The previous task needs to be made eligible for pushing
          * if it is still active
@@ -2314,6 +2324,7 @@ static void task_tick_rt(struct rq *rq, struct task_struct *p, int queued)
         struct sched_rt_entity *rt_se = &p->rt;
 
         update_curr_rt(rq);
+        update_rt_rq_load_avg(rq_clock_task(rq), rq, 1);
 
         watchdog(rq, p);
 
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index c7742dcc136c..4a2e8cae63c4 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -594,6 +594,7 @@ struct rt_rq {
         unsigned long           rt_nr_total;
         int                     overloaded;
         struct plist_head       pushable_tasks;
+
 #endif /* CONFIG_SMP */
         int                     rt_queued;
 
@@ -673,7 +674,26 @@ struct dl_rq {
         u64                     bw_ratio;
 };
 
+#ifdef CONFIG_FAIR_GROUP_SCHED
+/* An entity is a task if it doesn't "own" a runqueue */
+#define entity_is_task(se)      (!se->my_q)
+#else
+#define entity_is_task(se)      1
+#endif
+
 #ifdef CONFIG_SMP
+/*
+ * XXX we want to get rid of these helpers and use the full load resolution.
+ */
+static inline long se_weight(struct sched_entity *se)
+{
+        return scale_load_down(se->load.weight);
+}
+
+static inline long se_runnable(struct sched_entity *se)
+{
+        return scale_load_down(se->runnable_weight);
+}
 
 static inline bool sched_asym_prefer(int a, int b)
 {
@@ -833,8 +853,12 @@ struct rq {
 
         struct list_head cfs_tasks;
 
-        u64                     rt_avg;
-        u64                     age_stamp;
+        struct sched_avg        avg_rt;
+        struct sched_avg        avg_dl;
+#if defined(CONFIG_IRQ_TIME_ACCOUNTING) || defined(CONFIG_PARAVIRT_TIME_ACCOUNTING)
+#define HAVE_SCHED_AVG_IRQ
+        struct sched_avg        avg_irq;
+#endif
         u64                     idle_stamp;
         u64                     avg_idle;
 
@@ -1075,7 +1099,8 @@ enum numa_faults_stats {
 };
 extern void sched_setnuma(struct task_struct *p, int node);
 extern int migrate_task_to(struct task_struct *p, int cpu);
-extern int migrate_swap(struct task_struct *, struct task_struct *);
+extern int migrate_swap(struct task_struct *p, struct task_struct *t,
+                        int cpu, int scpu);
 extern void init_numa_balancing(unsigned long clone_flags, struct task_struct *p);
 #else
 static inline void
@@ -1690,15 +1715,9 @@ extern void deactivate_task(struct rq *rq, struct task_struct *p, int flags);
 
 extern void check_preempt_curr(struct rq *rq, struct task_struct *p, int flags);
 
-extern const_debug unsigned int sysctl_sched_time_avg;
 extern const_debug unsigned int sysctl_sched_nr_migrate;
 extern const_debug unsigned int sysctl_sched_migration_cost;
 
-static inline u64 sched_avg_period(void)
-{
-        return (u64)sysctl_sched_time_avg * NSEC_PER_MSEC / 2;
-}
-
 #ifdef CONFIG_SCHED_HRTICK
 
 /*
@@ -1735,8 +1754,6 @@ unsigned long arch_scale_freq_capacity(int cpu)
 #endif
 
 #ifdef CONFIG_SMP
-extern void sched_avg_update(struct rq *rq);
-
 #ifndef arch_scale_cpu_capacity
 static __always_inline
 unsigned long arch_scale_cpu_capacity(struct sched_domain *sd, int cpu)
@@ -1747,12 +1764,6 @@ unsigned long arch_scale_cpu_capacity(struct sched_domain *sd, int cpu)
         return SCHED_CAPACITY_SCALE;
 }
 #endif
-
-static inline void sched_rt_avg_update(struct rq *rq, u64 rt_delta)
-{
-        rq->rt_avg += rt_delta * arch_scale_freq_capacity(cpu_of(rq));
-        sched_avg_update(rq);
-}
 #else
 #ifndef arch_scale_cpu_capacity
 static __always_inline
@@ -1761,8 +1772,6 @@ unsigned long arch_scale_cpu_capacity(void __always_unused *sd, int cpu)
         return SCHED_CAPACITY_SCALE;
 }
 #endif
-static inline void sched_rt_avg_update(struct rq *rq, u64 rt_delta) { }
-static inline void sched_avg_update(struct rq *rq) { }
 #endif
 
 struct rq *__task_rq_lock(struct task_struct *p, struct rq_flags *rf)
@@ -2177,11 +2186,16 @@ static inline void cpufreq_update_util(struct rq *rq, unsigned int flags) {}
 #endif
 
 #ifdef CONFIG_CPU_FREQ_GOV_SCHEDUTIL
-static inline unsigned long cpu_util_dl(struct rq *rq)
+static inline unsigned long cpu_bw_dl(struct rq *rq)
 {
         return (rq->dl.running_bw * SCHED_CAPACITY_SCALE) >> BW_SHIFT;
 }
 
+static inline unsigned long cpu_util_dl(struct rq *rq)
+{
+        return READ_ONCE(rq->avg_dl.util_avg);
+}
+
 static inline unsigned long cpu_util_cfs(struct rq *rq)
 {
         unsigned long util = READ_ONCE(rq->cfs.avg.util_avg);
@@ -2193,4 +2207,37 @@ static inline unsigned long cpu_util_cfs(struct rq *rq)
 
         return util;
 }
+
+static inline unsigned long cpu_util_rt(struct rq *rq)
+{
+        return READ_ONCE(rq->avg_rt.util_avg);
+}
+#endif
+
+#ifdef HAVE_SCHED_AVG_IRQ
+static inline unsigned long cpu_util_irq(struct rq *rq)
+{
+        return rq->avg_irq.util_avg;
+}
+
+static inline
+unsigned long scale_irq_capacity(unsigned long util, unsigned long irq, unsigned long max)
+{
+        util *= (max - irq);
+        util /= max;
+
+        return util;
+
+}
+#else
+static inline unsigned long cpu_util_irq(struct rq *rq)
+{
+        return 0;
+}
+
+static inline
+unsigned long scale_irq_capacity(unsigned long util, unsigned long irq, unsigned long max)
+{
+        return util;
+}
 #endif
diff --git a/kernel/sched/swait.c b/kernel/sched/swait.c
index b6fb2c3b3ff7..66b59ac77c22 100644
--- a/kernel/sched/swait.c
+++ b/kernel/sched/swait.c
@@ -32,7 +32,7 @@ void swake_up_locked(struct swait_queue_head *q)
 }
 EXPORT_SYMBOL(swake_up_locked);
 
-void swake_up(struct swait_queue_head *q)
+void swake_up_one(struct swait_queue_head *q)
 {
         unsigned long flags;
 
@@ -40,7 +40,7 @@ void swake_up(struct swait_queue_head *q)
         swake_up_locked(q);
         raw_spin_unlock_irqrestore(&q->lock, flags);
 }
-EXPORT_SYMBOL(swake_up);
+EXPORT_SYMBOL(swake_up_one);
 
 /*
  * Does not allow usage from IRQ disabled, since we must be able to
@@ -69,14 +69,14 @@ void swake_up_all(struct swait_queue_head *q)
 }
 EXPORT_SYMBOL(swake_up_all);
 
-void __prepare_to_swait(struct swait_queue_head *q, struct swait_queue *wait)
+static void __prepare_to_swait(struct swait_queue_head *q, struct swait_queue *wait)
 {
         wait->task = current;
         if (list_empty(&wait->task_list))
-                list_add(&wait->task_list, &q->task_list);
+                list_add_tail(&wait->task_list, &q->task_list);
 }
 
-void prepare_to_swait(struct swait_queue_head *q, struct swait_queue *wait, int state)
+void prepare_to_swait_exclusive(struct swait_queue_head *q, struct swait_queue *wait, int state)
 {
         unsigned long flags;
 
@@ -85,16 +85,28 @@ void prepare_to_swait(struct swait_queue_head *q, struct swait_queue *wait, int
         set_current_state(state);
         raw_spin_unlock_irqrestore(&q->lock, flags);
 }
-EXPORT_SYMBOL(prepare_to_swait);
+EXPORT_SYMBOL(prepare_to_swait_exclusive);
 
 long prepare_to_swait_event(struct swait_queue_head *q, struct swait_queue *wait, int state)
 {
-        if (signal_pending_state(state, current))
-                return -ERESTARTSYS;
+        unsigned long flags;
+        long ret = 0;
 
-        prepare_to_swait(q, wait, state);
+        raw_spin_lock_irqsave(&q->lock, flags);
+        if (unlikely(signal_pending_state(state, current))) {
+                /*
+                 * See prepare_to_wait_event(). TL;DR, subsequent swake_up_one()
+                 * must not see us.
+                 */
+                list_del_init(&wait->task_list);
+                ret = -ERESTARTSYS;
+        } else {
+                __prepare_to_swait(q, wait);
+                set_current_state(state);
+        }
+        raw_spin_unlock_irqrestore(&q->lock, flags);
 
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL(prepare_to_swait_event);
 
diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c
index 928be527477e..870f97b313e3 100644
--- a/kernel/sched/wait.c
+++ b/kernel/sched/wait.c
@@ -134,8 +134,8 @@ static void __wake_up_common_lock(struct wait_queue_head *wq_head, unsigned int
  * @nr_exclusive: how many wake-one or wake-many threads to wake up
  * @key: is directly passed to the wakeup function
  *
- * It may be assumed that this function implies a write memory barrier before
- * changing the task state if and only if any tasks are woken up.
+ * If this function wakes up a task, it executes a full memory barrier before
+ * accessing the task state.
  */
 void __wake_up(struct wait_queue_head *wq_head, unsigned int mode,
                         int nr_exclusive, void *key)
@@ -180,8 +180,8 @@ EXPORT_SYMBOL_GPL(__wake_up_locked_key_bookmark);
  *
  * On UP it can prevent extra preemption.
  *
- * It may be assumed that this function implies a write memory barrier before
- * changing the task state if and only if any tasks are woken up.
+ * If this function wakes up a task, it executes a full memory barrier before
+ * accessing the task state.
  */
 void __wake_up_sync_key(struct wait_queue_head *wq_head, unsigned int mode,
                         int nr_exclusive, void *key)
@@ -392,35 +392,36 @@ static inline bool is_kthread_should_stop(void)
  *     if (condition)
  *         break;
  *
- *     p->state = mode;                         condition = true;
- *     smp_mb(); // A                           smp_wmb(); // C
- *     if (!wq_entry->flags & WQ_FLAG_WOKEN)    wq_entry->flags |= WQ_FLAG_WOKEN;
- *         schedule()                           try_to_wake_up();
- *     p->state = TASK_RUNNING;             ~~~~~~~~~~~~~~~~~~
- *     wq_entry->flags &= ~WQ_FLAG_WOKEN;               condition = true;
- *     smp_mb() // B                            smp_wmb(); // C
- *                                              wq_entry->flags |= WQ_FLAG_WOKEN;
- * }
- * remove_wait_queue(&wq_head, &wait);
+ *     // in wait_woken()                       // in woken_wake_function()
  *
+ *     p->state = mode;                         wq_entry->flags |= WQ_FLAG_WOKEN;
+ *     smp_mb(); // A                           try_to_wake_up():
+ *     if (!(wq_entry->flags & WQ_FLAG_WOKEN))     <full barrier>
+ *         schedule()                              if (p->state & mode)
+ *     p->state = TASK_RUNNING;                       p->state = TASK_RUNNING;
+ *     wq_entry->flags &= ~WQ_FLAG_WOKEN;       ~~~~~~~~~~~~~~~~~~
+ *     smp_mb(); // B                           condition = true;
+ * }                                            smp_mb(); // C
+ * remove_wait_queue(&wq_head, &wait);          wq_entry->flags |= WQ_FLAG_WOKEN;
  */
 long wait_woken(struct wait_queue_entry *wq_entry, unsigned mode, long timeout)
 {
-        set_current_state(mode); /* A */
         /*
-         * The above implies an smp_mb(), which matches with the smp_wmb() from
-         * woken_wake_function() such that if we observe WQ_FLAG_WOKEN we must
-         * also observe all state before the wakeup.
+         * The below executes an smp_mb(), which matches with the full barrier
+         * executed by the try_to_wake_up() in woken_wake_function() such that
+         * either we see the store to wq_entry->flags in woken_wake_function()
+         * or woken_wake_function() sees our store to current->state.
          */
+        set_current_state(mode); /* A */
         if (!(wq_entry->flags & WQ_FLAG_WOKEN) && !is_kthread_should_stop())
                 timeout = schedule_timeout(timeout);
         __set_current_state(TASK_RUNNING);
 
         /*
-         * The below implies an smp_mb(), it too pairs with the smp_wmb() from
-         * woken_wake_function() such that we must either observe the wait
-         * condition being true _OR_ WQ_FLAG_WOKEN such that we will not miss
-         * an event.
+         * The below executes an smp_mb(), which matches with the smp_mb() (C)
+         * in woken_wake_function() such that either we see the wait condition
+         * being true or the store to wq_entry->flags in woken_wake_function()
+         * follows ours in the coherence order.
          */
         smp_store_mb(wq_entry->flags, wq_entry->flags & ~WQ_FLAG_WOKEN); /* B */
 
@@ -430,14 +431,8 @@ EXPORT_SYMBOL(wait_woken);
 
 int woken_wake_function(struct wait_queue_entry *wq_entry, unsigned mode, int sync, void *key)
 {
-        /*
-         * Although this function is called under waitqueue lock, LOCK
-         * doesn't imply write barrier and the users expects write
-         * barrier semantics on wakeup functions.  The following
-         * smp_wmb() is equivalent to smp_wmb() in try_to_wake_up()
-         * and is paired with smp_store_mb() in wait_woken().
-         */
-        smp_wmb(); /* C */
+        /* Pairs with the smp_store_mb() in wait_woken(). */
+        smp_mb(); /* C */
         wq_entry->flags |= WQ_FLAG_WOKEN;
 
         return default_wake_function(wq_entry, mode, sync, key);
diff --git a/kernel/smpboot.c b/kernel/smpboot.c
index 5043e7433f4b..c230c2dd48e1 100644
--- a/kernel/smpboot.c
+++ b/kernel/smpboot.c
@@ -238,8 +238,7 @@ int smpboot_unpark_threads(unsigned int cpu)
 
         mutex_lock(&smpboot_threads_lock);
         list_for_each_entry(cur, &hotplug_threads, list)
-                if (cpumask_test_cpu(cpu, cur->cpumask))
-                        smpboot_unpark_thread(cur, cpu);
+                smpboot_unpark_thread(cur, cpu);
         mutex_unlock(&smpboot_threads_lock);
         return 0;
 }
@@ -280,34 +279,26 @@ static void smpboot_destroy_threads(struct smp_hotplug_thread *ht)
 }
 
 /**
- * smpboot_register_percpu_thread_cpumask - Register a per_cpu thread related
+ * smpboot_register_percpu_thread - Register a per_cpu thread related
  *                                          to hotplug
  * @plug_thread:        Hotplug thread descriptor
- * @cpumask:            The cpumask where threads run
  *
  * Creates and starts the threads on all online cpus.
  */
-int smpboot_register_percpu_thread_cpumask(struct smp_hotplug_thread *plug_thread,
-                                           const struct cpumask *cpumask)
+int smpboot_register_percpu_thread(struct smp_hotplug_thread *plug_thread)
 {
         unsigned int cpu;
         int ret = 0;
 
-        if (!alloc_cpumask_var(&plug_thread->cpumask, GFP_KERNEL))
-                return -ENOMEM;
-        cpumask_copy(plug_thread->cpumask, cpumask);
-
         get_online_cpus();
         mutex_lock(&smpboot_threads_lock);
         for_each_online_cpu(cpu) {
                 ret = __smpboot_create_thread(plug_thread, cpu);
                 if (ret) {
                         smpboot_destroy_threads(plug_thread);
-                        free_cpumask_var(plug_thread->cpumask);
                         goto out;
                 }
-                if (cpumask_test_cpu(cpu, cpumask))
-                        smpboot_unpark_thread(plug_thread, cpu);
+                smpboot_unpark_thread(plug_thread, cpu);
         }
         list_add(&plug_thread->list, &hotplug_threads);
 out:
@@ -315,7 +306,7 @@ out:
         put_online_cpus();
         return ret;
 }
-EXPORT_SYMBOL_GPL(smpboot_register_percpu_thread_cpumask);
+EXPORT_SYMBOL_GPL(smpboot_register_percpu_thread);
 
 /**
  * smpboot_unregister_percpu_thread - Unregister a per_cpu thread related to hotplug
@@ -331,44 +322,9 @@ void smpboot_unregister_percpu_thread(struct smp_hotplug_thread *plug_thread)
         smpboot_destroy_threads(plug_thread);
         mutex_unlock(&smpboot_threads_lock);
         put_online_cpus();
-        free_cpumask_var(plug_thread->cpumask);
 }
 EXPORT_SYMBOL_GPL(smpboot_unregister_percpu_thread);
 
-/**
- * smpboot_update_cpumask_percpu_thread - Adjust which per_cpu hotplug threads stay parked
- * @plug_thread:        Hotplug thread descriptor
- * @new:                Revised mask to use
- *
- * The cpumask field in the smp_hotplug_thread must not be updated directly
- * by the client, but only by calling this function.
- * This function can only be called on a registered smp_hotplug_thread.
- */
-void smpboot_update_cpumask_percpu_thread(struct smp_hotplug_thread *plug_thread,
-                                          const struct cpumask *new)
-{
-        struct cpumask *old = plug_thread->cpumask;
-        static struct cpumask tmp;
-        unsigned int cpu;
-
-        lockdep_assert_cpus_held();
-        mutex_lock(&smpboot_threads_lock);
-
-        /* Park threads that were exclusively enabled on the old mask. */
-        cpumask_andnot(&tmp, old, new);
-        for_each_cpu_and(cpu, &tmp, cpu_online_mask)
-                smpboot_park_thread(plug_thread, cpu);
-
-        /* Unpark threads that are exclusively enabled on the new mask. */
-        cpumask_andnot(&tmp, new, old);
-        for_each_cpu_and(cpu, &tmp, cpu_online_mask)
-                smpboot_unpark_thread(plug_thread, cpu);
-
-        cpumask_copy(old, new);
-
-        mutex_unlock(&smpboot_threads_lock);
-}
-
 static DEFINE_PER_CPU(atomic_t, cpu_hotplug_state) = ATOMIC_INIT(CPU_POST_DEAD);
 
 /*
diff --git a/kernel/softirq.c b/kernel/softirq.c
index 75ffc1d1a2e0..6f584861d329 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -390,7 +390,7 @@ static inline void tick_irq_exit(void)
 
         /* Make sure that timer wheel updates are propagated */
         if ((idle_cpu(cpu) && !need_resched()) || tick_nohz_full_cpu(cpu)) {
-                if (!in_interrupt())
+                if (!in_irq())
                         tick_nohz_irq_exit();
         }
 #endif
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index e190d1ef3a23..067cb83f37ea 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -81,6 +81,7 @@ static bool cpu_stop_queue_work(unsigned int cpu, struct cpu_stop_work *work)
         unsigned long flags;
         bool enabled;
 
+        preempt_disable();
         raw_spin_lock_irqsave(&stopper->lock, flags);
         enabled = stopper->enabled;
         if (enabled)
@@ -90,6 +91,7 @@ static bool cpu_stop_queue_work(unsigned int cpu, struct cpu_stop_work *work)
         raw_spin_unlock_irqrestore(&stopper->lock, flags);
 
         wake_up_q(&wakeq);
+        preempt_enable();
 
         return enabled;
 }
@@ -236,13 +238,24 @@ static int cpu_stop_queue_two_works(int cpu1, struct cpu_stop_work *work1,
         struct cpu_stopper *stopper2 = per_cpu_ptr(&cpu_stopper, cpu2);
         DEFINE_WAKE_Q(wakeq);
         int err;
+
 retry:
+        /*
+         * The waking up of stopper threads has to happen in the same
+         * scheduling context as the queueing.  Otherwise, there is a
+         * possibility of one of the above stoppers being woken up by another
+         * CPU, and preempting us. This will cause us to not wake up the other
+         * stopper forever.
+         */
+        preempt_disable();
         raw_spin_lock_irq(&stopper1->lock);
         raw_spin_lock_nested(&stopper2->lock, SINGLE_DEPTH_NESTING);
 
-        err = -ENOENT;
-        if (!stopper1->enabled || !stopper2->enabled)
+        if (!stopper1->enabled || !stopper2->enabled) {
+                err = -ENOENT;
                 goto unlock;
+        }
+
         /*
          * Ensure that if we race with __stop_cpus() the stoppers won't get
          * queued up in reverse order leading to system deadlock.
@@ -253,36 +266,30 @@ retry:
          * It can be falsely true but it is safe to spin until it is cleared,
          * queue_stop_cpus_work() does everything under preempt_disable().
          */
-        err = -EDEADLK;
-        if (unlikely(stop_cpus_in_progress))
-                        goto unlock;
+        if (unlikely(stop_cpus_in_progress)) {
+                err = -EDEADLK;
+                goto unlock;
+        }
 
         err = 0;
         __cpu_stop_queue_work(stopper1, work1, &wakeq);
         __cpu_stop_queue_work(stopper2, work2, &wakeq);
-        /*
-         * The waking up of stopper threads has to happen
-         * in the same scheduling context as the queueing.
-         * Otherwise, there is a possibility of one of the
-         * above stoppers being woken up by another CPU,
-         * and preempting us. This will cause us to n ot
-         * wake up the other stopper forever.
-         */
-        preempt_disable();
+
 unlock:
         raw_spin_unlock(&stopper2->lock);
         raw_spin_unlock_irq(&stopper1->lock);
 
         if (unlikely(err == -EDEADLK)) {
+                preempt_enable();
+
                 while (stop_cpus_in_progress)
                         cpu_relax();
+
                 goto retry;
         }
 
-        if (!err) {
-                wake_up_q(&wakeq);
-                preempt_enable();
-        }
+        wake_up_q(&wakeq);
+        preempt_enable();
 
         return err;
 }
diff --git a/kernel/sys.c b/kernel/sys.c
index 38509dc1f77b..e27b51d3facd 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -2512,11 +2512,11 @@ static int do_sysinfo(struct sysinfo *info)
 {
         unsigned long mem_total, sav_total;
         unsigned int mem_unit, bitcount;
-        struct timespec tp;
+        struct timespec64 tp;
 
         memset(info, 0, sizeof(struct sysinfo));
 
-        get_monotonic_boottime(&tp);
+        ktime_get_boottime_ts64(&tp);
         info->uptime = tp.tv_sec + (tp.tv_nsec ? 1 : 0);
 
         get_avenrun(info->loads, 0, SI_LOAD_SHIFT - FSHIFT);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 2d9837c0aff4..f22f76b7a138 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -368,14 +368,6 @@ static struct ctl_table kern_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
-        {
-                .procname       = "sched_time_avg_ms",
-                .data           = &sysctl_sched_time_avg,
-                .maxlen         = sizeof(unsigned int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
-        },
 #ifdef CONFIG_SCHEDSTATS
         {
                 .procname       = "sched_schedstats",
diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
index 639321bf2e39..fa5de5e8de61 100644
--- a/kernel/time/alarmtimer.c
+++ b/kernel/time/alarmtimer.c
@@ -581,11 +581,11 @@ static void alarm_timer_rearm(struct k_itimer *timr)
  * @timr:       Pointer to the posixtimer data struct
  * @now:        Current time to forward the timer against
  */
-static int alarm_timer_forward(struct k_itimer *timr, ktime_t now)
+static s64 alarm_timer_forward(struct k_itimer *timr, ktime_t now)
 {
         struct alarm *alarm = &timr->it.alarm.alarmtimer;
 
-        return (int) alarm_forward(alarm, timr->it_interval, now);
+        return alarm_forward(alarm, timr->it_interval, now);
 }
 
 /**
@@ -808,7 +808,8 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags,
         /* Convert (if necessary) to absolute time */
         if (flags != TIMER_ABSTIME) {
                 ktime_t now = alarm_bases[type].gettime();
-                exp = ktime_add(now, exp);
+
+                exp = ktime_add_safe(now, exp);
         }
 
         ret = alarmtimer_do_nsleep(&alarm, exp, type);
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index 16c027e9cc73..8c0e4092f661 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -463,6 +463,12 @@ void clockevents_register_device(struct clock_event_device *dev)
                 dev->cpumask = cpumask_of(smp_processor_id());
         }
 
+        if (dev->cpumask == cpu_all_mask) {
+                WARN(1, "%s cpumask == cpu_all_mask, using cpu_possible_mask instead\n",
+                     dev->name);
+                dev->cpumask = cpu_possible_mask;
+        }
+
         raw_spin_lock_irqsave(&clockevents_lock, flags);
 
         list_add(&dev->list, &clockevent_devices);
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index f89a78e2792b..f74fb00d8064 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -94,6 +94,8 @@ EXPORT_SYMBOL_GPL(clocks_calc_mult_shift);
 /*[Clocksource internal variables]---------
  * curr_clocksource:
  *      currently selected clocksource.
+ * suspend_clocksource:
+ *      used to calculate the suspend time.
  * clocksource_list:
  *      linked list with the registered clocksources
  * clocksource_mutex:
@@ -102,10 +104,12 @@ EXPORT_SYMBOL_GPL(clocks_calc_mult_shift);
  *      Name of the user-specified clocksource.
  */
 static struct clocksource *curr_clocksource;
+static struct clocksource *suspend_clocksource;
 static LIST_HEAD(clocksource_list);
 static DEFINE_MUTEX(clocksource_mutex);
 static char override_name[CS_NAME_LEN];
 static int finished_booting;
+static u64 suspend_start;
 
 #ifdef CONFIG_CLOCKSOURCE_WATCHDOG
 static void clocksource_watchdog_work(struct work_struct *work);
@@ -447,6 +451,140 @@ static inline void clocksource_watchdog_unlock(unsigned long *flags) { }
 
 #endif /* CONFIG_CLOCKSOURCE_WATCHDOG */
 
+static bool clocksource_is_suspend(struct clocksource *cs)
+{
+        return cs == suspend_clocksource;
+}
+
+static void __clocksource_suspend_select(struct clocksource *cs)
+{
+        /*
+         * Skip the clocksource which will be stopped in suspend state.
+         */
+        if (!(cs->flags & CLOCK_SOURCE_SUSPEND_NONSTOP))
+                return;
+
+        /*
+         * The nonstop clocksource can be selected as the suspend clocksource to
+         * calculate the suspend time, so it should not supply suspend/resume
+         * interfaces to suspend the nonstop clocksource when system suspends.
+         */
+        if (cs->suspend || cs->resume) {
+                pr_warn("Nonstop clocksource %s should not supply suspend/resume interfaces\n",
+                        cs->name);
+        }
+
+        /* Pick the best rating. */
+        if (!suspend_clocksource || cs->rating > suspend_clocksource->rating)
+                suspend_clocksource = cs;
+}
+
+/**
+ * clocksource_suspend_select - Select the best clocksource for suspend timing
+ * @fallback:   if select a fallback clocksource
+ */
+static void clocksource_suspend_select(bool fallback)
+{
+        struct clocksource *cs, *old_suspend;
+
+        old_suspend = suspend_clocksource;
+        if (fallback)
+                suspend_clocksource = NULL;
+
+        list_for_each_entry(cs, &clocksource_list, list) {
+                /* Skip current if we were requested for a fallback. */
+                if (fallback && cs == old_suspend)
+                        continue;
+
+                __clocksource_suspend_select(cs);
+        }
+}
+
+/**
+ * clocksource_start_suspend_timing - Start measuring the suspend timing
+ * @cs:                 current clocksource from timekeeping
+ * @start_cycles:       current cycles from timekeeping
+ *
+ * This function will save the start cycle values of suspend timer to calculate
+ * the suspend time when resuming system.
+ *
+ * This function is called late in the suspend process from timekeeping_suspend(),
+ * that means processes are freezed, non-boot cpus and interrupts are disabled
+ * now. It is therefore possible to start the suspend timer without taking the
+ * clocksource mutex.
+ */
+void clocksource_start_suspend_timing(struct clocksource *cs, u64 start_cycles)
+{
+        if (!suspend_clocksource)
+                return;
+
+        /*
+         * If current clocksource is the suspend timer, we should use the
+         * tkr_mono.cycle_last value as suspend_start to avoid same reading
+         * from suspend timer.
+         */
+        if (clocksource_is_suspend(cs)) {
+                suspend_start = start_cycles;
+                return;
+        }
+
+        if (suspend_clocksource->enable &&
+            suspend_clocksource->enable(suspend_clocksource)) {
+                pr_warn_once("Failed to enable the non-suspend-able clocksource.\n");
+                return;
+        }
+
+        suspend_start = suspend_clocksource->read(suspend_clocksource);
+}
+
+/**
+ * clocksource_stop_suspend_timing - Stop measuring the suspend timing
+ * @cs:         current clocksource from timekeeping
+ * @cycle_now:  current cycles from timekeeping
+ *
+ * This function will calculate the suspend time from suspend timer.
+ *
+ * Returns nanoseconds since suspend started, 0 if no usable suspend clocksource.
+ *
+ * This function is called early in the resume process from timekeeping_resume(),
+ * that means there is only one cpu, no processes are running and the interrupts
+ * are disabled. It is therefore possible to stop the suspend timer without
+ * taking the clocksource mutex.
+ */
+u64 clocksource_stop_suspend_timing(struct clocksource *cs, u64 cycle_now)
+{
+        u64 now, delta, nsec = 0;
+
+        if (!suspend_clocksource)
+                return 0;
+
+        /*
+         * If current clocksource is the suspend timer, we should use the
+         * tkr_mono.cycle_last value from timekeeping as current cycle to
+         * avoid same reading from suspend timer.
+         */
+        if (clocksource_is_suspend(cs))
+                now = cycle_now;
+        else
+                now = suspend_clocksource->read(suspend_clocksource);
+
+        if (now > suspend_start) {
+                delta = clocksource_delta(now, suspend_start,
+                                          suspend_clocksource->mask);
+                nsec = mul_u64_u32_shr(delta, suspend_clocksource->mult,
+                                       suspend_clocksource->shift);
+        }
+
+        /*
+         * Disable the suspend timer to save power if current clocksource is
+         * not the suspend timer.
+         */
+        if (!clocksource_is_suspend(cs) && suspend_clocksource->disable)
+                suspend_clocksource->disable(suspend_clocksource);
+
+        return nsec;
+}
+
 /**
  * clocksource_suspend - suspend the clocksource(s)
  */
@@ -792,6 +930,7 @@ int __clocksource_register_scale(struct clocksource *cs, u32 scale, u32 freq)
 
         clocksource_select();
         clocksource_select_watchdog(false);
+        __clocksource_suspend_select(cs);
         mutex_unlock(&clocksource_mutex);
         return 0;
 }
@@ -820,6 +959,7 @@ void clocksource_change_rating(struct clocksource *cs, int rating)
 
         clocksource_select();
         clocksource_select_watchdog(false);
+        clocksource_suspend_select(false);
         mutex_unlock(&clocksource_mutex);
 }
 EXPORT_SYMBOL(clocksource_change_rating);
@@ -845,6 +985,15 @@ static int clocksource_unbind(struct clocksource *cs)
                         return -EBUSY;
         }
 
+        if (clocksource_is_suspend(cs)) {
+                /*
+                 * Select and try to install a replacement suspend clocksource.
+                 * If no replacement suspend clocksource, we will just let the
+                 * clocksource go and have no suspend clocksource.
+                 */
+                clocksource_suspend_select(true);
+        }
+
         clocksource_watchdog_lock(&flags);
         clocksource_dequeue_watchdog(cs);
         list_del_init(&cs->list);
diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
index 3e93c54bd3a1..e1a549c9e399 100644
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -718,8 +718,8 @@ static void hrtimer_switch_to_hres(void)
         struct hrtimer_cpu_base *base = this_cpu_ptr(&hrtimer_bases);
 
         if (tick_init_highres()) {
-                printk(KERN_WARNING "Could not switch to high resolution "
-                                    "mode on CPU %d\n", base->cpu);
+                pr_warn("Could not switch to high resolution mode on CPU %u\n",
+                        base->cpu);
                 return;
         }
         base->hres_active = 1;
@@ -1573,8 +1573,7 @@ retry:
         else
                 expires_next = ktime_add(now, delta);
         tick_program_event(expires_next, 1);
-        printk_once(KERN_WARNING "hrtimer: interrupt took %llu ns\n",
-                    ktime_to_ns(delta));
+        pr_warn_once("hrtimer: interrupt took %llu ns\n", ktime_to_ns(delta));
 }
 
 /* called with interrupts disabled */
diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index a09ded765f6c..c5e0cba3b39c 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -502,7 +502,7 @@ static void sched_sync_hw_clock(struct timespec64 now,
 {
         struct timespec64 next;
 
-        getnstimeofday64(&next);
+        ktime_get_real_ts64(&next);
         if (!fail)
                 next.tv_sec = 659;
         else {
@@ -537,7 +537,7 @@ static void sync_rtc_clock(void)
         if (!IS_ENABLED(CONFIG_RTC_SYSTOHC))
                 return;
 
-        getnstimeofday64(&now);
+        ktime_get_real_ts64(&now);
 
         adjust = now;
         if (persistent_clock_is_local)
@@ -591,7 +591,7 @@ static bool sync_cmos_clock(void)
          * Architectures are strongly encouraged to use rtclib and not
          * implement this legacy API.
          */
-        getnstimeofday64(&now);
+        ktime_get_real_ts64(&now);
         if (rtc_tv_nsec_ok(-1 * target_nsec, &adjust, &now)) {
                 if (persistent_clock_is_local)
                         adjust.tv_sec -= (sys_tz.tz_minuteswest * 60);
@@ -642,7 +642,7 @@ void ntp_notify_cmos_timer(void)
 /*
  * Propagate a new txc->status value into the NTP state:
  */
-static inline void process_adj_status(struct timex *txc, struct timespec64 *ts)
+static inline void process_adj_status(const struct timex *txc)
 {
         if ((time_status & STA_PLL) && !(txc->status & STA_PLL)) {
                 time_state = TIME_OK;
@@ -665,12 +665,10 @@ static inline void process_adj_status(struct timex *txc, struct timespec64 *ts)
 }
 
 
-static inline void process_adjtimex_modes(struct timex *txc,
-                                                struct timespec64 *ts,
-                                                s32 *time_tai)
+static inline void process_adjtimex_modes(const struct timex *txc, s32 *time_tai)
 {
         if (txc->modes & ADJ_STATUS)
-                process_adj_status(txc, ts);
+                process_adj_status(txc);
 
         if (txc->modes & ADJ_NANO)
                 time_status |= STA_NANO;
@@ -718,7 +716,7 @@ static inline void process_adjtimex_modes(struct timex *txc,
  * adjtimex mainly allows reading (and writing, if superuser) of
  * kernel time-keeping variables. used by xntpd.
  */
-int __do_adjtimex(struct timex *txc, struct timespec64 *ts, s32 *time_tai)
+int __do_adjtimex(struct timex *txc, const struct timespec64 *ts, s32 *time_tai)
 {
         int result;
 
@@ -735,7 +733,7 @@ int __do_adjtimex(struct timex *txc, struct timespec64 *ts, s32 *time_tai)
 
                 /* If there are input parameters, then process them: */
                 if (txc->modes)
-                        process_adjtimex_modes(txc, ts, time_tai);
+                        process_adjtimex_modes(txc, time_tai);
 
                 txc->offset = shift_right(time_offset * NTP_INTERVAL_FREQ,
                                   NTP_SCALE_SHIFT);
@@ -1022,12 +1020,11 @@ void __hardpps(const struct timespec64 *phase_ts, const struct timespec64 *raw_t
 
 static int __init ntp_tick_adj_setup(char *str)
 {
-        int rc = kstrtol(str, 0, (long *)&ntp_tick_adj);
-
+        int rc = kstrtos64(str, 0, &ntp_tick_adj);
         if (rc)
                 return rc;
-        ntp_tick_adj <<= NTP_SCALE_SHIFT;
 
+        ntp_tick_adj <<= NTP_SCALE_SHIFT;
         return 1;
 }
 
diff --git a/kernel/time/ntp_internal.h b/kernel/time/ntp_internal.h
index 909bd1f1bfb1..c24b0e13f011 100644
--- a/kernel/time/ntp_internal.h
+++ b/kernel/time/ntp_internal.h
@@ -8,6 +8,6 @@ extern void ntp_clear(void);
 extern u64 ntp_tick_length(void);
 extern ktime_t ntp_get_next_leap(void);
 extern int second_overflow(time64_t secs);
-extern int __do_adjtimex(struct timex *, struct timespec64 *, s32 *);
-extern void __hardpps(const struct timespec64 *, const struct timespec64 *);
+extern int __do_adjtimex(struct timex *txc, const struct timespec64 *ts, s32 *time_tai);
+extern void __hardpps(const struct timespec64 *phase_ts, const struct timespec64 *raw_ts);
 #endif /* _LINUX_NTP_INTERNAL_H */
diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index 9cdf54b04ca8..294d7b65af33 100644
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -85,7 +85,7 @@ static void bump_cpu_timer(struct k_itimer *timer, u64 now)
                         continue;
 
                 timer->it.cpu.expires += incr;
-                timer->it_overrun += 1 << i;
+                timer->it_overrun += 1LL << i;
                 delta -= incr;
         }
 }
diff --git a/kernel/time/posix-stubs.c b/kernel/time/posix-stubs.c
index 26aa9569e24a..2c6847d5d69b 100644
--- a/kernel/time/posix-stubs.c
+++ b/kernel/time/posix-stubs.c
@@ -81,7 +81,7 @@ int do_clock_gettime(clockid_t which_clock, struct timespec64 *tp)
                 ktime_get_ts64(tp);
                 break;
         case CLOCK_BOOTTIME:
-                get_monotonic_boottime64(tp);
+                ktime_get_boottime_ts64(tp);
                 break;
         default:
                 return -EINVAL;
diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
index e08ce3f27447..3ac7295306dc 100644
--- a/kernel/time/posix-timers.c
+++ b/kernel/time/posix-timers.c
@@ -228,21 +228,21 @@ static int posix_ktime_get_ts(clockid_t which_clock, struct timespec64 *tp)
  */
 static int posix_get_monotonic_raw(clockid_t which_clock, struct timespec64 *tp)
 {
-        getrawmonotonic64(tp);
+        ktime_get_raw_ts64(tp);
         return 0;
 }
 
 
 static int posix_get_realtime_coarse(clockid_t which_clock, struct timespec64 *tp)
 {
-        *tp = current_kernel_time64();
+        ktime_get_coarse_real_ts64(tp);
         return 0;
 }
 
 static int posix_get_monotonic_coarse(clockid_t which_clock,
                                                 struct timespec64 *tp)
 {
-        *tp = get_monotonic_coarse64();
+        ktime_get_coarse_ts64(tp);
         return 0;
 }
 
@@ -254,13 +254,13 @@ static int posix_get_coarse_res(const clockid_t which_clock, struct timespec64 *
 
 static int posix_get_boottime(const clockid_t which_clock, struct timespec64 *tp)
 {
-        get_monotonic_boottime64(tp);
+        ktime_get_boottime_ts64(tp);
         return 0;
 }
 
 static int posix_get_tai(clockid_t which_clock, struct timespec64 *tp)
 {
-        timekeeping_clocktai64(tp);
+        ktime_get_clocktai_ts64(tp);
         return 0;
 }
 
@@ -283,6 +283,17 @@ static __init int init_posix_timers(void)
 }
 __initcall(init_posix_timers);
 
+/*
+ * The siginfo si_overrun field and the return value of timer_getoverrun(2)
+ * are of type int. Clamp the overrun value to INT_MAX
+ */
+static inline int timer_overrun_to_int(struct k_itimer *timr, int baseval)
+{
+        s64 sum = timr->it_overrun_last + (s64)baseval;
+
+        return sum > (s64)INT_MAX ? INT_MAX : (int)sum;
+}
+
 static void common_hrtimer_rearm(struct k_itimer *timr)
 {
         struct hrtimer *timer = &timr->it.real.timer;
@@ -290,9 +301,8 @@ static void common_hrtimer_rearm(struct k_itimer *timr)
         if (!timr->it_interval)
                 return;
 
-        timr->it_overrun += (unsigned int) hrtimer_forward(timer,
-                                                timer->base->get_time(),
-                                                timr->it_interval);
+        timr->it_overrun += hrtimer_forward(timer, timer->base->get_time(),
+                                            timr->it_interval);
         hrtimer_restart(timer);
 }
 
@@ -321,10 +331,10 @@ void posixtimer_rearm(struct siginfo *info)
 
                 timr->it_active = 1;
                 timr->it_overrun_last = timr->it_overrun;
-                timr->it_overrun = -1;
+                timr->it_overrun = -1LL;
                 ++timr->it_requeue_pending;
 
-                info->si_overrun += timr->it_overrun_last;
+                info->si_overrun = timer_overrun_to_int(timr, info->si_overrun);
         }
 
         unlock_timer(timr, flags);
@@ -418,9 +428,8 @@ static enum hrtimer_restart posix_timer_fn(struct hrtimer *timer)
                                         now = ktime_add(now, kj);
                         }
 #endif
-                        timr->it_overrun += (unsigned int)
-                                hrtimer_forward(timer, now,
-                                                timr->it_interval);
+                        timr->it_overrun += hrtimer_forward(timer, now,
+                                                            timr->it_interval);
                         ret = HRTIMER_RESTART;
                         ++timr->it_requeue_pending;
                         timr->it_active = 1;
@@ -524,7 +533,7 @@ static int do_timer_create(clockid_t which_clock, struct sigevent *event,
         new_timer->it_id = (timer_t) new_timer_id;
         new_timer->it_clock = which_clock;
         new_timer->kclock = kc;
-        new_timer->it_overrun = -1;
+        new_timer->it_overrun = -1LL;
 
         if (event) {
                 rcu_read_lock();
@@ -645,11 +654,11 @@ static ktime_t common_hrtimer_remaining(struct k_itimer *timr, ktime_t now)
         return __hrtimer_expires_remaining_adjusted(timer, now);
 }
 
-static int common_hrtimer_forward(struct k_itimer *timr, ktime_t now)
+static s64 common_hrtimer_forward(struct k_itimer *timr, ktime_t now)
 {
         struct hrtimer *timer = &timr->it.real.timer;
 
-        return (int)hrtimer_forward(timer, now, timr->it_interval);
+        return hrtimer_forward(timer, now, timr->it_interval);
 }
 
 /*
@@ -743,7 +752,7 @@ static int do_timer_gettime(timer_t timer_id,  struct itimerspec64 *setting)
 
 /* Get the time remaining on a POSIX.1b interval timer. */
 SYSCALL_DEFINE2(timer_gettime, timer_t, timer_id,
-                struct itimerspec __user *, setting)
+                struct __kernel_itimerspec __user *, setting)
 {
         struct itimerspec64 cur_setting;
 
@@ -755,7 +764,8 @@ SYSCALL_DEFINE2(timer_gettime, timer_t, timer_id,
         return ret;
 }
 
-#ifdef CONFIG_COMPAT
+#ifdef CONFIG_COMPAT_32BIT_TIME
+
 COMPAT_SYSCALL_DEFINE2(timer_gettime, timer_t, timer_id,
                        struct compat_itimerspec __user *, setting)
 {
@@ -768,6 +778,7 @@ COMPAT_SYSCALL_DEFINE2(timer_gettime, timer_t, timer_id,
         }
         return ret;
 }
+
 #endif
 
 /*
@@ -789,7 +800,7 @@ SYSCALL_DEFINE1(timer_getoverrun, timer_t, timer_id)
         if (!timr)
                 return -EINVAL;
 
-        overrun = timr->it_overrun_last;
+        overrun = timer_overrun_to_int(timr, 0);
         unlock_timer(timr, flags);
 
         return overrun;
@@ -906,8 +917,8 @@ retry:
 
 /* Set a POSIX.1b interval timer */
 SYSCALL_DEFINE4(timer_settime, timer_t, timer_id, int, flags,
-                const struct itimerspec __user *, new_setting,
-                struct itimerspec __user *, old_setting)
+                const struct __kernel_itimerspec __user *, new_setting,
+                struct __kernel_itimerspec __user *, old_setting)
 {
         struct itimerspec64 new_spec, old_spec;
         struct itimerspec64 *rtn = old_setting ? &old_spec : NULL;
@@ -927,7 +938,7 @@ SYSCALL_DEFINE4(timer_settime, timer_t, timer_id, int, flags,
         return error;
 }
 
-#ifdef CONFIG_COMPAT
+#ifdef CONFIG_COMPAT_32BIT_TIME
 COMPAT_SYSCALL_DEFINE4(timer_settime, timer_t, timer_id, int, flags,
                        struct compat_itimerspec __user *, new,
                        struct compat_itimerspec __user *, old)
diff --git a/kernel/time/posix-timers.h b/kernel/time/posix-timers.h
index 151e28f5bf30..ddb21145211a 100644
--- a/kernel/time/posix-timers.h
+++ b/kernel/time/posix-timers.h
@@ -19,7 +19,7 @@ struct k_clock {
         void    (*timer_get)(struct k_itimer *timr,
                              struct itimerspec64 *cur_setting);
         void    (*timer_rearm)(struct k_itimer *timr);
-        int     (*timer_forward)(struct k_itimer *timr, ktime_t now);
+        s64     (*timer_forward)(struct k_itimer *timr, ktime_t now);
         ktime_t (*timer_remaining)(struct k_itimer *timr, ktime_t now);
         int     (*timer_try_to_cancel)(struct k_itimer *timr);
         void    (*timer_arm)(struct k_itimer *timr, ktime_t expires,
diff --git a/kernel/time/sched_clock.c b/kernel/time/sched_clock.c
index 2d8f05aad442..cbc72c2c1fca 100644
--- a/kernel/time/sched_clock.c
+++ b/kernel/time/sched_clock.c
@@ -237,7 +237,7 @@ sched_clock_register(u64 (*read)(void), int bits, unsigned long rate)
         pr_debug("Registered %pF as sched_clock source\n", read);
 }
 
-void __init sched_clock_postinit(void)
+void __init generic_sched_clock_init(void)
 {
         /*
          * If no sched_clock() function has been provided at that point,
diff --git a/kernel/time/tick-broadcast-hrtimer.c b/kernel/time/tick-broadcast-hrtimer.c
index 58045eb976c3..a59641fb88b6 100644
--- a/kernel/time/tick-broadcast-hrtimer.c
+++ b/kernel/time/tick-broadcast-hrtimer.c
@@ -90,7 +90,7 @@ static struct clock_event_device ce_broadcast_hrtimer = {
         .max_delta_ticks        = ULONG_MAX,
         .mult                   = 1,
         .shift                  = 0,
-        .cpumask                = cpu_all_mask,
+        .cpumask                = cpu_possible_mask,
 };
 
 static enum hrtimer_restart bc_handler(struct hrtimer *t)
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index da9455a6b42b..5b33e2f5c0ed 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -642,7 +642,7 @@ static void tick_nohz_restart(struct tick_sched *ts, ktime_t now)
 
 static inline bool local_timer_softirq_pending(void)
 {
-        return local_softirq_pending() & TIMER_SOFTIRQ;
+        return local_softirq_pending() & BIT(TIMER_SOFTIRQ);
 }
 
 static ktime_t tick_nohz_next_event(struct tick_sched *ts, int cpu)
diff --git a/kernel/time/time.c b/kernel/time/time.c
index 2b41e8e2d31d..ccdb351277ee 100644
--- a/kernel/time/time.c
+++ b/kernel/time/time.c
@@ -64,7 +64,7 @@ EXPORT_SYMBOL(sys_tz);
  */
 SYSCALL_DEFINE1(time, time_t __user *, tloc)
 {
-        time_t i = get_seconds();
+        time_t i = (time_t)ktime_get_real_seconds();
 
         if (tloc) {
                 if (put_user(i,tloc))
@@ -107,11 +107,9 @@ SYSCALL_DEFINE1(stime, time_t __user *, tptr)
 /* compat_time_t is a 32 bit "long" and needs to get converted. */
 COMPAT_SYSCALL_DEFINE1(time, compat_time_t __user *, tloc)
 {
-        struct timeval tv;
         compat_time_t i;
 
-        do_gettimeofday(&tv);
-        i = tv.tv_sec;
+        i = (compat_time_t)ktime_get_real_seconds();
 
         if (tloc) {
                 if (put_user(i,tloc))
@@ -931,7 +929,7 @@ int compat_put_timespec64(const struct timespec64 *ts, void __user *uts)
 EXPORT_SYMBOL_GPL(compat_put_timespec64);
 
 int get_itimerspec64(struct itimerspec64 *it,
-                        const struct itimerspec __user *uit)
+                        const struct __kernel_itimerspec __user *uit)
 {
         int ret;
 
@@ -946,7 +944,7 @@ int get_itimerspec64(struct itimerspec64 *it,
 EXPORT_SYMBOL_GPL(get_itimerspec64);
 
 int put_itimerspec64(const struct itimerspec64 *it,
-                        struct itimerspec __user *uit)
+                        struct __kernel_itimerspec __user *uit)
 {
         int ret;
 
@@ -959,3 +957,24 @@ int put_itimerspec64(const struct itimerspec64 *it,
         return ret;
 }
 EXPORT_SYMBOL_GPL(put_itimerspec64);
+
+int get_compat_itimerspec64(struct itimerspec64 *its,
+                        const struct compat_itimerspec __user *uits)
+{
+
+        if (__compat_get_timespec64(&its->it_interval, &uits->it_interval) ||
+            __compat_get_timespec64(&its->it_value, &uits->it_value))
+                return -EFAULT;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(get_compat_itimerspec64);
+
+int put_compat_itimerspec64(const struct itimerspec64 *its,
+                        struct compat_itimerspec __user *uits)
+{
+        if (__compat_put_timespec64(&its->it_interval, &uits->it_interval) ||
+            __compat_put_timespec64(&its->it_value, &uits->it_value))
+                return -EFAULT;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(put_compat_itimerspec64);
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 4786df904c22..f3b22f456fac 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -17,6 +17,7 @@
 #include <linux/nmi.h>
 #include <linux/sched.h>
 #include <linux/sched/loadavg.h>
+#include <linux/sched/clock.h>
 #include <linux/syscore_ops.h>
 #include <linux/clocksource.h>
 #include <linux/jiffies.h>
@@ -34,6 +35,14 @@
 #define TK_MIRROR               (1 << 1)
 #define TK_CLOCK_WAS_SET        (1 << 2)
 
+enum timekeeping_adv_mode {
+        /* Update timekeeper when a tick has passed */
+        TK_ADV_TICK,
+
+        /* Update timekeeper on a direct frequency change */
+        TK_ADV_FREQ
+};
+
 /*
  * The most important data for readout fits into a single 64 byte
  * cache line.
@@ -97,7 +106,7 @@ static inline void tk_normalize_xtime(struct timekeeper *tk)
         }
 }
 
-static inline struct timespec64 tk_xtime(struct timekeeper *tk)
+static inline struct timespec64 tk_xtime(const struct timekeeper *tk)
 {
         struct timespec64 ts;
 
@@ -154,7 +163,7 @@ static inline void tk_update_sleep_time(struct timekeeper *tk, ktime_t delta)
  * a read of the fast-timekeeper tkrs (which is protected by its own locking
  * and update logic).
  */
-static inline u64 tk_clock_read(struct tk_read_base *tkr)
+static inline u64 tk_clock_read(const struct tk_read_base *tkr)
 {
         struct clocksource *clock = READ_ONCE(tkr->clock);
 
@@ -203,7 +212,7 @@ static void timekeeping_check_update(struct timekeeper *tk, u64 offset)
         }
 }
 
-static inline u64 timekeeping_get_delta(struct tk_read_base *tkr)
+static inline u64 timekeeping_get_delta(const struct tk_read_base *tkr)
 {
         struct timekeeper *tk = &tk_core.timekeeper;
         u64 now, last, mask, max, delta;
@@ -247,7 +256,7 @@ static inline u64 timekeeping_get_delta(struct tk_read_base *tkr)
 static inline void timekeeping_check_update(struct timekeeper *tk, u64 offset)
 {
 }
-static inline u64 timekeeping_get_delta(struct tk_read_base *tkr)
+static inline u64 timekeeping_get_delta(const struct tk_read_base *tkr)
 {
         u64 cycle_now, delta;
 
@@ -344,7 +353,7 @@ u32 (*arch_gettimeoffset)(void) = default_arch_gettimeoffset;
 static inline u32 arch_gettimeoffset(void) { return 0; }
 #endif
 
-static inline u64 timekeeping_delta_to_ns(struct tk_read_base *tkr, u64 delta)
+static inline u64 timekeeping_delta_to_ns(const struct tk_read_base *tkr, u64 delta)
 {
         u64 nsec;
 
@@ -355,7 +364,7 @@ static inline u64 timekeeping_delta_to_ns(struct tk_read_base *tkr, u64 delta)
         return nsec + arch_gettimeoffset();
 }
 
-static inline u64 timekeeping_get_ns(struct tk_read_base *tkr)
+static inline u64 timekeeping_get_ns(const struct tk_read_base *tkr)
 {
         u64 delta;
 
@@ -363,7 +372,7 @@ static inline u64 timekeeping_get_ns(struct tk_read_base *tkr)
         return timekeeping_delta_to_ns(tkr, delta);
 }
 
-static inline u64 timekeeping_cycles_to_ns(struct tk_read_base *tkr, u64 cycles)
+static inline u64 timekeeping_cycles_to_ns(const struct tk_read_base *tkr, u64 cycles)
 {
         u64 delta;
 
@@ -386,7 +395,8 @@ static inline u64 timekeeping_cycles_to_ns(struct tk_read_base *tkr, u64 cycles)
  * slightly wrong timestamp (a few nanoseconds). See
  * @ktime_get_mono_fast_ns.
  */
-static void update_fast_timekeeper(struct tk_read_base *tkr, struct tk_fast *tkf)
+static void update_fast_timekeeper(const struct tk_read_base *tkr,
+                                   struct tk_fast *tkf)
 {
         struct tk_read_base *base = tkf->base;
 
@@ -541,10 +551,10 @@ EXPORT_SYMBOL_GPL(ktime_get_real_fast_ns);
  * number of cycles every time until timekeeping is resumed at which time the
  * proper readout base for the fast timekeeper will be restored automatically.
  */
-static void halt_fast_timekeeper(struct timekeeper *tk)
+static void halt_fast_timekeeper(const struct timekeeper *tk)
 {
         static struct tk_read_base tkr_dummy;
-        struct tk_read_base *tkr = &tk->tkr_mono;
+        const struct tk_read_base *tkr = &tk->tkr_mono;
 
         memcpy(&tkr_dummy, tkr, sizeof(tkr_dummy));
         cycles_at_suspend = tk_clock_read(tkr);
@@ -1269,7 +1279,7 @@ EXPORT_SYMBOL(do_settimeofday64);
  *
  * Adds or subtracts an offset value from the current time.
  */
-static int timekeeping_inject_offset(struct timespec64 *ts)
+static int timekeeping_inject_offset(const struct timespec64 *ts)
 {
         struct timekeeper *tk = &tk_core.timekeeper;
         unsigned long flags;
@@ -1496,22 +1506,39 @@ void __weak read_persistent_clock64(struct timespec64 *ts64)
 }
 
 /**
- * read_boot_clock64 -  Return time of the system start.
+ * read_persistent_wall_and_boot_offset - Read persistent clock, and also offset
+ *                                        from the boot.
  *
  * Weak dummy function for arches that do not yet support it.
- * Function to read the exact time the system has been started.
- * Returns a timespec64 with tv_sec=0 and tv_nsec=0 if unsupported.
- *
- *  XXX - Do be sure to remove it once all arches implement it.
+ * wall_time    - current time as returned by persistent clock
+ * boot_offset  - offset that is defined as wall_time - boot_time
+ * The default function calculates offset based on the current value of
+ * local_clock(). This way architectures that support sched_clock() but don't
+ * support dedicated boot time clock will provide the best estimate of the
+ * boot time.
  */
-void __weak read_boot_clock64(struct timespec64 *ts)
+void __weak __init
+read_persistent_wall_and_boot_offset(struct timespec64 *wall_time,
+                                     struct timespec64 *boot_offset)
 {
-        ts->tv_sec = 0;
-        ts->tv_nsec = 0;
+        read_persistent_clock64(wall_time);
+        *boot_offset = ns_to_timespec64(local_clock());
 }
 
-/* Flag for if timekeeping_resume() has injected sleeptime */
-static bool sleeptime_injected;
+/*
+ * Flag reflecting whether timekeeping_resume() has injected sleeptime.
+ *
+ * The flag starts of false and is only set when a suspend reaches
+ * timekeeping_suspend(), timekeeping_resume() sets it to false when the
+ * timekeeper clocksource is not stopping across suspend and has been
+ * used to update sleep time. If the timekeeper clocksource has stopped
+ * then the flag stays true and is used by the RTC resume code to decide
+ * whether sleeptime must be injected and if so the flag gets false then.
+ *
+ * If a suspend fails before reaching timekeeping_resume() then the flag
+ * stays false and prevents erroneous sleeptime injection.
+ */
+static bool suspend_timing_needed;
 
 /* Flag for if there is a persistent clock on this platform */
 static bool persistent_clock_exists;
@@ -1521,28 +1548,29 @@ static bool persistent_clock_exists;
  */
 void __init timekeeping_init(void)
 {
+        struct timespec64 wall_time, boot_offset, wall_to_mono;
         struct timekeeper *tk = &tk_core.timekeeper;
         struct clocksource *clock;
         unsigned long flags;
-        struct timespec64 now, boot, tmp;
-
-        read_persistent_clock64(&now);
-        if (!timespec64_valid_strict(&now)) {
-                pr_warn("WARNING: Persistent clock returned invalid value!\n"
-                        "         Check your CMOS/BIOS settings.\n");
-                now.tv_sec = 0;
-                now.tv_nsec = 0;
-        } else if (now.tv_sec || now.tv_nsec)
-                persistent_clock_exists = true;
 
-        read_boot_clock64(&boot);
-        if (!timespec64_valid_strict(&boot)) {
-                pr_warn("WARNING: Boot clock returned invalid value!\n"
-                        "         Check your CMOS/BIOS settings.\n");
-                boot.tv_sec = 0;
-                boot.tv_nsec = 0;
+        read_persistent_wall_and_boot_offset(&wall_time, &boot_offset);
+        if (timespec64_valid_strict(&wall_time) &&
+            timespec64_to_ns(&wall_time) > 0) {
+                persistent_clock_exists = true;
+        } else if (timespec64_to_ns(&wall_time) != 0) {
+                pr_warn("Persistent clock returned invalid value");
+                wall_time = (struct timespec64){0};
         }
 
+        if (timespec64_compare(&wall_time, &boot_offset) < 0)
+                boot_offset = (struct timespec64){0};
+
+        /*
+         * We want set wall_to_mono, so the following is true:
+         * wall time + wall_to_mono = boot time
+         */
+        wall_to_mono = timespec64_sub(boot_offset, wall_time);
+
         raw_spin_lock_irqsave(&timekeeper_lock, flags);
         write_seqcount_begin(&tk_core.seq);
         ntp_init();
@@ -1552,13 +1580,10 @@ void __init timekeeping_init(void)
                 clock->enable(clock);
         tk_setup_internals(tk, clock);
 
-        tk_set_xtime(tk, &now);
+        tk_set_xtime(tk, &wall_time);
         tk->raw_sec = 0;
-        if (boot.tv_sec == 0 && boot.tv_nsec == 0)
-                boot = tk_xtime(tk);
 
-        set_normalized_timespec64(&tmp, -boot.tv_sec, -boot.tv_nsec);
-        tk_set_wall_to_mono(tk, tmp);
+        tk_set_wall_to_mono(tk, wall_to_mono);
 
         timekeeping_update(tk, TK_MIRROR | TK_CLOCK_WAS_SET);
 
@@ -1577,7 +1602,7 @@ static struct timespec64 timekeeping_suspend_time;
  * adds the sleep offset to the timekeeping variables.
  */
 static void __timekeeping_inject_sleeptime(struct timekeeper *tk,
-                                           struct timespec64 *delta)
+                                           const struct timespec64 *delta)
 {
         if (!timespec64_valid_strict(delta)) {
                 printk_deferred(KERN_WARNING
@@ -1610,7 +1635,7 @@ static void __timekeeping_inject_sleeptime(struct timekeeper *tk,
  */
 bool timekeeping_rtc_skipresume(void)
 {
-        return sleeptime_injected;
+        return !suspend_timing_needed;
 }
 
 /**
@@ -1638,7 +1663,7 @@ bool timekeeping_rtc_skipsuspend(void)
  * This function should only be called by rtc_resume(), and allows
  * a suspend offset to be injected into the timekeeping values.
  */
-void timekeeping_inject_sleeptime64(struct timespec64 *delta)
+void timekeeping_inject_sleeptime64(const struct timespec64 *delta)
 {
         struct timekeeper *tk = &tk_core.timekeeper;
         unsigned long flags;
@@ -1646,6 +1671,8 @@ void timekeeping_inject_sleeptime64(struct timespec64 *delta)
         raw_spin_lock_irqsave(&timekeeper_lock, flags);
         write_seqcount_begin(&tk_core.seq);
 
+        suspend_timing_needed = false;
+
         timekeeping_forward_now(tk);
 
         __timekeeping_inject_sleeptime(tk, delta);
@@ -1669,9 +1696,9 @@ void timekeeping_resume(void)
         struct clocksource *clock = tk->tkr_mono.clock;
         unsigned long flags;
         struct timespec64 ts_new, ts_delta;
-        u64 cycle_now;
+        u64 cycle_now, nsec;
+        bool inject_sleeptime = false;
 
-        sleeptime_injected = false;
         read_persistent_clock64(&ts_new);
 
         clockevents_resume();
@@ -1693,22 +1720,19 @@ void timekeeping_resume(void)
          * usable source. The rtc part is handled separately in rtc core code.
          */
         cycle_now = tk_clock_read(&tk->tkr_mono);
-        if ((clock->flags & CLOCK_SOURCE_SUSPEND_NONSTOP) &&
-                cycle_now > tk->tkr_mono.cycle_last) {
-                u64 nsec, cyc_delta;
-
-                cyc_delta = clocksource_delta(cycle_now, tk->tkr_mono.cycle_last,
-                                              tk->tkr_mono.mask);
-                nsec = mul_u64_u32_shr(cyc_delta, clock->mult, clock->shift);
+        nsec = clocksource_stop_suspend_timing(clock, cycle_now);
+        if (nsec > 0) {
                 ts_delta = ns_to_timespec64(nsec);
-                sleeptime_injected = true;
+                inject_sleeptime = true;
         } else if (timespec64_compare(&ts_new, &timekeeping_suspend_time) > 0) {
                 ts_delta = timespec64_sub(ts_new, timekeeping_suspend_time);
-                sleeptime_injected = true;
+                inject_sleeptime = true;
         }
 
-        if (sleeptime_injected)
+        if (inject_sleeptime) {
+                suspend_timing_needed = false;
                 __timekeeping_inject_sleeptime(tk, &ts_delta);
+        }
 
         /* Re-base the last cycle value */
         tk->tkr_mono.cycle_last = cycle_now;
@@ -1732,6 +1756,8 @@ int timekeeping_suspend(void)
         unsigned long flags;
         struct timespec64               delta, delta_delta;
         static struct timespec64        old_delta;
+        struct clocksource *curr_clock;
+        u64 cycle_now;
 
         read_persistent_clock64(&timekeeping_suspend_time);
 
@@ -1743,11 +1769,22 @@ int timekeeping_suspend(void)
         if (timekeeping_suspend_time.tv_sec || timekeeping_suspend_time.tv_nsec)
                 persistent_clock_exists = true;
 
+        suspend_timing_needed = true;
+
         raw_spin_lock_irqsave(&timekeeper_lock, flags);
         write_seqcount_begin(&tk_core.seq);
         timekeeping_forward_now(tk);
         timekeeping_suspended = 1;
 
+        /*
+         * Since we've called forward_now, cycle_last stores the value
+         * just read from the current clocksource. Save this to potentially
+         * use in suspend timing.
+         */
+        curr_clock = tk->tkr_mono.clock;
+        cycle_now = tk->tkr_mono.cycle_last;
+        clocksource_start_suspend_timing(curr_clock, cycle_now);
+
         if (persistent_clock_exists) {
                 /*
                  * To avoid drift caused by repeated suspend/resumes,
@@ -2021,11 +2058,11 @@ static u64 logarithmic_accumulation(struct timekeeper *tk, u64 offset,
         return offset;
 }
 
-/**
- * update_wall_time - Uses the current clocksource to increment the wall time
- *
+/*
+ * timekeeping_advance - Updates the timekeeper to the current time and
+ * current NTP tick length
  */
-void update_wall_time(void)
+static void timekeeping_advance(enum timekeeping_adv_mode mode)
 {
         struct timekeeper *real_tk = &tk_core.timekeeper;
         struct timekeeper *tk = &shadow_timekeeper;
@@ -2042,14 +2079,17 @@ void update_wall_time(void)
 
 #ifdef CONFIG_ARCH_USES_GETTIMEOFFSET
         offset = real_tk->cycle_interval;
+
+        if (mode != TK_ADV_TICK)
+                goto out;
 #else
         offset = clocksource_delta(tk_clock_read(&tk->tkr_mono),
                                    tk->tkr_mono.cycle_last, tk->tkr_mono.mask);
-#endif
 
         /* Check if there's really nothing to do */
-        if (offset < real_tk->cycle_interval)
+        if (offset < real_tk->cycle_interval && mode == TK_ADV_TICK)
                 goto out;
+#endif
 
         /* Do some additional sanity checking */
         timekeeping_check_update(tk, offset);
@@ -2106,6 +2146,15 @@ out:
 }
 
 /**
+ * update_wall_time - Uses the current clocksource to increment the wall time
+ *
+ */
+void update_wall_time(void)
+{
+        timekeeping_advance(TK_ADV_TICK);
+}
+
+/**
  * getboottime64 - Return the real time of system boot.
  * @ts:         pointer to the timespec64 to be set
  *
@@ -2220,7 +2269,7 @@ ktime_t ktime_get_update_offsets_now(unsigned int *cwsseq, ktime_t *offs_real,
 /**
  * timekeeping_validate_timex - Ensures the timex is ok for use in do_adjtimex
  */
-static int timekeeping_validate_timex(struct timex *txc)
+static int timekeeping_validate_timex(const struct timex *txc)
 {
         if (txc->modes & ADJ_ADJTIME) {
                 /* singleshot must not be used with any other mode bits */
@@ -2310,7 +2359,7 @@ int do_adjtimex(struct timex *txc)
                         return ret;
         }
 
-        getnstimeofday64(&ts);
+        ktime_get_real_ts64(&ts);
 
         raw_spin_lock_irqsave(&timekeeper_lock, flags);
         write_seqcount_begin(&tk_core.seq);
@@ -2327,6 +2376,10 @@ int do_adjtimex(struct timex *txc)
         write_seqcount_end(&tk_core.seq);
         raw_spin_unlock_irqrestore(&timekeeper_lock, flags);
 
+        /* Update the multiplier immediately if frequency was set directly */
+        if (txc->modes & (ADJ_FREQUENCY | ADJ_TICK))
+                timekeeping_advance(TK_ADV_FREQ);
+
         if (tai != orig_tai)
                 clock_was_set();
 
diff --git a/kernel/time/timekeeping_debug.c b/kernel/time/timekeeping_debug.c
index 0754cadfa9e6..238e4be60229 100644
--- a/kernel/time/timekeeping_debug.c
+++ b/kernel/time/timekeeping_debug.c
@@ -70,7 +70,7 @@ static int __init tk_debug_sleep_time_init(void)
 }
 late_initcall(tk_debug_sleep_time_init);
 
-void tk_debug_account_sleep_time(struct timespec64 *t)
+void tk_debug_account_sleep_time(const struct timespec64 *t)
 {
         /* Cap bin index so we don't overflow the array */
         int bin = min(fls(t->tv_sec), NUM_BINS-1);
diff --git a/kernel/time/timekeeping_internal.h b/kernel/time/timekeeping_internal.h
index cf5c0828ee31..bcbb52db2256 100644
--- a/kernel/time/timekeeping_internal.h
+++ b/kernel/time/timekeeping_internal.h
@@ -8,7 +8,7 @@
 #include <linux/time.h>
 
 #ifdef CONFIG_DEBUG_FS
-extern void tk_debug_account_sleep_time(struct timespec64 *t);
+extern void tk_debug_account_sleep_time(const struct timespec64 *t);
 #else
 #define tk_debug_account_sleep_time(x)
 #endif
diff --git a/kernel/time/timer.c b/kernel/time/timer.c
index cc2d23e6ff61..fa49cd753dea 100644
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -581,7 +581,7 @@ trigger_dyntick_cpu(struct timer_base *base, struct timer_list *timer)
          * wheel:
          */
         base->next_expiry = timer->expires;
-                wake_up_nohz_cpu(base->cpu);
+        wake_up_nohz_cpu(base->cpu);
 }
 
 static void
@@ -1657,6 +1657,22 @@ static inline void __run_timers(struct timer_base *base)
 
         raw_spin_lock_irq(&base->lock);
 
+        /*
+         * timer_base::must_forward_clk must be cleared before running
+         * timers so that any timer functions that call mod_timer() will
+         * not try to forward the base. Idle tracking / clock forwarding
+         * logic is only used with BASE_STD timers.
+         *
+         * The must_forward_clk flag is cleared unconditionally also for
+         * the deferrable base. The deferrable base is not affected by idle
+         * tracking and never forwarded, so clearing the flag is a NOOP.
+         *
+         * The fact that the deferrable base is never forwarded can cause
+         * large variations in granularity for deferrable timers, but they
+         * can be deferred for long periods due to idle anyway.
+         */
+        base->must_forward_clk = false;
+
         while (time_after_eq(jiffies, base->clk)) {
 
                 levels = collect_expired_timers(base, heads);
@@ -1676,19 +1692,6 @@ static __latent_entropy void run_timer_softirq(struct softirq_action *h)
 {
         struct timer_base *base = this_cpu_ptr(&timer_bases[BASE_STD]);
 
-        /*
-         * must_forward_clk must be cleared before running timers so that any
-         * timer functions that call mod_timer will not try to forward the
-         * base. idle trcking / clock forwarding logic is only used with
-         * BASE_STD timers.
-         *
-         * The deferrable base does not do idle tracking at all, so we do
-         * not forward it. This can result in very large variations in
-         * granularity for deferrable timers, but they can be deferred for
-         * long periods due to idle.
-         */
-        base->must_forward_clk = false;
-
         __run_timers(base);
         if (IS_ENABLED(CONFIG_NO_HZ_COMMON))
                 __run_timers(this_cpu_ptr(&timer_bases[BASE_DEF]));
diff --git a/kernel/torture.c b/kernel/torture.c
index 3de1efbecd6a..1ac24a826589 100644
--- a/kernel/torture.c
+++ b/kernel/torture.c
@@ -20,6 +20,9 @@
  * Author: Paul E. McKenney <paulmck@us.ibm.com>
  *      Based on kernel/rcu/torture.c.
  */
+
+#define pr_fmt(fmt) fmt
+
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -53,7 +56,7 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Paul E. McKenney <paulmck@us.ibm.com>");
 
 static char *torture_type;
-static bool verbose;
+static int verbose;
 
 /* Mediate rmmod and system shutdown.  Concurrent rmmod & shutdown illegal! */
 #define FULLSTOP_DONTSTOP 0     /* Normal operation. */
@@ -98,7 +101,7 @@ bool torture_offline(int cpu, long *n_offl_attempts, long *n_offl_successes,
         if (!cpu_online(cpu) || !cpu_is_hotpluggable(cpu))
                 return false;
 
-        if (verbose)
+        if (verbose > 1)
                 pr_alert("%s" TORTURE_FLAG
                          "torture_onoff task: offlining %d\n",
                          torture_type, cpu);
@@ -111,7 +114,7 @@ bool torture_offline(int cpu, long *n_offl_attempts, long *n_offl_successes,
                                  "torture_onoff task: offline %d failed: errno %d\n",
                                  torture_type, cpu, ret);
         } else {
-                if (verbose)
+                if (verbose > 1)
                         pr_alert("%s" TORTURE_FLAG
                                  "torture_onoff task: offlined %d\n",
                                  torture_type, cpu);
@@ -147,7 +150,7 @@ bool torture_online(int cpu, long *n_onl_attempts, long *n_onl_successes,
         if (cpu_online(cpu) || !cpu_is_hotpluggable(cpu))
                 return false;
 
-        if (verbose)
+        if (verbose > 1)
                 pr_alert("%s" TORTURE_FLAG
                          "torture_onoff task: onlining %d\n",
                          torture_type, cpu);
@@ -160,7 +163,7 @@ bool torture_online(int cpu, long *n_onl_attempts, long *n_onl_successes,
                                  "torture_onoff task: online %d failed: errno %d\n",
                                  torture_type, cpu, ret);
         } else {
-                if (verbose)
+                if (verbose > 1)
                         pr_alert("%s" TORTURE_FLAG
                                  "torture_onoff task: onlined %d\n",
                                  torture_type, cpu);
@@ -647,7 +650,7 @@ static void torture_stutter_cleanup(void)
  * The runnable parameter points to a flag that controls whether or not
  * the test is currently runnable.  If there is no such flag, pass in NULL.
  */
-bool torture_init_begin(char *ttype, bool v)
+bool torture_init_begin(char *ttype, int v)
 {
         mutex_lock(&fullstop_mutex);
         if (torture_type != NULL) {
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 576d18045811..5470dce212c0 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -18,18 +18,14 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/sysctl.h>
-#include <linux/smpboot.h>
-#include <linux/sched/rt.h>
-#include <uapi/linux/sched/types.h>
 #include <linux/tick.h>
-#include <linux/workqueue.h>
 #include <linux/sched/clock.h>
 #include <linux/sched/debug.h>
 #include <linux/sched/isolation.h>
+#include <linux/stop_machine.h>
 
 #include <asm/irq_regs.h>
 #include <linux/kvm_para.h>
-#include <linux/kthread.h>
 
 static DEFINE_MUTEX(watchdog_mutex);
 
@@ -169,11 +165,10 @@ static void lockup_detector_update_enable(void)
 unsigned int __read_mostly softlockup_panic =
                         CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE;
 
-static bool softlockup_threads_initialized __read_mostly;
+static bool softlockup_initialized __read_mostly;
 static u64 __read_mostly sample_period;
 
 static DEFINE_PER_CPU(unsigned long, watchdog_touch_ts);
-static DEFINE_PER_CPU(struct task_struct *, softlockup_watchdog);
 static DEFINE_PER_CPU(struct hrtimer, watchdog_hrtimer);
 static DEFINE_PER_CPU(bool, softlockup_touch_sync);
 static DEFINE_PER_CPU(bool, soft_watchdog_warn);
@@ -335,6 +330,27 @@ static void watchdog_interrupt_count(void)
         __this_cpu_inc(hrtimer_interrupts);
 }
 
+static DEFINE_PER_CPU(struct completion, softlockup_completion);
+static DEFINE_PER_CPU(struct cpu_stop_work, softlockup_stop_work);
+
+/*
+ * The watchdog thread function - touches the timestamp.
+ *
+ * It only runs once every sample_period seconds (4 seconds by
+ * default) to reset the softlockup timestamp. If this gets delayed
+ * for more than 2*watchdog_thresh seconds then the debug-printout
+ * triggers in watchdog_timer_fn().
+ */
+static int softlockup_fn(void *data)
+{
+        __this_cpu_write(soft_lockup_hrtimer_cnt,
+                         __this_cpu_read(hrtimer_interrupts));
+        __touch_watchdog();
+        complete(this_cpu_ptr(&softlockup_completion));
+
+        return 0;
+}
+
 /* watchdog kicker functions */
 static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
 {
@@ -350,7 +366,12 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
         watchdog_interrupt_count();
 
         /* kick the softlockup detector */
-        wake_up_process(__this_cpu_read(softlockup_watchdog));
+        if (completion_done(this_cpu_ptr(&softlockup_completion))) {
+                reinit_completion(this_cpu_ptr(&softlockup_completion));
+                stop_one_cpu_nowait(smp_processor_id(),
+                                softlockup_fn, NULL,
+                                this_cpu_ptr(&softlockup_stop_work));
+        }
 
         /* .. and repeat */
         hrtimer_forward_now(hrtimer, ns_to_ktime(sample_period));
@@ -448,16 +469,15 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
         return HRTIMER_RESTART;
 }
 
-static void watchdog_set_prio(unsigned int policy, unsigned int prio)
-{
-        struct sched_param param = { .sched_priority = prio };
-
-        sched_setscheduler(current, policy, &param);
-}
-
 static void watchdog_enable(unsigned int cpu)
 {
         struct hrtimer *hrtimer = this_cpu_ptr(&watchdog_hrtimer);
+        struct completion *done = this_cpu_ptr(&softlockup_completion);
+
+        WARN_ON_ONCE(cpu != smp_processor_id());
+
+        init_completion(done);
+        complete(done);
 
         /*
          * Start the timer first to prevent the NMI watchdog triggering
@@ -473,15 +493,14 @@ static void watchdog_enable(unsigned int cpu)
         /* Enable the perf event */
         if (watchdog_enabled & NMI_WATCHDOG_ENABLED)
                 watchdog_nmi_enable(cpu);
-
-        watchdog_set_prio(SCHED_FIFO, MAX_RT_PRIO - 1);
 }
 
 static void watchdog_disable(unsigned int cpu)
 {
         struct hrtimer *hrtimer = this_cpu_ptr(&watchdog_hrtimer);
 
-        watchdog_set_prio(SCHED_NORMAL, 0);
+        WARN_ON_ONCE(cpu != smp_processor_id());
+
         /*
          * Disable the perf event first. That prevents that a large delay
          * between disabling the timer and disabling the perf event causes
@@ -489,79 +508,66 @@ static void watchdog_disable(unsigned int cpu)
          */
         watchdog_nmi_disable(cpu);
         hrtimer_cancel(hrtimer);
+        wait_for_completion(this_cpu_ptr(&softlockup_completion));
 }
 
-static void watchdog_cleanup(unsigned int cpu, bool online)
+static int softlockup_stop_fn(void *data)
 {
-        watchdog_disable(cpu);
+        watchdog_disable(smp_processor_id());
+        return 0;
 }
 
-static int watchdog_should_run(unsigned int cpu)
+static void softlockup_stop_all(void)
 {
-        return __this_cpu_read(hrtimer_interrupts) !=
-                __this_cpu_read(soft_lockup_hrtimer_cnt);
+        int cpu;
+
+        if (!softlockup_initialized)
+                return;
+
+        for_each_cpu(cpu, &watchdog_allowed_mask)
+                smp_call_on_cpu(cpu, softlockup_stop_fn, NULL, false);
+
+        cpumask_clear(&watchdog_allowed_mask);
 }
 
-/*
- * The watchdog thread function - touches the timestamp.
- *
- * It only runs once every sample_period seconds (4 seconds by
- * default) to reset the softlockup timestamp. If this gets delayed
- * for more than 2*watchdog_thresh seconds then the debug-printout
- * triggers in watchdog_timer_fn().
- */
-static void watchdog(unsigned int cpu)
+static int softlockup_start_fn(void *data)
 {
-        __this_cpu_write(soft_lockup_hrtimer_cnt,
-                         __this_cpu_read(hrtimer_interrupts));
-        __touch_watchdog();
+        watchdog_enable(smp_processor_id());
+        return 0;
 }
 
-static struct smp_hotplug_thread watchdog_threads = {
-        .store                  = &softlockup_watchdog,
-        .thread_should_run      = watchdog_should_run,
-        .thread_fn              = watchdog,
-        .thread_comm            = "watchdog/%u",
-        .setup                  = watchdog_enable,
-        .cleanup                = watchdog_cleanup,
-        .park                   = watchdog_disable,
-        .unpark                 = watchdog_enable,
-};
-
-static void softlockup_update_smpboot_threads(void)
+static void softlockup_start_all(void)
 {
-        lockdep_assert_held(&watchdog_mutex);
-
-        if (!softlockup_threads_initialized)
-                return;
+        int cpu;
 
-        smpboot_update_cpumask_percpu_thread(&watchdog_threads,
-                                             &watchdog_allowed_mask);
+        cpumask_copy(&watchdog_allowed_mask, &watchdog_cpumask);
+        for_each_cpu(cpu, &watchdog_allowed_mask)
+                smp_call_on_cpu(cpu, softlockup_start_fn, NULL, false);
 }
 
-/* Temporarily park all watchdog threads */
-static void softlockup_park_all_threads(void)
+int lockup_detector_online_cpu(unsigned int cpu)
 {
-        cpumask_clear(&watchdog_allowed_mask);
-        softlockup_update_smpboot_threads();
+        watchdog_enable(cpu);
+        return 0;
 }
 
-/* Unpark enabled threads */
-static void softlockup_unpark_threads(void)
+int lockup_detector_offline_cpu(unsigned int cpu)
 {
-        cpumask_copy(&watchdog_allowed_mask, &watchdog_cpumask);
-        softlockup_update_smpboot_threads();
+        watchdog_disable(cpu);
+        return 0;
 }
 
 static void lockup_detector_reconfigure(void)
 {
         cpus_read_lock();
         watchdog_nmi_stop();
-        softlockup_park_all_threads();
+
+        softlockup_stop_all();
         set_sample_period();
         lockup_detector_update_enable();
         if (watchdog_enabled && watchdog_thresh)
-                softlockup_unpark_threads();
+                softlockup_start_all();
+
         watchdog_nmi_start();
         cpus_read_unlock();
         /*
@@ -580,8 +586,6 @@ static void lockup_detector_reconfigure(void)
  */
 static __init void lockup_detector_setup(void)
 {
-        int ret;
-
         /*
          * If sysctl is off and watchdog got disabled on the command line,
          * nothing to do here.
@@ -592,24 +596,13 @@ static __init void lockup_detector_setup(void)
             !(watchdog_enabled && watchdog_thresh))
                 return;
 
-        ret = smpboot_register_percpu_thread_cpumask(&watchdog_threads,
-                                                     &watchdog_allowed_mask);
-        if (ret) {
-                pr_err("Failed to initialize soft lockup detector threads\n");
-                return;
-        }
-
         mutex_lock(&watchdog_mutex);
-        softlockup_threads_initialized = true;
         lockup_detector_reconfigure();
+        softlockup_initialized = true;
         mutex_unlock(&watchdog_mutex);
 }
 
 #else /* CONFIG_SOFTLOCKUP_DETECTOR */
-static inline int watchdog_park_threads(void) { return 0; }
-static inline void watchdog_unpark_threads(void) { }
-static inline int watchdog_enable_all_cpus(void) { return 0; }
-static inline void watchdog_disable_all_cpus(void) { }
 static void lockup_detector_reconfigure(void)
 {
         cpus_read_lock();
diff --git a/kernel/watchdog_hld.c b/kernel/watchdog_hld.c
index e449a23e9d59..1f7020d65d0a 100644
--- a/kernel/watchdog_hld.c
+++ b/kernel/watchdog_hld.c
@@ -175,8 +175,8 @@ static int hardlockup_detector_event_create(void)
         evt = perf_event_create_kernel_counter(wd_attr, cpu, NULL,
                                                watchdog_overflow_callback, NULL);
         if (IS_ERR(evt)) {
-                pr_info("Perf event create on CPU %d failed with %ld\n", cpu,
-                        PTR_ERR(evt));
+                pr_debug("Perf event create on CPU %d failed with %ld\n", cpu,
+                         PTR_ERR(evt));
                 return PTR_ERR(evt);
         }
         this_cpu_write(watchdog_ev, evt);
diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan
index 19d42ea75ec2..98fa559ebd80 100644
--- a/lib/Kconfig.ubsan
+++ b/lib/Kconfig.ubsan
@@ -1,9 +1,6 @@
 config ARCH_HAS_UBSAN_SANITIZE_ALL
         bool
 
-config ARCH_WANTS_UBSAN_NO_NULL
-        def_bool n
-
 config UBSAN
         bool "Undefined behaviour sanity checker"
         help
@@ -39,14 +36,6 @@ config UBSAN_ALIGNMENT
           Enabling this option on architectures that support unaligned
           accesses may produce a lot of false positives.
 
-config UBSAN_NULL
-        bool "Enable checking of null pointers"
-        depends on UBSAN
-        default y if !ARCH_WANTS_UBSAN_NO_NULL
-        help
-          This option enables detection of memory accesses via a
-          null pointer.
-
 config TEST_UBSAN
         tristate "Module for testing for undefined behavior detection"
         depends on m && UBSAN
diff --git a/lib/atomic64.c b/lib/atomic64.c
index 53c2d5edc826..1d91e31eceec 100644
--- a/lib/atomic64.c
+++ b/lib/atomic64.c
@@ -178,18 +178,18 @@ long long atomic64_xchg(atomic64_t *v, long long new)
 }
 EXPORT_SYMBOL(atomic64_xchg);
 
-int atomic64_add_unless(atomic64_t *v, long long a, long long u)
+long long atomic64_fetch_add_unless(atomic64_t *v, long long a, long long u)
 {
         unsigned long flags;
         raw_spinlock_t *lock = lock_addr(v);
-        int ret = 0;
+        long long val;
 
         raw_spin_lock_irqsave(lock, flags);
-        if (v->counter != u) {
+        val = v->counter;
+        if (val != u)
                 v->counter += a;
-                ret = 1;
-        }
         raw_spin_unlock_irqrestore(lock, flags);
-        return ret;
+
+        return val;
 }
-EXPORT_SYMBOL(atomic64_add_unless);
+EXPORT_SYMBOL(atomic64_fetch_add_unless);
diff --git a/lib/debugobjects.c b/lib/debugobjects.c
index 994be4805cec..70935ed91125 100644
--- a/lib/debugobjects.c
+++ b/lib/debugobjects.c
@@ -360,9 +360,12 @@ static void debug_object_is_on_stack(void *addr, int onstack)
 
         limit++;
         if (is_on_stack)
-                pr_warn("object is on stack, but not annotated\n");
+                pr_warn("object %p is on stack %p, but NOT annotated.\n", addr,
+                         task_stack_page(current));
         else
-                pr_warn("object is not on stack, but annotated\n");
+                pr_warn("object %p is NOT on stack %p, but annotated.\n", addr,
+                         task_stack_page(current));
+
         WARN_ON(1);
 }
 
@@ -1185,8 +1188,7 @@ void __init debug_objects_mem_init(void)
 
         if (!obj_cache || debug_objects_replace_static_objects()) {
                 debug_objects_enabled = 0;
-                if (obj_cache)
-                        kmem_cache_destroy(obj_cache);
+                kmem_cache_destroy(obj_cache);
                 pr_warn("out of memory.\n");
         } else
                 debug_objects_selftest();
diff --git a/lib/ioremap.c b/lib/ioremap.c
index 54e5bbaa3200..517f5853ffed 100644
--- a/lib/ioremap.c
+++ b/lib/ioremap.c
@@ -92,7 +92,7 @@ static inline int ioremap_pmd_range(pud_t *pud, unsigned long addr,
                 if (ioremap_pmd_enabled() &&
                     ((next - addr) == PMD_SIZE) &&
                     IS_ALIGNED(phys_addr + addr, PMD_SIZE) &&
-                    pmd_free_pte_page(pmd)) {
+                    pmd_free_pte_page(pmd, addr)) {
                         if (pmd_set_huge(pmd, phys_addr + addr, prot))
                                 continue;
                 }
@@ -119,7 +119,7 @@ static inline int ioremap_pud_range(p4d_t *p4d, unsigned long addr,
                 if (ioremap_pud_enabled() &&
                     ((next - addr) == PUD_SIZE) &&
                     IS_ALIGNED(phys_addr + addr, PUD_SIZE) &&
-                    pud_free_pmd_page(pud)) {
+                    pud_free_pmd_page(pud, addr)) {
                         if (pud_set_huge(pud, phys_addr + addr, prot))
                                 continue;
                 }
diff --git a/lib/refcount.c b/lib/refcount.c
index d3b81cefce91..ebcf8cd49e05 100644
--- a/lib/refcount.c
+++ b/lib/refcount.c
@@ -35,13 +35,13 @@
  *
  */
 
+#include <linux/mutex.h>
 #include <linux/refcount.h>
+#include <linux/spinlock.h>
 #include <linux/bug.h>
 
-#ifdef CONFIG_REFCOUNT_FULL
-
 /**
- * refcount_add_not_zero - add a value to a refcount unless it is 0
+ * refcount_add_not_zero_checked - add a value to a refcount unless it is 0
  * @i: the value to add to the refcount
  * @r: the refcount
  *
@@ -58,7 +58,7 @@
  *
  * Return: false if the passed refcount is 0, true otherwise
  */
-bool refcount_add_not_zero(unsigned int i, refcount_t *r)
+bool refcount_add_not_zero_checked(unsigned int i, refcount_t *r)
 {
         unsigned int new, val = atomic_read(&r->refs);
 
@@ -79,10 +79,10 @@ bool refcount_add_not_zero(unsigned int i, refcount_t *r)
 
         return true;
 }
-EXPORT_SYMBOL(refcount_add_not_zero);
+EXPORT_SYMBOL(refcount_add_not_zero_checked);
 
 /**
- * refcount_add - add a value to a refcount
+ * refcount_add_checked - add a value to a refcount
  * @i: the value to add to the refcount
  * @r: the refcount
  *
@@ -97,14 +97,14 @@ EXPORT_SYMBOL(refcount_add_not_zero);
  * cases, refcount_inc(), or one of its variants, should instead be used to
  * increment a reference count.
  */
-void refcount_add(unsigned int i, refcount_t *r)
+void refcount_add_checked(unsigned int i, refcount_t *r)
 {
-        WARN_ONCE(!refcount_add_not_zero(i, r), "refcount_t: addition on 0; use-after-free.\n");
+        WARN_ONCE(!refcount_add_not_zero_checked(i, r), "refcount_t: addition on 0; use-after-free.\n");
 }
-EXPORT_SYMBOL(refcount_add);
+EXPORT_SYMBOL(refcount_add_checked);
 
 /**
- * refcount_inc_not_zero - increment a refcount unless it is 0
+ * refcount_inc_not_zero_checked - increment a refcount unless it is 0
  * @r: the refcount to increment
  *
  * Similar to atomic_inc_not_zero(), but will saturate at UINT_MAX and WARN.
@@ -115,7 +115,7 @@ EXPORT_SYMBOL(refcount_add);
  *
  * Return: true if the increment was successful, false otherwise
  */
-bool refcount_inc_not_zero(refcount_t *r)
+bool refcount_inc_not_zero_checked(refcount_t *r)
 {
         unsigned int new, val = atomic_read(&r->refs);
 
@@ -134,10 +134,10 @@ bool refcount_inc_not_zero(refcount_t *r)
 
         return true;
 }
-EXPORT_SYMBOL(refcount_inc_not_zero);
+EXPORT_SYMBOL(refcount_inc_not_zero_checked);
 
 /**
- * refcount_inc - increment a refcount
+ * refcount_inc_checked - increment a refcount
  * @r: the refcount to increment
  *
  * Similar to atomic_inc(), but will saturate at UINT_MAX and WARN.
@@ -148,14 +148,14 @@ EXPORT_SYMBOL(refcount_inc_not_zero);
  * Will WARN if the refcount is 0, as this represents a possible use-after-free
  * condition.
  */
-void refcount_inc(refcount_t *r)
+void refcount_inc_checked(refcount_t *r)
 {
-        WARN_ONCE(!refcount_inc_not_zero(r), "refcount_t: increment on 0; use-after-free.\n");
+        WARN_ONCE(!refcount_inc_not_zero_checked(r), "refcount_t: increment on 0; use-after-free.\n");
 }
-EXPORT_SYMBOL(refcount_inc);
+EXPORT_SYMBOL(refcount_inc_checked);
 
 /**
- * refcount_sub_and_test - subtract from a refcount and test if it is 0
+ * refcount_sub_and_test_checked - subtract from a refcount and test if it is 0
  * @i: amount to subtract from the refcount
  * @r: the refcount
  *
@@ -174,7 +174,7 @@ EXPORT_SYMBOL(refcount_inc);
  *
  * Return: true if the resulting refcount is 0, false otherwise
  */
-bool refcount_sub_and_test(unsigned int i, refcount_t *r)
+bool refcount_sub_and_test_checked(unsigned int i, refcount_t *r)
 {
         unsigned int new, val = atomic_read(&r->refs);
 
@@ -192,10 +192,10 @@ bool refcount_sub_and_test(unsigned int i, refcount_t *r)
 
         return !new;
 }
-EXPORT_SYMBOL(refcount_sub_and_test);
+EXPORT_SYMBOL(refcount_sub_and_test_checked);
 
 /**
- * refcount_dec_and_test - decrement a refcount and test if it is 0
+ * refcount_dec_and_test_checked - decrement a refcount and test if it is 0
  * @r: the refcount
  *
  * Similar to atomic_dec_and_test(), it will WARN on underflow and fail to
@@ -207,14 +207,14 @@ EXPORT_SYMBOL(refcount_sub_and_test);
  *
  * Return: true if the resulting refcount is 0, false otherwise
  */
-bool refcount_dec_and_test(refcount_t *r)
+bool refcount_dec_and_test_checked(refcount_t *r)
 {
-        return refcount_sub_and_test(1, r);
+        return refcount_sub_and_test_checked(1, r);
 }
-EXPORT_SYMBOL(refcount_dec_and_test);
+EXPORT_SYMBOL(refcount_dec_and_test_checked);
 
 /**
- * refcount_dec - decrement a refcount
+ * refcount_dec_checked - decrement a refcount
  * @r: the refcount
  *
  * Similar to atomic_dec(), it will WARN on underflow and fail to decrement
@@ -223,12 +223,11 @@ EXPORT_SYMBOL(refcount_dec_and_test);
  * Provides release memory ordering, such that prior loads and stores are done
  * before.
  */
-void refcount_dec(refcount_t *r)
+void refcount_dec_checked(refcount_t *r)
 {
-        WARN_ONCE(refcount_dec_and_test(r), "refcount_t: decrement hit 0; leaking memory.\n");
+        WARN_ONCE(refcount_dec_and_test_checked(r), "refcount_t: decrement hit 0; leaking memory.\n");
 }
-EXPORT_SYMBOL(refcount_dec);
-#endif /* CONFIG_REFCOUNT_FULL */
+EXPORT_SYMBOL(refcount_dec_checked);
 
 /**
  * refcount_dec_if_one - decrement a refcount if it is 1
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 039ddbc574e9..3103099f64fd 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3167,6 +3167,13 @@ static vm_fault_t hugetlb_vm_op_fault(struct vm_fault *vmf)
         return 0;
 }
 
+/*
+ * When a new function is introduced to vm_operations_struct and added
+ * to hugetlb_vm_ops, please consider adding the function to shm_vm_ops.
+ * This is because under System V memory model, mappings created via
+ * shmget/shmat with "huge page" specified are backed by hugetlbfs files,
+ * their original vm_ops are overwritten with shm_vm_ops.
+ */
 const struct vm_operations_struct hugetlb_vm_ops = {
         .fault = hugetlb_vm_op_fault,
         .open = hugetlb_vm_op_open,
diff --git a/mm/init-mm.c b/mm/init-mm.c
index f0179c9c04c2..a787a319211e 100644
--- a/mm/init-mm.c
+++ b/mm/init-mm.c
@@ -15,6 +15,16 @@
 #define INIT_MM_CONTEXT(name)
 #endif
 
+/*
+ * For dynamically allocated mm_structs, there is a dynamically sized cpumask
+ * at the end of the structure, the size of which depends on the maximum CPU
+ * number the system can see. That way we allocate only as much memory for
+ * mm_cpumask() as needed for the hundreds, or thousands of processes that
+ * a system typically runs.
+ *
+ * Since there is only one init_mm in the entire system, keep it simple
+ * and size this cpu_bitmask to NR_CPUS.
+ */
 struct mm_struct init_mm = {
         .mm_rb          = RB_ROOT,
         .pgd            = swapper_pg_dir,
@@ -25,5 +35,6 @@ struct mm_struct init_mm = {
         .arg_lock       =  __SPIN_LOCK_UNLOCKED(init_mm.arg_lock),
         .mmlist         = LIST_HEAD_INIT(init_mm.mmlist),
         .user_ns        = &init_user_ns,
+        .cpu_bitmap     = { [BITS_TO_LONGS(NR_CPUS)] = 0},
         INIT_MM_CONTEXT(init_mm)
 };
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 8c0280b3143e..b2173f7e5164 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4037,6 +4037,14 @@ static struct cftype mem_cgroup_legacy_files[] = {
 
 static DEFINE_IDR(mem_cgroup_idr);
 
+static void mem_cgroup_id_remove(struct mem_cgroup *memcg)
+{
+        if (memcg->id.id > 0) {
+                idr_remove(&mem_cgroup_idr, memcg->id.id);
+                memcg->id.id = 0;
+        }
+}
+
 static void mem_cgroup_id_get_many(struct mem_cgroup *memcg, unsigned int n)
 {
         VM_BUG_ON(atomic_read(&memcg->id.ref) <= 0);
@@ -4047,8 +4055,7 @@ static void mem_cgroup_id_put_many(struct mem_cgroup *memcg, unsigned int n)
 {
         VM_BUG_ON(atomic_read(&memcg->id.ref) < n);
         if (atomic_sub_and_test(n, &memcg->id.ref)) {
-                idr_remove(&mem_cgroup_idr, memcg->id.id);
-                memcg->id.id = 0;
+                mem_cgroup_id_remove(memcg);
 
                 /* Memcg ID pins CSS */
                 css_put(&memcg->css);
@@ -4185,8 +4192,7 @@ static struct mem_cgroup *mem_cgroup_alloc(void)
         idr_replace(&mem_cgroup_idr, memcg, memcg->id.id);
         return memcg;
 fail:
-        if (memcg->id.id > 0)
-                idr_remove(&mem_cgroup_idr, memcg->id.id);
+        mem_cgroup_id_remove(memcg);
         __mem_cgroup_free(memcg);
         return NULL;
 }
@@ -4245,6 +4251,7 @@ mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css)
 
         return &memcg->css;
 fail:
+        mem_cgroup_id_remove(memcg);
         mem_cgroup_free(memcg);
         return ERR_PTR(-ENOMEM);
 }
diff --git a/mm/memory.c b/mm/memory.c
index 7206a634270b..3d0a74ab70f2 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -326,16 +326,20 @@ bool __tlb_remove_page_size(struct mmu_gather *tlb, struct page *page, int page_
 
 #ifdef CONFIG_HAVE_RCU_TABLE_FREE
 
-/*
- * See the comment near struct mmu_table_batch.
- */
-
 static void tlb_remove_table_smp_sync(void *arg)
 {
-        /* Simply deliver the interrupt */
+        struct mm_struct __maybe_unused *mm = arg;
+        /*
+         * On most architectures this does nothing. Simply delivering the
+         * interrupt is enough to prevent races with software page table
+         * walking like that done in get_user_pages_fast.
+         *
+         * See the comment near struct mmu_table_batch.
+         */
+        tlb_flush_remove_tables_local(mm);
 }
 
-static void tlb_remove_table_one(void *table)
+static void tlb_remove_table_one(void *table, struct mmu_gather *tlb)
 {
         /*
          * This isn't an RCU grace period and hence the page-tables cannot be
@@ -344,7 +348,7 @@ static void tlb_remove_table_one(void *table)
          * It is however sufficient for software page-table walkers that rely on
          * IRQ disabling. See the comment near struct mmu_table_batch.
          */
-        smp_call_function(tlb_remove_table_smp_sync, NULL, 1);
+        smp_call_function(tlb_remove_table_smp_sync, tlb->mm, 1);
         __tlb_remove_table(table);
 }
 
@@ -365,6 +369,8 @@ void tlb_table_flush(struct mmu_gather *tlb)
 {
         struct mmu_table_batch **batch = &tlb->batch;
 
+        tlb_flush_remove_tables(tlb->mm);
+
         if (*batch) {
                 call_rcu_sched(&(*batch)->rcu, tlb_remove_table_rcu);
                 *batch = NULL;
@@ -387,7 +393,7 @@ void tlb_remove_table(struct mmu_gather *tlb, void *table)
         if (*batch == NULL) {
                 *batch = (struct mmu_table_batch *)__get_free_page(GFP_NOWAIT | __GFP_NOWARN);
                 if (*batch == NULL) {
-                        tlb_remove_table_one(table);
+                        tlb_remove_table_one(table, tlb);
                         return;
                 }
                 (*batch)->nr = 0;
@@ -1417,11 +1423,9 @@ static inline unsigned long zap_pmd_range(struct mmu_gather *tlb,
         do {
                 next = pmd_addr_end(addr, end);
                 if (is_swap_pmd(*pmd) || pmd_trans_huge(*pmd) || pmd_devmap(*pmd)) {
-                        if (next - addr != HPAGE_PMD_SIZE) {
-                                VM_BUG_ON_VMA(vma_is_anonymous(vma) &&
-                                    !rwsem_is_locked(&tlb->mm->mmap_sem), vma);
+                        if (next - addr != HPAGE_PMD_SIZE)
                                 __split_huge_pmd(vma, pmd, addr, false, NULL);
-                        } else if (zap_huge_pmd(tlb, vma, pmd, addr))
+                        else if (zap_huge_pmd(tlb, vma, pmd, addr))
                                 goto next;
                         /* fall through */
                 }
@@ -4397,6 +4401,9 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
                 return -EINVAL;
 
         maddr = ioremap_prot(phys_addr, PAGE_ALIGN(len + offset), prot);
+        if (!maddr)
+                return -ENOMEM;
+
         if (write)
                 memcpy_toio(maddr + offset, buf, len);
         else
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index a790ef4be74e..3222193c46c6 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -6939,9 +6939,21 @@ unsigned long free_reserved_area(void *start, void *end, int poison, char *s)
         start = (void *)PAGE_ALIGN((unsigned long)start);
         end = (void *)((unsigned long)end & PAGE_MASK);
         for (pos = start; pos < end; pos += PAGE_SIZE, pages++) {
+                struct page *page = virt_to_page(pos);
+                void *direct_map_addr;
+
+                /*
+                 * 'direct_map_addr' might be different from 'pos'
+                 * because some architectures' virt_to_page()
+                 * work with aliases.  Getting the direct map
+                 * address ensures that we get a _writeable_
+                 * alias for the memset().
+                 */
+                direct_map_addr = page_address(page);
                 if ((unsigned int)poison <= 0xFF)
-                        memset(pos, poison, PAGE_SIZE);
-                free_reserved_page(virt_to_page(pos));
+                        memset(direct_map_addr, poison, PAGE_SIZE);
+
+                free_reserved_page(page);
         }
 
         if (pages && s)
diff --git a/net/atm/pppoatm.c b/net/atm/pppoatm.c
index af8c4b38b746..d84227d75717 100644
--- a/net/atm/pppoatm.c
+++ b/net/atm/pppoatm.c
@@ -244,7 +244,7 @@ static int pppoatm_may_send(struct pppoatm_vcc *pvcc, int size)
          * the packet count limit, so...
          */
         if (atm_may_send(pvcc->atmvcc, size) &&
-            atomic_inc_not_zero_hint(&pvcc->inflight, NONE_INFLIGHT))
+            atomic_inc_not_zero(&pvcc->inflight))
                 return 1;
 
         /*
diff --git a/net/core/dev.c b/net/core/dev.c
index a5aa1c7444e6..559a91271f82 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -7149,16 +7149,19 @@ int dev_change_tx_queue_len(struct net_device *dev, unsigned long new_len)
                 dev->tx_queue_len = new_len;
                 res = call_netdevice_notifiers(NETDEV_CHANGE_TX_QUEUE_LEN, dev);
                 res = notifier_to_errno(res);
-                if (res) {
-                        netdev_err(dev,
-                                   "refused to change device tx_queue_len\n");
-                        dev->tx_queue_len = orig_len;
-                        return res;
-                }
-                return dev_qdisc_change_tx_queue_len(dev);
+                if (res)
+                        goto err_rollback;
+                res = dev_qdisc_change_tx_queue_len(dev);
+                if (res)
+                        goto err_rollback;
         }
 
         return 0;
+
+err_rollback:
+        netdev_err(dev, "refused to change device tx_queue_len\n");
+        dev->tx_queue_len = orig_len;
+        return res;
 }
 
 /**
diff --git a/net/core/filter.c b/net/core/filter.c
index 06da770f543f..9dfd145eedcc 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -1712,24 +1712,26 @@ static const struct bpf_func_proto bpf_skb_load_bytes_proto = {
 BPF_CALL_5(bpf_skb_load_bytes_relative, const struct sk_buff *, skb,
            u32, offset, void *, to, u32, len, u32, start_header)
 {
+        u8 *end = skb_tail_pointer(skb);
+        u8 *net = skb_network_header(skb);
+        u8 *mac = skb_mac_header(skb);
         u8 *ptr;
 
-        if (unlikely(offset > 0xffff || len > skb_headlen(skb)))
+        if (unlikely(offset > 0xffff || len > (end - mac)))
                 goto err_clear;
 
         switch (start_header) {
         case BPF_HDR_START_MAC:
-                ptr = skb_mac_header(skb) + offset;
+                ptr = mac + offset;
                 break;
         case BPF_HDR_START_NET:
-                ptr = skb_network_header(skb) + offset;
+                ptr = net + offset;
                 break;
         default:
                 goto err_clear;
         }
 
-        if (likely(ptr >= skb_mac_header(skb) &&
-                   ptr + len <= skb_tail_pointer(skb))) {
+        if (likely(ptr >= mac && ptr + len <= end)) {
                 memcpy(to, ptr, len);
                 return 0;
         }
diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index e7e626fb87bb..e45098593dc0 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -217,7 +217,7 @@ static int bpf_parse_prog(struct nlattr *attr, struct bpf_lwt_prog *prog,
         if (!tb[LWT_BPF_PROG_FD] || !tb[LWT_BPF_PROG_NAME])
                 return -EINVAL;
 
-        prog->name = nla_memdup(tb[LWT_BPF_PROG_NAME], GFP_KERNEL);
+        prog->name = nla_memdup(tb[LWT_BPF_PROG_NAME], GFP_ATOMIC);
         if (!prog->name)
                 return -ENOMEM;
 
diff --git a/net/core/xdp.c b/net/core/xdp.c
index 9d1f22072d5d..6771f1855b96 100644
--- a/net/core/xdp.c
+++ b/net/core/xdp.c
@@ -345,7 +345,8 @@ static void __xdp_return(void *data, struct xdp_mem_info *mem, bool napi_direct,
                 rcu_read_lock();
                 /* mem->id is valid, checked in xdp_rxq_info_reg_mem_model() */
                 xa = rhashtable_lookup(mem_id_ht, &mem->id, mem_id_rht_params);
-                xa->zc_alloc->free(xa->zc_alloc, handle);
+                if (!WARN_ON_ONCE(!xa))
+                        xa->zc_alloc->free(xa->zc_alloc, handle);
                 rcu_read_unlock();
         default:
                 /* Not possible, checked in xdp_rxq_info_reg_mem_model() */
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index 2b75df469220..842a9c7c73a3 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -229,14 +229,16 @@ static void ccid2_cwnd_restart(struct sock *sk, const u32 now)
         struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
         u32 cwnd = hc->tx_cwnd, restart_cwnd,
             iwnd = rfc3390_bytes_to_packets(dccp_sk(sk)->dccps_mss_cache);
+        s32 delta = now - hc->tx_lsndtime;
 
         hc->tx_ssthresh = max(hc->tx_ssthresh, (cwnd >> 1) + (cwnd >> 2));
 
         /* don't reduce cwnd below the initial window (IW) */
         restart_cwnd = min(cwnd, iwnd);
-        cwnd >>= (now - hc->tx_lsndtime) / hc->tx_rto;
-        hc->tx_cwnd = max(cwnd, restart_cwnd);
 
+        while ((delta -= hc->tx_rto) >= 0 && cwnd > restart_cwnd)
+                cwnd >>= 1;
+        hc->tx_cwnd = max(cwnd, restart_cwnd);
         hc->tx_cwnd_stamp = now;
         hc->tx_cwnd_used  = 0;
 
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 1e3b6a6d8a40..9864bcd3d317 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -639,7 +639,7 @@ static int dsa_slave_set_eee(struct net_device *dev, struct ethtool_eee *e)
         int ret;
 
         /* Port's PHY and MAC both need to be EEE capable */
-        if (!dev->phydev)
+        if (!dev->phydev && !dp->pl)
                 return -ENODEV;
 
         if (!ds->ops->set_mac_eee)
@@ -659,7 +659,7 @@ static int dsa_slave_get_eee(struct net_device *dev, struct ethtool_eee *e)
         int ret;
 
         /* Port's PHY and MAC both need to be EEE capable */
-        if (!dev->phydev)
+        if (!dev->phydev && !dp->pl)
                 return -ENODEV;
 
         if (!ds->ops->get_mac_eee)
@@ -1248,6 +1248,9 @@ int dsa_slave_suspend(struct net_device *slave_dev)
 {
         struct dsa_port *dp = dsa_slave_to_port(slave_dev);
 
+        if (!netif_running(slave_dev))
+                return 0;
+
         netif_device_detach(slave_dev);
 
         rtnl_lock();
@@ -1261,6 +1264,9 @@ int dsa_slave_resume(struct net_device *slave_dev)
 {
         struct dsa_port *dp = dsa_slave_to_port(slave_dev);
 
+        if (!netif_running(slave_dev))
+                return 0;
+
         netif_device_attach(slave_dev);
 
         rtnl_lock();
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index e46cdd310e5f..2998b0e47d4b 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -292,19 +292,19 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
                 return ip_hdr(skb)->daddr;
 
         in_dev = __in_dev_get_rcu(dev);
-        BUG_ON(!in_dev);
 
         net = dev_net(dev);
 
         scope = RT_SCOPE_UNIVERSE;
         if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) {
+                bool vmark = in_dev && IN_DEV_SRC_VMARK(in_dev);
                 struct flowi4 fl4 = {
                         .flowi4_iif = LOOPBACK_IFINDEX,
                         .flowi4_oif = l3mdev_master_ifindex_rcu(dev),
                         .daddr = ip_hdr(skb)->saddr,
                         .flowi4_tos = RT_TOS(ip_hdr(skb)->tos),
                         .flowi4_scope = scope,
-                        .flowi4_mark = IN_DEV_SRC_VMARK(in_dev) ? skb->mark : 0,
+                        .flowi4_mark = vmark ? skb->mark : 0,
                 };
                 if (!fib_lookup(net, &fl4, &res, 0))
                         return FIB_RES_PREFSRC(net, res);
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 28fef7d15959..75151be21413 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1387,7 +1387,8 @@ static void ip_mc_hash_remove(struct in_device *in_dev,
 /*
  *      A socket has joined a multicast group on device dev.
  */
-void __ip_mc_inc_group(struct in_device *in_dev, __be32 addr, unsigned int mode)
+static void __ip_mc_inc_group(struct in_device *in_dev, __be32 addr,
+                              unsigned int mode)
 {
         struct ip_mc_list *im;
 #ifdef CONFIG_IP_MULTICAST
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 1e4cf3ab560f..0d70608cc2e1 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -157,9 +157,6 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf,
 {
         struct inet_frag_queue *q;
 
-        if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh)
-                return NULL;
-
         q = kmem_cache_zalloc(f->frags_cachep, GFP_ATOMIC);
         if (!q)
                 return NULL;
@@ -204,6 +201,9 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, void *key)
 {
         struct inet_frag_queue *fq;
 
+        if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh)
+                return NULL;
+
         rcu_read_lock();
 
         fq = rhashtable_lookup(&nf->rhashtable, key, nf->f->rhash_params);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 8e9528ebaa8e..d14d741fb05e 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -383,11 +383,16 @@ found:
                 int i = end - next->ip_defrag_offset; /* overlap is 'i' bytes */
 
                 if (i < next->len) {
+                        int delta = -next->truesize;
+
                         /* Eat head of the next overlapped fragment
                          * and leave the loop. The next ones cannot overlap.
                          */
                         if (!pskb_pull(next, i))
                                 goto err;
+                        delta += next->truesize;
+                        if (delta)
+                                add_frag_mem_limit(qp->q.net, delta);
                         next->ip_defrag_offset += i;
                         qp->q.meat -= i;
                         if (next->ip_summed != CHECKSUM_UNNECESSARY)
diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c
index 58e2f479ffb4..4bfff3c87e8e 100644
--- a/net/ipv4/tcp_bbr.c
+++ b/net/ipv4/tcp_bbr.c
@@ -354,6 +354,10 @@ static u32 bbr_target_cwnd(struct sock *sk, u32 bw, int gain)
         /* Reduce delayed ACKs by rounding up cwnd to the next even number. */
         cwnd = (cwnd + 1) & ~1U;
 
+        /* Ensure gain cycling gets inflight above BDP even for small BDPs. */
+        if (bbr->mode == BBR_PROBE_BW && gain > BBR_UNIT)
+                cwnd += 2;
+
         return cwnd;
 }
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 3bcd30a2ba06..f9dcb29be12d 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -246,8 +246,15 @@ static void tcp_ecn_queue_cwr(struct tcp_sock *tp)
 
 static void tcp_ecn_accept_cwr(struct tcp_sock *tp, const struct sk_buff *skb)
 {
-        if (tcp_hdr(skb)->cwr)
+        if (tcp_hdr(skb)->cwr) {
                 tp->ecn_flags &= ~TCP_ECN_DEMAND_CWR;
+
+                /* If the sender is telling us it has entered CWR, then its
+                 * cwnd may be very low (even just 1 packet), so we should ACK
+                 * immediately.
+                 */
+                tcp_enter_quickack_mode((struct sock *)tp, 2);
+        }
 }
 
 static void tcp_ecn_withdraw_cwr(struct tcp_sock *tp)
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 97513f35bcc5..88a7579c23bd 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -669,8 +669,10 @@ skip_cow:
 
         sg_init_table(sg, nfrags);
         ret = skb_to_sgvec(skb, sg, 0, skb->len);
-        if (unlikely(ret < 0))
+        if (unlikely(ret < 0)) {
+                kfree(tmp);
                 goto out;
+        }
 
         skb->ip_summed = CHECKSUM_NONE;
 
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 00e138a44cbb..1cc9650af9fb 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1133,12 +1133,8 @@ route_lookup:
                 max_headroom += 8;
                 mtu -= 8;
         }
-        if (skb->protocol == htons(ETH_P_IPV6)) {
-                if (mtu < IPV6_MIN_MTU)
-                        mtu = IPV6_MIN_MTU;
-        } else if (mtu < 576) {
-                mtu = 576;
-        }
+        mtu = max(mtu, skb->protocol == htons(ETH_P_IPV6) ?
+                       IPV6_MIN_MTU : IPV4_MIN_MTU);
 
         skb_dst_update_pmtu(skb, mtu);
         if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) {
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index b7f28deddaea..c72ae3a4fe09 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -480,10 +480,6 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
                 goto tx_err_dst_release;
         }
 
-        skb_scrub_packet(skb, !net_eq(t->net, dev_net(dev)));
-        skb_dst_set(skb, dst);
-        skb->dev = skb_dst(skb)->dev;
-
         mtu = dst_mtu(dst);
         if (!skb->ignore_df && skb->len > mtu) {
                 skb_dst_update_pmtu(skb, mtu);
@@ -498,9 +494,14 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
                                   htonl(mtu));
                 }
 
-                return -EMSGSIZE;
+                err = -EMSGSIZE;
+                goto tx_err_dst_release;
         }
 
+        skb_scrub_packet(skb, !net_eq(t->net, dev_net(dev)));
+        skb_dst_set(skb, dst);
+        skb->dev = skb_dst(skb)->dev;
+
         err = dst_output(t->net, skb->sk, skb);
         if (net_xmit_eval(err) == 0) {
                 struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index ec18b3ce8b6d..7208c16302f6 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -978,10 +978,6 @@ static void rt6_set_from(struct rt6_info *rt, struct fib6_info *from)
         rt->rt6i_flags &= ~RTF_EXPIRES;
         rcu_assign_pointer(rt->from, from);
         dst_init_metrics(&rt->dst, from->fib6_metrics->metrics, true);
-        if (from->fib6_metrics != &dst_default_metrics) {
-                rt->dst._metrics |= DST_METRICS_REFCOUNTED;
-                refcount_inc(&from->fib6_metrics->refcnt);
-        }
 }
 
 /* Caller must already hold reference to @ort */
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index e398797878a9..cf6cca260e7b 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -1201,13 +1201,18 @@ static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel,
                                 l2tp_session_get(sock_net(sk), tunnel,
                                                  stats.session_id);
 
-                        if (session && session->pwtype == L2TP_PWTYPE_PPP) {
-                                err = pppol2tp_session_ioctl(session, cmd,
-                                                             arg);
+                        if (!session) {
+                                err = -EBADR;
+                                break;
+                        }
+                        if (session->pwtype != L2TP_PWTYPE_PPP) {
                                 l2tp_session_dec_refcount(session);
-                        } else {
                                 err = -EBADR;
+                                break;
                         }
+
+                        err = pppol2tp_session_ioctl(session, cmd, arg);
+                        l2tp_session_dec_refcount(session);
                         break;
                 }
 #ifdef CONFIG_XFRM
diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
index 89041260784c..260b3dc1b4a2 100644
--- a/net/llc/llc_core.c
+++ b/net/llc/llc_core.c
@@ -73,8 +73,8 @@ struct llc_sap *llc_sap_find(unsigned char sap_value)
 
         rcu_read_lock_bh();
         sap = __llc_sap_find(sap_value);
-        if (sap)
-                llc_sap_hold(sap);
+        if (!sap || !llc_sap_hold_safe(sap))
+                sap = NULL;
         rcu_read_unlock_bh();
         return sap;
 }
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 393573a99a5a..56704d95f82d 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -63,6 +63,7 @@
 #include <linux/hash.h>
 #include <linux/genetlink.h>
 #include <linux/net_namespace.h>
+#include <linux/nospec.h>
 
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
@@ -679,6 +680,7 @@ static int netlink_create(struct net *net, struct socket *sock, int protocol,
 
         if (protocol < 0 || protocol >= MAX_LINKS)
                 return -EPROTONOSUPPORT;
+        protocol = array_index_nospec(protocol, MAX_LINKS);
 
         netlink_lock_table();
 #ifdef CONFIG_MODULES
@@ -1009,6 +1011,11 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
                         return err;
         }
 
+        if (nlk->ngroups == 0)
+                groups = 0;
+        else if (nlk->ngroups < 8*sizeof(groups))
+                groups &= (1UL << nlk->ngroups) - 1;
+
         bound = nlk->bound;
         if (bound) {
                 /* Ensure nlk->portid is up-to-date. */
diff --git a/net/openvswitch/meter.c b/net/openvswitch/meter.c
index b891a91577f8..c038e021a591 100644
--- a/net/openvswitch/meter.c
+++ b/net/openvswitch/meter.c
@@ -211,6 +211,7 @@ static struct dp_meter *dp_meter_create(struct nlattr **a)
         if (!meter)
                 return ERR_PTR(-ENOMEM);
 
+        meter->id = nla_get_u32(a[OVS_METER_ATTR_ID]);
         meter->used = div_u64(ktime_get_ns(), 1000 * 1000);
         meter->kbps = a[OVS_METER_ATTR_KBPS] ? 1 : 0;
         meter->keep_stats = !a[OVS_METER_ATTR_CLEAR];
@@ -280,6 +281,10 @@ static int ovs_meter_cmd_set(struct sk_buff *skb, struct genl_info *info)
         u32 meter_id;
         bool failed;
 
+        if (!a[OVS_METER_ATTR_ID]) {
+                return -ENODEV;
+        }
+
         meter = dp_meter_create(a);
         if (IS_ERR_OR_NULL(meter))
                 return PTR_ERR(meter);
@@ -298,11 +303,6 @@ static int ovs_meter_cmd_set(struct sk_buff *skb, struct genl_info *info)
                 goto exit_unlock;
         }
 
-        if (!a[OVS_METER_ATTR_ID]) {
-                err = -ENODEV;
-                goto exit_unlock;
-        }
-
         meter_id = nla_get_u32(a[OVS_METER_ATTR_ID]);
 
         /* Cannot fail after this. */
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 9b27d0cd766d..e6445d8f3f57 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -4226,6 +4226,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
         }
 
         if (req->tp_block_nr) {
+                unsigned int min_frame_size;
+
                 /* Sanity tests and some calculations */
                 err = -EBUSY;
                 if (unlikely(rb->pg_vec))
@@ -4248,12 +4250,12 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                         goto out;
                 if (unlikely(!PAGE_ALIGNED(req->tp_block_size)))
                         goto out;
+                min_frame_size = po->tp_hdrlen + po->tp_reserve;
                 if (po->tp_version >= TPACKET_V3 &&
-                    req->tp_block_size <=
-                    BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + sizeof(struct tpacket3_hdr))
+                    req->tp_block_size <
+                    BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + min_frame_size)
                         goto out;
-                if (unlikely(req->tp_frame_size < po->tp_hdrlen +
-                                        po->tp_reserve))
+                if (unlikely(req->tp_frame_size < min_frame_size))
                         goto out;
                 if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))
                         goto out;
diff --git a/net/rds/ib_frmr.c b/net/rds/ib_frmr.c
index 48332a6ed738..d152e48ea371 100644
--- a/net/rds/ib_frmr.c
+++ b/net/rds/ib_frmr.c
@@ -344,6 +344,11 @@ struct rds_ib_mr *rds_ib_reg_frmr(struct rds_ib_device *rds_ibdev,
         struct rds_ib_frmr *frmr;
         int ret;
 
+        if (!ic) {
+                /* TODO: Add FRWR support for RDS_GET_MR using proxy qp*/
+                return ERR_PTR(-EOPNOTSUPP);
+        }
+
         do {
                 if (ibmr)
                         rds_ib_free_frmr(ibmr, true);
diff --git a/net/rds/ib_mr.h b/net/rds/ib_mr.h
index 0ea4ab017a8c..655f01d427fe 100644
--- a/net/rds/ib_mr.h
+++ b/net/rds/ib_mr.h
@@ -115,7 +115,8 @@ void rds_ib_get_mr_info(struct rds_ib_device *rds_ibdev,
                         struct rds_info_rdma_connection *iinfo);
 void rds_ib_destroy_mr_pool(struct rds_ib_mr_pool *);
 void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
-                    struct rds_sock *rs, u32 *key_ret);
+                    struct rds_sock *rs, u32 *key_ret,
+                    struct rds_connection *conn);
 void rds_ib_sync_mr(void *trans_private, int dir);
 void rds_ib_free_mr(void *trans_private, int invalidate);
 void rds_ib_flush_mrs(void);
diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
index e678699268a2..2e49a40a5e11 100644
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -537,11 +537,12 @@ void rds_ib_flush_mrs(void)
 }
 
 void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
-                    struct rds_sock *rs, u32 *key_ret)
+                    struct rds_sock *rs, u32 *key_ret,
+                    struct rds_connection *conn)
 {
         struct rds_ib_device *rds_ibdev;
         struct rds_ib_mr *ibmr = NULL;
-        struct rds_ib_connection *ic = rs->rs_conn->c_transport_data;
+        struct rds_ib_connection *ic = NULL;
         int ret;
 
         rds_ibdev = rds_ib_get_device(rs->rs_bound_addr);
@@ -550,6 +551,9 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
                 goto out;
         }
 
+        if (conn)
+                ic = conn->c_transport_data;
+
         if (!rds_ibdev->mr_8k_pool || !rds_ibdev->mr_1m_pool) {
                 ret = -ENODEV;
                 goto out;
@@ -559,17 +563,18 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
                 ibmr = rds_ib_reg_frmr(rds_ibdev, ic, sg, nents, key_ret);
         else
                 ibmr = rds_ib_reg_fmr(rds_ibdev, sg, nents, key_ret);
-        if (ibmr)
-                rds_ibdev = NULL;
-
- out:
-        if (!ibmr)
+        if (IS_ERR(ibmr)) {
+                ret = PTR_ERR(ibmr);
                 pr_warn("RDS/IB: rds_ib_get_mr failed (errno=%d)\n", ret);
+        } else {
+                return ibmr;
+        }
 
+ out:
         if (rds_ibdev)
                 rds_ib_dev_put(rds_ibdev);
 
-        return ibmr;
+        return ERR_PTR(ret);
 }
 
 void rds_ib_destroy_mr_pool(struct rds_ib_mr_pool *pool)
diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index 634cfcb7bba6..80920e47f2c7 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -170,7 +170,8 @@ static int rds_pin_pages(unsigned long user_addr, unsigned int nr_pages,
 }
 
 static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args,
-                                u64 *cookie_ret, struct rds_mr **mr_ret)
+                          u64 *cookie_ret, struct rds_mr **mr_ret,
+                          struct rds_conn_path *cp)
 {
         struct rds_mr *mr = NULL, *found;
         unsigned int nr_pages;
@@ -269,7 +270,8 @@ static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args,
          * Note that dma_map() implies that pending writes are
          * flushed to RAM, so no dma_sync is needed here. */
         trans_private = rs->rs_transport->get_mr(sg, nents, rs,
-                                                 &mr->r_key);
+                                                 &mr->r_key,
+                                                 cp ? cp->cp_conn : NULL);
 
         if (IS_ERR(trans_private)) {
                 for (i = 0 ; i < nents; i++)
@@ -330,7 +332,7 @@ int rds_get_mr(struct rds_sock *rs, char __user *optval, int optlen)
                            sizeof(struct rds_get_mr_args)))
                 return -EFAULT;
 
-        return __rds_rdma_map(rs, &args, NULL, NULL);
+        return __rds_rdma_map(rs, &args, NULL, NULL, NULL);
 }
 
 int rds_get_mr_for_dest(struct rds_sock *rs, char __user *optval, int optlen)
@@ -354,7 +356,7 @@ int rds_get_mr_for_dest(struct rds_sock *rs, char __user *optval, int optlen)
         new_args.cookie_addr = args.cookie_addr;
         new_args.flags = args.flags;
 
-        return __rds_rdma_map(rs, &new_args, NULL, NULL);
+        return __rds_rdma_map(rs, &new_args, NULL, NULL, NULL);
 }
 
 /*
@@ -782,7 +784,8 @@ int rds_cmsg_rdma_map(struct rds_sock *rs, struct rds_message *rm,
             rm->m_rdma_cookie != 0)
                 return -EINVAL;
 
-        return __rds_rdma_map(rs, CMSG_DATA(cmsg), &rm->m_rdma_cookie, &rm->rdma.op_rdma_mr);
+        return __rds_rdma_map(rs, CMSG_DATA(cmsg), &rm->m_rdma_cookie,
+                              &rm->rdma.op_rdma_mr, rm->m_conn_path);
 }
 
 /*
diff --git a/net/rds/rds.h b/net/rds/rds.h
index f2272fb8cd45..60b3b787fbdb 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -464,6 +464,8 @@ struct rds_message {
                         struct scatterlist      *op_sg;
                 } data;
         };
+
+        struct rds_conn_path *m_conn_path;
 };
 
 /*
@@ -544,7 +546,8 @@ struct rds_transport {
                                         unsigned int avail);
         void (*exit)(void);
         void *(*get_mr)(struct scatterlist *sg, unsigned long nr_sg,
-                        struct rds_sock *rs, u32 *key_ret);
+                        struct rds_sock *rs, u32 *key_ret,
+                        struct rds_connection *conn);
         void (*sync_mr)(void *trans_private, int direction);
         void (*free_mr)(void *trans_private, int invalidate);
         void (*flush_mrs)(void);
diff --git a/net/rds/send.c b/net/rds/send.c
index 94c7f74909be..59f17a2335f4 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -1169,6 +1169,13 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
                 rs->rs_conn = conn;
         }
 
+        if (conn->c_trans->t_mp_capable)
+                cpath = &conn->c_path[rds_send_mprds_hash(rs, conn)];
+        else
+                cpath = &conn->c_path[0];
+
+        rm->m_conn_path = cpath;
+
         /* Parse any control messages the user may have included. */
         ret = rds_cmsg_send(rs, rm, msg, &allocated_mr);
         if (ret) {
@@ -1192,11 +1199,6 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
                 goto out;
         }
 
-        if (conn->c_trans->t_mp_capable)
-                cpath = &conn->c_path[rds_send_mprds_hash(rs, conn)];
-        else
-                cpath = &conn->c_path[0];
-
         if (rds_destroy_pending(conn)) {
                 ret = -EAGAIN;
                 goto out;
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 5fb7d3254d9e..707630ab4713 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -104,9 +104,9 @@ struct rxrpc_net {
 
 #define RXRPC_KEEPALIVE_TIME 20 /* NAT keepalive time in seconds */
         u8                      peer_keepalive_cursor;
-        ktime_t                 peer_keepalive_base;
-        struct hlist_head       peer_keepalive[RXRPC_KEEPALIVE_TIME + 1];
-        struct hlist_head       peer_keepalive_new;
+        time64_t                peer_keepalive_base;
+        struct list_head        peer_keepalive[32];
+        struct list_head        peer_keepalive_new;
         struct timer_list       peer_keepalive_timer;
         struct work_struct      peer_keepalive_work;
 };
@@ -295,7 +295,7 @@ struct rxrpc_peer {
         struct hlist_head       error_targets;  /* targets for net error distribution */
         struct work_struct      error_distributor;
         struct rb_root          service_conns;  /* Service connections */
-        struct hlist_node       keepalive_link; /* Link in net->peer_keepalive[] */
+        struct list_head        keepalive_link; /* Link in net->peer_keepalive[] */
         time64_t                last_tx_at;     /* Last time packet sent here */
         seqlock_t               service_conn_lock;
         spinlock_t              lock;           /* access lock */
diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
index a9a9be5519b9..9d1e298b784c 100644
--- a/net/rxrpc/call_accept.c
+++ b/net/rxrpc/call_accept.c
@@ -116,9 +116,9 @@ static int rxrpc_service_prealloc_one(struct rxrpc_sock *rx,
                 while (*pp) {
                         parent = *pp;
                         xcall = rb_entry(parent, struct rxrpc_call, sock_node);
-                        if (user_call_ID < call->user_call_ID)
+                        if (user_call_ID < xcall->user_call_ID)
                                 pp = &(*pp)->rb_left;
-                        else if (user_call_ID > call->user_call_ID)
+                        else if (user_call_ID > xcall->user_call_ID)
                                 pp = &(*pp)->rb_right;
                         else
                                 goto id_in_use;
diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
index f6734d8cb01a..9486293fef5c 100644
--- a/net/rxrpc/call_object.c
+++ b/net/rxrpc/call_object.c
@@ -415,7 +415,7 @@ void rxrpc_incoming_call(struct rxrpc_sock *rx,
 bool rxrpc_queue_call(struct rxrpc_call *call)
 {
         const void *here = __builtin_return_address(0);
-        int n = __atomic_add_unless(&call->usage, 1, 0);
+        int n = atomic_fetch_add_unless(&call->usage, 1, 0);
         if (n == 0)
                 return false;
         if (rxrpc_queue_work(&call->processor))
diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index 8229a52c2acd..3fde001fcc39 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -136,7 +136,7 @@ static void rxrpc_conn_retransmit_call(struct rxrpc_connection *conn,
         }
 
         ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, ioc, len);
-        conn->params.peer->last_tx_at = ktime_get_real();
+        conn->params.peer->last_tx_at = ktime_get_seconds();
         if (ret < 0)
                 trace_rxrpc_tx_fail(conn->debug_id, serial, ret,
                                     rxrpc_tx_fail_call_final_resend);
@@ -245,7 +245,7 @@ static int rxrpc_abort_connection(struct rxrpc_connection *conn,
                 return -EAGAIN;
         }
 
-        conn->params.peer->last_tx_at = ktime_get_real();
+        conn->params.peer->last_tx_at = ktime_get_seconds();
 
         _leave(" = 0");
         return 0;
diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c
index 4c77a78a252a..77440a356b14 100644
--- a/net/rxrpc/conn_object.c
+++ b/net/rxrpc/conn_object.c
@@ -266,7 +266,7 @@ void rxrpc_kill_connection(struct rxrpc_connection *conn)
 bool rxrpc_queue_conn(struct rxrpc_connection *conn)
 {
         const void *here = __builtin_return_address(0);
-        int n = __atomic_add_unless(&conn->usage, 1, 0);
+        int n = atomic_fetch_add_unless(&conn->usage, 1, 0);
         if (n == 0)
                 return false;
         if (rxrpc_queue_work(&conn->processor))
@@ -309,7 +309,7 @@ rxrpc_get_connection_maybe(struct rxrpc_connection *conn)
         const void *here = __builtin_return_address(0);
 
         if (conn) {
-                int n = __atomic_add_unless(&conn->usage, 1, 0);
+                int n = atomic_fetch_add_unless(&conn->usage, 1, 0);
                 if (n > 0)
                         trace_rxrpc_conn(conn, rxrpc_conn_got, n + 1, here);
                 else
diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
index b493e6b62740..777c3ed4cfc0 100644
--- a/net/rxrpc/local_object.c
+++ b/net/rxrpc/local_object.c
@@ -305,7 +305,7 @@ struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *local)
         const void *here = __builtin_return_address(0);
 
         if (local) {
-                int n = __atomic_add_unless(&local->usage, 1, 0);
+                int n = atomic_fetch_add_unless(&local->usage, 1, 0);
                 if (n > 0)
                         trace_rxrpc_local(local, rxrpc_local_got, n + 1, here);
                 else
diff --git a/net/rxrpc/net_ns.c b/net/rxrpc/net_ns.c
index 5d6a773db973..417d80867c4f 100644
--- a/net/rxrpc/net_ns.c
+++ b/net/rxrpc/net_ns.c
@@ -85,12 +85,12 @@ static __net_init int rxrpc_init_net(struct net *net)
         hash_init(rxnet->peer_hash);
         spin_lock_init(&rxnet->peer_hash_lock);
         for (i = 0; i < ARRAY_SIZE(rxnet->peer_keepalive); i++)
-                INIT_HLIST_HEAD(&rxnet->peer_keepalive[i]);
-        INIT_HLIST_HEAD(&rxnet->peer_keepalive_new);
+                INIT_LIST_HEAD(&rxnet->peer_keepalive[i]);
+        INIT_LIST_HEAD(&rxnet->peer_keepalive_new);
         timer_setup(&rxnet->peer_keepalive_timer,
                     rxrpc_peer_keepalive_timeout, 0);
         INIT_WORK(&rxnet->peer_keepalive_work, rxrpc_peer_keepalive_worker);
-        rxnet->peer_keepalive_base = ktime_add(ktime_get_real(), NSEC_PER_SEC);
+        rxnet->peer_keepalive_base = ktime_get_seconds();
 
         ret = -ENOMEM;
         rxnet->proc_net = proc_net_mkdir(net, "rxrpc", net->proc_net);
diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
index f03de1c59ba3..4774c8f5634d 100644
--- a/net/rxrpc/output.c
+++ b/net/rxrpc/output.c
@@ -209,7 +209,7 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping,
         now = ktime_get_real();
         if (ping)
                 call->ping_time = now;
-        conn->params.peer->last_tx_at = ktime_get_real();
+        conn->params.peer->last_tx_at = ktime_get_seconds();
         if (ret < 0)
                 trace_rxrpc_tx_fail(call->debug_id, serial, ret,
                                     rxrpc_tx_fail_call_ack);
@@ -296,7 +296,7 @@ int rxrpc_send_abort_packet(struct rxrpc_call *call)
 
         ret = kernel_sendmsg(conn->params.local->socket,
                              &msg, iov, 1, sizeof(pkt));
-        conn->params.peer->last_tx_at = ktime_get_real();
+        conn->params.peer->last_tx_at = ktime_get_seconds();
         if (ret < 0)
                 trace_rxrpc_tx_fail(call->debug_id, serial, ret,
                                     rxrpc_tx_fail_call_abort);
@@ -391,7 +391,7 @@ int rxrpc_send_data_packet(struct rxrpc_call *call, struct sk_buff *skb,
          *     message and update the peer record
          */
         ret = kernel_sendmsg(conn->params.local->socket, &msg, iov, 2, len);
-        conn->params.peer->last_tx_at = ktime_get_real();
+        conn->params.peer->last_tx_at = ktime_get_seconds();
 
         up_read(&conn->params.local->defrag_sem);
         if (ret < 0)
@@ -457,7 +457,7 @@ send_fragmentable:
                 if (ret == 0) {
                         ret = kernel_sendmsg(conn->params.local->socket, &msg,
                                              iov, 2, len);
-                        conn->params.peer->last_tx_at = ktime_get_real();
+                        conn->params.peer->last_tx_at = ktime_get_seconds();
 
                         opt = IP_PMTUDISC_DO;
                         kernel_setsockopt(conn->params.local->socket, SOL_IP,
@@ -475,7 +475,7 @@ send_fragmentable:
                 if (ret == 0) {
                         ret = kernel_sendmsg(conn->params.local->socket, &msg,
                                              iov, 2, len);
-                        conn->params.peer->last_tx_at = ktime_get_real();
+                        conn->params.peer->last_tx_at = ktime_get_seconds();
 
                         opt = IPV6_PMTUDISC_DO;
                         kernel_setsockopt(conn->params.local->socket,
@@ -599,6 +599,6 @@ void rxrpc_send_keepalive(struct rxrpc_peer *peer)
                 trace_rxrpc_tx_fail(peer->debug_id, 0, ret,
                                     rxrpc_tx_fail_version_keepalive);
 
-        peer->last_tx_at = ktime_get_real();
+        peer->last_tx_at = ktime_get_seconds();
         _leave("");
 }
diff --git a/net/rxrpc/peer_event.c b/net/rxrpc/peer_event.c
index 0ed8b651cec2..4f9da2f51c69 100644
--- a/net/rxrpc/peer_event.c
+++ b/net/rxrpc/peer_event.c
@@ -350,97 +350,117 @@ void rxrpc_peer_add_rtt(struct rxrpc_call *call, enum rxrpc_rtt_rx_trace why,
 }
 
 /*
- * Perform keep-alive pings with VERSION packets to keep any NAT alive.
+ * Perform keep-alive pings.
  */
-void rxrpc_peer_keepalive_worker(struct work_struct *work)
+static void rxrpc_peer_keepalive_dispatch(struct rxrpc_net *rxnet,
+                                          struct list_head *collector,
+                                          time64_t base,
+                                          u8 cursor)
 {
-        struct rxrpc_net *rxnet =
-                container_of(work, struct rxrpc_net, peer_keepalive_work);
         struct rxrpc_peer *peer;
-        unsigned long delay;
-        ktime_t base, now = ktime_get_real();
-        s64 diff;
-        u8 cursor, slot;
+        const u8 mask = ARRAY_SIZE(rxnet->peer_keepalive) - 1;
+        time64_t keepalive_at;
+        int slot;
 
-        base = rxnet->peer_keepalive_base;
-        cursor = rxnet->peer_keepalive_cursor;
+        spin_lock_bh(&rxnet->peer_hash_lock);
 
-        _enter("%u,%lld", cursor, ktime_sub(now, base));
+        while (!list_empty(collector)) {
+                peer = list_entry(collector->next,
+                                  struct rxrpc_peer, keepalive_link);
 
-next_bucket:
-        diff = ktime_to_ns(ktime_sub(now, base));
-        if (diff < 0)
-                goto resched;
+                list_del_init(&peer->keepalive_link);
+                if (!rxrpc_get_peer_maybe(peer))
+                        continue;
 
-        _debug("at %u", cursor);
-        spin_lock_bh(&rxnet->peer_hash_lock);
-next_peer:
-        if (!rxnet->live) {
                 spin_unlock_bh(&rxnet->peer_hash_lock);
-                goto out;
-        }
 
-        /* Everything in the bucket at the cursor is processed this second; the
-         * bucket at cursor + 1 goes now + 1s and so on...
-         */
-        if (hlist_empty(&rxnet->peer_keepalive[cursor])) {
-                if (hlist_empty(&rxnet->peer_keepalive_new)) {
-                        spin_unlock_bh(&rxnet->peer_hash_lock);
-                        goto emptied_bucket;
+                keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME;
+                slot = keepalive_at - base;
+                _debug("%02x peer %u t=%d {%pISp}",
+                       cursor, peer->debug_id, slot, &peer->srx.transport);
+
+                if (keepalive_at <= base ||
+                    keepalive_at > base + RXRPC_KEEPALIVE_TIME) {
+                        rxrpc_send_keepalive(peer);
+                        slot = RXRPC_KEEPALIVE_TIME;
                 }
 
-                hlist_move_list(&rxnet->peer_keepalive_new,
-                                &rxnet->peer_keepalive[cursor]);
+                /* A transmission to this peer occurred since last we examined
+                 * it so put it into the appropriate future bucket.
+                 */
+                slot += cursor;
+                slot &= mask;
+                spin_lock_bh(&rxnet->peer_hash_lock);
+                list_add_tail(&peer->keepalive_link,
+                              &rxnet->peer_keepalive[slot & mask]);
+                rxrpc_put_peer(peer);
         }
 
-        peer = hlist_entry(rxnet->peer_keepalive[cursor].first,
-                           struct rxrpc_peer, keepalive_link);
-        hlist_del_init(&peer->keepalive_link);
-        if (!rxrpc_get_peer_maybe(peer))
-                goto next_peer;
-
         spin_unlock_bh(&rxnet->peer_hash_lock);
+}
 
-        _debug("peer %u {%pISp}", peer->debug_id, &peer->srx.transport);
+/*
+ * Perform keep-alive pings with VERSION packets to keep any NAT alive.
+ */
+void rxrpc_peer_keepalive_worker(struct work_struct *work)
+{
+        struct rxrpc_net *rxnet =
+                container_of(work, struct rxrpc_net, peer_keepalive_work);
+        const u8 mask = ARRAY_SIZE(rxnet->peer_keepalive) - 1;
+        time64_t base, now, delay;
+        u8 cursor, stop;
+        LIST_HEAD(collector);
 
-recalc:
-        diff = ktime_divns(ktime_sub(peer->last_tx_at, base), NSEC_PER_SEC);
-        if (diff < -30 || diff > 30)
-                goto send; /* LSW of 64-bit time probably wrapped on 32-bit */
-        diff += RXRPC_KEEPALIVE_TIME - 1;
-        if (diff < 0)
-                goto send;
+        now = ktime_get_seconds();
+        base = rxnet->peer_keepalive_base;
+        cursor = rxnet->peer_keepalive_cursor;
+        _enter("%lld,%u", base - now, cursor);
 
-        slot = (diff > RXRPC_KEEPALIVE_TIME - 1) ? RXRPC_KEEPALIVE_TIME - 1 : diff;
-        if (slot == 0)
-                goto send;
+        if (!rxnet->live)
+                return;
 
-        /* A transmission to this peer occurred since last we examined it so
-         * put it into the appropriate future bucket.
+        /* Remove to a temporary list all the peers that are currently lodged
+         * in expired buckets plus all new peers.
+         *
+         * Everything in the bucket at the cursor is processed this
+         * second; the bucket at cursor + 1 goes at now + 1s and so
+         * on...
          */
-        slot = (slot + cursor) % ARRAY_SIZE(rxnet->peer_keepalive);
         spin_lock_bh(&rxnet->peer_hash_lock);
-        hlist_add_head(&peer->keepalive_link, &rxnet->peer_keepalive[slot]);
-        rxrpc_put_peer(peer);
-        goto next_peer;
-
-send:
-        rxrpc_send_keepalive(peer);
-        now = ktime_get_real();
-        goto recalc;
+        list_splice_init(&rxnet->peer_keepalive_new, &collector);
+
+        stop = cursor + ARRAY_SIZE(rxnet->peer_keepalive);
+        while (base <= now && (s8)(cursor - stop) < 0) {
+                list_splice_tail_init(&rxnet->peer_keepalive[cursor & mask],
+                                      &collector);
+                base++;
+                cursor++;
+        }
 
-emptied_bucket:
-        cursor++;
-        if (cursor >= ARRAY_SIZE(rxnet->peer_keepalive))
-                cursor = 0;
-        base = ktime_add_ns(base, NSEC_PER_SEC);
-        goto next_bucket;
+        base = now;
+        spin_unlock_bh(&rxnet->peer_hash_lock);
 
-resched:
         rxnet->peer_keepalive_base = base;
         rxnet->peer_keepalive_cursor = cursor;
-        delay = nsecs_to_jiffies(-diff) + 1;
-        timer_reduce(&rxnet->peer_keepalive_timer, jiffies + delay);
-out:
+        rxrpc_peer_keepalive_dispatch(rxnet, &collector, base, cursor);
+        ASSERT(list_empty(&collector));
+
+        /* Schedule the timer for the next occupied timeslot. */
+        cursor = rxnet->peer_keepalive_cursor;
+        stop = cursor + RXRPC_KEEPALIVE_TIME - 1;
+        for (; (s8)(cursor - stop) < 0; cursor++) {
+                if (!list_empty(&rxnet->peer_keepalive[cursor & mask]))
+                        break;
+                base++;
+        }
+
+        now = ktime_get_seconds();
+        delay = base - now;
+        if (delay < 1)
+                delay = 1;
+        delay *= HZ;
+        if (rxnet->live)
+                timer_reduce(&rxnet->peer_keepalive_timer, jiffies + delay);
+
         _leave("");
 }
diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c
index 1b7e8107b3ae..1dc7648e3eff 100644
--- a/net/rxrpc/peer_object.c
+++ b/net/rxrpc/peer_object.c
@@ -322,7 +322,7 @@ struct rxrpc_peer *rxrpc_lookup_incoming_peer(struct rxrpc_local *local,
         if (!peer) {
                 peer = prealloc;
                 hash_add_rcu(rxnet->peer_hash, &peer->hash_link, hash_key);
-                hlist_add_head(&peer->keepalive_link, &rxnet->peer_keepalive_new);
+                list_add_tail(&peer->keepalive_link, &rxnet->peer_keepalive_new);
         }
 
         spin_unlock(&rxnet->peer_hash_lock);
@@ -367,8 +367,8 @@ struct rxrpc_peer *rxrpc_lookup_peer(struct rxrpc_local *local,
                 if (!peer) {
                         hash_add_rcu(rxnet->peer_hash,
                                      &candidate->hash_link, hash_key);
-                        hlist_add_head(&candidate->keepalive_link,
-                                       &rxnet->peer_keepalive_new);
+                        list_add_tail(&candidate->keepalive_link,
+                                      &rxnet->peer_keepalive_new);
                 }
 
                 spin_unlock_bh(&rxnet->peer_hash_lock);
@@ -406,7 +406,7 @@ struct rxrpc_peer *rxrpc_get_peer_maybe(struct rxrpc_peer *peer)
         const void *here = __builtin_return_address(0);
 
         if (peer) {
-                int n = __atomic_add_unless(&peer->usage, 1, 0);
+                int n = atomic_fetch_add_unless(&peer->usage, 1, 0);
                 if (n > 0)
                         trace_rxrpc_peer(peer, rxrpc_peer_got, n + 1, here);
                 else
@@ -441,7 +441,7 @@ static void __rxrpc_put_peer(struct rxrpc_peer *peer)
 
         spin_lock_bh(&rxnet->peer_hash_lock);
         hash_del_rcu(&peer->hash_link);
-        hlist_del_init(&peer->keepalive_link);
+        list_del_init(&peer->keepalive_link);
         spin_unlock_bh(&rxnet->peer_hash_lock);
 
         kfree_rcu(peer, rcu);
diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index 278ac0807a60..47cb019c521a 100644
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -669,7 +669,7 @@ static int rxkad_issue_challenge(struct rxrpc_connection *conn)
                 return -EAGAIN;
         }
 
-        conn->params.peer->last_tx_at = ktime_get_real();
+        conn->params.peer->last_tx_at = ktime_get_seconds();
         _leave(" = 0");
         return 0;
 }
@@ -725,7 +725,7 @@ static int rxkad_send_response(struct rxrpc_connection *conn,
                 return -EAGAIN;
         }
 
-        conn->params.peer->last_tx_at = ktime_get_real();
+        conn->params.peer->last_tx_at = ktime_get_seconds();
         _leave(" = 0");
         return 0;
 }
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 05e4ffe5aabd..e7de5f282722 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -1122,6 +1122,8 @@ static void smc_tcp_listen_work(struct work_struct *work)
                 sock_hold(lsk); /* sock_put in smc_listen_work */
                 INIT_WORK(&new_smc->smc_listen_work, smc_listen_work);
                 smc_copy_sock_settings_to_smc(new_smc);
+                new_smc->sk.sk_sndbuf = lsmc->sk.sk_sndbuf;
+                new_smc->sk.sk_rcvbuf = lsmc->sk.sk_rcvbuf;
                 sock_hold(&new_smc->sk); /* sock_put in passive closing */
                 if (!schedule_work(&new_smc->smc_listen_work))
                         sock_put(&new_smc->sk);
@@ -1397,8 +1399,7 @@ static int smc_shutdown(struct socket *sock, int how)
         lock_sock(sk);
 
         rc = -ENOTCONN;
-        if ((sk->sk_state != SMC_LISTEN) &&
-            (sk->sk_state != SMC_ACTIVE) &&
+        if ((sk->sk_state != SMC_ACTIVE) &&
             (sk->sk_state != SMC_PEERCLOSEWAIT1) &&
             (sk->sk_state != SMC_PEERCLOSEWAIT2) &&
             (sk->sk_state != SMC_APPCLOSEWAIT1) &&
@@ -1521,12 +1522,16 @@ static int smc_ioctl(struct socket *sock, unsigned int cmd,
 
         smc = smc_sk(sock->sk);
         conn = &smc->conn;
+        lock_sock(&smc->sk);
         if (smc->use_fallback) {
-                if (!smc->clcsock)
+                if (!smc->clcsock) {
+                        release_sock(&smc->sk);
                         return -EBADF;
-                return smc->clcsock->ops->ioctl(smc->clcsock, cmd, arg);
+                }
+                answ = smc->clcsock->ops->ioctl(smc->clcsock, cmd, arg);
+                release_sock(&smc->sk);
+                return answ;
         }
-        lock_sock(&smc->sk);
         switch (cmd) {
         case SIOCINQ: /* same as FIONREAD */
                 if (smc->sk.sk_state == SMC_LISTEN) {
diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index a7e8d63fc8ae..9bde1e4ca288 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -233,7 +233,8 @@ static void smc_cdc_msg_recv_action(struct smc_sock *smc,
                         /* force immediate tx of current consumer cursor, but
                          * under send_lock to guarantee arrival in seqno-order
                          */
-                        smc_tx_sndbuf_nonempty(conn);
+                        if (smc->sk.sk_state != SMC_INIT)
+                                smc_tx_sndbuf_nonempty(conn);
                 }
         }
 
diff --git a/net/socket.c b/net/socket.c
index 85633622c94d..8c24d5dc4bc8 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -89,6 +89,7 @@
 #include <linux/magic.h>
 #include <linux/slab.h>
 #include <linux/xattr.h>
+#include <linux/nospec.h>
 
 #include <linux/uaccess.h>
 #include <asm/unistd.h>
@@ -2522,6 +2523,7 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
 
         if (call < 1 || call > SYS_SENDMMSG)
                 return -EINVAL;
+        call = array_index_nospec(call, SYS_SENDMMSG + 1);
 
         len = nargs[call];
         if (len > sizeof(a))
@@ -2688,7 +2690,8 @@ EXPORT_SYMBOL(sock_unregister);
 
 bool sock_is_registered(int family)
 {
-        return family < NPROTO && rcu_access_pointer(net_families[family]);
+        return family < NPROTO &&
+                rcu_access_pointer(net_families[array_index_nospec(family, NPROTO)]);
 }
 
 static int __init sock_init(void)
diff --git a/net/tipc/net.c b/net/tipc/net.c
index a7f6964c3a4b..62199cf5a56c 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -123,15 +123,13 @@ void tipc_net_finalize(struct net *net, u32 addr)
 {
         struct tipc_net *tn = tipc_net(net);
 
-        spin_lock_bh(&tn->node_list_lock);
-        if (!tipc_own_addr(net)) {
+        if (!cmpxchg(&tn->node_addr, 0, addr)) {
                 tipc_set_node_addr(net, addr);
                 tipc_named_reinit(net);
                 tipc_sk_reinit(net);
                 tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
                                      TIPC_CLUSTER_SCOPE, 0, addr);
         }
-        spin_unlock_bh(&tn->node_list_lock);
 }
 
 void tipc_net_stop(struct net *net)
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index c1076c19b858..ab27a2872935 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -451,14 +451,14 @@ static int vsock_send_shutdown(struct sock *sk, int mode)
         return transport->shutdown(vsock_sk(sk), mode);
 }
 
-void vsock_pending_work(struct work_struct *work)
+static void vsock_pending_work(struct work_struct *work)
 {
         struct sock *sk;
         struct sock *listener;
         struct vsock_sock *vsk;
         bool cleanup;
 
-        vsk = container_of(work, struct vsock_sock, dwork.work);
+        vsk = container_of(work, struct vsock_sock, pending_work.work);
         sk = sk_vsock(vsk);
         listener = vsk->listener;
         cleanup = true;
@@ -498,7 +498,6 @@ out:
         sock_put(sk);
         sock_put(listener);
 }
-EXPORT_SYMBOL_GPL(vsock_pending_work);
 
 /**** SOCKET OPERATIONS ****/
 
@@ -597,6 +596,8 @@ static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr)
         return retval;
 }
 
+static void vsock_connect_timeout(struct work_struct *work);
+
 struct sock *__vsock_create(struct net *net,
                             struct socket *sock,
                             struct sock *parent,
@@ -638,6 +639,8 @@ struct sock *__vsock_create(struct net *net,
         vsk->sent_request = false;
         vsk->ignore_connecting_rst = false;
         vsk->peer_shutdown = 0;
+        INIT_DELAYED_WORK(&vsk->connect_work, vsock_connect_timeout);
+        INIT_DELAYED_WORK(&vsk->pending_work, vsock_pending_work);
 
         psk = parent ? vsock_sk(parent) : NULL;
         if (parent) {
@@ -1117,7 +1120,7 @@ static void vsock_connect_timeout(struct work_struct *work)
         struct vsock_sock *vsk;
         int cancel = 0;
 
-        vsk = container_of(work, struct vsock_sock, dwork.work);
+        vsk = container_of(work, struct vsock_sock, connect_work.work);
         sk = sk_vsock(vsk);
 
         lock_sock(sk);
@@ -1221,9 +1224,7 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
                          * timeout fires.
                          */
                         sock_hold(sk);
-                        INIT_DELAYED_WORK(&vsk->dwork,
-                                          vsock_connect_timeout);
-                        schedule_delayed_work(&vsk->dwork, timeout);
+                        schedule_delayed_work(&vsk->connect_work, timeout);
 
                         /* Skip ahead to preserve error code set above. */
                         goto out_wait;
diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
index a7a73ffe675b..cb332adb84cd 100644
--- a/net/vmw_vsock/vmci_transport.c
+++ b/net/vmw_vsock/vmci_transport.c
@@ -1094,8 +1094,7 @@ static int vmci_transport_recv_listen(struct sock *sk,
         vpending->listener = sk;
         sock_hold(sk);
         sock_hold(pending);
-        INIT_DELAYED_WORK(&vpending->dwork, vsock_pending_work);
-        schedule_delayed_work(&vpending->dwork, HZ);
+        schedule_delayed_work(&vpending->pending_work, HZ);
 
 out:
         return err;
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index 72335c2e8108..4e937cd7c17d 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -84,10 +84,8 @@ static int __xsk_rcv_zc(struct xdp_sock *xs, struct xdp_buff *xdp, u32 len)
 {
         int err = xskq_produce_batch_desc(xs->rx, (u64)xdp->handle, len);
 
-        if (err) {
-                xdp_return_buff(xdp);
+        if (err)
                 xs->rx_dropped++;
-        }
 
         return err;
 }
diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h
index 52ecaf770642..8a64b150be54 100644
--- a/net/xdp/xsk_queue.h
+++ b/net/xdp/xsk_queue.h
@@ -250,7 +250,7 @@ static inline bool xskq_full_desc(struct xsk_queue *q)
 
 static inline bool xskq_empty_desc(struct xsk_queue *q)
 {
-        return xskq_nb_free(q, q->prod_tail, 1) == q->nentries;
+        return xskq_nb_free(q, q->prod_tail, q->nentries) == q->nentries;
 }
 
 void xskq_set_umem(struct xsk_queue *q, struct xdp_umem_props *umem_props);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 5f48251c1319..7c5e8978aeaa 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2286,6 +2286,9 @@ struct dst_entry *xfrm_lookup_route(struct net *net, struct dst_entry *dst_orig,
         if (IS_ERR(dst) && PTR_ERR(dst) == -EREMOTE)
                 return make_blackhole(net, dst_orig->ops->family, dst_orig);
 
+        if (IS_ERR(dst))
+                dst_release(dst_orig);
+
         return dst;
 }
 EXPORT_SYMBOL(xfrm_lookup_route);
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 080035f056d9..33878e6e0d0a 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1025,10 +1025,12 @@ static inline int xfrm_nlmsg_multicast(struct net *net, struct sk_buff *skb,
 {
         struct sock *nlsk = rcu_dereference(net->xfrm.nlsk);
 
-        if (nlsk)
-                return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC);
-        else
-                return -1;
+        if (!nlsk) {
+                kfree_skb(skb);
+                return -EPIPE;
+        }
+
+        return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC);
 }
 
 static inline unsigned int xfrm_spdinfo_msgsize(void)
@@ -1671,9 +1673,11 @@ static inline unsigned int userpolicy_type_attrsize(void)
 #ifdef CONFIG_XFRM_SUB_POLICY
 static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
 {
-        struct xfrm_userpolicy_type upt = {
-                .type = type,
-        };
+        struct xfrm_userpolicy_type upt;
+
+        /* Sadly there are two holes in struct xfrm_userpolicy_type */
+        memset(&upt, 0, sizeof(upt));
+        upt.type = type;
 
         return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
 }
diff --git a/samples/bpf/xdp_redirect_cpu_kern.c b/samples/bpf/xdp_redirect_cpu_kern.c
index 303e9e7161f3..4938dcbaecbf 100644
--- a/samples/bpf/xdp_redirect_cpu_kern.c
+++ b/samples/bpf/xdp_redirect_cpu_kern.c
@@ -14,7 +14,7 @@
 #include <uapi/linux/bpf.h>
 #include "bpf_helpers.h"
 
-#define MAX_CPUS 12 /* WARNING - sync with _user.c */
+#define MAX_CPUS 64 /* WARNING - sync with _user.c */
 
 /* Special map type that can XDP_REDIRECT frames to another CPU */
 struct bpf_map_def SEC("maps") cpu_map = {
diff --git a/samples/bpf/xdp_redirect_cpu_user.c b/samples/bpf/xdp_redirect_cpu_user.c
index f6efaefd485b..4b4d78fffe30 100644
--- a/samples/bpf/xdp_redirect_cpu_user.c
+++ b/samples/bpf/xdp_redirect_cpu_user.c
@@ -19,7 +19,7 @@ static const char *__doc__ =
 #include <arpa/inet.h>
 #include <linux/if_link.h>
 
-#define MAX_CPUS 12 /* WARNING - sync with _kern.c */
+#define MAX_CPUS 64 /* WARNING - sync with _kern.c */
 
 /* How many xdp_progs are defined in _kern.c */
 #define MAX_PROG 5
@@ -527,7 +527,7 @@ static void stress_cpumap(void)
          * procedure.
          */
         create_cpu_entry(1,  1024, 0, false);
-        create_cpu_entry(1,   128, 0, false);
+        create_cpu_entry(1,     8, 0, false);
         create_cpu_entry(1, 16000, 0, false);
 }
 
diff --git a/scripts/Makefile.ubsan b/scripts/Makefile.ubsan
index b593b36ccff8..38b2b4818e8e 100644
--- a/scripts/Makefile.ubsan
+++ b/scripts/Makefile.ubsan
@@ -14,10 +14,6 @@ ifdef CONFIG_UBSAN_ALIGNMENT
       CFLAGS_UBSAN += $(call cc-option, -fsanitize=alignment)
 endif
 
-ifdef CONFIG_UBSAN_NULL
-      CFLAGS_UBSAN += $(call cc-option, -fsanitize=null)
-endif
-
       # -fsanitize=* options makes GCC less smart than usual and
       # increase number of 'maybe-uninitialized false-positives
       CFLAGS_UBSAN += $(call cc-option, -Wno-maybe-uninitialized)
diff --git a/security/Kconfig b/security/Kconfig
index c4302067a3ad..afa91c6f06bb 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -57,7 +57,7 @@ config SECURITY_NETWORK
 config PAGE_TABLE_ISOLATION
         bool "Remove the kernel mapping in user mode"
         default y
-        depends on X86_64 && !UML
+        depends on X86 && !UML
         help
           This feature reduces the number of hardware side channels by
           ensuring that the majority of kernel addresses are not mapped
diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index 097b1a5e046b..f74a8bcbda87 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -36,6 +36,7 @@
 #include <assert.h>
 #include <errno.h>
 #include <fcntl.h>
+#include <linux/kernel.h>
 #include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -90,7 +91,8 @@ static bool map_is_map_of_progs(__u32 type)
 static void *alloc_value(struct bpf_map_info *info)
 {
         if (map_is_per_cpu(info->type))
-                return malloc(info->value_size * get_possible_cpus());
+                return malloc(round_up(info->value_size, 8) *
+                              get_possible_cpus());
         else
                 return malloc(info->value_size);
 }
@@ -161,9 +163,10 @@ static void print_entry_json(struct bpf_map_info *info, unsigned char *key,
                 jsonw_name(json_wtr, "value");
                 print_hex_data_json(value, info->value_size);
         } else {
-                unsigned int i, n;
+                unsigned int i, n, step;
 
                 n = get_possible_cpus();
+                step = round_up(info->value_size, 8);
 
                 jsonw_name(json_wtr, "key");
                 print_hex_data_json(key, info->key_size);
@@ -176,7 +179,7 @@ static void print_entry_json(struct bpf_map_info *info, unsigned char *key,
                         jsonw_int_field(json_wtr, "cpu", i);
 
                         jsonw_name(json_wtr, "value");
-                        print_hex_data_json(value + i * info->value_size,
+                        print_hex_data_json(value + i * step,
                                             info->value_size);
 
                         jsonw_end_object(json_wtr);
@@ -207,9 +210,10 @@ static void print_entry_plain(struct bpf_map_info *info, unsigned char *key,
 
                 printf("\n");
         } else {
-                unsigned int i, n;
+                unsigned int i, n, step;
 
                 n = get_possible_cpus();
+                step = round_up(info->value_size, 8);
 
                 printf("key:\n");
                 fprint_hex(stdout, key, info->key_size, " ");
@@ -217,7 +221,7 @@ static void print_entry_plain(struct bpf_map_info *info, unsigned char *key,
                 for (i = 0; i < n; i++) {
                         printf("value (CPU %02d):%c",
                                i, info->value_size > 16 ? '\n' : ' ');
-                        fprint_hex(stdout, value + i * info->value_size,
+                        fprint_hex(stdout, value + i * step,
                                    info->value_size, " ");
                         printf("\n");
                 }
diff --git a/tools/include/uapi/linux/btf.h b/tools/include/uapi/linux/btf.h
index 0b5ddbe135a4..972265f32871 100644
--- a/tools/include/uapi/linux/btf.h
+++ b/tools/include/uapi/linux/btf.h
@@ -76,7 +76,7 @@ struct btf_type {
  */
 #define BTF_INT_ENCODING(VAL)   (((VAL) & 0x0f000000) >> 24)
 #define BTF_INT_OFFSET(VAL)     (((VAL  & 0x00ff0000)) >> 16)
-#define BTF_INT_BITS(VAL)       ((VAL)  & 0x0000ffff)
+#define BTF_INT_BITS(VAL)       ((VAL)  & 0x000000ff)
 
 /* Attributes stored in the BTF_INT_ENCODING */
 #define BTF_INT_SIGNED  (1 << 0)
diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index 8c54a4b6f187..c36a3a76986a 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -1,8 +1,7 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+// SPDX-License-Identifier: LGPL-2.1
 /* Copyright (c) 2018 Facebook */
 
 #include <stdlib.h>
-#include <stdint.h>
 #include <string.h>
 #include <unistd.h>
 #include <errno.h>
@@ -27,13 +26,13 @@ struct btf {
         struct btf_type **types;
         const char *strings;
         void *nohdr_data;
-        uint32_t nr_types;
-        uint32_t types_size;
-        uint32_t data_size;
+        __u32 nr_types;
+        __u32 types_size;
+        __u32 data_size;
         int fd;
 };
 
-static const char *btf_name_by_offset(const struct btf *btf, uint32_t offset)
+static const char *btf_name_by_offset(const struct btf *btf, __u32 offset)
 {
         if (offset < btf->hdr->str_len)
                 return &btf->strings[offset];
@@ -45,7 +44,7 @@ static int btf_add_type(struct btf *btf, struct btf_type *t)
 {
         if (btf->types_size - btf->nr_types < 2) {
                 struct btf_type **new_types;
-                u32 expand_by, new_size;
+                __u32 expand_by, new_size;
 
                 if (btf->types_size == BTF_MAX_NR_TYPES)
                         return -E2BIG;
@@ -72,7 +71,7 @@ static int btf_add_type(struct btf *btf, struct btf_type *t)
 static int btf_parse_hdr(struct btf *btf, btf_print_fn_t err_log)
 {
         const struct btf_header *hdr = btf->hdr;
-        u32 meta_left;
+        __u32 meta_left;
 
         if (btf->data_size < sizeof(struct btf_header)) {
                 elog("BTF header not found\n");
@@ -151,7 +150,7 @@ static int btf_parse_type_sec(struct btf *btf, btf_print_fn_t err_log)
 
         while (next_type < end_type) {
                 struct btf_type *t = next_type;
-                uint16_t vlen = BTF_INFO_VLEN(t->info);
+                __u16 vlen = BTF_INFO_VLEN(t->info);
                 int err;
 
                 next_type += sizeof(*t);
@@ -190,8 +189,7 @@ static int btf_parse_type_sec(struct btf *btf, btf_print_fn_t err_log)
         return 0;
 }
 
-static const struct btf_type *btf_type_by_id(const struct btf *btf,
-                                             uint32_t type_id)
+const struct btf_type *btf__type_by_id(const struct btf *btf, __u32 type_id)
 {
         if (type_id > btf->nr_types)
                 return NULL;
@@ -209,7 +207,7 @@ static bool btf_type_is_void_or_null(const struct btf_type *t)
         return !t || btf_type_is_void(t);
 }
 
-static int64_t btf_type_size(const struct btf_type *t)
+static __s64 btf_type_size(const struct btf_type *t)
 {
         switch (BTF_INFO_KIND(t->info)) {
         case BTF_KIND_INT:
@@ -226,15 +224,15 @@ static int64_t btf_type_size(const struct btf_type *t)
 
 #define MAX_RESOLVE_DEPTH 32
 
-int64_t btf__resolve_size(const struct btf *btf, uint32_t type_id)
+__s64 btf__resolve_size(const struct btf *btf, __u32 type_id)
 {
         const struct btf_array *array;
         const struct btf_type *t;
-        uint32_t nelems = 1;
-        int64_t size = -1;
+        __u32 nelems = 1;
+        __s64 size = -1;
         int i;
 
-        t = btf_type_by_id(btf, type_id);
+        t = btf__type_by_id(btf, type_id);
         for (i = 0; i < MAX_RESOLVE_DEPTH && !btf_type_is_void_or_null(t);
              i++) {
                 size = btf_type_size(t);
@@ -259,7 +257,7 @@ int64_t btf__resolve_size(const struct btf *btf, uint32_t type_id)
                         return -EINVAL;
                 }
 
-                t = btf_type_by_id(btf, type_id);
+                t = btf__type_by_id(btf, type_id);
         }
 
         if (size < 0)
@@ -271,9 +269,9 @@ int64_t btf__resolve_size(const struct btf *btf, uint32_t type_id)
         return nelems * size;
 }
 
-int32_t btf__find_by_name(const struct btf *btf, const char *type_name)
+__s32 btf__find_by_name(const struct btf *btf, const char *type_name)
 {
-        uint32_t i;
+        __u32 i;
 
         if (!strcmp(type_name, "void"))
                 return 0;
@@ -302,10 +300,9 @@ void btf__free(struct btf *btf)
         free(btf);
 }
 
-struct btf *btf__new(uint8_t *data, uint32_t size,
-                     btf_print_fn_t err_log)
+struct btf *btf__new(__u8 *data, __u32 size, btf_print_fn_t err_log)
 {
-        uint32_t log_buf_size = 0;
+        __u32 log_buf_size = 0;
         char *log_buf = NULL;
         struct btf *btf;
         int err;
diff --git a/tools/lib/bpf/btf.h b/tools/lib/bpf/btf.h
index 74bb344035bb..caac3a404dc5 100644
--- a/tools/lib/bpf/btf.h
+++ b/tools/lib/bpf/btf.h
@@ -1,22 +1,24 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+/* SPDX-License-Identifier: LGPL-2.1 */
 /* Copyright (c) 2018 Facebook */
 
 #ifndef __BPF_BTF_H
 #define __BPF_BTF_H
 
-#include <stdint.h>
+#include <linux/types.h>
 
 #define BTF_ELF_SEC ".BTF"
 
 struct btf;
+struct btf_type;
 
 typedef int (*btf_print_fn_t)(const char *, ...)
         __attribute__((format(printf, 1, 2)));
 
 void btf__free(struct btf *btf);
-struct btf *btf__new(uint8_t *data, uint32_t size, btf_print_fn_t err_log);
-int32_t btf__find_by_name(const struct btf *btf, const char *type_name);
-int64_t btf__resolve_size(const struct btf *btf, uint32_t type_id);
+struct btf *btf__new(__u8 *data, __u32 size, btf_print_fn_t err_log);
+__s32 btf__find_by_name(const struct btf *btf, const char *type_name);
+const struct btf_type *btf__type_by_id(const struct btf *btf, __u32 id);
+__s64 btf__resolve_size(const struct btf *btf, __u32 type_id);
 int btf__fd(const struct btf *btf);
 
 #endif
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index a1e96b5de5ff..1aafdbe827fe 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -36,6 +36,7 @@
 #include <linux/err.h>
 #include <linux/kernel.h>
 #include <linux/bpf.h>
+#include <linux/btf.h>
 #include <linux/list.h>
 #include <linux/limits.h>
 #include <sys/stat.h>
@@ -216,8 +217,8 @@ struct bpf_map {
         size_t offset;
         int map_ifindex;
         struct bpf_map_def def;
-        uint32_t btf_key_type_id;
-        uint32_t btf_value_type_id;
+        __u32 btf_key_type_id;
+        __u32 btf_value_type_id;
         void *priv;
         bpf_map_clear_priv_t clear_priv;
 };
@@ -1014,68 +1015,72 @@ bpf_program__collect_reloc(struct bpf_program *prog, GElf_Shdr *shdr,
 
 static int bpf_map_find_btf_info(struct bpf_map *map, const struct btf *btf)
 {
+        const struct btf_type *container_type;
+        const struct btf_member *key, *value;
         struct bpf_map_def *def = &map->def;
         const size_t max_name = 256;
-        int64_t key_size, value_size;
-        int32_t key_id, value_id;
-        char name[max_name];
+        char container_name[max_name];
+        __s64 key_size, value_size;
+        __s32 container_id;
 
-        /* Find key type by name from BTF */
-        if (snprintf(name, max_name, "%s_key", map->name) == max_name) {
-                pr_warning("map:%s length of BTF key_type:%s_key is too long\n",
+        if (snprintf(container_name, max_name, "____btf_map_%s", map->name) ==
+            max_name) {
+                pr_warning("map:%s length of '____btf_map_%s' is too long\n",
                            map->name, map->name);
                 return -EINVAL;
         }
 
-        key_id = btf__find_by_name(btf, name);
-        if (key_id < 0) {
-                pr_debug("map:%s key_type:%s cannot be found in BTF\n",
-                         map->name, name);
-                return key_id;
+        container_id = btf__find_by_name(btf, container_name);
+        if (container_id < 0) {
+                pr_debug("map:%s container_name:%s cannot be found in BTF. Missing BPF_ANNOTATE_KV_PAIR?\n",
+                         map->name, container_name);
+                return container_id;
         }
 
-        key_size = btf__resolve_size(btf, key_id);
-        if (key_size < 0) {
-                pr_warning("map:%s key_type:%s cannot get the BTF type_size\n",
-                           map->name, name);
-                return key_size;
+        container_type = btf__type_by_id(btf, container_id);
+        if (!container_type) {
+                pr_warning("map:%s cannot find BTF type for container_id:%u\n",
+                           map->name, container_id);
+                return -EINVAL;
         }
 
-        if (def->key_size != key_size) {
-                pr_warning("map:%s key_type:%s has BTF type_size:%u != key_size:%u\n",
-                           map->name, name, (unsigned int)key_size, def->key_size);
+        if (BTF_INFO_KIND(container_type->info) != BTF_KIND_STRUCT ||
+            BTF_INFO_VLEN(container_type->info) < 2) {
+                pr_warning("map:%s container_name:%s is an invalid container struct\n",
+                           map->name, container_name);
                 return -EINVAL;
         }
 
-        /* Find value type from BTF */
-        if (snprintf(name, max_name, "%s_value", map->name) == max_name) {
-                pr_warning("map:%s length of BTF value_type:%s_value is too long\n",
-                          map->name, map->name);
-                return -EINVAL;
+        key = (struct btf_member *)(container_type + 1);
+        value = key + 1;
+
+        key_size = btf__resolve_size(btf, key->type);
+        if (key_size < 0) {
+                pr_warning("map:%s invalid BTF key_type_size\n",
+                           map->name);
+                return key_size;
         }
 
-        value_id = btf__find_by_name(btf, name);
-        if (value_id < 0) {
-                pr_debug("map:%s value_type:%s cannot be found in BTF\n",
-                         map->name, name);
-                return value_id;
+        if (def->key_size != key_size) {
+                pr_warning("map:%s btf_key_type_size:%u != map_def_key_size:%u\n",
+                           map->name, (__u32)key_size, def->key_size);
+                return -EINVAL;
         }
 
-        value_size = btf__resolve_size(btf, value_id);
+        value_size = btf__resolve_size(btf, value->type);
         if (value_size < 0) {
-                pr_warning("map:%s value_type:%s cannot get the BTF type_size\n",
-                           map->name, name);
+                pr_warning("map:%s invalid BTF value_type_size\n", map->name);
                 return value_size;
         }
 
         if (def->value_size != value_size) {
-                pr_warning("map:%s value_type:%s has BTF type_size:%u != value_size:%u\n",
-                           map->name, name, (unsigned int)value_size, def->value_size);
+                pr_warning("map:%s btf_value_type_size:%u != map_def_value_size:%u\n",
+                           map->name, (__u32)value_size, def->value_size);
                 return -EINVAL;
         }
 
-        map->btf_key_type_id = key_id;
-        map->btf_value_type_id = value_id;
+        map->btf_key_type_id = key->type;
+        map->btf_value_type_id = value->type;
 
         return 0;
 }
@@ -2089,12 +2094,12 @@ const char *bpf_map__name(struct bpf_map *map)
         return map ? map->name : NULL;
 }
 
-uint32_t bpf_map__btf_key_type_id(const struct bpf_map *map)
+__u32 bpf_map__btf_key_type_id(const struct bpf_map *map)
 {
         return map ? map->btf_key_type_id : 0;
 }
 
-uint32_t bpf_map__btf_value_type_id(const struct bpf_map *map)
+__u32 bpf_map__btf_value_type_id(const struct bpf_map *map)
 {
         return map ? map->btf_value_type_id : 0;
 }
@@ -2268,8 +2273,8 @@ bpf_perf_event_read_simple(void *mem, unsigned long size,
         volatile struct perf_event_mmap_page *header = mem;
         __u64 data_tail = header->data_tail;
         __u64 data_head = header->data_head;
+        int ret = LIBBPF_PERF_EVENT_ERROR;
         void *base, *begin, *end;
-        int ret;
 
         asm volatile("" ::: "memory"); /* in real code it should be smp_rmb() */
         if (data_head == data_tail)
diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
index 09976531aa74..b33ae02f7d0e 100644
--- a/tools/lib/bpf/libbpf.h
+++ b/tools/lib/bpf/libbpf.h
@@ -244,8 +244,8 @@ bpf_map__next(struct bpf_map *map, struct bpf_object *obj);
 int bpf_map__fd(struct bpf_map *map);
 const struct bpf_map_def *bpf_map__def(struct bpf_map *map);
 const char *bpf_map__name(struct bpf_map *map);
-uint32_t bpf_map__btf_key_type_id(const struct bpf_map *map);
-uint32_t bpf_map__btf_value_type_id(const struct bpf_map *map);
+__u32 bpf_map__btf_key_type_id(const struct bpf_map *map);
+__u32 bpf_map__btf_value_type_id(const struct bpf_map *map);
 
 typedef void (*bpf_map_clear_priv_t)(struct bpf_map *, void *);
 int bpf_map__set_priv(struct bpf_map *map, void *priv,
diff --git a/tools/memory-model/Documentation/explanation.txt b/tools/memory-model/Documentation/explanation.txt
index 1b09f3175a1f..0cbd1ef8f86d 100644
--- a/tools/memory-model/Documentation/explanation.txt
+++ b/tools/memory-model/Documentation/explanation.txt
@@ -804,7 +804,7 @@ type of fence:
 Second, some types of fence affect the way the memory subsystem
 propagates stores.  When a fence instruction is executed on CPU C:
 
-        For each other CPU C', smb_wmb() forces all po-earlier stores
+        For each other CPU C', smp_wmb() forces all po-earlier stores
         on C to propagate to C' before any po-later stores do.
 
         For each other CPU C', any store which propagates to C before
diff --git a/tools/memory-model/Documentation/recipes.txt b/tools/memory-model/Documentation/recipes.txt
index ee4309a87fc4..af72700cc20a 100644
--- a/tools/memory-model/Documentation/recipes.txt
+++ b/tools/memory-model/Documentation/recipes.txt
@@ -126,7 +126,7 @@ However, it is not necessarily the case that accesses ordered by
 locking will be seen as ordered by CPUs not holding that lock.
 Consider this example:
 
-        /* See Z6.0+pooncelock+pooncelock+pombonce.litmus. */
+        /* See Z6.0+pooncerelease+poacquirerelease+fencembonceonce.litmus. */
         void CPU0(void)
         {
                 spin_lock(&mylock);
@@ -292,7 +292,7 @@ and to use smp_load_acquire() instead of smp_rmb().  However, the older
 smp_wmb() and smp_rmb() APIs are still heavily used, so it is important
 to understand their use cases.  The general approach is shown below:
 
-        /* See MP+wmbonceonce+rmbonceonce.litmus. */
+        /* See MP+fencewmbonceonce+fencermbonceonce.litmus. */
         void CPU0(void)
         {
                 WRITE_ONCE(x, 1);
@@ -322,9 +322,9 @@ the following write-side code fragment:
 And the xlog_valid_lsn() function in fs/xfs/xfs_log_priv.h contains
 the corresponding read-side code fragment:
 
-        cur_cycle = ACCESS_ONCE(log->l_curr_cycle);
+        cur_cycle = READ_ONCE(log->l_curr_cycle);
         smp_rmb();
-        cur_block = ACCESS_ONCE(log->l_curr_block);
+        cur_block = READ_ONCE(log->l_curr_block);
 
 Alternatively, consider the following comment in function
 perf_output_put_handle() in kernel/events/ring_buffer.c:
@@ -360,7 +360,7 @@ can be seen in the LB+poonceonces.litmus litmus test.
 One way of avoiding the counter-intuitive outcome is through the use of a
 control dependency paired with a full memory barrier:
 
-        /* See LB+ctrlonceonce+mbonceonce.litmus. */
+        /* See LB+fencembonceonce+ctrlonceonce.litmus. */
         void CPU0(void)
         {
                 r0 = READ_ONCE(x);
@@ -476,7 +476,7 @@ that one CPU first stores to one variable and then loads from a second,
 while another CPU stores to the second variable and then loads from the
 first.  Preserving order requires nothing less than full barriers:
 
-        /* See SB+mbonceonces.litmus. */
+        /* See SB+fencembonceonces.litmus. */
         void CPU0(void)
         {
                 WRITE_ONCE(x, 1);
diff --git a/tools/memory-model/README b/tools/memory-model/README
index 734f7feaa5dc..ee987ce20aae 100644
--- a/tools/memory-model/README
+++ b/tools/memory-model/README
@@ -35,13 +35,13 @@ BASIC USAGE: HERD7
 The memory model is used, in conjunction with "herd7", to exhaustively
 explore the state space of small litmus tests.
 
-For example, to run SB+mbonceonces.litmus against the memory model:
+For example, to run SB+fencembonceonces.litmus against the memory model:
 
-  $ herd7 -conf linux-kernel.cfg litmus-tests/SB+mbonceonces.litmus
+  $ herd7 -conf linux-kernel.cfg litmus-tests/SB+fencembonceonces.litmus
 
 Here is the corresponding output:
 
-  Test SB+mbonceonces Allowed
+  Test SB+fencembonceonces Allowed
   States 3
   0:r0=0; 1:r0=1;
   0:r0=1; 1:r0=0;
@@ -50,8 +50,8 @@ Here is the corresponding output:
   Witnesses
   Positive: 0 Negative: 3
   Condition exists (0:r0=0 /\ 1:r0=0)
-  Observation SB+mbonceonces Never 0 3
-  Time SB+mbonceonces 0.01
+  Observation SB+fencembonceonces Never 0 3
+  Time SB+fencembonceonces 0.01
   Hash=d66d99523e2cac6b06e66f4c995ebb48
 
 The "Positive: 0 Negative: 3" and the "Never 0 3" each indicate that
@@ -67,16 +67,16 @@ BASIC USAGE: KLITMUS7
 The "klitmus7" tool converts a litmus test into a Linux kernel module,
 which may then be loaded and run.
 
-For example, to run SB+mbonceonces.litmus against hardware:
+For example, to run SB+fencembonceonces.litmus against hardware:
 
   $ mkdir mymodules
-  $ klitmus7 -o mymodules litmus-tests/SB+mbonceonces.litmus
+  $ klitmus7 -o mymodules litmus-tests/SB+fencembonceonces.litmus
   $ cd mymodules ; make
   $ sudo sh run.sh
 
 The corresponding output includes:
 
-  Test SB+mbonceonces Allowed
+  Test SB+fencembonceonces Allowed
   Histogram (3 states)
   644580  :>0:r0=1; 1:r0=0;
   644328  :>0:r0=0; 1:r0=1;
@@ -86,8 +86,8 @@ The corresponding output includes:
   Positive: 0, Negative: 2000000
   Condition exists (0:r0=0 /\ 1:r0=0) is NOT validated
   Hash=d66d99523e2cac6b06e66f4c995ebb48
-  Observation SB+mbonceonces Never 0 2000000
-  Time SB+mbonceonces 0.16
+  Observation SB+fencembonceonces Never 0 2000000
+  Time SB+fencembonceonces 0.16
 
 The "Positive: 0 Negative: 2000000" and the "Never 0 2000000" indicate
 that during two million trials, the state specified in this litmus
diff --git a/tools/memory-model/linux-kernel.bell b/tools/memory-model/linux-kernel.bell
index 64f5740e0e75..b84fb2f67109 100644
--- a/tools/memory-model/linux-kernel.bell
+++ b/tools/memory-model/linux-kernel.bell
@@ -13,7 +13,7 @@
 
 "Linux-kernel memory consistency model"
 
-enum Accesses = 'once (*READ_ONCE,WRITE_ONCE,ACCESS_ONCE*) ||
+enum Accesses = 'once (*READ_ONCE,WRITE_ONCE*) ||
                 'release (*smp_store_release*) ||
                 'acquire (*smp_load_acquire*) ||
                 'noreturn (* R of non-return RMW *)
diff --git a/tools/memory-model/litmus-tests/IRIW+mbonceonces+OnceOnce.litmus b/tools/memory-model/litmus-tests/IRIW+fencembonceonces+OnceOnce.litmus
index 98a3716efa37..e729d2776e89 100644
--- a/tools/memory-model/litmus-tests/IRIW+mbonceonces+OnceOnce.litmus
+++ b/tools/memory-model/litmus-tests/IRIW+fencembonceonces+OnceOnce.litmus
@@ -1,4 +1,4 @@
-C IRIW+mbonceonces+OnceOnce
+C IRIW+fencembonceonces+OnceOnce
 
 (*
  * Result: Never
diff --git a/tools/memory-model/litmus-tests/ISA2+pooncelock+pooncelock+pombonce.litmus b/tools/memory-model/litmus-tests/ISA2+pooncelock+pooncelock+pombonce.litmus
index 7a39a0aaa976..0f749e419b34 100644
--- a/tools/memory-model/litmus-tests/ISA2+pooncelock+pooncelock+pombonce.litmus
+++ b/tools/memory-model/litmus-tests/ISA2+pooncelock+pooncelock+pombonce.litmus
@@ -1,4 +1,4 @@
-C ISA2+pooncelock+pooncelock+pombonce.litmus
+C ISA2+pooncelock+pooncelock+pombonce
 
 (*
  * Result: Sometimes
diff --git a/tools/memory-model/litmus-tests/LB+ctrlonceonce+mbonceonce.litmus b/tools/memory-model/litmus-tests/LB+fencembonceonce+ctrlonceonce.litmus
index de6708229dd1..4727f5aaf03b 100644
--- a/tools/memory-model/litmus-tests/LB+ctrlonceonce+mbonceonce.litmus
+++ b/tools/memory-model/litmus-tests/LB+fencembonceonce+ctrlonceonce.litmus
@@ -1,4 +1,4 @@
-C LB+ctrlonceonce+mbonceonce
+C LB+fencembonceonce+ctrlonceonce
 
 (*
  * Result: Never
diff --git a/tools/memory-model/litmus-tests/MP+wmbonceonce+rmbonceonce.litmus b/tools/memory-model/litmus-tests/MP+fencewmbonceonce+fencermbonceonce.litmus
index c078f38ff27a..a273da9faa6d 100644
--- a/tools/memory-model/litmus-tests/MP+wmbonceonce+rmbonceonce.litmus
+++ b/tools/memory-model/litmus-tests/MP+fencewmbonceonce+fencermbonceonce.litmus
@@ -1,4 +1,4 @@
-C MP+wmbonceonce+rmbonceonce
+C MP+fencewmbonceonce+fencermbonceonce
 
 (*
  * Result: Never
diff --git a/tools/memory-model/litmus-tests/R+mbonceonces.litmus b/tools/memory-model/litmus-tests/R+fencembonceonces.litmus
index a0e884ad2132..222a0b850b4a 100644
--- a/tools/memory-model/litmus-tests/R+mbonceonces.litmus
+++ b/tools/memory-model/litmus-tests/R+fencembonceonces.litmus
@@ -1,4 +1,4 @@
-C R+mbonceonces
+C R+fencembonceonces
 
 (*
  * Result: Never
diff --git a/tools/memory-model/litmus-tests/README b/tools/memory-model/litmus-tests/README
index 17eb9a8c222d..4581ec2d3c57 100644
--- a/tools/memory-model/litmus-tests/README
+++ b/tools/memory-model/litmus-tests/README
@@ -18,7 +18,7 @@ CoWW+poonceonce.litmus
         Test of write-write coherence, that is, whether or not two
         successive writes to the same variable are ordered.
 
-IRIW+mbonceonces+OnceOnce.litmus
+IRIW+fencembonceonces+OnceOnce.litmus
         Test of independent reads from independent writes with smp_mb()
         between each pairs of reads.  In other words, is smp_mb()
         sufficient to cause two different reading processes to agree on
@@ -47,7 +47,7 @@ ISA2+pooncerelease+poacquirerelease+poacquireonce.litmus
         Can a release-acquire chain order a prior store against
         a later load?
 
-LB+ctrlonceonce+mbonceonce.litmus
+LB+fencembonceonce+ctrlonceonce.litmus
         Does a control dependency and an smp_mb() suffice for the
         load-buffering litmus test, where each process reads from one
         of two variables then writes to the other?
@@ -88,14 +88,14 @@ MP+porevlocks.litmus
         As below, but with the first access of the writer process
         and the second access of reader process protected by a lock.
 
-MP+wmbonceonce+rmbonceonce.litmus
+MP+fencewmbonceonce+fencermbonceonce.litmus
         Does a smp_wmb() (between the stores) and an smp_rmb() (between
         the loads) suffice for the message-passing litmus test, where one
         process writes data and then a flag, and the other process reads
         the flag and then the data.  (This is similar to the ISA2 tests,
         but with two processes instead of three.)
 
-R+mbonceonces.litmus
+R+fencembonceonces.litmus
         This is the fully ordered (via smp_mb()) version of one of
         the classic counterintuitive litmus tests that illustrates the
         effects of store propagation delays.
@@ -103,7 +103,7 @@ R+mbonceonces.litmus
 R+poonceonces.litmus
         As above, but without the smp_mb() invocations.
 
-SB+mbonceonces.litmus
+SB+fencembonceonces.litmus
         This is the fully ordered (again, via smp_mb() version of store
         buffering, which forms the core of Dekker's mutual-exclusion
         algorithm.
@@ -111,15 +111,24 @@ SB+mbonceonces.litmus
 SB+poonceonces.litmus
         As above, but without the smp_mb() invocations.
 
+SB+rfionceonce-poonceonces.litmus
+        This litmus test demonstrates that LKMM is not fully multicopy
+        atomic.  (Neither is it other multicopy atomic.)  This litmus test
+        also demonstrates the "locations" debugging aid, which designates
+        additional registers and locations to be printed out in the dump
+        of final states in the herd7 output.  Without the "locations"
+        statement, only those registers and locations mentioned in the
+        "exists" clause will be printed.
+
 S+poonceonces.litmus
         As below, but without the smp_wmb() and acquire load.
 
-S+wmbonceonce+poacquireonce.litmus
+S+fencewmbonceonce+poacquireonce.litmus
         Can a smp_wmb(), instead of a release, and an acquire order
         a prior store against a subsequent store?
 
 WRC+poonceonces+Once.litmus
-WRC+pooncerelease+rmbonceonce+Once.litmus
+WRC+pooncerelease+fencermbonceonce+Once.litmus
         These two are members of an extension of the MP litmus-test
         class in which the first write is moved to a separate process.
         The second is forbidden because smp_store_release() is
@@ -134,7 +143,7 @@ Z6.0+pooncelock+poonceLock+pombonce.litmus
         As above, but with smp_mb__after_spinlock() immediately
         following the spin_lock().
 
-Z6.0+pooncerelease+poacquirerelease+mbonceonce.litmus
+Z6.0+pooncerelease+poacquirerelease+fencembonceonce.litmus
         Is the ordering provided by a release-acquire chain sufficient
         to make ordering apparent to accesses by a process that does
         not participate in that release-acquire chain?
diff --git a/tools/memory-model/litmus-tests/S+wmbonceonce+poacquireonce.litmus b/tools/memory-model/litmus-tests/S+fencewmbonceonce+poacquireonce.litmus
index c53350205d28..18479823cd6c 100644
--- a/tools/memory-model/litmus-tests/S+wmbonceonce+poacquireonce.litmus
+++ b/tools/memory-model/litmus-tests/S+fencewmbonceonce+poacquireonce.litmus
@@ -1,4 +1,4 @@
-C S+wmbonceonce+poacquireonce
+C S+fencewmbonceonce+poacquireonce
 
 (*
  * Result: Never
diff --git a/tools/memory-model/litmus-tests/SB+mbonceonces.litmus b/tools/memory-model/litmus-tests/SB+fencembonceonces.litmus
index 74b874ffa8da..ed5fff18d223 100644
--- a/tools/memory-model/litmus-tests/SB+mbonceonces.litmus
+++ b/tools/memory-model/litmus-tests/SB+fencembonceonces.litmus
@@ -1,4 +1,4 @@
-C SB+mbonceonces
+C SB+fencembonceonces
 
 (*
  * Result: Never
diff --git a/tools/memory-model/litmus-tests/SB+rfionceonce-poonceonces.litmus b/tools/memory-model/litmus-tests/SB+rfionceonce-poonceonces.litmus
new file mode 100644
index 000000000000..04a16603660b
--- /dev/null
+++ b/tools/memory-model/litmus-tests/SB+rfionceonce-poonceonces.litmus
@@ -0,0 +1,32 @@
+C SB+rfionceonce-poonceonces
+
+(*
+ * Result: Sometimes
+ *
+ * This litmus test demonstrates that LKMM is not fully multicopy atomic.
+ *)
+
+{}
+
+P0(int *x, int *y)
+{
+        int r1;
+        int r2;
+
+        WRITE_ONCE(*x, 1);
+        r1 = READ_ONCE(*x);
+        r2 = READ_ONCE(*y);
+}
+
+P1(int *x, int *y)
+{
+        int r3;
+        int r4;
+
+        WRITE_ONCE(*y, 1);
+        r3 = READ_ONCE(*y);
+        r4 = READ_ONCE(*x);
+}
+
+locations [0:r1; 1:r3; x; y] (* Debug aid: Print things not in "exists". *)
+exists (0:r2=0 /\ 1:r4=0)
diff --git a/tools/memory-model/litmus-tests/WRC+pooncerelease+rmbonceonce+Once.litmus b/tools/memory-model/litmus-tests/WRC+pooncerelease+fencermbonceonce+Once.litmus
index ad3448b941e6..e9947250d7de 100644
--- a/tools/memory-model/litmus-tests/WRC+pooncerelease+rmbonceonce+Once.litmus
+++ b/tools/memory-model/litmus-tests/WRC+pooncerelease+fencermbonceonce+Once.litmus
@@ -1,4 +1,4 @@
-C WRC+pooncerelease+rmbonceonce+Once
+C WRC+pooncerelease+fencermbonceonce+Once
 
 (*
  * Result: Never
diff --git a/tools/memory-model/litmus-tests/Z6.0+pooncerelease+poacquirerelease+mbonceonce.litmus b/tools/memory-model/litmus-tests/Z6.0+pooncerelease+poacquirerelease+fencembonceonce.litmus
index a20fc3fafb53..88e70b87a683 100644
--- a/tools/memory-model/litmus-tests/Z6.0+pooncerelease+poacquirerelease+mbonceonce.litmus
+++ b/tools/memory-model/litmus-tests/Z6.0+pooncerelease+poacquirerelease+fencembonceonce.litmus
@@ -1,4 +1,4 @@
-C Z6.0+pooncerelease+poacquirerelease+mbonceonce
+C Z6.0+pooncerelease+poacquirerelease+fencembonceonce
 
 (*
  * Result: Sometimes
diff --git a/tools/memory-model/scripts/checkalllitmus.sh b/tools/memory-model/scripts/checkalllitmus.sh
index af0aa15ab84e..ca528f9a24d4 100644..100755
--- a/tools/memory-model/scripts/checkalllitmus.sh
+++ b/tools/memory-model/scripts/checkalllitmus.sh
@@ -9,7 +9,7 @@
 # appended.
 #
 # Usage:
-#       sh checkalllitmus.sh [ directory ]
+#       checkalllitmus.sh [ directory ]
 #
 # The LINUX_HERD_OPTIONS environment variable may be used to specify
 # arguments to herd, whose default is defined by the checklitmus.sh script.
diff --git a/tools/memory-model/scripts/checklitmus.sh b/tools/memory-model/scripts/checklitmus.sh
index e2e477472844..bf12a75c0719 100644..100755
--- a/tools/memory-model/scripts/checklitmus.sh
+++ b/tools/memory-model/scripts/checklitmus.sh
@@ -8,7 +8,7 @@
 # with ".out" appended.
 #
 # Usage:
-#       sh checklitmus.sh file.litmus
+#       checklitmus.sh file.litmus
 #
 # The LINUX_HERD_OPTIONS environment variable may be used to specify
 # arguments to herd, which default to "-conf linux-kernel.cfg".  Thus,
diff --git a/tools/objtool/arch/x86/include/asm/orc_types.h b/tools/objtool/arch/x86/include/asm/orc_types.h
index 9c9dc579bd7d..46f516dd80ce 100644
--- a/tools/objtool/arch/x86/include/asm/orc_types.h
+++ b/tools/objtool/arch/x86/include/asm/orc_types.h
@@ -88,6 +88,7 @@ struct orc_entry {
         unsigned        sp_reg:4;
         unsigned        bp_reg:4;
         unsigned        type:2;
+        unsigned        end:1;
 } __packed;
 
 /*
@@ -101,6 +102,7 @@ struct unwind_hint {
         s16             sp_offset;
         u8              sp_reg;
         u8              type;
+        u8              end;
 };
 #endif /* __ASSEMBLY__ */
 
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index f4a25bd1871f..2928939b98ec 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -1157,6 +1157,7 @@ static int read_unwind_hints(struct objtool_file *file)
 
                 cfa->offset = hint->sp_offset;
                 insn->state.type = hint->type;
+                insn->state.end = hint->end;
         }
 
         return 0;
diff --git a/tools/objtool/check.h b/tools/objtool/check.h
index c6b68fcb926f..95700a2bcb7c 100644
--- a/tools/objtool/check.h
+++ b/tools/objtool/check.h
@@ -31,7 +31,7 @@ struct insn_state {
         int stack_size;
         unsigned char type;
         bool bp_scratch;
-        bool drap;
+        bool drap, end;
         int drap_reg, drap_offset;
         struct cfi_reg vals[CFI_NUM_REGS];
 };
diff --git a/tools/objtool/orc_dump.c b/tools/objtool/orc_dump.c
index c3343820916a..faa444270ee3 100644
--- a/tools/objtool/orc_dump.c
+++ b/tools/objtool/orc_dump.c
@@ -203,7 +203,8 @@ int orc_dump(const char *_objname)
 
                 print_reg(orc[i].bp_reg, orc[i].bp_offset);
 
-                printf(" type:%s\n", orc_type_name(orc[i].type));
+                printf(" type:%s end:%d\n",
+                       orc_type_name(orc[i].type), orc[i].end);
         }
 
         elf_end(elf);
diff --git a/tools/objtool/orc_gen.c b/tools/objtool/orc_gen.c
index 18384d9be4e1..3f98dcfbc177 100644
--- a/tools/objtool/orc_gen.c
+++ b/tools/objtool/orc_gen.c
@@ -31,6 +31,8 @@ int create_orc(struct objtool_file *file)
                 struct cfi_reg *cfa = &insn->state.cfa;
                 struct cfi_reg *bp = &insn->state.regs[CFI_BP];
 
+                orc->end = insn->state.end;
+
                 if (cfa->base == CFI_UNDEFINED) {
                         orc->sp_reg = ORC_REG_UNDEFINED;
                         continue;
diff --git a/tools/power/x86/turbostat/turbostat.8 b/tools/power/x86/turbostat/turbostat.8
index d39e4ff7d0bf..a6db83a88e85 100644
--- a/tools/power/x86/turbostat/turbostat.8
+++ b/tools/power/x86/turbostat/turbostat.8
@@ -106,7 +106,7 @@ The system configuration dump (if --quiet is not used) is followed by statistics
 \fBC1%, C2%, C3%\fP The residency percentage that Linux requested C1, C2, C3....  The system summary is the average of all CPUs in the system.  Note that these are software, reflecting what was requested.  The hardware counters reflect what was actually achieved.
 \fBCPU%c1, CPU%c3, CPU%c6, CPU%c7\fP show the percentage residency in hardware core idle states.  These numbers are from hardware residency counters.
 \fBCoreTmp\fP Degrees Celsius reported by the per-core Digital Thermal Sensor.
-\fBPkgTtmp\fP Degrees Celsius reported by the per-package Package Thermal Monitor.
+\fBPkgTmp\fP Degrees Celsius reported by the per-package Package Thermal Monitor.
 \fBGFX%rc6\fP The percentage of time the GPU is in the "render C6" state, rc6, during the measurement interval. From /sys/class/drm/card0/power/rc6_residency_ms.
 \fBGFXMHz\fP Instantaneous snapshot of what sysfs presents at the end of the measurement interval. From /sys/class/graphics/fb0/device/drm/card0/gt_cur_freq_mhz.
 \fBPkg%pc2, Pkg%pc3, Pkg%pc6, Pkg%pc7\fP percentage residency in hardware package idle states.  These numbers are from hardware residency counters.
@@ -114,7 +114,7 @@ The system configuration dump (if --quiet is not used) is followed by statistics
 \fBCorWatt\fP Watts consumed by the core part of the package.
 \fBGFXWatt\fP Watts consumed by the Graphics part of the package -- available only on client processors.
 \fBRAMWatt\fP Watts consumed by the DRAM DIMMS -- available only on server processors.
-\fBPKG_%\fP percent of the interval that RAPL throttling was active on the Package.
+\fBPKG_%\fP percent of the interval that RAPL throttling was active on the Package.  Note that the system summary is the sum of the package throttling time, and thus may be higher than 100% on a multi-package system.  Note that the meaning of this field is model specific.  For example, some hardware increments this counter when RAPL responds to thermal limits, but does not increment this counter when RAPL responds to power limits.  Comparing PkgWatt and PkgTmp to system limits is necessary.
 \fBRAM_%\fP percent of the interval that RAPL throttling was active on DRAM.
 .fi
 .SH TOO MUCH INFORMATION EXAMPLE
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index 4d14bbbf9b63..980bd9d20646 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -1163,9 +1163,7 @@ void format_all_counters(struct thread_data *t, struct core_data *c, struct pkg_
         if (!printed || !summary_only)
                 print_header("\t");
 
-        if (topo.num_cpus > 1)
-                format_counters(&average.threads, &average.cores,
-                        &average.packages);
+        format_counters(&average.threads, &average.cores, &average.packages);
 
         printed = 1;
 
@@ -1692,7 +1690,7 @@ void get_apic_id(struct thread_data *t)
         t->x2apic_id = edx;
 
         if (debug && (t->apic_id != t->x2apic_id))
-                fprintf(stderr, "cpu%d: apic 0x%x x2apic 0x%x\n", t->cpu_id, t->apic_id, t->x2apic_id);
+                fprintf(outf, "cpu%d: apic 0x%x x2apic 0x%x\n", t->cpu_id, t->apic_id, t->x2apic_id);
 }
 
 /*
@@ -2473,55 +2471,43 @@ int get_core_id(int cpu)
 
 void set_node_data(void)
 {
-        char path[80];
-        FILE *filep;
-        int pkg, node, cpu;
-
-        struct pkg_node_info {
-                int count;
-                int min;
-        } *pni;
-
-        pni = calloc(topo.num_packages, sizeof(struct pkg_node_info));
-        if (!pni)
-                err(1, "calloc pkg_node_count");
-
-        for (pkg = 0; pkg < topo.num_packages; pkg++)
-                pni[pkg].min = topo.num_cpus;
-
-        for (node = 0; node <= topo.max_node_num; node++) {
-                /* find the "first" cpu in the node */
-                sprintf(path, "/sys/bus/node/devices/node%d/cpulist", node);
-                filep = fopen(path, "r");
-                if (!filep)
-                        continue;
-                fscanf(filep, "%d", &cpu);
-                fclose(filep);
-
-                pkg = cpus[cpu].physical_package_id;
-                pni[pkg].count++;
-
-                if (node < pni[pkg].min)
-                        pni[pkg].min = node;
-        }
-
-        for (pkg = 0; pkg < topo.num_packages; pkg++)
-                if (pni[pkg].count > topo.nodes_per_pkg)
-                        topo.nodes_per_pkg = pni[0].count;
-
-        /* Fake 1 node per pkg for machines that don't
-         * expose nodes and thus avoid -nan results
-         */
-        if (topo.nodes_per_pkg == 0)
-                topo.nodes_per_pkg = 1;
-
-        for (cpu = 0; cpu < topo.num_cpus; cpu++) {
-                pkg = cpus[cpu].physical_package_id;
-                node = cpus[cpu].physical_node_id;
-                cpus[cpu].logical_node_id = node - pni[pkg].min;
+        int pkg, node, lnode, cpu, cpux;
+        int cpu_count;
+
+        /* initialize logical_node_id */
+        for (cpu = 0; cpu <= topo.max_cpu_num; ++cpu)
+                cpus[cpu].logical_node_id = -1;
+
+        cpu_count = 0;
+        for (pkg = 0; pkg < topo.num_packages; pkg++) {
+                lnode = 0;
+                for (cpu = 0; cpu <= topo.max_cpu_num; ++cpu) {
+                        if (cpus[cpu].physical_package_id != pkg)
+                                continue;
+                        /* find a cpu with an unset logical_node_id */
+                        if (cpus[cpu].logical_node_id != -1)
+                                continue;
+                        cpus[cpu].logical_node_id = lnode;
+                        node = cpus[cpu].physical_node_id;
+                        cpu_count++;
+                        /*
+                         * find all matching cpus on this pkg and set
+                         * the logical_node_id
+                         */
+                        for (cpux = cpu; cpux <= topo.max_cpu_num; cpux++) {
+                                if ((cpus[cpux].physical_package_id == pkg) &&
+                                   (cpus[cpux].physical_node_id == node)) {
+                                        cpus[cpux].logical_node_id = lnode;
+                                        cpu_count++;
+                                }
+                        }
+                        lnode++;
+                        if (lnode > topo.nodes_per_pkg)
+                                topo.nodes_per_pkg = lnode;
+                }
+                if (cpu_count >= topo.max_cpu_num)
+                        break;
         }
-        free(pni);
-
 }
 
 int get_physical_node_id(struct cpu_topology *thiscpu)
@@ -4471,7 +4457,9 @@ void process_cpuid()
         family = (fms >> 8) & 0xf;
         model = (fms >> 4) & 0xf;
         stepping = fms & 0xf;
-        if (family == 6 || family == 0xf)
+        if (family == 0xf)
+                family += (fms >> 20) & 0xff;
+        if (family >= 6)
                 model += ((fms >> 16) & 0xf) << 4;
 
         if (!quiet) {
@@ -4840,16 +4828,8 @@ void topology_probe()
                 siblings = get_thread_siblings(&cpus[i]);
                 if (siblings > max_siblings)
                         max_siblings = siblings;
-                if (cpus[i].thread_id != -1)
+                if (cpus[i].thread_id == 0)
                         topo.num_cores++;
-
-                if (debug > 1)
-                        fprintf(outf,
-                                "cpu %d pkg %d node %d core %d thread %d\n",
-                                i, cpus[i].physical_package_id,
-                                cpus[i].physical_node_id,
-                                cpus[i].physical_core_id,
-                                cpus[i].thread_id);
         }
 
         topo.cores_per_node = max_core_id + 1;
@@ -4875,6 +4855,20 @@ void topology_probe()
         topo.threads_per_core = max_siblings;
         if (debug > 1)
                 fprintf(outf, "max_siblings %d\n", max_siblings);
+
+        if (debug < 1)
+                return;
+
+        for (i = 0; i <= topo.max_cpu_num; ++i) {
+                fprintf(outf,
+                        "cpu %d pkg %d node %d lnode %d core %d thread %d\n",
+                        i, cpus[i].physical_package_id,
+                        cpus[i].physical_node_id,
+                        cpus[i].logical_node_id,
+                        cpus[i].physical_core_id,
+                        cpus[i].thread_id);
+        }
+
 }
 
 void
@@ -5102,7 +5096,7 @@ int get_and_dump_counters(void)
 }
 
 void print_version() {
-        fprintf(outf, "turbostat version 18.06.20"
+        fprintf(outf, "turbostat version 18.07.27"
                 " - Len Brown <lenb@kernel.org>\n");
 }
 
diff --git a/tools/testing/selftests/bpf/bpf_helpers.h b/tools/testing/selftests/bpf/bpf_helpers.h
index f2f28b6c8915..810de20e8e26 100644
--- a/tools/testing/selftests/bpf/bpf_helpers.h
+++ b/tools/testing/selftests/bpf/bpf_helpers.h
@@ -158,6 +158,15 @@ struct bpf_map_def {
         unsigned int numa_node;
 };
 
+#define BPF_ANNOTATE_KV_PAIR(name, type_key, type_val)          \
+        struct ____btf_map_##name {                             \
+                type_key key;                                   \
+                type_val value;                                 \
+        };                                                      \
+        struct ____btf_map_##name                               \
+        __attribute__ ((section(".maps." #name), used))         \
+                ____btf_map_##name = { }
+
 static int (*bpf_skb_load_bytes)(void *ctx, int off, void *to, int len) =
         (void *) BPF_FUNC_skb_load_bytes;
 static int (*bpf_skb_store_bytes)(void *ctx, int off, void *from, int len, int flags) =
diff --git a/tools/testing/selftests/bpf/test_btf.c b/tools/testing/selftests/bpf/test_btf.c
index 3619f3023088..ffdd27737c9e 100644
--- a/tools/testing/selftests/bpf/test_btf.c
+++ b/tools/testing/selftests/bpf/test_btf.c
@@ -247,6 +247,34 @@ static struct btf_raw_test raw_tests[] = {
         .max_entries = 4,
 },
 
+{
+        .descr = "struct test #3 Invalid member offset",
+        .raw_types = {
+                /* int */                                       /* [1] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),
+                /* int64 */                                     /* [2] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 64, 8),
+
+                /* struct A { */                                /* [3] */
+                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 2), 16),
+                BTF_MEMBER_ENC(NAME_TBD, 1, 64),        /* int m;               */
+                BTF_MEMBER_ENC(NAME_TBD, 2, 0),         /* int64 n; */
+                /* } */
+                BTF_END_RAW,
+        },
+        .str_sec = "\0A\0m\0n\0",
+        .str_sec_size = sizeof("\0A\0m\0n\0"),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "struct_test3_map",
+        .key_size = sizeof(int),
+        .value_size = 16,
+        .key_type_id = 1,
+        .value_type_id = 3,
+        .max_entries = 4,
+        .btf_load_err = true,
+        .err_str = "Invalid member bits_offset",
+},
+
 /* Test member exceeds the size of struct.
  *
  * struct A {
@@ -479,7 +507,7 @@ static struct btf_raw_test raw_tests[] = {
         .key_size = sizeof(int),
         .value_size = sizeof(void *) * 4,
         .key_type_id = 1,
-        .value_type_id = 4,
+        .value_type_id = 5,
         .max_entries = 4,
 },
 
@@ -1264,6 +1292,88 @@ static struct btf_raw_test raw_tests[] = {
         .err_str = "type != 0",
 },
 
+{
+        .descr = "arraymap invalid btf key (a bit field)",
+        .raw_types = {
+                /* int */                               /* [1] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),
+                /* 32 bit int with 32 bit offset */     /* [2] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 32, 32, 8),
+                BTF_END_RAW,
+        },
+        .str_sec = "",
+        .str_sec_size = sizeof(""),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "array_map_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 2,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .map_create_err = true,
+},
+
+{
+        .descr = "arraymap invalid btf key (!= 32 bits)",
+        .raw_types = {
+                /* int */                               /* [1] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),
+                /* 16 bit int with 0 bit offset */      /* [2] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 16, 2),
+                BTF_END_RAW,
+        },
+        .str_sec = "",
+        .str_sec_size = sizeof(""),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "array_map_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 2,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .map_create_err = true,
+},
+
+{
+        .descr = "arraymap invalid btf value (too small)",
+        .raw_types = {
+                /* int */                               /* [1] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),
+                BTF_END_RAW,
+        },
+        .str_sec = "",
+        .str_sec_size = sizeof(""),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "array_map_check_btf",
+        .key_size = sizeof(int),
+        /* btf_value_size < map->value_size */
+        .value_size = sizeof(__u64),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .map_create_err = true,
+},
+
+{
+        .descr = "arraymap invalid btf value (too big)",
+        .raw_types = {
+                /* int */                               /* [1] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),
+                BTF_END_RAW,
+        },
+        .str_sec = "",
+        .str_sec_size = sizeof(""),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "array_map_check_btf",
+        .key_size = sizeof(int),
+        /* btf_value_size > map->value_size */
+        .value_size = sizeof(__u16),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .map_create_err = true,
+},
+
 }; /* struct btf_raw_test raw_tests[] */
 
 static const char *get_next_str(const char *start, const char *end)
@@ -2023,7 +2133,7 @@ static struct btf_raw_test pprint_test = {
                 BTF_ENUM_ENC(NAME_TBD, 2),
                 BTF_ENUM_ENC(NAME_TBD, 3),
                 /* struct pprint_mapv */                /* [16] */
-                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 8), 28),
+                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 8), 32),
                 BTF_MEMBER_ENC(NAME_TBD, 11, 0),        /* uint32_t ui32 */
                 BTF_MEMBER_ENC(NAME_TBD, 10, 32),       /* uint16_t ui16 */
                 BTF_MEMBER_ENC(NAME_TBD, 12, 64),       /* int32_t si32 */
diff --git a/tools/testing/selftests/bpf/test_btf_haskv.c b/tools/testing/selftests/bpf/test_btf_haskv.c
index 8c7ca096ecf2..b21b876f475d 100644
--- a/tools/testing/selftests/bpf/test_btf_haskv.c
+++ b/tools/testing/selftests/bpf/test_btf_haskv.c
@@ -10,11 +10,6 @@ struct ipv_counts {
         unsigned int v6;
 };
 
-typedef int btf_map_key;
-typedef struct ipv_counts btf_map_value;
-btf_map_key dumm_key;
-btf_map_value dummy_value;
-
 struct bpf_map_def SEC("maps") btf_map = {
         .type = BPF_MAP_TYPE_ARRAY,
         .key_size = sizeof(int),
@@ -22,6 +17,8 @@ struct bpf_map_def SEC("maps") btf_map = {
         .max_entries = 4,
 };
 
+BPF_ANNOTATE_KV_PAIR(btf_map, int, struct ipv_counts);
+
 struct dummy_tracepoint_args {
         unsigned long long pad;
         struct sock *sock;
diff --git a/tools/testing/selftests/bpf/test_lwt_seg6local.sh b/tools/testing/selftests/bpf/test_lwt_seg6local.sh
index 270fa8f49573..785eabf2a593 100755
--- a/tools/testing/selftests/bpf/test_lwt_seg6local.sh
+++ b/tools/testing/selftests/bpf/test_lwt_seg6local.sh
@@ -115,14 +115,14 @@ ip netns exec ns2 ip -6 route add fb00::6 encap bpf in obj test_lwt_seg6local.o
 ip netns exec ns2 ip -6 route add fd00::1 dev veth3 via fb00::43 scope link
 
 ip netns exec ns3 ip -6 route add fc42::1 dev veth5 via fb00::65
-ip netns exec ns3 ip -6 route add fd00::1 encap seg6local action End.BPF obj test_lwt_seg6local.o sec add_egr_x dev veth4
+ip netns exec ns3 ip -6 route add fd00::1 encap seg6local action End.BPF endpoint obj test_lwt_seg6local.o sec add_egr_x dev veth4
 
-ip netns exec ns4 ip -6 route add fd00::2 encap seg6local action End.BPF obj test_lwt_seg6local.o sec pop_egr dev veth6
+ip netns exec ns4 ip -6 route add fd00::2 encap seg6local action End.BPF endpoint obj test_lwt_seg6local.o sec pop_egr dev veth6
 ip netns exec ns4 ip -6 addr add fc42::1 dev lo
 ip netns exec ns4 ip -6 route add fd00::3 dev veth7 via fb00::87
 
 ip netns exec ns5 ip -6 route add fd00::4 table 117 dev veth9 via fb00::109
-ip netns exec ns5 ip -6 route add fd00::3 encap seg6local action End.BPF obj test_lwt_seg6local.o sec inspect_t dev veth8
+ip netns exec ns5 ip -6 route add fd00::3 encap seg6local action End.BPF endpoint obj test_lwt_seg6local.o sec inspect_t dev veth8
 
 ip netns exec ns6 ip -6 addr add fb00::6/16 dev lo
 ip netns exec ns6 ip -6 addr add fd00::4/16 dev lo
diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
index 9e78df207919..0c7d9e556b47 100644
--- a/tools/testing/selftests/bpf/test_sockmap.c
+++ b/tools/testing/selftests/bpf/test_sockmap.c
@@ -354,7 +354,7 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,
                 while (s->bytes_recvd < total_bytes) {
                         if (txmsg_cork) {
                                 timeout.tv_sec = 0;
-                                timeout.tv_usec = 1000;
+                                timeout.tv_usec = 300000;
                         } else {
                                 timeout.tv_sec = 1;
                                 timeout.tv_usec = 0;
diff --git a/tools/testing/selftests/net/tcp_mmap.c b/tools/testing/selftests/net/tcp_mmap.c
index 77f762780199..e8c5dff448eb 100644
--- a/tools/testing/selftests/net/tcp_mmap.c
+++ b/tools/testing/selftests/net/tcp_mmap.c
@@ -402,7 +402,7 @@ int main(int argc, char *argv[])
                 exit(1);
         }
 
-        fd = socket(AF_INET6, SOCK_STREAM, 0);
+        fd = socket(cfg_family, SOCK_STREAM, 0);
         if (fd == -1) {
                 perror("socket");
                 exit(1);
diff --git a/tools/testing/selftests/rcutorture/bin/configinit.sh b/tools/testing/selftests/rcutorture/bin/configinit.sh
index c15f270e121d..65541c21a544 100755
--- a/tools/testing/selftests/rcutorture/bin/configinit.sh
+++ b/tools/testing/selftests/rcutorture/bin/configinit.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# Usage: configinit.sh config-spec-file [ build output dir ]
+# Usage: configinit.sh config-spec-file build-output-dir results-dir
 #
 # Create a .config file from the spec file.  Run from the kernel source tree.
 # Exits with 0 if all went well, with 1 if all went well but the config
@@ -40,20 +40,18 @@ mkdir $T
 
 c=$1
 buildloc=$2
+resdir=$3
 builddir=
-if test -n $buildloc
+if echo $buildloc | grep -q '^O='
 then
-        if echo $buildloc | grep -q '^O='
+        builddir=`echo $buildloc | sed -e 's/^O=//'`
+        if test ! -d $builddir
         then
-                builddir=`echo $buildloc | sed -e 's/^O=//'`
-                if test ! -d $builddir
-                then
-                        mkdir $builddir
-                fi
-        else
-                echo Bad build directory: \"$buildloc\"
-                exit 2
+                mkdir $builddir
         fi
+else
+        echo Bad build directory: \"$buildloc\"
+        exit 2
 fi
 
 sed -e 's/^\(CONFIG[0-9A-Z_]*\)=.*$/grep -v "^# \1" |/' < $c > $T/u.sh
@@ -61,12 +59,12 @@ sed -e 's/^\(CONFIG[0-9A-Z_]*=\).*$/grep -v \1 |/' < $c >> $T/u.sh
 grep '^grep' < $T/u.sh > $T/upd.sh
 echo "cat - $c" >> $T/upd.sh
 make mrproper
-make $buildloc distclean > $builddir/Make.distclean 2>&1
-make $buildloc $TORTURE_DEFCONFIG > $builddir/Make.defconfig.out 2>&1
+make $buildloc distclean > $resdir/Make.distclean 2>&1
+make $buildloc $TORTURE_DEFCONFIG > $resdir/Make.defconfig.out 2>&1
 mv $builddir/.config $builddir/.config.sav
 sh $T/upd.sh < $builddir/.config.sav > $builddir/.config
 cp $builddir/.config $builddir/.config.new
-yes '' | make $buildloc oldconfig > $builddir/Make.oldconfig.out 2> $builddir/Make.oldconfig.err
+yes '' | make $buildloc oldconfig > $resdir/Make.oldconfig.out 2> $resdir/Make.oldconfig.err
 
 # verify new config matches specification.
 configcheck.sh $builddir/.config $c
diff --git a/tools/testing/selftests/rcutorture/bin/kvm-build.sh b/tools/testing/selftests/rcutorture/bin/kvm-build.sh
index 34d126734cde..9115fcdb5617 100755
--- a/tools/testing/selftests/rcutorture/bin/kvm-build.sh
+++ b/tools/testing/selftests/rcutorture/bin/kvm-build.sh
@@ -2,7 +2,7 @@
 #
 # Build a kvm-ready Linux kernel from the tree in the current directory.
 #
-# Usage: kvm-build.sh config-template build-dir
+# Usage: kvm-build.sh config-template build-dir resdir
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -29,6 +29,7 @@ then
         exit 1
 fi
 builddir=${2}
+resdir=${3}
 
 T=${TMPDIR-/tmp}/test-linux.sh.$$
 trap 'rm -rf $T' 0
@@ -41,19 +42,19 @@ CONFIG_VIRTIO_PCI=y
 CONFIG_VIRTIO_CONSOLE=y
 ___EOF___
 
-configinit.sh $T/config O=$builddir
+configinit.sh $T/config O=$builddir $resdir
 retval=$?
 if test $retval -gt 1
 then
         exit 2
 fi
 ncpus=`cpus2use.sh`
-make O=$builddir -j$ncpus $TORTURE_KMAKE_ARG > $builddir/Make.out 2>&1
+make O=$builddir -j$ncpus $TORTURE_KMAKE_ARG > $resdir/Make.out 2>&1
 retval=$?
-if test $retval -ne 0 || grep "rcu[^/]*": < $builddir/Make.out | egrep -q "Stop|Error|error:|warning:" || egrep -q "Stop|Error|error:" < $builddir/Make.out
+if test $retval -ne 0 || grep "rcu[^/]*": < $resdir/Make.out | egrep -q "Stop|Error|error:|warning:" || egrep -q "Stop|Error|error:" < $resdir/Make.out
 then
         echo Kernel build error
-        egrep "Stop|Error|error:|warning:" < $builddir/Make.out
+        egrep "Stop|Error|error:|warning:" < $resdir/Make.out
         echo Run aborted.
         exit 3
 fi
diff --git a/tools/testing/selftests/rcutorture/bin/kvm-recheck-rcu.sh b/tools/testing/selftests/rcutorture/bin/kvm-recheck-rcu.sh
index 477ecb1293ab..0fa8a61ccb7b 100755
--- a/tools/testing/selftests/rcutorture/bin/kvm-recheck-rcu.sh
+++ b/tools/testing/selftests/rcutorture/bin/kvm-recheck-rcu.sh
@@ -70,4 +70,5 @@ else
         else
                 print_warning $nclosecalls "Reader Batch close calls in" $(($dur/60)) minute run: $i
         fi
+        echo $nclosecalls "Reader Batch close calls in" $(($dur/60)) minute run: $i > $i/console.log.rcu.diags
 fi
diff --git a/tools/testing/selftests/rcutorture/bin/kvm-recheck.sh b/tools/testing/selftests/rcutorture/bin/kvm-recheck.sh
index c27e97824163..c9bab57a77eb 100755
--- a/tools/testing/selftests/rcutorture/bin/kvm-recheck.sh
+++ b/tools/testing/selftests/rcutorture/bin/kvm-recheck.sh
@@ -39,6 +39,7 @@ do
                         head -1 $resdir/log
                 fi
                 TORTURE_SUITE="`cat $i/../TORTURE_SUITE`"
+                rm -f $i/console.log.*.diags
                 kvm-recheck-${TORTURE_SUITE}.sh $i
                 if test -f "$i/console.log"
                 then
diff --git a/tools/testing/selftests/rcutorture/bin/kvm-test-1-run.sh b/tools/testing/selftests/rcutorture/bin/kvm-test-1-run.sh
index c5b0f94341d9..f7247ee00514 100755
--- a/tools/testing/selftests/rcutorture/bin/kvm-test-1-run.sh
+++ b/tools/testing/selftests/rcutorture/bin/kvm-test-1-run.sh
@@ -98,14 +98,15 @@ then
         ln -s $base_resdir/.config $resdir  # for kvm-recheck.sh
         # Arch-independent indicator
         touch $resdir/builtkernel
-elif kvm-build.sh $T/Kc2 $builddir
+elif kvm-build.sh $T/Kc2 $builddir $resdir
 then
         # Had to build a kernel for this test.
         QEMU="`identify_qemu $builddir/vmlinux`"
         BOOT_IMAGE="`identify_boot_image $QEMU`"
-        cp $builddir/Make*.out $resdir
         cp $builddir/vmlinux $resdir
         cp $builddir/.config $resdir
+        cp $builddir/Module.symvers $resdir > /dev/null || :
+        cp $builddir/System.map $resdir > /dev/null || :
         if test -n "$BOOT_IMAGE"
         then
                 cp $builddir/$BOOT_IMAGE $resdir
diff --git a/tools/testing/selftests/rcutorture/bin/kvm.sh b/tools/testing/selftests/rcutorture/bin/kvm.sh
index 56610dbbdf73..5a7a62d76a50 100755
--- a/tools/testing/selftests/rcutorture/bin/kvm.sh
+++ b/tools/testing/selftests/rcutorture/bin/kvm.sh
@@ -347,7 +347,7 @@ function dump(first, pastlast, batchnum)
         print "needqemurun="
         jn=1
         for (j = first; j < pastlast; j++) {
-                builddir=KVM "/b" jn
+                builddir=KVM "/b1"
                 cpusr[jn] = cpus[j];
                 if (cfrep[cf[j]] == "") {
                         cfr[jn] = cf[j];
diff --git a/tools/testing/selftests/rcutorture/bin/parse-console.sh b/tools/testing/selftests/rcutorture/bin/parse-console.sh
index 17293436f551..84933f6aed77 100755
--- a/tools/testing/selftests/rcutorture/bin/parse-console.sh
+++ b/tools/testing/selftests/rcutorture/bin/parse-console.sh
@@ -163,6 +163,13 @@ then
         print_warning Summary: $summary
         cat $T.diags >> $file.diags
 fi
+for i in $file.*.diags
+do
+        if test -f "$i"
+        then
+                cat $i >> $file.diags
+        fi
+done
 if ! test -s $file.diags
 then
         rm -f $file.diags
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot b/tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot
index 5d2cc0bd50a0..5c3213cc3ad7 100644
--- a/tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TREE03.boot
@@ -1,5 +1,5 @@
-rcutorture.onoff_interval=1 rcutorture.onoff_holdoff=30
-rcutree.gp_preinit_delay=3
+rcutorture.onoff_interval=200 rcutorture.onoff_holdoff=30
+rcutree.gp_preinit_delay=12
 rcutree.gp_init_delay=3
 rcutree.gp_cleanup_delay=3
 rcutree.kthread_prio=2
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TREE08-T.boot b/tools/testing/selftests/rcutorture/configs/rcu/TREE08-T.boot
deleted file mode 100644
index 883149b5f2d1..000000000000
--- a/tools/testing/selftests/rcutorture/configs/rcu/TREE08-T.boot
+++ /dev/null
@@ -1 +0,0 @@
-rcutree.rcu_fanout_exact=1
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/ver_functions.sh b/tools/testing/selftests/rcutorture/configs/rcu/ver_functions.sh
index 24ec91041957..7bab8246392b 100644
--- a/tools/testing/selftests/rcutorture/configs/rcu/ver_functions.sh
+++ b/tools/testing/selftests/rcutorture/configs/rcu/ver_functions.sh
@@ -39,7 +39,7 @@ rcutorture_param_onoff () {
         if ! bootparam_hotplug_cpu "$1" && configfrag_hotplug_cpu "$2"
         then
                 echo CPU-hotplug kernel, adding rcutorture onoff. 1>&2
-                echo rcutorture.onoff_interval=3 rcutorture.onoff_holdoff=30
+                echo rcutorture.onoff_interval=1000 rcutorture.onoff_holdoff=30
         fi
 }
 
diff --git a/tools/testing/selftests/timers/raw_skew.c b/tools/testing/selftests/timers/raw_skew.c
index ca6cd146aafe..dcf73c5dab6e 100644
--- a/tools/testing/selftests/timers/raw_skew.c
+++ b/tools/testing/selftests/timers/raw_skew.c
@@ -134,6 +134,11 @@ int main(int argv, char **argc)
         printf(" %lld.%i(act)", ppm/1000, abs((int)(ppm%1000)));
 
         if (llabs(eppm - ppm) > 1000) {
+                if (tx1.offset || tx2.offset ||
+                    tx1.freq != tx2.freq || tx1.tick != tx2.tick) {
+                        printf("        [SKIP]\n");
+                        return ksft_exit_skip("The clock was adjusted externally. Shutdown NTPd or other time sync daemons\n");
+                }
                 printf("        [FAILED]\n");
                 return ksft_exit_fail();
         }
diff --git a/tools/virtio/asm/barrier.h b/tools/virtio/asm/barrier.h
index 0ac3caf90877..d0351f83aebe 100644
--- a/tools/virtio/asm/barrier.h
+++ b/tools/virtio/asm/barrier.h
@@ -13,8 +13,8 @@
 } while (0);
 /* Weak barriers should be used. If not - it's a bug */
 # define mb() abort()
-# define rmb() abort()
-# define wmb() abort()
+# define dma_rmb() abort()
+# define dma_wmb() abort()
 #else
 #error Please fill in barrier macros
 #endif
diff --git a/tools/virtio/linux/kernel.h b/tools/virtio/linux/kernel.h
index fca8381bbe04..fb22bccfbc8a 100644
--- a/tools/virtio/linux/kernel.h
+++ b/tools/virtio/linux/kernel.h
@@ -52,6 +52,11 @@ static inline void *kmalloc(size_t s, gfp_t gfp)
                 return __kmalloc_fake;
         return malloc(s);
 }
+static inline void *kmalloc_array(unsigned n, size_t s, gfp_t gfp)
+{
+        return kmalloc(n * s, gfp);
+}
+
 static inline void *kzalloc(size_t s, gfp_t gfp)
 {
         void *p = kmalloc(s, gfp);
diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
index 04e554cae3a2..108250e4d376 100644
--- a/virt/kvm/arm/arm.c
+++ b/virt/kvm/arm/arm.c
@@ -604,7 +604,7 @@ void kvm_arm_resume_guest(struct kvm *kvm)
 
         kvm_for_each_vcpu(i, vcpu, kvm) {
                 vcpu->arch.pause = false;
-                swake_up(kvm_arch_vcpu_wq(vcpu));
+                swake_up_one(kvm_arch_vcpu_wq(vcpu));
         }
 }
 
@@ -612,7 +612,7 @@ static void vcpu_req_sleep(struct kvm_vcpu *vcpu)
 {
         struct swait_queue_head *wq = kvm_arch_vcpu_wq(vcpu);
 
-        swait_event_interruptible(*wq, ((!vcpu->arch.power_off) &&
+        swait_event_interruptible_exclusive(*wq, ((!vcpu->arch.power_off) &&
                                        (!vcpu->arch.pause)));
 
         if (vcpu->arch.power_off || vcpu->arch.pause) {
diff --git a/virt/kvm/arm/psci.c b/virt/kvm/arm/psci.c
index c95ab4c5a475..9b73d3ad918a 100644
--- a/virt/kvm/arm/psci.c
+++ b/virt/kvm/arm/psci.c
@@ -155,7 +155,7 @@ static unsigned long kvm_psci_vcpu_on(struct kvm_vcpu *source_vcpu)
         smp_mb();               /* Make sure the above is visible */
 
         wq = kvm_arch_vcpu_wq(vcpu);
-        swake_up(wq);
+        swake_up_one(wq);
 
         return PSCI_RET_SUCCESS;
 }
diff --git a/virt/kvm/async_pf.c b/virt/kvm/async_pf.c
index 57bcb27dcf30..23c2519c5b32 100644
--- a/virt/kvm/async_pf.c
+++ b/virt/kvm/async_pf.c
@@ -107,7 +107,7 @@ static void async_pf_execute(struct work_struct *work)
         trace_kvm_async_pf_completed(addr, gva);
 
         if (swq_has_sleeper(&vcpu->wq))
-                swake_up(&vcpu->wq);
+                swake_up_one(&vcpu->wq);
 
         mmput(mm);
         kvm_put_kvm(vcpu->kvm);
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 8b47507faab5..3d233ebfbee9 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2172,7 +2172,7 @@ void kvm_vcpu_block(struct kvm_vcpu *vcpu)
         kvm_arch_vcpu_blocking(vcpu);
 
         for (;;) {
-                prepare_to_swait(&vcpu->wq, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_swait_exclusive(&vcpu->wq, &wait, TASK_INTERRUPTIBLE);
 
                 if (kvm_vcpu_check_block(vcpu) < 0)
                         break;
@@ -2214,7 +2214,7 @@ bool kvm_vcpu_wake_up(struct kvm_vcpu *vcpu)
 
         wqp = kvm_arch_vcpu_wq(vcpu);
         if (swq_has_sleeper(wqp)) {
-                swake_up(wqp);
+                swake_up_one(wqp);
                 ++vcpu->stat.halt_wakeup;
                 return true;
         }