140 files changed, 1336 insertions, 796 deletions

diff --git a/.mailmap b/.mailmap
index e18cab73e209..a2ce89a456c2 100644
--- a/.mailmap
+++ b/.mailmap
@@ -62,6 +62,7 @@ Frank Zago <fzago@systemfabricworks.com>
 Greg Kroah-Hartman <greg@echidna.(none)>
 Greg Kroah-Hartman <gregkh@suse.de>
 Greg Kroah-Hartman <greg@kroah.com>
+Gregory CLEMENT <gregory.clement@bootlin.com> <gregory.clement@free-electrons.com>
 Henk Vergonet <Henk.Vergonet@gmail.com>
 Henrik Kretzschmar <henne@nachtwindheim.de>
 Henrik Rydberg <rydberg@bitmath.org>
diff --git a/Documentation/devicetree/bindings/iio/adc/sigma-delta-modulator.txt b/Documentation/devicetree/bindings/iio/adc/sigma-delta-modulator.txt
index e9ebb8a20e0d..ba24ca7ba95e 100644
--- a/Documentation/devicetree/bindings/iio/adc/sigma-delta-modulator.txt
+++ b/Documentation/devicetree/bindings/iio/adc/sigma-delta-modulator.txt
@@ -3,11 +3,11 @@ Device-Tree bindings for sigma delta modulator
 Required properties:
 - compatible: should be "ads1201", "sd-modulator". "sd-modulator" can be use
         as a generic SD modulator if modulator not specified in compatible list.
-- #io-channel-cells = <1>: See the IIO bindings section "IIO consumers".
+- #io-channel-cells = <0>: See the IIO bindings section "IIO consumers".
 
 Example node:
 
         ads1202: adc@0 {
                 compatible = "sd-modulator";
-                #io-channel-cells = <1>;
+                #io-channel-cells = <0>;
         };
diff --git a/MAINTAINERS b/MAINTAINERS
index 73c0cdabf755..6e950b8b4a41 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1060,41 +1060,42 @@ ARM PORT
 M:      Russell King <linux@armlinux.org.uk>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://www.armlinux.org.uk/
-S:      Maintained
+S:      Odd Fixes
 T:      git git://git.armlinux.org.uk/~rmk/linux-arm.git
 F:      arch/arm/
+X:      arch/arm/boot/dts/
 
 ARM PRIMECELL AACI PL041 DRIVER
 M:      Russell King <linux@armlinux.org.uk>
-S:      Maintained
+S:      Odd Fixes
 F:      sound/arm/aaci.*
 
 ARM PRIMECELL BUS SUPPORT
 M:      Russell King <linux@armlinux.org.uk>
-S:      Maintained
+S:      Odd Fixes
 F:      drivers/amba/
 F:      include/linux/amba/bus.h
 
 ARM PRIMECELL CLCD PL110 DRIVER
 M:      Russell King <linux@armlinux.org.uk>
-S:      Maintained
+S:      Odd Fixes
 F:      drivers/video/fbdev/amba-clcd.*
 
 ARM PRIMECELL KMI PL050 DRIVER
 M:      Russell King <linux@armlinux.org.uk>
-S:      Maintained
+S:      Odd Fixes
 F:      drivers/input/serio/ambakmi.*
 F:      include/linux/amba/kmi.h
 
 ARM PRIMECELL MMCI PL180/1 DRIVER
 M:      Russell King <linux@armlinux.org.uk>
-S:      Maintained
+S:      Odd Fixes
 F:      drivers/mmc/host/mmci.*
 F:      include/linux/amba/mmci.h
 
 ARM PRIMECELL UART PL010 AND PL011 DRIVERS
 M:      Russell King <linux@armlinux.org.uk>
-S:      Maintained
+S:      Odd Fixes
 F:      drivers/tty/serial/amba-pl01*.c
 F:      include/linux/amba/serial.h
 
@@ -1152,7 +1153,7 @@ S:	Maintained
 F:      drivers/clk/sunxi/
 
 ARM/Allwinner sunXi SoC support
-M:      Maxime Ripard <maxime.ripard@free-electrons.com>
+M:      Maxime Ripard <maxime.ripard@bootlin.com>
 M:      Chen-Yu Tsai <wens@csie.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
@@ -4626,7 +4627,7 @@ F:	include/uapi/drm/drm*
 F:      include/linux/vga*
 
 DRM DRIVERS FOR ALLWINNER A10
-M:      Maxime Ripard  <maxime.ripard@free-electrons.com>
+M:      Maxime Ripard  <maxime.ripard@bootlin.com>
 L:      dri-devel@lists.freedesktop.org
 S:      Supported
 F:      drivers/gpu/drm/sun4i/
@@ -8434,7 +8435,7 @@ S:	Orphan
 F:      drivers/net/wireless/marvell/libertas/
 
 MARVELL MACCHIATOBIN SUPPORT
-M:      Russell King <rmk@armlinux.org.uk>
+M:      Russell King <linux@armlinux.org.uk>
 L:      linux-arm-kernel@lists.infradead.org
 S:      Maintained
 F:      arch/arm64/boot/dts/marvell/armada-8040-mcbin.dts
@@ -8447,7 +8448,7 @@ F:	drivers/net/ethernet/marvell/mv643xx_eth.*
 F:      include/linux/mv643xx.h
 
 MARVELL MV88X3310 PHY DRIVER
-M:      Russell King <rmk@armlinux.org.uk>
+M:      Russell King <linux@armlinux.org.uk>
 L:      netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/phy/marvell10g.c
@@ -12875,6 +12876,19 @@ S:	Maintained
 F:      drivers/net/ethernet/socionext/netsec.c
 F:      Documentation/devicetree/bindings/net/socionext-netsec.txt
 
+SOLIDRUN CLEARFOG SUPPORT
+M:      Russell King <linux@armlinux.org.uk>
+S:      Maintained
+F:      arch/arm/boot/dts/armada-388-clearfog*
+F:      arch/arm/boot/dts/armada-38x-solidrun-*
+
+SOLIDRUN CUBOX-I/HUMMINGBOARD SUPPORT
+M:      Russell King <linux@armlinux.org.uk>
+S:      Maintained
+F:      arch/arm/boot/dts/imx6*-cubox-i*
+F:      arch/arm/boot/dts/imx6*-hummingboard*
+F:      arch/arm/boot/dts/imx6*-sr-*
+
 SONIC NETWORK DRIVER
 M:      Thomas Bogendoerfer <tsbogend@alpha.franken.de>
 L:      netdev@vger.kernel.org
@@ -13644,7 +13658,8 @@ S:	Supported
 F:      drivers/i2c/busses/i2c-tegra.c
 
 TEGRA IOMMU DRIVERS
-M:      Hiroshi Doyu <hdoyu@nvidia.com>
+M:      Thierry Reding <thierry.reding@gmail.com>
+L:      linux-tegra@vger.kernel.org
 S:      Supported
 F:      drivers/iommu/tegra*
 
diff --git a/Makefile b/Makefile
index 486db374d1c1..7ba478ab8c82 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 4
 PATCHLEVEL = 16
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
index 78a647080ebc..199ebc1c4538 100644
--- a/arch/arm/Kconfig.debug
+++ b/arch/arm/Kconfig.debug
@@ -22,6 +22,7 @@ config ARM_PTDUMP_DEBUGFS
 
 config DEBUG_WX
         bool "Warn on W+X mappings at boot"
+        depends on MMU
         select ARM_PTDUMP_CORE
         ---help---
                 Generate a warning if any W+X mappings are found at boot.
diff --git a/arch/arm/boot/deflate_xip_data.sh b/arch/arm/boot/deflate_xip_data.sh
index 1189598a25eb..5e7d758ebdd6 100755
--- a/arch/arm/boot/deflate_xip_data.sh
+++ b/arch/arm/boot/deflate_xip_data.sh
@@ -30,7 +30,7 @@ esac
 
 sym_val() {
         # extract hex value for symbol in $1
-        local val=$($NM "$VMLINUX" | sed -n "/ $1$/{s/ .*$//p;q}")
+        local val=$($NM "$VMLINUX" 2>/dev/null | sed -n "/ $1\$/{s/ .*$//p;q}")
         [ "$val" ] || { echo "can't find $1 in $VMLINUX" 1>&2; exit 1; }
         # convert from hex to decimal
         echo $((0x$val))
@@ -48,12 +48,12 @@ data_end=$(($_edata_loc - $base_offset))
 file_end=$(stat -c "%s" "$XIPIMAGE")
 if [ "$file_end" != "$data_end" ]; then
         printf "end of xipImage doesn't match with _edata_loc (%#x vs %#x)\n" \
-               $(($file_end + $base_offset)) $_edata_loc 2>&1
+               $(($file_end + $base_offset)) $_edata_loc 1>&2
         exit 1;
 fi
 
 # be ready to clean up
-trap 'rm -f "$XIPIMAGE.tmp"' 0 1 2 3
+trap 'rm -f "$XIPIMAGE.tmp"; exit 1' 1 2 3
 
 # substitute the data section by a compressed version
 $DD if="$XIPIMAGE" count=$data_start iflag=count_bytes of="$XIPIMAGE.tmp"
diff --git a/arch/arm/boot/dts/aspeed-g4.dtsi b/arch/arm/boot/dts/aspeed-g4.dtsi
index b0d8431a3700..ae2b8c952e80 100644
--- a/arch/arm/boot/dts/aspeed-g4.dtsi
+++ b/arch/arm/boot/dts/aspeed-g4.dtsi
@@ -42,6 +42,11 @@
                 };
         };
 
+        memory@40000000 {
+                device_type = "memory";
+                reg = <0x40000000 0>;
+        };
+
         ahb {
                 compatible = "simple-bus";
                 #address-cells = <1>;
diff --git a/arch/arm/boot/dts/aspeed-g5.dtsi b/arch/arm/boot/dts/aspeed-g5.dtsi
index 40de3b66c33f..2477ebc11d9d 100644
--- a/arch/arm/boot/dts/aspeed-g5.dtsi
+++ b/arch/arm/boot/dts/aspeed-g5.dtsi
@@ -42,6 +42,11 @@
                 };
         };
 
+        memory@80000000 {
+                device_type = "memory";
+                reg = <0x80000000 0>;
+        };
+
         ahb {
                 compatible = "simple-bus";
                 #address-cells = <1>;
diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts
index a7a5dc7b2700..e7d2db839d70 100644
--- a/arch/arm/boot/dts/imx7d-sdb.dts
+++ b/arch/arm/boot/dts/imx7d-sdb.dts
@@ -82,7 +82,7 @@
                 enable-active-high;
         };
 
-        reg_usb_otg2_vbus: regulator-usb-otg1-vbus {
+        reg_usb_otg2_vbus: regulator-usb-otg2-vbus {
                 compatible = "regulator-fixed";
                 regulator-name = "usb_otg2_vbus";
                 regulator-min-microvolt = <5000000>;
diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
index 6102e4e7f35c..354aff45c1af 100644
--- a/arch/arm/boot/dts/rk3288.dtsi
+++ b/arch/arm/boot/dts/rk3288.dtsi
@@ -927,6 +927,7 @@
         i2s: i2s@ff890000 {
                 compatible = "rockchip,rk3288-i2s", "rockchip,rk3066-i2s";
                 reg = <0x0 0xff890000 0x0 0x10000>;
+                #sound-dai-cells = <0>;
                 interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>;
                 #address-cells = <1>;
                 #size-cells = <0>;
@@ -1176,6 +1177,7 @@
                 compatible = "rockchip,rk3288-dw-hdmi";
                 reg = <0x0 0xff980000 0x0 0x20000>;
                 reg-io-width = <4>;
+                #sound-dai-cells = <0>;
                 rockchip,grf = <&grf>;
                 interrupts = <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&cru  PCLK_HDMI_CTRL>, <&cru SCLK_HDMI_HDCP>, <&cru SCLK_HDMI_CEC>;
diff --git a/arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts b/arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts
index 51e6f1d21c32..b2758dd8ce43 100644
--- a/arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts
+++ b/arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts
@@ -42,7 +42,6 @@
 
 /dts-v1/;
 #include "sun6i-a31s.dtsi"
-#include "sunxi-common-regulators.dtsi"
 #include <dt-bindings/gpio/gpio.h>
 
 / {
@@ -99,6 +98,7 @@
         pinctrl-0 = <&gmac_pins_rgmii_a>, <&gmac_phy_reset_pin_bpi_m2>;
         phy = <&phy1>;
         phy-mode = "rgmii";
+        phy-supply = <&reg_dldo1>;
         snps,reset-gpio = <&pio 0 21 GPIO_ACTIVE_HIGH>; /* PA21 */
         snps,reset-active-low;
         snps,reset-delays-us = <0 10000 30000>;
@@ -118,7 +118,7 @@
 &mmc0 {
         pinctrl-names = "default";
         pinctrl-0 = <&mmc0_pins_a>, <&mmc0_cd_pin_bpi_m2>;
-        vmmc-supply = <&reg_vcc3v0>;
+        vmmc-supply = <&reg_dcdc1>;
         bus-width = <4>;
         cd-gpios = <&pio 0 4 GPIO_ACTIVE_HIGH>; /* PA4 */
         cd-inverted;
@@ -132,7 +132,7 @@
 &mmc2 {
         pinctrl-names = "default";
         pinctrl-0 = <&mmc2_pins_a>;
-        vmmc-supply = <&reg_vcc3v0>;
+        vmmc-supply = <&reg_aldo1>;
         mmc-pwrseq = <&mmc2_pwrseq>;
         bus-width = <4>;
         non-removable;
@@ -163,6 +163,8 @@
                 reg = <0x68>;
                 interrupt-parent = <&nmi_intc>;
                 interrupts = <0 IRQ_TYPE_LEVEL_LOW>;
+                eldoin-supply = <&reg_dcdc1>;
+                x-powers,drive-vbus-en;
         };
 };
 
@@ -193,7 +195,28 @@
 
 #include "axp22x.dtsi"
 
+&reg_aldo1 {
+        regulator-min-microvolt = <3300000>;
+        regulator-max-microvolt = <3300000>;
+        regulator-name = "vcc-wifi";
+};
+
+&reg_aldo2 {
+        regulator-always-on;
+        regulator-min-microvolt = <2500000>;
+        regulator-max-microvolt = <2500000>;
+        regulator-name = "vcc-gmac";
+};
+
+&reg_aldo3 {
+        regulator-always-on;
+        regulator-min-microvolt = <3000000>;
+        regulator-max-microvolt = <3000000>;
+        regulator-name = "avcc";
+};
+
 &reg_dc5ldo {
+        regulator-always-on;
         regulator-min-microvolt = <700000>;
         regulator-max-microvolt = <1320000>;
         regulator-name = "vdd-cpus";
@@ -233,6 +256,40 @@
         regulator-name = "vcc-dram";
 };
 
+&reg_dldo1 {
+        regulator-min-microvolt = <3000000>;
+        regulator-max-microvolt = <3000000>;
+        regulator-name = "vcc-mac";
+};
+
+&reg_dldo2 {
+        regulator-min-microvolt = <2800000>;
+        regulator-max-microvolt = <2800000>;
+        regulator-name = "avdd-csi";
+};
+
+&reg_dldo3 {
+        regulator-always-on;
+        regulator-min-microvolt = <3300000>;
+        regulator-max-microvolt = <3300000>;
+        regulator-name = "vcc-pb";
+};
+
+&reg_eldo1 {
+        regulator-min-microvolt = <1800000>;
+        regulator-max-microvolt = <1800000>;
+        regulator-name = "vdd-csi";
+        status = "okay";
+};
+
+&reg_ldo_io1 {
+        regulator-always-on;
+        regulator-min-microvolt = <1800000>;
+        regulator-max-microvolt = <1800000>;
+        regulator-name = "vcc-pm-cpus";
+        status = "okay";
+};
+
 &uart0 {
         pinctrl-names = "default";
         pinctrl-0 = <&uart0_pins_a>;
diff --git a/arch/arm/include/asm/vdso.h b/arch/arm/include/asm/vdso.h
index 9c99e817535e..5b85889f82ee 100644
--- a/arch/arm/include/asm/vdso.h
+++ b/arch/arm/include/asm/vdso.h
@@ -12,8 +12,6 @@ struct mm_struct;
 
 void arm_install_vdso(struct mm_struct *mm, unsigned long addr);
 
-extern char vdso_start, vdso_end;
-
 extern unsigned int vdso_total_pages;
 
 #else /* CONFIG_VDSO */
diff --git a/arch/arm/kernel/vdso.c b/arch/arm/kernel/vdso.c
index a4d6dc0f2427..f4dd7f9663c1 100644
--- a/arch/arm/kernel/vdso.c
+++ b/arch/arm/kernel/vdso.c
@@ -39,6 +39,8 @@
 
 static struct page **vdso_text_pagelist;
 
+extern char vdso_start[], vdso_end[];
+
 /* Total number of pages needed for the data and text portions of the VDSO. */
 unsigned int vdso_total_pages __ro_after_init;
 
@@ -197,13 +199,13 @@ static int __init vdso_init(void)
         unsigned int text_pages;
         int i;
 
-        if (memcmp(&vdso_start, "\177ELF", 4)) {
+        if (memcmp(vdso_start, "\177ELF", 4)) {
                 pr_err("VDSO is not a valid ELF object!\n");
                 return -ENOEXEC;
         }
 
-        text_pages = (&vdso_end - &vdso_start) >> PAGE_SHIFT;
-        pr_debug("vdso: %i text pages at base %p\n", text_pages, &vdso_start);
+        text_pages = (vdso_end - vdso_start) >> PAGE_SHIFT;
+        pr_debug("vdso: %i text pages at base %p\n", text_pages, vdso_start);
 
         /* Allocate the VDSO text pagelist */
         vdso_text_pagelist = kcalloc(text_pages, sizeof(struct page *),
@@ -218,7 +220,7 @@ static int __init vdso_init(void)
         for (i = 0; i < text_pages; i++) {
                 struct page *page;
 
-                page = virt_to_page(&vdso_start + i * PAGE_SIZE);
+                page = virt_to_page(vdso_start + i * PAGE_SIZE);
                 vdso_text_pagelist[i] = page;
         }
 
@@ -229,7 +231,7 @@ static int __init vdso_init(void)
 
         cntvct_ok = cntvct_functional();
 
-        patch_vdso(&vdso_start);
+        patch_vdso(vdso_start);
 
         return 0;
 }
diff --git a/arch/arm/mach-davinci/board-omapl138-hawk.c b/arch/arm/mach-davinci/board-omapl138-hawk.c
index a3e78074be70..62eb7d668890 100644
--- a/arch/arm/mach-davinci/board-omapl138-hawk.c
+++ b/arch/arm/mach-davinci/board-omapl138-hawk.c
@@ -127,8 +127,8 @@ static struct gpiod_lookup_table mmc_gpios_table = {
         .dev_id = "da830-mmc.0",
         .table = {
                 /* CD: gpio3_12: gpio60: chip 1 contains gpio range 32-63*/
-                GPIO_LOOKUP("davinci_gpio.1", 28, "cd", GPIO_ACTIVE_LOW),
-                GPIO_LOOKUP("davinci_gpio.1", 29, "wp", GPIO_ACTIVE_LOW),
+                GPIO_LOOKUP("davinci_gpio.0", 28, "cd", GPIO_ACTIVE_LOW),
+                GPIO_LOOKUP("davinci_gpio.0", 29, "wp", GPIO_ACTIVE_LOW),
         },
 };
 
diff --git a/arch/arm/mach-ux500/cpu-db8500.c b/arch/arm/mach-ux500/cpu-db8500.c
index 7e5d7a083707..36cd23c8be9b 100644
--- a/arch/arm/mach-ux500/cpu-db8500.c
+++ b/arch/arm/mach-ux500/cpu-db8500.c
@@ -133,6 +133,9 @@ static void __init u8500_init_machine(void)
         if (of_machine_is_compatible("st-ericsson,u8540"))
                 of_platform_populate(NULL, u8500_local_bus_nodes,
                                      u8540_auxdata_lookup, NULL);
+        else
+                of_platform_populate(NULL, u8500_local_bus_nodes,
+                                     NULL, NULL);
 }
 
 static const char * stericsson_dt_platform_compat[] = {
diff --git a/arch/arm/plat-omap/dmtimer.c b/arch/arm/plat-omap/dmtimer.c
index d443e481c3e9..8805a59bae53 100644
--- a/arch/arm/plat-omap/dmtimer.c
+++ b/arch/arm/plat-omap/dmtimer.c
@@ -888,11 +888,8 @@ static int omap_dm_timer_probe(struct platform_device *pdev)
         timer->irq = irq->start;
         timer->pdev = pdev;
 
-        /* Skip pm_runtime_enable for OMAP1 */
-        if (!(timer->capability & OMAP_TIMER_NEEDS_RESET)) {
-                pm_runtime_enable(dev);
-                pm_runtime_irq_safe(dev);
-        }
+        pm_runtime_enable(dev);
+        pm_runtime_irq_safe(dev);
 
         if (!timer->reserved) {
                 ret = pm_runtime_get_sync(dev);
diff --git a/arch/arm/plat-omap/include/plat/sram.h b/arch/arm/plat-omap/include/plat/sram.h
index fb061cf0d736..30a07730807a 100644
--- a/arch/arm/plat-omap/include/plat/sram.h
+++ b/arch/arm/plat-omap/include/plat/sram.h
@@ -5,13 +5,4 @@ void omap_map_sram(unsigned long start, unsigned long size,
                         unsigned long skip, int cached);
 void omap_sram_reset(void);
 
-extern void *omap_sram_push_address(unsigned long size);
-
-/* Macro to push a function to the internal SRAM, using the fncpy API */
-#define omap_sram_push(funcp, size) ({                          \
-        typeof(&(funcp)) _res = NULL;                           \
-        void *_sram_address = omap_sram_push_address(size);     \
-        if (_sram_address)                                      \
-                _res = fncpy(_sram_address, &(funcp), size);    \
-        _res;                                                   \
-})
+extern void *omap_sram_push(void *funcp, unsigned long size);
diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c
index a5bc92d7e476..921840acf65c 100644
--- a/arch/arm/plat-omap/sram.c
+++ b/arch/arm/plat-omap/sram.c
@@ -23,6 +23,7 @@
 #include <asm/fncpy.h>
 #include <asm/tlb.h>
 #include <asm/cacheflush.h>
+#include <asm/set_memory.h>
 
 #include <asm/mach/map.h>
 
@@ -42,7 +43,7 @@ static void __iomem *omap_sram_ceil;
  * Note that fncpy requires the returned address to be aligned
  * to an 8-byte boundary.
  */
-void *omap_sram_push_address(unsigned long size)
+static void *omap_sram_push_address(unsigned long size)
 {
         unsigned long available, new_ceil = (unsigned long)omap_sram_ceil;
 
@@ -60,6 +61,30 @@ void *omap_sram_push_address(unsigned long size)
         return (void *)omap_sram_ceil;
 }
 
+void *omap_sram_push(void *funcp, unsigned long size)
+{
+        void *sram;
+        unsigned long base;
+        int pages;
+        void *dst = NULL;
+
+        sram = omap_sram_push_address(size);
+        if (!sram)
+                return NULL;
+
+        base = (unsigned long)sram & PAGE_MASK;
+        pages = PAGE_ALIGN(size) / PAGE_SIZE;
+
+        set_memory_rw(base, pages);
+
+        dst = fncpy(sram, funcp, size);
+
+        set_memory_ro(base, pages);
+        set_memory_x(base, pages);
+
+        return dst;
+}
+
 /*
  * The SRAM context is lost during off-idle and stack
  * needs to be reset.
@@ -75,6 +100,9 @@ void omap_sram_reset(void)
 void __init omap_map_sram(unsigned long start, unsigned long size,
                                  unsigned long skip, int cached)
 {
+        unsigned long base;
+        int pages;
+
         if (size == 0)
                 return;
 
@@ -95,4 +123,10 @@ void __init omap_map_sram(unsigned long start, unsigned long size,
          */
         memset_io(omap_sram_base + omap_sram_skip, 0,
                   omap_sram_size - omap_sram_skip);
+
+        base = (unsigned long)omap_sram_base;
+        pages = PAGE_ALIGN(omap_sram_size) / PAGE_SIZE;
+
+        set_memory_ro(base, pages);
+        set_memory_x(base, pages);
 }
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index 03c6a3c72f9c..4c375e11ae95 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -648,7 +648,7 @@ int vfp_restore_user_hwstate(struct user_vfp __user *ufp,
  */
 static int vfp_dying_cpu(unsigned int cpu)
 {
-        vfp_force_reload(cpu, current_thread_info());
+        vfp_current_hw_state[cpu] = NULL;
         return 0;
 }
 
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi
index 03f195025390..204bdb9857b9 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi
@@ -406,8 +406,9 @@
         wlan_pd_n: wlan-pd-n {
                 compatible = "regulator-fixed";
                 regulator-name = "wlan_pd_n";
+                pinctrl-names = "default";
+                pinctrl-0 = <&wlan_module_reset_l>;
 
-                /* Note the wlan_module_reset_l pinctrl */
                 enable-active-high;
                 gpio = <&gpio1 11 GPIO_ACTIVE_HIGH>;
 
@@ -983,12 +984,6 @@ ap_i2c_audio: &i2c8 {
         pinctrl-0 = <
                 &ap_pwroff      /* AP will auto-assert this when in S3 */
                 &clk_32k        /* This pin is always 32k on gru boards */
-
-                /*
-                 * We want this driven low ASAP; firmware should help us, but
-                 * we can help ourselves too.
-                 */
-                &wlan_module_reset_l
         >;
 
         pcfg_output_low: pcfg-output-low {
@@ -1168,12 +1163,7 @@ ap_i2c_audio: &i2c8 {
                 };
 
                 wlan_module_reset_l: wlan-module-reset-l {
-                        /*
-                         * We want this driven low ASAP (As {Soon,Strongly} As
-                         * Possible), to avoid leakage through the powered-down
-                         * WiFi.
-                         */
-                        rockchip,pins = <1 11 RK_FUNC_GPIO &pcfg_output_low>;
+                        rockchip,pins = <1 11 RK_FUNC_GPIO &pcfg_pull_none>;
                 };
 
                 bt_host_wake_l: bt-host-wake-l {
diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
index 2605118d4b4c..0b81ca1d07e7 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
@@ -411,8 +411,8 @@
                         reg = <0x0 0xfe800000 0x0 0x100000>;
                         interrupts = <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH 0>;
                         dr_mode = "otg";
-                        phys = <&u2phy0_otg>, <&tcphy0_usb3>;
-                        phy-names = "usb2-phy", "usb3-phy";
+                        phys = <&u2phy0_otg>;
+                        phy-names = "usb2-phy";
                         phy_type = "utmi_wide";
                         snps,dis_enblslpm_quirk;
                         snps,dis-u2-freeclk-exists-quirk;
@@ -444,8 +444,8 @@
                         reg = <0x0 0xfe900000 0x0 0x100000>;
                         interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH 0>;
                         dr_mode = "otg";
-                        phys = <&u2phy1_otg>, <&tcphy1_usb3>;
-                        phy-names = "usb2-phy", "usb3-phy";
+                        phys = <&u2phy1_otg>;
+                        phy-names = "usb2-phy";
                         phy_type = "utmi_wide";
                         snps,dis_enblslpm_quirk;
                         snps,dis-u2-freeclk-exists-quirk;
diff --git a/arch/mips/lantiq/Kconfig b/arch/mips/lantiq/Kconfig
index 692ae85a3e3d..8e3a1fc2bc39 100644
--- a/arch/mips/lantiq/Kconfig
+++ b/arch/mips/lantiq/Kconfig
@@ -13,6 +13,8 @@ choice
 config SOC_AMAZON_SE
         bool "Amazon SE"
         select SOC_TYPE_XWAY
+        select MFD_SYSCON
+        select MFD_CORE
 
 config SOC_XWAY
         bool "XWAY"
diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c
index 52500d3b7004..e0af39b33e28 100644
--- a/arch/mips/lantiq/xway/sysctrl.c
+++ b/arch/mips/lantiq/xway/sysctrl.c
@@ -549,9 +549,9 @@ void __init ltq_soc_init(void)
                 clkdev_add_static(ltq_ar9_cpu_hz(), ltq_ar9_fpi_hz(),
                                 ltq_ar9_fpi_hz(), CLOCK_250M);
                 clkdev_add_pmu("1f203018.usb2-phy", "phy", 1, 0, PMU_USB0_P);
-                clkdev_add_pmu("1e101000.usb", "otg", 1, 0, PMU_USB0);
+                clkdev_add_pmu("1e101000.usb", "otg", 1, 0, PMU_USB0 | PMU_AHBM);
                 clkdev_add_pmu("1f203034.usb2-phy", "phy", 1, 0, PMU_USB1_P);
-                clkdev_add_pmu("1e106000.usb", "otg", 1, 0, PMU_USB1);
+                clkdev_add_pmu("1e106000.usb", "otg", 1, 0, PMU_USB1 | PMU_AHBM);
                 clkdev_add_pmu("1e180000.etop", "switch", 1, 0, PMU_SWITCH);
                 clkdev_add_pmu("1e103000.sdio", NULL, 1, 0, PMU_SDIO);
                 clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU);
@@ -560,7 +560,7 @@ void __init ltq_soc_init(void)
         } else {
                 clkdev_add_static(ltq_danube_cpu_hz(), ltq_danube_fpi_hz(),
                                 ltq_danube_fpi_hz(), ltq_danube_pp32_hz());
-                clkdev_add_pmu("1f203018.usb2-phy", "ctrl", 1, 0, PMU_USB0);
+                clkdev_add_pmu("1e101000.usb", "otg", 1, 0, PMU_USB0 | PMU_AHBM);
                 clkdev_add_pmu("1f203018.usb2-phy", "phy", 1, 0, PMU_USB0_P);
                 clkdev_add_pmu("1e103000.sdio", NULL, 1, 0, PMU_SDIO);
                 clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU);
diff --git a/arch/mips/ralink/mt7621.c b/arch/mips/ralink/mt7621.c
index 1b274742077d..d2718de60b9b 100644
--- a/arch/mips/ralink/mt7621.c
+++ b/arch/mips/ralink/mt7621.c
@@ -170,6 +170,28 @@ void prom_soc_init(struct ralink_soc_info *soc_info)
         u32 n1;
         u32 rev;
 
+        /* Early detection of CMP support */
+        mips_cm_probe();
+        mips_cpc_probe();
+
+        if (mips_cps_numiocu(0)) {
+                /*
+                 * mips_cm_probe() wipes out bootloader
+                 * config for CM regions and we have to configure them
+                 * again. This SoC cannot talk to pamlbus devices
+                 * witout proper iocu region set up.
+                 *
+                 * FIXME: it would be better to do this with values
+                 * from DT, but we need this very early because
+                 * without this we cannot talk to pretty much anything
+                 * including serial.
+                 */
+                write_gcr_reg0_base(MT7621_PALMBUS_BASE);
+                write_gcr_reg0_mask(~MT7621_PALMBUS_SIZE |
+                                    CM_GCR_REGn_MASK_CMTGT_IOCU0);
+                __sync();
+        }
+
         n0 = __raw_readl(sysc + SYSC_REG_CHIP_NAME0);
         n1 = __raw_readl(sysc + SYSC_REG_CHIP_NAME1);
 
@@ -194,26 +216,6 @@ void prom_soc_init(struct ralink_soc_info *soc_info)
 
         rt2880_pinmux_data = mt7621_pinmux_data;
 
-        /* Early detection of CMP support */
-        mips_cm_probe();
-        mips_cpc_probe();
-
-        if (mips_cps_numiocu(0)) {
-                /*
-                 * mips_cm_probe() wipes out bootloader
-                 * config for CM regions and we have to configure them
-                 * again. This SoC cannot talk to pamlbus devices
-                 * witout proper iocu region set up.
-                 *
-                 * FIXME: it would be better to do this with values
-                 * from DT, but we need this very early because
-                 * without this we cannot talk to pretty much anything
-                 * including serial.
-                 */
-                write_gcr_reg0_base(MT7621_PALMBUS_BASE);
-                write_gcr_reg0_mask(~MT7621_PALMBUS_SIZE |
-                                    CM_GCR_REGn_MASK_CMTGT_IOCU0);
-        }
 
         if (!register_cps_smp_ops())
                 return;
diff --git a/arch/mips/ralink/reset.c b/arch/mips/ralink/reset.c
index 64543d66e76b..e9531fea23a2 100644
--- a/arch/mips/ralink/reset.c
+++ b/arch/mips/ralink/reset.c
@@ -96,16 +96,9 @@ static void ralink_restart(char *command)
         unreachable();
 }
 
-static void ralink_halt(void)
-{
-        local_irq_disable();
-        unreachable();
-}
-
 static int __init mips_reboot_setup(void)
 {
         _machine_restart = ralink_restart;
-        _machine_halt = ralink_halt;
 
         return 0;
 }
diff --git a/arch/powerpc/include/asm/book3s/64/mmu.h b/arch/powerpc/include/asm/book3s/64/mmu.h
index 0abeb0e2d616..37671feb2bf6 100644
--- a/arch/powerpc/include/asm/book3s/64/mmu.h
+++ b/arch/powerpc/include/asm/book3s/64/mmu.h
@@ -87,6 +87,9 @@ typedef struct {
         /* Number of bits in the mm_cpumask */
         atomic_t active_cpus;
 
+        /* Number of users of the external (Nest) MMU */
+        atomic_t copros;
+
         /* NPU NMMU context */
         struct npu_context *npu_context;
 
diff --git a/arch/powerpc/include/asm/book3s/64/tlbflush-radix.h b/arch/powerpc/include/asm/book3s/64/tlbflush-radix.h
index 8eea90f80e45..19b45ba6caf9 100644
--- a/arch/powerpc/include/asm/book3s/64/tlbflush-radix.h
+++ b/arch/powerpc/include/asm/book3s/64/tlbflush-radix.h
@@ -47,9 +47,6 @@ extern void radix__flush_tlb_page_psize(struct mm_struct *mm, unsigned long vmad
 #endif
 extern void radix__flush_tlb_pwc(struct mmu_gather *tlb, unsigned long addr);
 extern void radix__flush_tlb_collapsed_pmd(struct mm_struct *mm, unsigned long addr);
-extern void radix__flush_tlb_lpid_va(unsigned long lpid, unsigned long gpa,
-                                     unsigned long page_size);
-extern void radix__flush_tlb_lpid(unsigned long lpid);
 extern void radix__flush_tlb_all(void);
 extern void radix__flush_tlb_pte_p9_dd1(unsigned long old_pte, struct mm_struct *mm,
                                         unsigned long address);
diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
index a2c5c95882cf..2e2bacbdf6ed 100644
--- a/arch/powerpc/include/asm/cputable.h
+++ b/arch/powerpc/include/asm/cputable.h
@@ -203,6 +203,7 @@ static inline void cpu_feature_keys_init(void) { }
 #define CPU_FTR_DAWR                    LONG_ASM_CONST(0x0400000000000000)
 #define CPU_FTR_DABRX                   LONG_ASM_CONST(0x0800000000000000)
 #define CPU_FTR_PMAO_BUG                LONG_ASM_CONST(0x1000000000000000)
+#define CPU_FTR_P9_TLBIE_BUG            LONG_ASM_CONST(0x2000000000000000)
 #define CPU_FTR_POWER9_DD1              LONG_ASM_CONST(0x4000000000000000)
 #define CPU_FTR_POWER9_DD2_1            LONG_ASM_CONST(0x8000000000000000)
 
@@ -465,7 +466,7 @@ static inline void cpu_feature_keys_init(void) { }
             CPU_FTR_CFAR | CPU_FTR_HVMODE | CPU_FTR_VMX_COPY | \
             CPU_FTR_DBELL | CPU_FTR_HAS_PPR | CPU_FTR_DAWR | \
             CPU_FTR_ARCH_207S | CPU_FTR_TM_COMP | CPU_FTR_ARCH_300 | \
-            CPU_FTR_PKEY)
+            CPU_FTR_PKEY | CPU_FTR_P9_TLBIE_BUG)
 #define CPU_FTRS_POWER9_DD1 ((CPU_FTRS_POWER9 | CPU_FTR_POWER9_DD1) & \
                              (~CPU_FTR_SAO))
 #define CPU_FTRS_POWER9_DD2_0 CPU_FTRS_POWER9
diff --git a/arch/powerpc/include/asm/mmu_context.h b/arch/powerpc/include/asm/mmu_context.h
index 051b3d63afe3..3a15b6db9501 100644
--- a/arch/powerpc/include/asm/mmu_context.h
+++ b/arch/powerpc/include/asm/mmu_context.h
@@ -92,15 +92,23 @@ static inline void dec_mm_active_cpus(struct mm_struct *mm)
 static inline void mm_context_add_copro(struct mm_struct *mm)
 {
         /*
-         * On hash, should only be called once over the lifetime of
-         * the context, as we can't decrement the active cpus count
-         * and flush properly for the time being.
+         * If any copro is in use, increment the active CPU count
+         * in order to force TLB invalidations to be global as to
+         * propagate to the Nest MMU.
          */
-        inc_mm_active_cpus(mm);
+        if (atomic_inc_return(&mm->context.copros) == 1)
+                inc_mm_active_cpus(mm);
 }
 
 static inline void mm_context_remove_copro(struct mm_struct *mm)
 {
+        int c;
+
+        c = atomic_dec_if_positive(&mm->context.copros);
+
+        /* Detect imbalance between add and remove */
+        WARN_ON(c < 0);
+
         /*
          * Need to broadcast a global flush of the full mm before
          * decrementing active_cpus count, as the next TLBI may be
@@ -111,7 +119,7 @@ static inline void mm_context_remove_copro(struct mm_struct *mm)
          * for the time being. Invalidations will remain global if
          * used on hash.
          */
-        if (radix_enabled()) {
+        if (c == 0 && radix_enabled()) {
                 flush_all_mm(mm);
                 dec_mm_active_cpus(mm);
         }
diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c
index 945e2c29ad2d..8ca5d5b74618 100644
--- a/arch/powerpc/kernel/dt_cpu_ftrs.c
+++ b/arch/powerpc/kernel/dt_cpu_ftrs.c
@@ -709,6 +709,9 @@ static __init void cpufeatures_cpu_quirks(void)
                 cur_cpu_spec->cpu_features |= CPU_FTR_POWER9_DD1;
         else if ((version & 0xffffefff) == 0x004e0201)
                 cur_cpu_spec->cpu_features |= CPU_FTR_POWER9_DD2_1;
+
+        if ((version & 0xffff0000) == 0x004e0000)
+                cur_cpu_spec->cpu_features |= CPU_FTR_P9_TLBIE_BUG;
 }
 
 static void __init cpufeatures_setup_finished(void)
@@ -720,6 +723,9 @@ static void __init cpufeatures_setup_finished(void)
                 cur_cpu_spec->cpu_features |= CPU_FTR_HVMODE;
         }
 
+        /* Make sure powerpc_base_platform is non-NULL */
+        powerpc_base_platform = cur_cpu_spec->platform;
+
         system_registers.lpcr = mfspr(SPRN_LPCR);
         system_registers.hfscr = mfspr(SPRN_HFSCR);
         system_registers.fscr = mfspr(SPRN_FSCR);
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 3ac87e53b3da..1ecfd8ffb098 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -706,7 +706,7 @@ EXC_COMMON_BEGIN(bad_addr_slb)
         ld      r3, PACA_EXSLB+EX_DAR(r13)
         std     r3, _DAR(r1)
         beq     cr6, 2f
-        li      r10, 0x480              /* fix trap number for I-SLB miss */
+        li      r10, 0x481              /* fix trap number for I-SLB miss */
         std     r10, _TRAP(r1)
 2:      bl      save_nvgprs
         addi    r3, r1, STACK_FRAME_OVERHEAD
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index f88038847790..061aa0f47bb1 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -476,6 +476,14 @@ void force_external_irq_replay(void)
          */
         WARN_ON(!arch_irqs_disabled());
 
+        /*
+         * Interrupts must always be hard disabled before irq_happened is
+         * modified (to prevent lost update in case of interrupt between
+         * load and store).
+         */
+        __hard_irq_disable();
+        local_paca->irq_happened |= PACA_IRQ_HARD_DIS;
+
         /* Indicate in the PACA that we have an interrupt to replay */
         local_paca->irq_happened |= PACA_IRQ_EE;
 }
diff --git a/arch/powerpc/kvm/book3s_64_mmu_radix.c b/arch/powerpc/kvm/book3s_64_mmu_radix.c
index 5cb4e4687107..5d9bafe9a371 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_radix.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_radix.c
@@ -157,6 +157,9 @@ static void kvmppc_radix_tlbie_page(struct kvm *kvm, unsigned long addr,
         asm volatile("ptesync": : :"memory");
         asm volatile(PPC_TLBIE_5(%0, %1, 0, 0, 1)
                      : : "r" (addr), "r" (kvm->arch.lpid) : "memory");
+        if (cpu_has_feature(CPU_FTR_P9_TLBIE_BUG))
+                asm volatile(PPC_TLBIE_5(%0, %1, 0, 0, 1)
+                             : : "r" (addr), "r" (kvm->arch.lpid) : "memory");
         asm volatile("ptesync": : :"memory");
 }
 
diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
index 8888e625a999..e1c083fbe434 100644
--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c
+++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
@@ -473,6 +473,17 @@ static void do_tlbies(struct kvm *kvm, unsigned long *rbvalues,
                         trace_tlbie(kvm->arch.lpid, 0, rbvalues[i],
                                 kvm->arch.lpid, 0, 0, 0);
                 }
+
+                if (cpu_has_feature(CPU_FTR_P9_TLBIE_BUG)) {
+                        /*
+                         * Need the extra ptesync to make sure we don't
+                         * re-order the tlbie
+                         */
+                        asm volatile("ptesync": : :"memory");
+                        asm volatile(PPC_TLBIE_5(%0,%1,0,0,0) : :
+                                     "r" (rbvalues[0]), "r" (kvm->arch.lpid));
+                }
+
                 asm volatile("eieio; tlbsync; ptesync" : : : "memory");
                 kvm->arch.tlbie_lock = 0;
         } else {
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index d33264697a31..f86a20270e50 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -1557,6 +1557,24 @@ mc_cont:
         ptesync
 3:      stw     r5,VCPU_SLB_MAX(r9)
 
+        /* load host SLB entries */
+BEGIN_MMU_FTR_SECTION
+        b       0f
+END_MMU_FTR_SECTION_IFSET(MMU_FTR_TYPE_RADIX)
+        ld      r8,PACA_SLBSHADOWPTR(r13)
+
+        .rept   SLB_NUM_BOLTED
+        li      r3, SLBSHADOW_SAVEAREA
+        LDX_BE  r5, r8, r3
+        addi    r3, r3, 8
+        LDX_BE  r6, r8, r3
+        andis.  r7,r5,SLB_ESID_V@h
+        beq     1f
+        slbmte  r6,r5
+1:      addi    r8,r8,16
+        .endr
+0:
+
 guest_bypass:
         stw     r12, STACK_SLOT_TRAP(r1)
         mr      r3, r12
@@ -2018,23 +2036,6 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
         mtspr   SPRN_LPCR,r8
         isync
 48:
-        /* load host SLB entries */
-BEGIN_MMU_FTR_SECTION
-        b       0f
-END_MMU_FTR_SECTION_IFSET(MMU_FTR_TYPE_RADIX)
-        ld      r8,PACA_SLBSHADOWPTR(r13)
-
-        .rept   SLB_NUM_BOLTED
-        li      r3, SLBSHADOW_SAVEAREA
-        LDX_BE  r5, r8, r3
-        addi    r3, r3, 8
-        LDX_BE  r6, r8, r3
-        andis.  r7,r5,SLB_ESID_V@h
-        beq     1f
-        slbmte  r6,r5
-1:      addi    r8,r8,16
-        .endr
-0:
 #ifdef CONFIG_KVM_BOOK3S_HV_EXIT_TIMING
         /* Finish timing, if we have a vcpu */
         ld      r4, HSTATE_KVM_VCPU(r13)
diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
index a0675e91ad7d..656933c85925 100644
--- a/arch/powerpc/mm/hash_native_64.c
+++ b/arch/powerpc/mm/hash_native_64.c
@@ -201,6 +201,15 @@ static inline unsigned long  ___tlbie(unsigned long vpn, int psize,
         return va;
 }
 
+static inline void fixup_tlbie(unsigned long vpn, int psize, int apsize, int ssize)
+{
+        if (cpu_has_feature(CPU_FTR_P9_TLBIE_BUG)) {
+                /* Need the extra ptesync to ensure we don't reorder tlbie*/
+                asm volatile("ptesync": : :"memory");
+                ___tlbie(vpn, psize, apsize, ssize);
+        }
+}
+
 static inline void __tlbie(unsigned long vpn, int psize, int apsize, int ssize)
 {
         unsigned long rb;
@@ -278,6 +287,7 @@ static inline void tlbie(unsigned long vpn, int psize, int apsize,
                 asm volatile("ptesync": : :"memory");
         } else {
                 __tlbie(vpn, psize, apsize, ssize);
+                fixup_tlbie(vpn, psize, apsize, ssize);
                 asm volatile("eieio; tlbsync; ptesync": : :"memory");
         }
         if (lock_tlbie && !use_local)
@@ -771,7 +781,7 @@ static void native_hpte_clear(void)
  */
 static void native_flush_hash_range(unsigned long number, int local)
 {
-        unsigned long vpn;
+        unsigned long vpn = 0;
         unsigned long hash, index, hidx, shift, slot;
         struct hash_pte *hptep;
         unsigned long hpte_v;
@@ -843,6 +853,10 @@ static void native_flush_hash_range(unsigned long number, int local)
                                 __tlbie(vpn, psize, psize, ssize);
                         } pte_iterate_hashed_end();
                 }
+                /*
+                 * Just do one more with the last used values.
+                 */
+                fixup_tlbie(vpn, psize, psize, ssize);
                 asm volatile("eieio; tlbsync; ptesync":::"memory");
 
                 if (lock_tlbie)
diff --git a/arch/powerpc/mm/mmu_context_book3s64.c b/arch/powerpc/mm/mmu_context_book3s64.c
index 929d9ef7083f..3f980baade4c 100644
--- a/arch/powerpc/mm/mmu_context_book3s64.c
+++ b/arch/powerpc/mm/mmu_context_book3s64.c
@@ -173,6 +173,7 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
         mm_iommu_init(mm);
 #endif
         atomic_set(&mm->context.active_cpus, 0);
+        atomic_set(&mm->context.copros, 0);
 
         return 0;
 }
diff --git a/arch/powerpc/mm/pgtable_64.c b/arch/powerpc/mm/pgtable_64.c
index 28c980eb4422..adf469f312f2 100644
--- a/arch/powerpc/mm/pgtable_64.c
+++ b/arch/powerpc/mm/pgtable_64.c
@@ -481,6 +481,7 @@ void mmu_partition_table_set_entry(unsigned int lpid, unsigned long dw0,
                              "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
                 trace_tlbie(lpid, 0, TLBIEL_INVAL_SET_LPID, lpid, 2, 0, 0);
         }
+        /* do we need fixup here ?*/
         asm volatile("eieio; tlbsync; ptesync" : : : "memory");
 }
 EXPORT_SYMBOL_GPL(mmu_partition_table_set_entry);
diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
index 71d1b19ad1c0..a07f5372a4bf 100644
--- a/arch/powerpc/mm/tlb-radix.c
+++ b/arch/powerpc/mm/tlb-radix.c
@@ -119,6 +119,49 @@ static inline void __tlbie_pid(unsigned long pid, unsigned long ric)
         trace_tlbie(0, 0, rb, rs, ric, prs, r);
 }
 
+static inline void __tlbiel_va(unsigned long va, unsigned long pid,
+                               unsigned long ap, unsigned long ric)
+{
+        unsigned long rb,rs,prs,r;
+
+        rb = va & ~(PPC_BITMASK(52, 63));
+        rb |= ap << PPC_BITLSHIFT(58);
+        rs = pid << PPC_BITLSHIFT(31);
+        prs = 1; /* process scoped */
+        r = 1;   /* raidx format */
+
+        asm volatile(PPC_TLBIEL(%0, %4, %3, %2, %1)
+                     : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory");
+        trace_tlbie(0, 1, rb, rs, ric, prs, r);
+}
+
+static inline void __tlbie_va(unsigned long va, unsigned long pid,
+                              unsigned long ap, unsigned long ric)
+{
+        unsigned long rb,rs,prs,r;
+
+        rb = va & ~(PPC_BITMASK(52, 63));
+        rb |= ap << PPC_BITLSHIFT(58);
+        rs = pid << PPC_BITLSHIFT(31);
+        prs = 1; /* process scoped */
+        r = 1;   /* raidx format */
+
+        asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1)
+                     : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory");
+        trace_tlbie(0, 0, rb, rs, ric, prs, r);
+}
+
+static inline void fixup_tlbie(void)
+{
+        unsigned long pid = 0;
+        unsigned long va = ((1UL << 52) - 1);
+
+        if (cpu_has_feature(CPU_FTR_P9_TLBIE_BUG)) {
+                asm volatile("ptesync": : :"memory");
+                __tlbie_va(va, pid, mmu_get_ap(MMU_PAGE_64K), RIC_FLUSH_TLB);
+        }
+}
+
 /*
  * We use 128 set in radix mode and 256 set in hpt mode.
  */
@@ -151,24 +194,25 @@ static inline void _tlbiel_pid(unsigned long pid, unsigned long ric)
 static inline void _tlbie_pid(unsigned long pid, unsigned long ric)
 {
         asm volatile("ptesync": : :"memory");
-        __tlbie_pid(pid, ric);
-        asm volatile("eieio; tlbsync; ptesync": : :"memory");
-}
 
-static inline void __tlbiel_va(unsigned long va, unsigned long pid,
-                               unsigned long ap, unsigned long ric)
-{
-        unsigned long rb,rs,prs,r;
-
-        rb = va & ~(PPC_BITMASK(52, 63));
-        rb |= ap << PPC_BITLSHIFT(58);
-        rs = pid << PPC_BITLSHIFT(31);
-        prs = 1; /* process scoped */
-        r = 1;   /* raidx format */
-
-        asm volatile(PPC_TLBIEL(%0, %4, %3, %2, %1)
-                     : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory");
-        trace_tlbie(0, 1, rb, rs, ric, prs, r);
+        /*
+         * Workaround the fact that the "ric" argument to __tlbie_pid
+         * must be a compile-time contraint to match the "i" constraint
+         * in the asm statement.
+         */
+        switch (ric) {
+        case RIC_FLUSH_TLB:
+                __tlbie_pid(pid, RIC_FLUSH_TLB);
+                break;
+        case RIC_FLUSH_PWC:
+                __tlbie_pid(pid, RIC_FLUSH_PWC);
+                break;
+        case RIC_FLUSH_ALL:
+        default:
+                __tlbie_pid(pid, RIC_FLUSH_ALL);
+        }
+        fixup_tlbie();
+        asm volatile("eieio; tlbsync; ptesync": : :"memory");
 }
 
 static inline void __tlbiel_va_range(unsigned long start, unsigned long end,
@@ -203,22 +247,6 @@ static inline void _tlbiel_va_range(unsigned long start, unsigned long end,
         asm volatile("ptesync": : :"memory");
 }
 
-static inline void __tlbie_va(unsigned long va, unsigned long pid,
-                             unsigned long ap, unsigned long ric)
-{
-        unsigned long rb,rs,prs,r;
-
-        rb = va & ~(PPC_BITMASK(52, 63));
-        rb |= ap << PPC_BITLSHIFT(58);
-        rs = pid << PPC_BITLSHIFT(31);
-        prs = 1; /* process scoped */
-        r = 1;   /* raidx format */
-
-        asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1)
-                     : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory");
-        trace_tlbie(0, 0, rb, rs, ric, prs, r);
-}
-
 static inline void __tlbie_va_range(unsigned long start, unsigned long end,
                                     unsigned long pid, unsigned long page_size,
                                     unsigned long psize)
@@ -237,6 +265,7 @@ static inline void _tlbie_va(unsigned long va, unsigned long pid,
 
         asm volatile("ptesync": : :"memory");
         __tlbie_va(va, pid, ap, ric);
+        fixup_tlbie();
         asm volatile("eieio; tlbsync; ptesync": : :"memory");
 }
 
@@ -248,6 +277,7 @@ static inline void _tlbie_va_range(unsigned long start, unsigned long end,
         if (also_pwc)
                 __tlbie_pid(pid, RIC_FLUSH_PWC);
         __tlbie_va_range(start, end, pid, page_size, psize);
+        fixup_tlbie();
         asm volatile("eieio; tlbsync; ptesync": : :"memory");
 }
 
@@ -311,6 +341,16 @@ void radix__local_flush_tlb_page(struct vm_area_struct *vma, unsigned long vmadd
 }
 EXPORT_SYMBOL(radix__local_flush_tlb_page);
 
+static bool mm_needs_flush_escalation(struct mm_struct *mm)
+{
+        /*
+         * P9 nest MMU has issues with the page walk cache
+         * caching PTEs and not flushing them properly when
+         * RIC = 0 for a PID/LPID invalidate
+         */
+        return atomic_read(&mm->context.copros) != 0;
+}
+
 #ifdef CONFIG_SMP
 void radix__flush_tlb_mm(struct mm_struct *mm)
 {
@@ -321,9 +361,12 @@ void radix__flush_tlb_mm(struct mm_struct *mm)
                 return;
 
         preempt_disable();
-        if (!mm_is_thread_local(mm))
-                _tlbie_pid(pid, RIC_FLUSH_TLB);
-        else
+        if (!mm_is_thread_local(mm)) {
+                if (mm_needs_flush_escalation(mm))
+                        _tlbie_pid(pid, RIC_FLUSH_ALL);
+                else
+                        _tlbie_pid(pid, RIC_FLUSH_TLB);
+        } else
                 _tlbiel_pid(pid, RIC_FLUSH_TLB);
         preempt_enable();
 }
@@ -435,10 +478,14 @@ void radix__flush_tlb_range(struct vm_area_struct *vma, unsigned long start,
         }
 
         if (full) {
-                if (local)
+                if (local) {
                         _tlbiel_pid(pid, RIC_FLUSH_TLB);
-                else
-                        _tlbie_pid(pid, RIC_FLUSH_TLB);
+                } else {
+                        if (mm_needs_flush_escalation(mm))
+                                _tlbie_pid(pid, RIC_FLUSH_ALL);
+                        else
+                                _tlbie_pid(pid, RIC_FLUSH_TLB);
+                }
         } else {
                 bool hflush = false;
                 unsigned long hstart, hend;
@@ -465,6 +512,7 @@ void radix__flush_tlb_range(struct vm_area_struct *vma, unsigned long start,
                         if (hflush)
                                 __tlbie_va_range(hstart, hend, pid,
                                                 HPAGE_PMD_SIZE, MMU_PAGE_2M);
+                        fixup_tlbie();
                         asm volatile("eieio; tlbsync; ptesync": : :"memory");
                 }
         }
@@ -548,6 +596,9 @@ static inline void __radix__flush_tlb_range_psize(struct mm_struct *mm,
         }
 
         if (full) {
+                if (!local && mm_needs_flush_escalation(mm))
+                        also_pwc = true;
+
                 if (local)
                         _tlbiel_pid(pid, also_pwc ? RIC_FLUSH_ALL : RIC_FLUSH_TLB);
                 else
@@ -603,46 +654,6 @@ void radix__flush_tlb_collapsed_pmd(struct mm_struct *mm, unsigned long addr)
 }
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
 
-void radix__flush_tlb_lpid_va(unsigned long lpid, unsigned long gpa,
-                              unsigned long page_size)
-{
-        unsigned long rb,rs,prs,r;
-        unsigned long ap;
-        unsigned long ric = RIC_FLUSH_TLB;
-
-        ap = mmu_get_ap(radix_get_mmu_psize(page_size));
-        rb = gpa & ~(PPC_BITMASK(52, 63));
-        rb |= ap << PPC_BITLSHIFT(58);
-        rs = lpid & ((1UL << 32) - 1);
-        prs = 0; /* process scoped */
-        r = 1;   /* raidx format */
-
-        asm volatile("ptesync": : :"memory");
-        asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1)
-                     : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory");
-        asm volatile("eieio; tlbsync; ptesync": : :"memory");
-        trace_tlbie(lpid, 0, rb, rs, ric, prs, r);
-}
-EXPORT_SYMBOL(radix__flush_tlb_lpid_va);
-
-void radix__flush_tlb_lpid(unsigned long lpid)
-{
-        unsigned long rb,rs,prs,r;
-        unsigned long ric = RIC_FLUSH_ALL;
-
-        rb = 0x2 << PPC_BITLSHIFT(53); /* IS = 2 */
-        rs = lpid & ((1UL << 32) - 1);
-        prs = 0; /* partition scoped */
-        r = 1;   /* raidx format */
-
-        asm volatile("ptesync": : :"memory");
-        asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1)
-                     : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory");
-        asm volatile("eieio; tlbsync; ptesync": : :"memory");
-        trace_tlbie(lpid, 0, rb, rs, ric, prs, r);
-}
-EXPORT_SYMBOL(radix__flush_tlb_lpid);
-
 void radix__flush_pmd_tlb_range(struct vm_area_struct *vma,
                                 unsigned long start, unsigned long end)
 {
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
index 8b8d2297d486..638411f22267 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
@@ -315,19 +315,6 @@ config X86_L1_CACHE_SHIFT
         default "4" if MELAN || M486 || MGEODEGX1
         default "5" if MWINCHIP3D || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE_LX
 
-config X86_PPRO_FENCE
-        bool "PentiumPro memory ordering errata workaround"
-        depends on M686 || M586MMX || M586TSC || M586 || M486 || MGEODEGX1
-        ---help---
-          Old PentiumPro multiprocessor systems had errata that could cause
-          memory operations to violate the x86 ordering standard in rare cases.
-          Enabling this option will attempt to work around some (but not all)
-          occurrences of this problem, at the cost of much heavier spinlock and
-          memory barrier operations.
-
-          If unsure, say n here. Even distro kernels should think twice before
-          enabling this: there are few systems, and an unlikely bug.
-
 config X86_F00F_BUG
         def_bool y
         depends on M586MMX || M586TSC || M586 || M486
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 498c1b812300..1c4d012550ec 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -223,6 +223,15 @@ KBUILD_CFLAGS += $(cfi) $(cfi-sigframe) $(cfi-sections) $(asinstr) $(avx_instr)
 
 LDFLAGS := -m elf_$(UTS_MACHINE)
 
+#
+# The 64-bit kernel must be aligned to 2MB.  Pass -z max-page-size=0x200000 to
+# the linker to force 2MB page size regardless of the default page size used
+# by the linker.
+#
+ifdef CONFIG_X86_64
+LDFLAGS += $(call ld-option, -z max-page-size=0x200000)
+endif
+
 # Speed up the build
 KBUILD_CFLAGS += -pipe
 # Workaround for a gcc prelease that unfortunately was shipped in a suse release
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index 98761a1576ce..252fee320816 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -309,6 +309,10 @@ static void parse_elf(void *output)
 
                 switch (phdr->p_type) {
                 case PT_LOAD:
+#ifdef CONFIG_X86_64
+                        if ((phdr->p_align % 0x200000) != 0)
+                                error("Alignment of LOAD segment isn't multiple of 2MB");
+#endif
 #ifdef CONFIG_RELOCATABLE
                         dest = output;
                         dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 805f52703ee3..18ed349b4f83 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -1138,7 +1138,7 @@ apicinterrupt3 HYPERV_REENLIGHTENMENT_VECTOR \
 #endif /* CONFIG_HYPERV */
 
 idtentry debug                  do_debug                has_error_code=0        paranoid=1 shift_ist=DEBUG_STACK
-idtentry int3                   do_int3                 has_error_code=0        paranoid=1 shift_ist=DEBUG_STACK
+idtentry int3                   do_int3                 has_error_code=0
 idtentry stack_segment          do_stack_segment        has_error_code=1
 
 #ifdef CONFIG_XEN
diff --git a/arch/x86/entry/vdso/vdso32/vclock_gettime.c b/arch/x86/entry/vdso/vdso32/vclock_gettime.c
index 7780bbfb06ef..9242b28418d5 100644
--- a/arch/x86/entry/vdso/vdso32/vclock_gettime.c
+++ b/arch/x86/entry/vdso/vdso32/vclock_gettime.c
@@ -5,8 +5,6 @@
 #undef CONFIG_OPTIMIZE_INLINING
 #endif
 
-#undef CONFIG_X86_PPRO_FENCE
-
 #ifdef CONFIG_X86_64
 
 /*
diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
index 8560ef68a9d6..317be365bce3 100644
--- a/arch/x86/entry/vsyscall/vsyscall_64.c
+++ b/arch/x86/entry/vsyscall/vsyscall_64.c
@@ -347,7 +347,7 @@ void __init set_vsyscall_pgtable_user_bits(pgd_t *root)
         set_pgd(pgd, __pgd(pgd_val(*pgd) | _PAGE_USER));
         p4d = p4d_offset(pgd, VSYSCALL_ADDR);
 #if CONFIG_PGTABLE_LEVELS >= 5
-        p4d->p4d |= _PAGE_USER;
+        set_p4d(p4d, __p4d(p4d_val(*p4d) | _PAGE_USER));
 #endif
         pud = pud_offset(p4d, VSYSCALL_ADDR);
         set_pud(pud, __pud(pud_val(*pud) | _PAGE_USER));
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 140d33288e78..88797c80b3e0 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2118,7 +2118,8 @@ static int x86_pmu_event_init(struct perf_event *event)
                         event->destroy(event);
         }
 
-        if (READ_ONCE(x86_pmu.attr_rdpmc))
+        if (READ_ONCE(x86_pmu.attr_rdpmc) &&
+            !(event->hw.flags & PERF_X86_EVENT_LARGE_PEBS))
                 event->hw.flags |= PERF_X86_EVENT_RDPMC_ALLOWED;
 
         return err;
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 56457cb73448..1e41d7508d99 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -2952,9 +2952,9 @@ static void intel_pebs_aliases_skl(struct perf_event *event)
         return intel_pebs_aliases_precdist(event);
 }
 
-static unsigned long intel_pmu_free_running_flags(struct perf_event *event)
+static unsigned long intel_pmu_large_pebs_flags(struct perf_event *event)
 {
-        unsigned long flags = x86_pmu.free_running_flags;
+        unsigned long flags = x86_pmu.large_pebs_flags;
 
         if (event->attr.use_clockid)
                 flags &= ~PERF_SAMPLE_TIME;
@@ -2976,8 +2976,8 @@ static int intel_pmu_hw_config(struct perf_event *event)
                 if (!event->attr.freq) {
                         event->hw.flags |= PERF_X86_EVENT_AUTO_RELOAD;
                         if (!(event->attr.sample_type &
-                              ~intel_pmu_free_running_flags(event)))
-                                event->hw.flags |= PERF_X86_EVENT_FREERUNNING;
+                              ~intel_pmu_large_pebs_flags(event)))
+                                event->hw.flags |= PERF_X86_EVENT_LARGE_PEBS;
                 }
                 if (x86_pmu.pebs_aliases)
                         x86_pmu.pebs_aliases(event);
@@ -3194,7 +3194,7 @@ static unsigned bdw_limit_period(struct perf_event *event, unsigned left)
                         X86_CONFIG(.event=0xc0, .umask=0x01)) {
                 if (left < 128)
                         left = 128;
-                left &= ~0x3fu;
+                left &= ~0x3fULL;
         }
         return left;
 }
@@ -3460,7 +3460,7 @@ static __initconst const struct x86_pmu core_pmu = {
         .event_map              = intel_pmu_event_map,
         .max_events             = ARRAY_SIZE(intel_perfmon_event_map),
         .apic                   = 1,
-        .free_running_flags     = PEBS_FREERUNNING_FLAGS,
+        .large_pebs_flags       = LARGE_PEBS_FLAGS,
 
         /*
          * Intel PMCs cannot be accessed sanely above 32-bit width,
@@ -3502,7 +3502,7 @@ static __initconst const struct x86_pmu intel_pmu = {
         .event_map              = intel_pmu_event_map,
         .max_events             = ARRAY_SIZE(intel_perfmon_event_map),
         .apic                   = 1,
-        .free_running_flags     = PEBS_FREERUNNING_FLAGS,
+        .large_pebs_flags       = LARGE_PEBS_FLAGS,
         /*
          * Intel PMCs cannot be accessed sanely above 32 bit width,
          * so we install an artificial 1<<31 period regardless of
diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
index 18c25ab28557..d8015235ba76 100644
--- a/arch/x86/events/intel/ds.c
+++ b/arch/x86/events/intel/ds.c
@@ -935,7 +935,7 @@ void intel_pmu_pebs_add(struct perf_event *event)
         bool needed_cb = pebs_needs_sched_cb(cpuc);
 
         cpuc->n_pebs++;
-        if (hwc->flags & PERF_X86_EVENT_FREERUNNING)
+        if (hwc->flags & PERF_X86_EVENT_LARGE_PEBS)
                 cpuc->n_large_pebs++;
 
         pebs_update_state(needed_cb, cpuc, event->ctx->pmu);
@@ -975,7 +975,7 @@ void intel_pmu_pebs_del(struct perf_event *event)
         bool needed_cb = pebs_needs_sched_cb(cpuc);
 
         cpuc->n_pebs--;
-        if (hwc->flags & PERF_X86_EVENT_FREERUNNING)
+        if (hwc->flags & PERF_X86_EVENT_LARGE_PEBS)
                 cpuc->n_large_pebs--;
 
         pebs_update_state(needed_cb, cpuc, event->ctx->pmu);
@@ -1530,7 +1530,7 @@ void __init intel_ds_init(void)
                         x86_pmu.pebs_record_size =
                                                 sizeof(struct pebs_record_skl);
                         x86_pmu.drain_pebs = intel_pmu_drain_pebs_nhm;
-                        x86_pmu.free_running_flags |= PERF_SAMPLE_TIME;
+                        x86_pmu.large_pebs_flags |= PERF_SAMPLE_TIME;
                         break;
 
                 default:
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index 22ec65bc033a..c98b943e58b4 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -3343,6 +3343,7 @@ static struct extra_reg skx_uncore_cha_extra_regs[] = {
         SNBEP_CBO_EVENT_EXTRA_REG(0x9134, 0xffff, 0x4),
         SNBEP_CBO_EVENT_EXTRA_REG(0x35, 0xff, 0x8),
         SNBEP_CBO_EVENT_EXTRA_REG(0x36, 0xff, 0x8),
+        SNBEP_CBO_EVENT_EXTRA_REG(0x38, 0xff, 0x3),
         EVENT_EXTRA_END
 };
 
@@ -3562,24 +3563,27 @@ static struct intel_uncore_type *skx_msr_uncores[] = {
         NULL,
 };
 
+/*
+ * To determine the number of CHAs, it should read bits 27:0 in the CAPID6
+ * register which located at Device 30, Function 3, Offset 0x9C. PCI ID 0x2083.
+ */
+#define SKX_CAPID6              0x9c
+#define SKX_CHA_BIT_MASK        GENMASK(27, 0)
+
 static int skx_count_chabox(void)
 {
-        struct pci_dev *chabox_dev = NULL;
-        int bus, count = 0;
+        struct pci_dev *dev = NULL;
+        u32 val = 0;
 
-        while (1) {
-                chabox_dev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x208d, chabox_dev);
-                if (!chabox_dev)
-                        break;
-                if (count == 0)
-                        bus = chabox_dev->bus->number;
-                if (bus != chabox_dev->bus->number)
-                        break;
-                count++;
-        }
+        dev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x2083, dev);
+        if (!dev)
+                goto out;
 
-        pci_dev_put(chabox_dev);
-        return count;
+        pci_read_config_dword(dev, SKX_CAPID6, &val);
+        val &= SKX_CHA_BIT_MASK;
+out:
+        pci_dev_put(dev);
+        return hweight32(val);
 }
 
 void skx_uncore_cpu_init(void)
diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
index 78f91ec1056e..39cd0615f04f 100644
--- a/arch/x86/events/perf_event.h
+++ b/arch/x86/events/perf_event.h
@@ -69,7 +69,7 @@ struct event_constraint {
 #define PERF_X86_EVENT_RDPMC_ALLOWED    0x0100 /* grant rdpmc permission */
 #define PERF_X86_EVENT_EXCL_ACCT        0x0200 /* accounted EXCL event */
 #define PERF_X86_EVENT_AUTO_RELOAD      0x0400 /* use PEBS auto-reload */
-#define PERF_X86_EVENT_FREERUNNING      0x0800 /* use freerunning PEBS */
+#define PERF_X86_EVENT_LARGE_PEBS       0x0800 /* use large PEBS */
 
 
 struct amd_nb {
@@ -88,7 +88,7 @@ struct amd_nb {
  * REGS_USER can be handled for events limited to ring 3.
  *
  */
-#define PEBS_FREERUNNING_FLAGS \
+#define LARGE_PEBS_FLAGS \
         (PERF_SAMPLE_IP | PERF_SAMPLE_TID | PERF_SAMPLE_ADDR | \
         PERF_SAMPLE_ID | PERF_SAMPLE_CPU | PERF_SAMPLE_STREAM_ID | \
         PERF_SAMPLE_DATA_SRC | PERF_SAMPLE_IDENTIFIER | \
@@ -608,7 +608,7 @@ struct x86_pmu {
         struct event_constraint *pebs_constraints;
         void            (*pebs_aliases)(struct perf_event *event);
         int             max_pebs_events;
-        unsigned long   free_running_flags;
+        unsigned long   large_pebs_flags;
 
         /*
          * Intel LBR
diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
index e1259f043ae9..042b5e892ed1 100644
--- a/arch/x86/include/asm/barrier.h
+++ b/arch/x86/include/asm/barrier.h
@@ -52,11 +52,7 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
 #define barrier_nospec() alternative_2("", "mfence", X86_FEATURE_MFENCE_RDTSC, \
                                            "lfence", X86_FEATURE_LFENCE_RDTSC)
 
-#ifdef CONFIG_X86_PPRO_FENCE
-#define dma_rmb()       rmb()
-#else
 #define dma_rmb()       barrier()
-#endif
 #define dma_wmb()       barrier()
 
 #ifdef CONFIG_X86_32
@@ -68,30 +64,6 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
 #define __smp_wmb()     barrier()
 #define __smp_store_mb(var, value) do { (void)xchg(&var, value); } while (0)
 
-#if defined(CONFIG_X86_PPRO_FENCE)
-
-/*
- * For this option x86 doesn't have a strong TSO memory
- * model and we should fall back to full barriers.
- */
-
-#define __smp_store_release(p, v)                                       \
-do {                                                                    \
-        compiletime_assert_atomic_type(*p);                             \
-        __smp_mb();                                                     \
-        WRITE_ONCE(*p, v);                                              \
-} while (0)
-
-#define __smp_load_acquire(p)                                           \
-({                                                                      \
-        typeof(*p) ___p1 = READ_ONCE(*p);                               \
-        compiletime_assert_atomic_type(*p);                             \
-        __smp_mb();                                                     \
-        ___p1;                                                          \
-})
-
-#else /* regular x86 TSO memory ordering */
-
 #define __smp_store_release(p, v)                                       \
 do {                                                                    \
         compiletime_assert_atomic_type(*p);                             \
@@ -107,8 +79,6 @@ do {									\
         ___p1;                                                          \
 })
 
-#endif
-
 /* Atomic operations are already serializing on x86 */
 #define __smp_mb__before_atomic()       barrier()
 #define __smp_mb__after_atomic()        barrier()
diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
index 95e948627fd0..f6e5b9375d8c 100644
--- a/arch/x86/include/asm/io.h
+++ b/arch/x86/include/asm/io.h
@@ -232,21 +232,6 @@ extern void set_iounmap_nonlazy(void);
  */
 #define __ISA_IO_base ((char __iomem *)(PAGE_OFFSET))
 
-/*
- *      Cache management
- *
- *      This needed for two cases
- *      1. Out of order aware processors
- *      2. Accidentally out of order processors (PPro errata #51)
- */
-
-static inline void flush_write_buffers(void)
-{
-#if defined(CONFIG_X86_PPRO_FENCE)
-        asm volatile("lock; addl $0,0(%%esp)": : :"memory");
-#endif
-}
-
 #endif /* __KERNEL__ */
 
 extern void native_io_delay(void);
diff --git a/arch/x86/kernel/idt.c b/arch/x86/kernel/idt.c
index 56d99be3706a..50bee5fe1140 100644
--- a/arch/x86/kernel/idt.c
+++ b/arch/x86/kernel/idt.c
@@ -160,7 +160,6 @@ static const __initconst struct idt_data early_pf_idts[] = {
  */
 static const __initconst struct idt_data dbg_idts[] = {
         INTG(X86_TRAP_DB,       debug),
-        INTG(X86_TRAP_BP,       int3),
 };
 #endif
 
@@ -183,7 +182,6 @@ gate_desc debug_idt_table[IDT_ENTRIES] __page_aligned_bss;
 static const __initconst struct idt_data ist_idts[] = {
         ISTG(X86_TRAP_DB,       debug,          DEBUG_STACK),
         ISTG(X86_TRAP_NMI,      nmi,            NMI_STACK),
-        SISTG(X86_TRAP_BP,      int3,           DEBUG_STACK),
         ISTG(X86_TRAP_DF,       double_fault,   DOUBLEFAULT_STACK),
 #ifdef CONFIG_X86_MCE
         ISTG(X86_TRAP_MC,       &machine_check, MCE_STACK),
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index bc1a27280c4b..fae86e36e399 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -546,7 +546,7 @@ static void __init kvm_guest_init(void)
         }
 
         if (kvm_para_has_feature(KVM_FEATURE_PV_TLB_FLUSH) &&
-            !kvm_para_has_feature(KVM_FEATURE_STEAL_TIME))
+            kvm_para_has_feature(KVM_FEATURE_STEAL_TIME))
                 pv_mmu_ops.flush_tlb_others = kvm_flush_tlb_others;
 
         if (kvm_para_has_feature(KVM_FEATURE_PV_EOI))
@@ -635,7 +635,7 @@ static __init int kvm_setup_pv_tlb_flush(void)
         int cpu;
 
         if (kvm_para_has_feature(KVM_FEATURE_PV_TLB_FLUSH) &&
-            !kvm_para_has_feature(KVM_FEATURE_STEAL_TIME)) {
+            kvm_para_has_feature(KVM_FEATURE_STEAL_TIME)) {
                 for_each_possible_cpu(cpu) {
                         zalloc_cpumask_var_node(per_cpu_ptr(&__pv_tlb_mask, cpu),
                                 GFP_KERNEL, cpu_to_node(cpu));
diff --git a/arch/x86/kernel/pci-nommu.c b/arch/x86/kernel/pci-nommu.c
index 618285e475c6..ac7ea3a8242f 100644
--- a/arch/x86/kernel/pci-nommu.c
+++ b/arch/x86/kernel/pci-nommu.c
@@ -37,7 +37,6 @@ static dma_addr_t nommu_map_page(struct device *dev, struct page *page,
         WARN_ON(size == 0);
         if (!check_addr("map_single", dev, bus, size))
                 return NOMMU_MAPPING_ERROR;
-        flush_write_buffers();
         return bus;
 }
 
@@ -72,25 +71,9 @@ static int nommu_map_sg(struct device *hwdev, struct scatterlist *sg,
                         return 0;
                 s->dma_length = s->length;
         }
-        flush_write_buffers();
         return nents;
 }
 
-static void nommu_sync_single_for_device(struct device *dev,
-                        dma_addr_t addr, size_t size,
-                        enum dma_data_direction dir)
-{
-        flush_write_buffers();
-}
-
-
-static void nommu_sync_sg_for_device(struct device *dev,
-                        struct scatterlist *sg, int nelems,
-                        enum dma_data_direction dir)
-{
-        flush_write_buffers();
-}
-
 static int nommu_mapping_error(struct device *dev, dma_addr_t dma_addr)
 {
         return dma_addr == NOMMU_MAPPING_ERROR;
@@ -101,8 +84,6 @@ const struct dma_map_ops nommu_dma_ops = {
         .free                   = dma_generic_free_coherent,
         .map_sg                 = nommu_map_sg,
         .map_page               = nommu_map_page,
-        .sync_single_for_device = nommu_sync_single_for_device,
-        .sync_sg_for_device     = nommu_sync_sg_for_device,
         .is_phys                = 1,
         .mapping_error          = nommu_mapping_error,
         .dma_supported          = x86_dma_supported,
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 3d9b2308e7fa..03f3d7695dac 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -577,7 +577,6 @@ do_general_protection(struct pt_regs *regs, long error_code)
 }
 NOKPROBE_SYMBOL(do_general_protection);
 
-/* May run on IST stack. */
 dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code)
 {
 #ifdef CONFIG_DYNAMIC_FTRACE
@@ -592,6 +591,13 @@ dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code)
         if (poke_int3_handler(regs))
                 return;
 
+        /*
+         * Use ist_enter despite the fact that we don't use an IST stack.
+         * We can be called from a kprobe in non-CONTEXT_KERNEL kernel
+         * mode or even during context tracking state changes.
+         *
+         * This means that we can't schedule.  That's okay.
+         */
         ist_enter(regs);
         RCU_LOCKDEP_WARN(!rcu_is_watching(), "entry code didn't wake RCU");
 #ifdef CONFIG_KGDB_LOW_LEVEL_TRAP
@@ -609,15 +615,10 @@ dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code)
                         SIGTRAP) == NOTIFY_STOP)
                 goto exit;
 
-        /*
-         * Let others (NMI) know that the debug stack is in use
-         * as we may switch to the interrupt stack.
-         */
-        debug_stack_usage_inc();
         cond_local_irq_enable(regs);
         do_trap(X86_TRAP_BP, SIGTRAP, "int3", regs, error_code, NULL);
         cond_local_irq_disable(regs);
-        debug_stack_usage_dec();
+
 exit:
         ist_exit(regs);
 }
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 2d87603f9179..657c93409042 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -10711,6 +10711,11 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
         struct vcpu_vmx *vmx = to_vmx(vcpu);
         u32 exec_control, vmcs12_exec_ctrl;
 
+        if (vmx->nested.dirty_vmcs12) {
+                prepare_vmcs02_full(vcpu, vmcs12, from_vmentry);
+                vmx->nested.dirty_vmcs12 = false;
+        }
+
         /*
          * First, the fields that are shadowed.  This must be kept in sync
          * with vmx_shadow_fields.h.
@@ -10948,11 +10953,6 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
         /* Note: modifies VM_ENTRY/EXIT_CONTROLS and GUEST/HOST_IA32_EFER */
         vmx_set_efer(vcpu, vcpu->arch.efer);
 
-        if (vmx->nested.dirty_vmcs12) {
-                prepare_vmcs02_full(vcpu, vmcs12, from_vmentry);
-                vmx->nested.dirty_vmcs12 = false;
-        }
-
         /* Shadow page tables on either EPT or shadow page tables. */
         if (nested_vmx_load_cr3(vcpu, vmcs12->guest_cr3, nested_cpu_has_ept(vmcs12),
                                 entry_failure_code))
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index c310a8284358..f9cfbc0d1f33 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -227,7 +227,7 @@ int __init efi_alloc_page_tables(void)
         if (!pud) {
                 if (CONFIG_PGTABLE_LEVELS > 4)
                         free_page((unsigned long) pgd_page_vaddr(*pgd));
-                free_page((unsigned long)efi_pgd);
+                free_pages((unsigned long)efi_pgd, PGD_ALLOCATION_ORDER);
                 return -ENOMEM;
         }
 
diff --git a/arch/x86/um/asm/barrier.h b/arch/x86/um/asm/barrier.h
index b7d73400ea29..f31e5d903161 100644
--- a/arch/x86/um/asm/barrier.h
+++ b/arch/x86/um/asm/barrier.h
@@ -30,11 +30,7 @@
 
 #endif /* CONFIG_X86_32 */
 
-#ifdef CONFIG_X86_PPRO_FENCE
-#define dma_rmb()       rmb()
-#else /* CONFIG_X86_PPRO_FENCE */
 #define dma_rmb()       barrier()
-#endif /* CONFIG_X86_PPRO_FENCE */
 #define dma_wmb()       barrier()
 
 #include <asm-generic/barrier.h>
diff --git a/drivers/dma/stm32-dmamux.c b/drivers/dma/stm32-dmamux.c
index 4dbb30cf94ac..b922db90939a 100644
--- a/drivers/dma/stm32-dmamux.c
+++ b/drivers/dma/stm32-dmamux.c
@@ -118,14 +118,15 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec,
         spin_lock_irqsave(&dmamux->lock, flags);
         mux->chan_id = find_first_zero_bit(dmamux->dma_inuse,
                                            dmamux->dma_requests);
-        set_bit(mux->chan_id, dmamux->dma_inuse);
-        spin_unlock_irqrestore(&dmamux->lock, flags);
 
         if (mux->chan_id == dmamux->dma_requests) {
+                spin_unlock_irqrestore(&dmamux->lock, flags);
                 dev_err(&pdev->dev, "Run out of free DMA requests\n");
                 ret = -ENOMEM;
-                goto error;
+                goto error_chan_id;
         }
+        set_bit(mux->chan_id, dmamux->dma_inuse);
+        spin_unlock_irqrestore(&dmamux->lock, flags);
 
         /* Look for DMA Master */
         for (i = 1, min = 0, max = dmamux->dma_reqs[i];
@@ -173,6 +174,8 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec,
 
 error:
         clear_bit(mux->chan_id, dmamux->dma_inuse);
+
+error_chan_id:
         kfree(mux);
         return ERR_PTR(ret);
 }
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index b21285afa4ea..1bd5f26b3f00 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -821,13 +821,13 @@ static int create_queue_cpsch(struct device_queue_manager *dqm, struct queue *q,
                 pr_warn("Can't create new usermode queue because %d queues were already created\n",
                                 dqm->total_queue_count);
                 retval = -EPERM;
-                goto out;
+                goto out_unlock;
         }
 
         if (q->properties.type == KFD_QUEUE_TYPE_SDMA) {
                 retval = allocate_sdma_queue(dqm, &q->sdma_id);
                 if (retval)
-                        goto out;
+                        goto out_unlock;
                 q->properties.sdma_queue_id =
                         q->sdma_id / CIK_SDMA_QUEUES_PER_ENGINE;
                 q->properties.sdma_engine_id =
@@ -838,7 +838,7 @@ static int create_queue_cpsch(struct device_queue_manager *dqm, struct queue *q,
 
         if (!mqd) {
                 retval = -ENOMEM;
-                goto out;
+                goto out_deallocate_sdma_queue;
         }
 
         dqm->asic_ops.init_sdma_vm(dqm, q, qpd);
@@ -848,7 +848,7 @@ static int create_queue_cpsch(struct device_queue_manager *dqm, struct queue *q,
         retval = mqd->init_mqd(mqd, &q->mqd, &q->mqd_mem_obj,
                                 &q->gart_mqd_addr, &q->properties);
         if (retval)
-                goto out;
+                goto out_deallocate_sdma_queue;
 
         list_add(&q->list, &qpd->queues_list);
         qpd->queue_count++;
@@ -869,7 +869,13 @@ static int create_queue_cpsch(struct device_queue_manager *dqm, struct queue *q,
         pr_debug("Total of %d queues are accountable so far\n",
                         dqm->total_queue_count);
 
-out:
+        mutex_unlock(&dqm->lock);
+        return retval;
+
+out_deallocate_sdma_queue:
+        if (q->properties.type == KFD_QUEUE_TYPE_SDMA)
+                deallocate_sdma_queue(dqm, q->sdma_id);
+out_unlock:
         mutex_unlock(&dqm->lock);
         return retval;
 }
@@ -1188,8 +1194,10 @@ static int process_termination_cpsch(struct device_queue_manager *dqm,
 
         /* Clear all user mode queues */
         list_for_each_entry(q, &qpd->queues_list, list) {
-                if (q->properties.type == KFD_QUEUE_TYPE_SDMA)
+                if (q->properties.type == KFD_QUEUE_TYPE_SDMA) {
                         dqm->sdma_queue_count--;
+                        deallocate_sdma_queue(dqm, q->sdma_id);
+                }
 
                 if (q->properties.is_active)
                         dqm->queue_count--;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c
index 0ecbd1f9b606..0c3bc00978f7 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c
@@ -188,8 +188,7 @@ static int pm_create_map_process(struct packet_manager *pm, uint32_t *buffer,
         packet->sh_mem_ape1_base = qpd->sh_mem_ape1_base;
         packet->sh_mem_ape1_limit = qpd->sh_mem_ape1_limit;
 
-        /* TODO: scratch support */
-        packet->sh_hidden_private_base_vmid = 0;
+        packet->sh_hidden_private_base_vmid = qpd->sh_hidden_private_base;
 
         packet->gds_addr_lo = lower_32_bits(qpd->gds_context_area);
         packet->gds_addr_hi = upper_32_bits(qpd->gds_context_area);
diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
index fbffe1948b3b..90b25ce363ca 100644
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -2009,9 +2009,9 @@ static const struct tegra_dc_soc_info tegra124_dc_soc_info = {
         .coupled_pm = false,
         .has_nvdisplay = false,
         .num_primary_formats = ARRAY_SIZE(tegra124_primary_formats),
-        .primary_formats = tegra114_primary_formats,
+        .primary_formats = tegra124_primary_formats,
         .num_overlay_formats = ARRAY_SIZE(tegra124_overlay_formats),
-        .overlay_formats = tegra114_overlay_formats,
+        .overlay_formats = tegra124_overlay_formats,
 };
 
 static const struct tegra_dc_soc_info tegra210_dc_soc_info = {
@@ -2160,7 +2160,7 @@ static int tegra_dc_couple(struct tegra_dc *dc)
                 struct device_link *link;
                 struct device *partner;
 
-                partner = driver_find_device(dc->dev->driver, NULL, 0,
+                partner = driver_find_device(dc->dev->driver, NULL, NULL,
                                              tegra_dc_match_by_pipe);
                 if (!partner)
                         return -EPROBE_DEFER;
diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
index 50e071444a5c..8699bb969e7e 100644
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -417,13 +417,24 @@ __hv_pkt_iter_next(struct vmbus_channel *channel,
 }
 EXPORT_SYMBOL_GPL(__hv_pkt_iter_next);
 
+/* How many bytes were read in this iterator cycle */
+static u32 hv_pkt_iter_bytes_read(const struct hv_ring_buffer_info *rbi,
+                                        u32 start_read_index)
+{
+        if (rbi->priv_read_index >= start_read_index)
+                return rbi->priv_read_index - start_read_index;
+        else
+                return rbi->ring_datasize - start_read_index +
+                        rbi->priv_read_index;
+}
+
 /*
  * Update host ring buffer after iterating over packets.
  */
 void hv_pkt_iter_close(struct vmbus_channel *channel)
 {
         struct hv_ring_buffer_info *rbi = &channel->inbound;
-        u32 orig_write_sz = hv_get_bytes_to_write(rbi);
+        u32 curr_write_sz, pending_sz, bytes_read, start_read_index;
 
         /*
          * Make sure all reads are done before we update the read index since
@@ -431,8 +442,12 @@ void hv_pkt_iter_close(struct vmbus_channel *channel)
          * is updated.
          */
         virt_rmb();
+        start_read_index = rbi->ring_buffer->read_index;
         rbi->ring_buffer->read_index = rbi->priv_read_index;
 
+        if (!rbi->ring_buffer->feature_bits.feat_pending_send_sz)
+                return;
+
         /*
          * Issue a full memory barrier before making the signaling decision.
          * Here is the reason for having this barrier:
@@ -446,26 +461,29 @@ void hv_pkt_iter_close(struct vmbus_channel *channel)
          */
         virt_mb();
 
-        /* If host has disabled notifications then skip */
-        if (rbi->ring_buffer->interrupt_mask)
+        pending_sz = READ_ONCE(rbi->ring_buffer->pending_send_sz);
+        if (!pending_sz)
                 return;
 
-        if (rbi->ring_buffer->feature_bits.feat_pending_send_sz) {
-                u32 pending_sz = READ_ONCE(rbi->ring_buffer->pending_send_sz);
+        /*
+         * Ensure the read of write_index in hv_get_bytes_to_write()
+         * happens after the read of pending_send_sz.
+         */
+        virt_rmb();
+        curr_write_sz = hv_get_bytes_to_write(rbi);
+        bytes_read = hv_pkt_iter_bytes_read(rbi, start_read_index);
 
-                /*
-                 * If there was space before we began iteration,
-                 * then host was not blocked. Also handles case where
-                 * pending_sz is zero then host has nothing pending
-                 * and does not need to be signaled.
-                 */
-                if (orig_write_sz > pending_sz)
-                        return;
+        /*
+         * If there was space before we began iteration,
+         * then host was not blocked.
+         */
 
-                /* If pending write will not fit, don't give false hope. */
-                if (hv_get_bytes_to_write(rbi) < pending_sz)
-                        return;
-        }
+        if (curr_write_sz - bytes_read > pending_sz)
+                return;
+
+        /* If pending write will not fit, don't give false hope. */
+        if (curr_write_sz <= pending_sz)
+                return;
 
         vmbus_setevent(channel);
 }
diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
index b445b3bb0bb1..f273e28c39db 100644
--- a/drivers/i2c/busses/i2c-stm32f7.c
+++ b/drivers/i2c/busses/i2c-stm32f7.c
@@ -888,6 +888,11 @@ static int stm32f7_i2c_probe(struct platform_device *pdev)
         }
 
         setup = of_device_get_match_data(&pdev->dev);
+        if (!setup) {
+                dev_err(&pdev->dev, "Can't get device data\n");
+                ret = -ENODEV;
+                goto clk_free;
+        }
         i2c_dev->setup = *setup;
 
         ret = device_property_read_u32(i2c_dev->dev, "i2c-scl-rising-time-ns",
diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c
index 6fe995cf16a6..3e6fd5a8ac5b 100644
--- a/drivers/iio/accel/st_accel_core.c
+++ b/drivers/iio/accel/st_accel_core.c
@@ -920,6 +920,8 @@ static const struct iio_trigger_ops st_accel_trigger_ops = {
 int st_accel_common_probe(struct iio_dev *indio_dev)
 {
         struct st_sensor_data *adata = iio_priv(indio_dev);
+        struct st_sensors_platform_data *pdata =
+                (struct st_sensors_platform_data *)adata->dev->platform_data;
         int irq = adata->get_irq_data_ready(indio_dev);
         int err;
 
@@ -946,7 +948,10 @@ int st_accel_common_probe(struct iio_dev *indio_dev)
                                         &adata->sensor_settings->fs.fs_avl[0];
         adata->odr = adata->sensor_settings->odr.odr_avl[0].hz;
 
-        err = st_sensors_init_sensor(indio_dev, adata->dev->platform_data);
+        if (!pdata)
+                pdata = (struct st_sensors_platform_data *)&default_accel_pdata;
+
+        err = st_sensors_init_sensor(indio_dev, pdata);
         if (err < 0)
                 goto st_accel_power_off;
 
diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c
index 29fa7736d80c..ede955d9b2a4 100644
--- a/drivers/iio/adc/meson_saradc.c
+++ b/drivers/iio/adc/meson_saradc.c
@@ -462,8 +462,10 @@ static int meson_sar_adc_lock(struct iio_dev *indio_dev)
                         regmap_read(priv->regmap, MESON_SAR_ADC_DELAY, &val);
                 } while (val & MESON_SAR_ADC_DELAY_BL30_BUSY && timeout--);
 
-                if (timeout < 0)
+                if (timeout < 0) {
+                        mutex_unlock(&indio_dev->mlock);
                         return -ETIMEDOUT;
+                }
         }
 
         return 0;
diff --git a/drivers/iio/adc/stm32-dfsdm-adc.c b/drivers/iio/adc/stm32-dfsdm-adc.c
index daa026d6a94f..01422d11753c 100644
--- a/drivers/iio/adc/stm32-dfsdm-adc.c
+++ b/drivers/iio/adc/stm32-dfsdm-adc.c
@@ -54,7 +54,6 @@ struct stm32_dfsdm_adc {
         struct stm32_dfsdm *dfsdm;
         const struct stm32_dfsdm_dev_data *dev_data;
         unsigned int fl_id;
-        unsigned int ch_id;
 
         /* ADC specific */
         unsigned int oversamp;
@@ -384,7 +383,7 @@ static ssize_t dfsdm_adc_audio_set_spiclk(struct iio_dev *indio_dev,
 {
         struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
         struct stm32_dfsdm_filter *fl = &adc->dfsdm->fl_list[adc->fl_id];
-        struct stm32_dfsdm_channel *ch = &adc->dfsdm->ch_list[adc->ch_id];
+        struct stm32_dfsdm_channel *ch = &adc->dfsdm->ch_list[chan->channel];
         unsigned int sample_freq = adc->sample_freq;
         unsigned int spi_freq;
         int ret;
@@ -419,18 +418,20 @@ static ssize_t dfsdm_adc_audio_set_spiclk(struct iio_dev *indio_dev,
         return len;
 }
 
-static int stm32_dfsdm_start_conv(struct stm32_dfsdm_adc *adc, bool dma)
+static int stm32_dfsdm_start_conv(struct stm32_dfsdm_adc *adc,
+                                  const struct iio_chan_spec *chan,
+                                  bool dma)
 {
         struct regmap *regmap = adc->dfsdm->regmap;
         int ret;
         unsigned int dma_en = 0, cont_en = 0;
 
-        ret = stm32_dfsdm_start_channel(adc->dfsdm, adc->ch_id);
+        ret = stm32_dfsdm_start_channel(adc->dfsdm, chan->channel);
         if (ret < 0)
                 return ret;
 
         ret = stm32_dfsdm_filter_configure(adc->dfsdm, adc->fl_id,
-                                           adc->ch_id);
+                                           chan->channel);
         if (ret < 0)
                 goto stop_channels;
 
@@ -464,12 +465,13 @@ stop_channels:
 
         regmap_update_bits(regmap, DFSDM_CR1(adc->fl_id),
                            DFSDM_CR1_RCONT_MASK, 0);
-        stm32_dfsdm_stop_channel(adc->dfsdm, adc->fl_id);
+        stm32_dfsdm_stop_channel(adc->dfsdm, chan->channel);
 
         return ret;
 }
 
-static void stm32_dfsdm_stop_conv(struct stm32_dfsdm_adc *adc)
+static void stm32_dfsdm_stop_conv(struct stm32_dfsdm_adc *adc,
+                                  const struct iio_chan_spec *chan)
 {
         struct regmap *regmap = adc->dfsdm->regmap;
 
@@ -482,7 +484,7 @@ static void stm32_dfsdm_stop_conv(struct stm32_dfsdm_adc *adc)
         regmap_update_bits(regmap, DFSDM_CR1(adc->fl_id),
                            DFSDM_CR1_RCONT_MASK, 0);
 
-        stm32_dfsdm_stop_channel(adc->dfsdm, adc->ch_id);
+        stm32_dfsdm_stop_channel(adc->dfsdm, chan->channel);
 }
 
 static int stm32_dfsdm_set_watermark(struct iio_dev *indio_dev,
@@ -609,6 +611,7 @@ static int stm32_dfsdm_adc_dma_start(struct iio_dev *indio_dev)
 static int stm32_dfsdm_postenable(struct iio_dev *indio_dev)
 {
         struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
+        const struct iio_chan_spec *chan = &indio_dev->channels[0];
         int ret;
 
         /* Reset adc buffer index */
@@ -618,7 +621,7 @@ static int stm32_dfsdm_postenable(struct iio_dev *indio_dev)
         if (ret < 0)
                 return ret;
 
-        ret = stm32_dfsdm_start_conv(adc, true);
+        ret = stm32_dfsdm_start_conv(adc, chan, true);
         if (ret) {
                 dev_err(&indio_dev->dev, "Can't start conversion\n");
                 goto stop_dfsdm;
@@ -635,7 +638,7 @@ static int stm32_dfsdm_postenable(struct iio_dev *indio_dev)
         return 0;
 
 err_stop_conv:
-        stm32_dfsdm_stop_conv(adc);
+        stm32_dfsdm_stop_conv(adc, chan);
 stop_dfsdm:
         stm32_dfsdm_stop_dfsdm(adc->dfsdm);
 
@@ -645,11 +648,12 @@ stop_dfsdm:
 static int stm32_dfsdm_predisable(struct iio_dev *indio_dev)
 {
         struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
+        const struct iio_chan_spec *chan = &indio_dev->channels[0];
 
         if (adc->dma_chan)
                 dmaengine_terminate_all(adc->dma_chan);
 
-        stm32_dfsdm_stop_conv(adc);
+        stm32_dfsdm_stop_conv(adc, chan);
 
         stm32_dfsdm_stop_dfsdm(adc->dfsdm);
 
@@ -730,7 +734,7 @@ static int stm32_dfsdm_single_conv(struct iio_dev *indio_dev,
         if (ret < 0)
                 goto stop_dfsdm;
 
-        ret = stm32_dfsdm_start_conv(adc, false);
+        ret = stm32_dfsdm_start_conv(adc, chan, false);
         if (ret < 0) {
                 regmap_update_bits(adc->dfsdm->regmap, DFSDM_CR2(adc->fl_id),
                                    DFSDM_CR2_REOCIE_MASK, DFSDM_CR2_REOCIE(0));
@@ -751,7 +755,7 @@ static int stm32_dfsdm_single_conv(struct iio_dev *indio_dev,
         else
                 ret = IIO_VAL_INT;
 
-        stm32_dfsdm_stop_conv(adc);
+        stm32_dfsdm_stop_conv(adc, chan);
 
 stop_dfsdm:
         stm32_dfsdm_stop_dfsdm(adc->dfsdm);
@@ -765,7 +769,7 @@ static int stm32_dfsdm_write_raw(struct iio_dev *indio_dev,
 {
         struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
         struct stm32_dfsdm_filter *fl = &adc->dfsdm->fl_list[adc->fl_id];
-        struct stm32_dfsdm_channel *ch = &adc->dfsdm->ch_list[adc->ch_id];
+        struct stm32_dfsdm_channel *ch = &adc->dfsdm->ch_list[chan->channel];
         unsigned int spi_freq = adc->spi_freq;
         int ret = -EINVAL;
 
@@ -972,7 +976,6 @@ static int stm32_dfsdm_adc_chan_init_one(struct iio_dev *indio_dev,
         }
         ch->scan_type.realbits = 24;
         ch->scan_type.storagebits = 32;
-        adc->ch_id = ch->channel;
 
         return stm32_dfsdm_chan_configure(adc->dfsdm,
                                           &adc->dfsdm->ch_list[ch->channel]);
@@ -1001,7 +1004,7 @@ static int stm32_dfsdm_audio_init(struct iio_dev *indio_dev)
         }
         ch->info_mask_separate = BIT(IIO_CHAN_INFO_SAMP_FREQ);
 
-        d_ch = &adc->dfsdm->ch_list[adc->ch_id];
+        d_ch = &adc->dfsdm->ch_list[ch->channel];
         if (d_ch->src != DFSDM_CHANNEL_SPI_CLOCK_EXTERNAL)
                 adc->spi_freq = adc->dfsdm->spi_master_freq;
 
@@ -1042,8 +1045,8 @@ static int stm32_dfsdm_adc_init(struct iio_dev *indio_dev)
                 return -ENOMEM;
 
         for (chan_idx = 0; chan_idx < num_ch; chan_idx++) {
-                ch->scan_index = chan_idx;
-                ret = stm32_dfsdm_adc_chan_init_one(indio_dev, ch);
+                ch[chan_idx].scan_index = chan_idx;
+                ret = stm32_dfsdm_adc_chan_init_one(indio_dev, &ch[chan_idx]);
                 if (ret < 0) {
                         dev_err(&indio_dev->dev, "Channels init failed\n");
                         return ret;
diff --git a/drivers/iio/adc/stm32-dfsdm-core.c b/drivers/iio/adc/stm32-dfsdm-core.c
index 6290332cfd3f..e50efdcc41ff 100644
--- a/drivers/iio/adc/stm32-dfsdm-core.c
+++ b/drivers/iio/adc/stm32-dfsdm-core.c
@@ -83,7 +83,7 @@ int stm32_dfsdm_start_dfsdm(struct stm32_dfsdm *dfsdm)
 {
         struct dfsdm_priv *priv = container_of(dfsdm, struct dfsdm_priv, dfsdm);
         struct device *dev = &priv->pdev->dev;
-        unsigned int clk_div = priv->spi_clk_out_div;
+        unsigned int clk_div = priv->spi_clk_out_div, clk_src;
         int ret;
 
         if (atomic_inc_return(&priv->n_active_ch) == 1) {
@@ -100,6 +100,14 @@ int stm32_dfsdm_start_dfsdm(struct stm32_dfsdm *dfsdm)
                         }
                 }
 
+                /* select clock source, e.g. 0 for "dfsdm" or 1 for "audio" */
+                clk_src = priv->aclk ? 1 : 0;
+                ret = regmap_update_bits(dfsdm->regmap, DFSDM_CHCFGR1(0),
+                                         DFSDM_CHCFGR1_CKOUTSRC_MASK,
+                                         DFSDM_CHCFGR1_CKOUTSRC(clk_src));
+                if (ret < 0)
+                        goto disable_aclk;
+
                 /* Output the SPI CLKOUT (if clk_div == 0 clock if OFF) */
                 ret = regmap_update_bits(dfsdm->regmap, DFSDM_CHCFGR1(0),
                                          DFSDM_CHCFGR1_CKOUTDIV_MASK,
@@ -274,7 +282,7 @@ static int stm32_dfsdm_probe(struct platform_device *pdev)
 
         dfsdm->regmap = devm_regmap_init_mmio_clk(&pdev->dev, "dfsdm",
                                                   dfsdm->base,
-                                                  &stm32h7_dfsdm_regmap_cfg);
+                                                  dev_data->regmap_cfg);
         if (IS_ERR(dfsdm->regmap)) {
                 ret = PTR_ERR(dfsdm->regmap);
                 dev_err(&pdev->dev, "%s: Failed to allocate regmap: %d\n",
diff --git a/drivers/iio/chemical/ccs811.c b/drivers/iio/chemical/ccs811.c
index fbe2431f5b81..1ea9f5513b02 100644
--- a/drivers/iio/chemical/ccs811.c
+++ b/drivers/iio/chemical/ccs811.c
@@ -133,6 +133,9 @@ static int ccs811_start_sensor_application(struct i2c_client *client)
         if (ret < 0)
                 return ret;
 
+        if ((ret & CCS811_STATUS_FW_MODE_APPLICATION))
+                return 0;
+
         if ((ret & CCS811_STATUS_APP_VALID_MASK) !=
             CCS811_STATUS_APP_VALID_LOADED)
                 return -EIO;
diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c
index 349e5c713c03..4ddb6cf7d401 100644
--- a/drivers/iio/pressure/st_pressure_core.c
+++ b/drivers/iio/pressure/st_pressure_core.c
@@ -640,7 +640,7 @@ int st_press_common_probe(struct iio_dev *indio_dev)
                        press_data->sensor_settings->drdy_irq.int2.addr))
                 pdata = (struct st_sensors_platform_data *)&default_press_pdata;
 
-        err = st_sensors_init_sensor(indio_dev, press_data->dev->platform_data);
+        err = st_sensors_init_sensor(indio_dev, pdata);
         if (err < 0)
                 goto st_press_power_off;
 
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index 9183d148d644..cb1d2ab13c66 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -207,6 +207,22 @@ int rdma_addr_size(struct sockaddr *addr)
 }
 EXPORT_SYMBOL(rdma_addr_size);
 
+int rdma_addr_size_in6(struct sockaddr_in6 *addr)
+{
+        int ret = rdma_addr_size((struct sockaddr *) addr);
+
+        return ret <= sizeof(*addr) ? ret : 0;
+}
+EXPORT_SYMBOL(rdma_addr_size_in6);
+
+int rdma_addr_size_kss(struct __kernel_sockaddr_storage *addr)
+{
+        int ret = rdma_addr_size((struct sockaddr *) addr);
+
+        return ret <= sizeof(*addr) ? ret : 0;
+}
+EXPORT_SYMBOL(rdma_addr_size_kss);
+
 static struct rdma_addr_client self;
 
 void rdma_addr_register_client(struct rdma_addr_client *client)
@@ -586,6 +602,15 @@ static void process_one_req(struct work_struct *_work)
         list_del(&req->list);
         mutex_unlock(&lock);
 
+        /*
+         * Although the work will normally have been canceled by the
+         * workqueue, it can still be requeued as long as it is on the
+         * req_list, so it could have been requeued before we grabbed &lock.
+         * We need to cancel it after it is removed from req_list to really be
+         * sure it is safe to free.
+         */
+        cancel_delayed_work(&req->work);
+
         req->callback(req->status, (struct sockaddr *)&req->src_addr,
                 req->addr, req->context);
         put_client(req->client);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index bb065c9449be..b7459cf524e4 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -290,6 +290,7 @@ void ib_dealloc_device(struct ib_device *device)
 {
         WARN_ON(device->reg_state != IB_DEV_UNREGISTERED &&
                 device->reg_state != IB_DEV_UNINITIALIZED);
+        rdma_restrack_clean(&device->res);
         put_device(&device->dev);
 }
 EXPORT_SYMBOL(ib_dealloc_device);
@@ -600,8 +601,6 @@ void ib_unregister_device(struct ib_device *device)
         }
         up_read(&lists_rwsem);
 
-        rdma_restrack_clean(&device->res);
-
         ib_device_unregister_rdmacg(device);
         ib_device_unregister_sysfs(device);
 
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index e5a1e7d81326..d933336d7e01 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -632,6 +632,9 @@ static ssize_t ucma_bind_ip(struct ucma_file *file, const char __user *inbuf,
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
+        if (!rdma_addr_size_in6(&cmd.addr))
+                return -EINVAL;
+
         ctx = ucma_get_ctx(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
@@ -645,22 +648,21 @@ static ssize_t ucma_bind(struct ucma_file *file, const char __user *inbuf,
                          int in_len, int out_len)
 {
         struct rdma_ucm_bind cmd;
-        struct sockaddr *addr;
         struct ucma_context *ctx;
         int ret;
 
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        addr = (struct sockaddr *) &cmd.addr;
-        if (cmd.reserved || !cmd.addr_size || (cmd.addr_size != rdma_addr_size(addr)))
+        if (cmd.reserved || !cmd.addr_size ||
+            cmd.addr_size != rdma_addr_size_kss(&cmd.addr))
                 return -EINVAL;
 
         ctx = ucma_get_ctx(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
-        ret = rdma_bind_addr(ctx->cm_id, addr);
+        ret = rdma_bind_addr(ctx->cm_id, (struct sockaddr *) &cmd.addr);
         ucma_put_ctx(ctx);
         return ret;
 }
@@ -670,23 +672,22 @@ static ssize_t ucma_resolve_ip(struct ucma_file *file,
                                int in_len, int out_len)
 {
         struct rdma_ucm_resolve_ip cmd;
-        struct sockaddr *src, *dst;
         struct ucma_context *ctx;
         int ret;
 
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        src = (struct sockaddr *) &cmd.src_addr;
-        dst = (struct sockaddr *) &cmd.dst_addr;
-        if (!rdma_addr_size(src) || !rdma_addr_size(dst))
+        if (!rdma_addr_size_in6(&cmd.src_addr) ||
+            !rdma_addr_size_in6(&cmd.dst_addr))
                 return -EINVAL;
 
         ctx = ucma_get_ctx(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
-        ret = rdma_resolve_addr(ctx->cm_id, src, dst, cmd.timeout_ms);
+        ret = rdma_resolve_addr(ctx->cm_id, (struct sockaddr *) &cmd.src_addr,
+                                (struct sockaddr *) &cmd.dst_addr, cmd.timeout_ms);
         ucma_put_ctx(ctx);
         return ret;
 }
@@ -696,24 +697,23 @@ static ssize_t ucma_resolve_addr(struct ucma_file *file,
                                  int in_len, int out_len)
 {
         struct rdma_ucm_resolve_addr cmd;
-        struct sockaddr *src, *dst;
         struct ucma_context *ctx;
         int ret;
 
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        src = (struct sockaddr *) &cmd.src_addr;
-        dst = (struct sockaddr *) &cmd.dst_addr;
-        if (cmd.reserved || (cmd.src_size && (cmd.src_size != rdma_addr_size(src))) ||
-            !cmd.dst_size || (cmd.dst_size != rdma_addr_size(dst)))
+        if (cmd.reserved ||
+            (cmd.src_size && (cmd.src_size != rdma_addr_size_kss(&cmd.src_addr))) ||
+            !cmd.dst_size || (cmd.dst_size != rdma_addr_size_kss(&cmd.dst_addr)))
                 return -EINVAL;
 
         ctx = ucma_get_ctx(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
-        ret = rdma_resolve_addr(ctx->cm_id, src, dst, cmd.timeout_ms);
+        ret = rdma_resolve_addr(ctx->cm_id, (struct sockaddr *) &cmd.src_addr,
+                                (struct sockaddr *) &cmd.dst_addr, cmd.timeout_ms);
         ucma_put_ctx(ctx);
         return ret;
 }
@@ -1166,6 +1166,11 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file,
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
+        if (!ctx->cm_id->device) {
+                ret = -EINVAL;
+                goto out;
+        }
+
         resp.qp_attr_mask = 0;
         memset(&qp_attr, 0, sizeof qp_attr);
         qp_attr.qp_state = cmd.qp_state;
@@ -1307,7 +1312,7 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf,
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
-        if (unlikely(cmd.optval > KMALLOC_MAX_SIZE))
+        if (unlikely(cmd.optlen > KMALLOC_MAX_SIZE))
                 return -EINVAL;
 
         optval = memdup_user((void __user *) (unsigned long) cmd.optval,
@@ -1331,7 +1336,7 @@ static ssize_t ucma_notify(struct ucma_file *file, const char __user *inbuf,
 {
         struct rdma_ucm_notify cmd;
         struct ucma_context *ctx;
-        int ret;
+        int ret = -EINVAL;
 
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
@@ -1340,7 +1345,9 @@ static ssize_t ucma_notify(struct ucma_file *file, const char __user *inbuf,
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
-        ret = rdma_notify(ctx->cm_id, (enum ib_event_type) cmd.event);
+        if (ctx->cm_id->device)
+                ret = rdma_notify(ctx->cm_id, (enum ib_event_type)cmd.event);
+
         ucma_put_ctx(ctx);
         return ret;
 }
@@ -1426,7 +1433,7 @@ static ssize_t ucma_join_ip_multicast(struct ucma_file *file,
         join_cmd.response = cmd.response;
         join_cmd.uid = cmd.uid;
         join_cmd.id = cmd.id;
-        join_cmd.addr_size = rdma_addr_size((struct sockaddr *) &cmd.addr);
+        join_cmd.addr_size = rdma_addr_size_in6(&cmd.addr);
         if (!join_cmd.addr_size)
                 return -EINVAL;
 
@@ -1445,7 +1452,7 @@ static ssize_t ucma_join_multicast(struct ucma_file *file,
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
-        if (!rdma_addr_size((struct sockaddr *)&cmd.addr))
+        if (!rdma_addr_size_kss(&cmd.addr))
                 return -EINVAL;
 
         return ucma_process_join(file, &cmd, out_len);
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index db2ff352d75f..ec638778661c 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -4383,7 +4383,7 @@ err_dma_alloc_buf:
         eq->l0_dma = 0;
 
         if (mhop_num == 1)
-                for (i -= i; i >= 0; i--)
+                for (i -= 1; i >= 0; i--)
                         dma_free_coherent(dev, buf_chk_sz, eq->buf[i],
                                           eq->buf_dma[i]);
         else if (mhop_num == 2) {
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index da091de4e69d..7f8bda3a2005 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -3448,9 +3448,12 @@ static void destroy_umrc_res(struct mlx5_ib_dev *dev)
         if (err)
                 mlx5_ib_warn(dev, "mr cache cleanup failed\n");
 
-        mlx5_ib_destroy_qp(dev->umrc.qp);
-        ib_free_cq(dev->umrc.cq);
-        ib_dealloc_pd(dev->umrc.pd);
+        if (dev->umrc.qp)
+                mlx5_ib_destroy_qp(dev->umrc.qp);
+        if (dev->umrc.cq)
+                ib_free_cq(dev->umrc.cq);
+        if (dev->umrc.pd)
+                ib_dealloc_pd(dev->umrc.pd);
 }
 
 enum {
@@ -3552,12 +3555,15 @@ static int create_umr_res(struct mlx5_ib_dev *dev)
 
 error_4:
         mlx5_ib_destroy_qp(qp);
+        dev->umrc.qp = NULL;
 
 error_3:
         ib_free_cq(cq);
+        dev->umrc.cq = NULL;
 
 error_2:
         ib_dealloc_pd(pd);
+        dev->umrc.pd = NULL;
 
 error_0:
         kfree(attr);
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index c51c602f06d6..3e0b3f0238d6 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -739,6 +739,9 @@ int mlx5_mr_cache_cleanup(struct mlx5_ib_dev *dev)
 {
         int i;
 
+        if (!dev->cache.wq)
+                return 0;
+
         dev->cache.stopped = 1;
         flush_workqueue(dev->cache.wq);
 
diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c
index db4bf97c0e15..0ffb9b93e22d 100644
--- a/drivers/infiniband/hw/qedr/main.c
+++ b/drivers/infiniband/hw/qedr/main.c
@@ -833,7 +833,8 @@ static struct qedr_dev *qedr_add(struct qed_dev *cdev, struct pci_dev *pdev,
 
         dev->num_cnq = dev->ops->rdma_get_min_cnq_msix(cdev);
         if (!dev->num_cnq) {
-                DP_ERR(dev, "not enough CNQ resources.\n");
+                DP_ERR(dev, "Failed. At least one CNQ is required.\n");
+                rc = -ENOMEM;
                 goto init_err;
         }
 
diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 875b17272d65..419a158e8fca 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -1841,14 +1841,15 @@ static void qedr_reset_qp_hwq_info(struct qedr_qp_hwq_info *qph)
 
 static int qedr_update_qp_state(struct qedr_dev *dev,
                                 struct qedr_qp *qp,
+                                enum qed_roce_qp_state cur_state,
                                 enum qed_roce_qp_state new_state)
 {
         int status = 0;
 
-        if (new_state == qp->state)
+        if (new_state == cur_state)
                 return 0;
 
-        switch (qp->state) {
+        switch (cur_state) {
         case QED_ROCE_QP_STATE_RESET:
                 switch (new_state) {
                 case QED_ROCE_QP_STATE_INIT:
@@ -1955,6 +1956,7 @@ int qedr_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
         struct qedr_dev *dev = get_qedr_dev(&qp->dev->ibdev);
         const struct ib_global_route *grh = rdma_ah_read_grh(&attr->ah_attr);
         enum ib_qp_state old_qp_state, new_qp_state;
+        enum qed_roce_qp_state cur_state;
         int rc = 0;
 
         DP_DEBUG(dev, QEDR_MSG_QP,
@@ -2086,18 +2088,23 @@ int qedr_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
                 SET_FIELD(qp_params.modify_flags,
                           QED_ROCE_MODIFY_QP_VALID_ACK_TIMEOUT, 1);
 
-                qp_params.ack_timeout = attr->timeout;
-                if (attr->timeout) {
-                        u32 temp;
-
-                        temp = 4096 * (1UL << attr->timeout) / 1000 / 1000;
-                        /* FW requires [msec] */
-                        qp_params.ack_timeout = temp;
-                } else {
-                        /* Infinite */
+                /* The received timeout value is an exponent used like this:
+                 *    "12.7.34 LOCAL ACK TIMEOUT
+                 *    Value representing the transport (ACK) timeout for use by
+                 *    the remote, expressed as: 4.096 * 2^timeout [usec]"
+                 * The FW expects timeout in msec so we need to divide the usec
+                 * result by 1000. We'll approximate 1000~2^10, and 4.096 ~ 2^2,
+                 * so we get: 2^2 * 2^timeout / 2^10 = 2^(timeout - 8).
+                 * The value of zero means infinite so we use a 'max_t' to make
+                 * sure that sub 1 msec values will be configured as 1 msec.
+                 */
+                if (attr->timeout)
+                        qp_params.ack_timeout =
+                                        1 << max_t(int, attr->timeout - 8, 0);
+                else
                         qp_params.ack_timeout = 0;
-                }
         }
+
         if (attr_mask & IB_QP_RETRY_CNT) {
                 SET_FIELD(qp_params.modify_flags,
                           QED_ROCE_MODIFY_QP_VALID_RETRY_CNT, 1);
@@ -2170,13 +2177,25 @@ int qedr_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
                 qp->dest_qp_num = attr->dest_qp_num;
         }
 
+        cur_state = qp->state;
+
+        /* Update the QP state before the actual ramrod to prevent a race with
+         * fast path. Modifying the QP state to error will cause the device to
+         * flush the CQEs and while polling the flushed CQEs will considered as
+         * a potential issue if the QP isn't in error state.
+         */
+        if ((attr_mask & IB_QP_STATE) && qp->qp_type != IB_QPT_GSI &&
+            !udata && qp_params.new_state == QED_ROCE_QP_STATE_ERR)
+                qp->state = QED_ROCE_QP_STATE_ERR;
+
         if (qp->qp_type != IB_QPT_GSI)
                 rc = dev->ops->rdma_modify_qp(dev->rdma_ctx,
                                               qp->qed_qp, &qp_params);
 
         if (attr_mask & IB_QP_STATE) {
                 if ((qp->qp_type != IB_QPT_GSI) && (!udata))
-                        rc = qedr_update_qp_state(dev, qp, qp_params.new_state);
+                        rc = qedr_update_qp_state(dev, qp, cur_state,
+                                                  qp_params.new_state);
                 qp->state = qp_params.new_state;
         }
 
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index a05a560d3cba..a6b7baf31cdd 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -887,7 +887,7 @@ static struct pgpath *parse_path(struct dm_arg_set *as, struct path_selector *ps
 
         q = bdev_get_queue(p->path.dev->bdev);
         attached_handler_name = scsi_dh_attached_handler_name(q, GFP_KERNEL);
-        if (attached_handler_name) {
+        if (attached_handler_name || m->hw_handler_name) {
                 INIT_DELAYED_WORK(&p->activate_path, activate_path_work);
                 r = setup_scsi_dh(p->path.dev->bdev, m, attached_handler_name, &ti->error);
                 if (r) {
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 45328d8b2859..353ea0ede091 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -466,7 +466,7 @@ static int dm_get_bdev_for_ioctl(struct mapped_device *md,
 {
         struct dm_target *tgt;
         struct dm_table *map;
-        int srcu_idx, r;
+        int srcu_idx, r, r2;
 
 retry:
         r = -ENOTTY;
@@ -492,9 +492,11 @@ retry:
                 goto out;
 
         bdgrab(*bdev);
-        r = blkdev_get(*bdev, *mode, _dm_claim_ptr);
-        if (r < 0)
+        r2 = blkdev_get(*bdev, *mode, _dm_claim_ptr);
+        if (r2 < 0) {
+                r = r2;
                 goto out;
+        }
 
         dm_put_live_table(md, srcu_idx);
         return r;
diff --git a/drivers/media/Kconfig b/drivers/media/Kconfig
index 372c074bb1b9..86c1a190d946 100644
--- a/drivers/media/Kconfig
+++ b/drivers/media/Kconfig
@@ -151,7 +151,7 @@ config DVB_MMAP
         select VIDEOBUF2_VMALLOC
         default n
         help
-          This option enables DVB experimental memory-mapped API, with
+          This option enables DVB experimental memory-mapped API, which
           reduces the number of context switches to read DVB buffers, as
           the buffers can use mmap() syscalls.
 
diff --git a/drivers/media/platform/tegra-cec/tegra_cec.c b/drivers/media/platform/tegra-cec/tegra_cec.c
index 92f93a880015..aba488cd0e64 100644
--- a/drivers/media/platform/tegra-cec/tegra_cec.c
+++ b/drivers/media/platform/tegra-cec/tegra_cec.c
@@ -172,16 +172,13 @@ static irqreturn_t tegra_cec_irq_handler(int irq, void *data)
                 }
         }
 
-        if (status & (TEGRA_CEC_INT_STAT_RX_REGISTER_OVERRUN |
-                      TEGRA_CEC_INT_STAT_RX_BUS_ANOMALY_DETECTED |
-                      TEGRA_CEC_INT_STAT_RX_START_BIT_DETECTED |
-                      TEGRA_CEC_INT_STAT_RX_BUS_ERROR_DETECTED)) {
+        if (status & TEGRA_CEC_INT_STAT_RX_START_BIT_DETECTED) {
                 cec_write(cec, TEGRA_CEC_INT_STAT,
-                          (TEGRA_CEC_INT_STAT_RX_REGISTER_OVERRUN |
-                           TEGRA_CEC_INT_STAT_RX_BUS_ANOMALY_DETECTED |
-                           TEGRA_CEC_INT_STAT_RX_START_BIT_DETECTED |
-                           TEGRA_CEC_INT_STAT_RX_BUS_ERROR_DETECTED));
-        } else if (status & TEGRA_CEC_INT_STAT_RX_REGISTER_FULL) {
+                          TEGRA_CEC_INT_STAT_RX_START_BIT_DETECTED);
+                cec->rx_done = false;
+                cec->rx_buf_cnt = 0;
+        }
+        if (status & TEGRA_CEC_INT_STAT_RX_REGISTER_FULL) {
                 u32 v;
 
                 cec_write(cec, TEGRA_CEC_INT_STAT,
@@ -255,7 +252,7 @@ static int tegra_cec_adap_enable(struct cec_adapter *adap, bool enable)
                   TEGRA_CEC_INT_MASK_TX_BUS_ANOMALY_DETECTED |
                   TEGRA_CEC_INT_MASK_TX_FRAME_TRANSMITTED |
                   TEGRA_CEC_INT_MASK_RX_REGISTER_FULL |
-                  TEGRA_CEC_INT_MASK_RX_REGISTER_OVERRUN);
+                  TEGRA_CEC_INT_MASK_RX_START_BIT_DETECTED);
 
         cec_write(cec, TEGRA_CEC_HW_CONTROL, TEGRA_CEC_HWCTRL_TX_RX_MODE);
         return 0;
diff --git a/drivers/mtd/chips/jedec_probe.c b/drivers/mtd/chips/jedec_probe.c
index 7c0b27d132b1..b479bd81120b 100644
--- a/drivers/mtd/chips/jedec_probe.c
+++ b/drivers/mtd/chips/jedec_probe.c
@@ -1889,6 +1889,8 @@ static inline u32 jedec_read_mfr(struct map_info *map, uint32_t base,
         do {
                 uint32_t ofs = cfi_build_cmd_addr(0 + (bank << 8), map, cfi);
                 mask = (1 << (cfi->device_type * 8)) - 1;
+                if (ofs >= map->size)
+                        return 0;
                 result = map_read(map, base + ofs);
                 bank++;
         } while ((result.x[0] & mask) == CFI_MFR_CONTINUATION);
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index de8c902059b8..7d80a8bb96fe 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -479,7 +479,7 @@ static int shrink_ecclayout(struct mtd_info *mtd,
         for (i = 0; i < MTD_MAX_ECCPOS_ENTRIES;) {
                 u32 eccpos;
 
-                ret = mtd_ooblayout_ecc(mtd, section, &oobregion);
+                ret = mtd_ooblayout_ecc(mtd, section++, &oobregion);
                 if (ret < 0) {
                         if (ret != -ERANGE)
                                 return ret;
@@ -526,7 +526,7 @@ static int get_oobinfo(struct mtd_info *mtd, struct nand_oobinfo *to)
         for (i = 0; i < ARRAY_SIZE(to->eccpos);) {
                 u32 eccpos;
 
-                ret = mtd_ooblayout_ecc(mtd, section, &oobregion);
+                ret = mtd_ooblayout_ecc(mtd, section++, &oobregion);
                 if (ret < 0) {
                         if (ret != -ERANGE)
                                 return ret;
diff --git a/drivers/mtd/nand/atmel/pmecc.c b/drivers/mtd/nand/atmel/pmecc.c
index fcbe4fd6e684..ca0a70389ba9 100644
--- a/drivers/mtd/nand/atmel/pmecc.c
+++ b/drivers/mtd/nand/atmel/pmecc.c
@@ -426,7 +426,7 @@ static int get_strength(struct atmel_pmecc_user *user)
 
 static int get_sectorsize(struct atmel_pmecc_user *user)
 {
-        return user->cache.cfg & PMECC_LOOKUP_TABLE_SIZE_1024 ? 1024 : 512;
+        return user->cache.cfg & PMECC_CFG_SECTOR1024 ? 1024 : 512;
 }
 
 static void atmel_pmecc_gen_syndrome(struct atmel_pmecc_user *user, int sector)
diff --git a/drivers/mtd/nand/fsl_ifc_nand.c b/drivers/mtd/nand/fsl_ifc_nand.c
index 4872a7ba6503..5a9c2f0020c2 100644
--- a/drivers/mtd/nand/fsl_ifc_nand.c
+++ b/drivers/mtd/nand/fsl_ifc_nand.c
@@ -173,14 +173,9 @@ static void set_addr(struct mtd_info *mtd, int column, int page_addr, int oob)
 
 /* returns nonzero if entire page is blank */
 static int check_read_ecc(struct mtd_info *mtd, struct fsl_ifc_ctrl *ctrl,
-                          u32 *eccstat, unsigned int bufnum)
+                          u32 eccstat, unsigned int bufnum)
 {
-        u32 reg = eccstat[bufnum / 4];
-        int errors;
-
-        errors = (reg >> ((3 - bufnum % 4) * 8)) & 15;
-
-        return errors;
+        return  (eccstat >> ((3 - bufnum % 4) * 8)) & 15;
 }
 
 /*
@@ -193,7 +188,7 @@ static void fsl_ifc_run_command(struct mtd_info *mtd)
         struct fsl_ifc_ctrl *ctrl = priv->ctrl;
         struct fsl_ifc_nand_ctrl *nctrl = ifc_nand_ctrl;
         struct fsl_ifc_runtime __iomem *ifc = ctrl->rregs;
-        u32 eccstat[4];
+        u32 eccstat;
         int i;
 
         /* set the chip select for NAND Transaction */
@@ -228,19 +223,17 @@ static void fsl_ifc_run_command(struct mtd_info *mtd)
         if (nctrl->eccread) {
                 int errors;
                 int bufnum = nctrl->page & priv->bufnum_mask;
-                int sector = bufnum * chip->ecc.steps;
-                int sector_end = sector + chip->ecc.steps - 1;
+                int sector_start = bufnum * chip->ecc.steps;
+                int sector_end = sector_start + chip->ecc.steps - 1;
                 __be32 *eccstat_regs;
 
-                if (ctrl->version >= FSL_IFC_VERSION_2_0_0)
-                        eccstat_regs = ifc->ifc_nand.v2_nand_eccstat;
-                else
-                        eccstat_regs = ifc->ifc_nand.v1_nand_eccstat;
+                eccstat_regs = ifc->ifc_nand.nand_eccstat;
+                eccstat = ifc_in32(&eccstat_regs[sector_start / 4]);
 
-                for (i = sector / 4; i <= sector_end / 4; i++)
-                        eccstat[i] = ifc_in32(&eccstat_regs[i]);
+                for (i = sector_start; i <= sector_end; i++) {
+                        if (i != sector_start && !(i % 4))
+                                eccstat = ifc_in32(&eccstat_regs[i / 4]);
 
-                for (i = sector; i <= sector_end; i++) {
                         errors = check_read_ecc(mtd, ctrl, eccstat, i);
 
                         if (errors == 15) {
@@ -626,6 +619,7 @@ static int fsl_ifc_wait(struct mtd_info *mtd, struct nand_chip *chip)
         struct fsl_ifc_ctrl *ctrl = priv->ctrl;
         struct fsl_ifc_runtime __iomem *ifc = ctrl->rregs;
         u32 nand_fsr;
+        int status;
 
         /* Use READ_STATUS command, but wait for the device to be ready */
         ifc_out32((IFC_FIR_OP_CW0 << IFC_NAND_FIR0_OP0_SHIFT) |
@@ -640,12 +634,12 @@ static int fsl_ifc_wait(struct mtd_info *mtd, struct nand_chip *chip)
         fsl_ifc_run_command(mtd);
 
         nand_fsr = ifc_in32(&ifc->ifc_nand.nand_fsr);
-
+        status = nand_fsr >> 24;
         /*
          * The chip always seems to report that it is
          * write-protected, even when it is not.
          */
-        return nand_fsr | NAND_STATUS_WP;
+        return status | NAND_STATUS_WP;
 }
 
 /*
diff --git a/drivers/pinctrl/samsung/pinctrl-exynos-arm.c b/drivers/pinctrl/samsung/pinctrl-exynos-arm.c
index c32399faff57..90c274490181 100644
--- a/drivers/pinctrl/samsung/pinctrl-exynos-arm.c
+++ b/drivers/pinctrl/samsung/pinctrl-exynos-arm.c
@@ -124,7 +124,7 @@ static const struct samsung_pin_bank_data s5pv210_pin_bank[] __initconst = {
         EXYNOS_PIN_BANK_EINTW(8, 0xc60, "gph3", 0x0c),
 };
 
-const struct samsung_pin_ctrl s5pv210_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl s5pv210_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = s5pv210_pin_bank,
@@ -137,6 +137,11 @@ const struct samsung_pin_ctrl s5pv210_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data s5pv210_of_data __initconst = {
+        .ctrl           = s5pv210_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(s5pv210_pin_ctrl),
+};
+
 /* Pad retention control code for accessing PMU regmap */
 static atomic_t exynos_shared_retention_refcnt;
 
@@ -199,7 +204,7 @@ static const struct samsung_retention_data exynos3250_retention_data __initconst
  * Samsung pinctrl driver data for Exynos3250 SoC. Exynos3250 SoC includes
  * two gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos3250_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos3250_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos3250_pin_banks0,
@@ -220,6 +225,11 @@ const struct samsung_pin_ctrl exynos3250_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos3250_of_data __initconst = {
+        .ctrl           = exynos3250_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos3250_pin_ctrl),
+};
+
 /* pin banks of exynos4210 pin-controller 0 */
 static const struct samsung_pin_bank_data exynos4210_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00),
@@ -303,7 +313,7 @@ static const struct samsung_retention_data exynos4_audio_retention_data __initco
  * Samsung pinctrl driver data for Exynos4210 SoC. Exynos4210 SoC includes
  * three gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos4210_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos4210_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos4210_pin_banks0,
@@ -329,6 +339,11 @@ const struct samsung_pin_ctrl exynos4210_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos4210_of_data __initconst = {
+        .ctrl           = exynos4210_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos4210_pin_ctrl),
+};
+
 /* pin banks of exynos4x12 pin-controller 0 */
 static const struct samsung_pin_bank_data exynos4x12_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00),
@@ -391,7 +406,7 @@ static const struct samsung_pin_bank_data exynos4x12_pin_banks3[] __initconst =
  * Samsung pinctrl driver data for Exynos4x12 SoC. Exynos4x12 SoC includes
  * four gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos4x12_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos4x12_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos4x12_pin_banks0,
@@ -427,6 +442,11 @@ const struct samsung_pin_ctrl exynos4x12_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos4x12_of_data __initconst = {
+        .ctrl           = exynos4x12_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos4x12_pin_ctrl),
+};
+
 /* pin banks of exynos5250 pin-controller 0 */
 static const struct samsung_pin_bank_data exynos5250_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00),
@@ -487,7 +507,7 @@ static const struct samsung_pin_bank_data exynos5250_pin_banks3[] __initconst =
  * Samsung pinctrl driver data for Exynos5250 SoC. Exynos5250 SoC includes
  * four gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos5250_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos5250_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos5250_pin_banks0,
@@ -523,6 +543,11 @@ const struct samsung_pin_ctrl exynos5250_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos5250_of_data __initconst = {
+        .ctrl           = exynos5250_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos5250_pin_ctrl),
+};
+
 /* pin banks of exynos5260 pin-controller 0 */
 static const struct samsung_pin_bank_data exynos5260_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(4, 0x000, "gpa0", 0x00),
@@ -567,7 +592,7 @@ static const struct samsung_pin_bank_data exynos5260_pin_banks2[] __initconst =
  * Samsung pinctrl driver data for Exynos5260 SoC. Exynos5260 SoC includes
  * three gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos5260_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos5260_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos5260_pin_banks0,
@@ -587,6 +612,11 @@ const struct samsung_pin_ctrl exynos5260_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos5260_of_data __initconst = {
+        .ctrl           = exynos5260_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos5260_pin_ctrl),
+};
+
 /* pin banks of exynos5410 pin-controller 0 */
 static const struct samsung_pin_bank_data exynos5410_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00),
@@ -657,7 +687,7 @@ static const struct samsung_pin_bank_data exynos5410_pin_banks3[] __initconst =
  * Samsung pinctrl driver data for Exynos5410 SoC. Exynos5410 SoC includes
  * four gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos5410_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos5410_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos5410_pin_banks0,
@@ -690,6 +720,11 @@ const struct samsung_pin_ctrl exynos5410_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos5410_of_data __initconst = {
+        .ctrl           = exynos5410_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos5410_pin_ctrl),
+};
+
 /* pin banks of exynos5420 pin-controller 0 */
 static const struct samsung_pin_bank_data exynos5420_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpy7", 0x00),
@@ -774,7 +809,7 @@ static const struct samsung_retention_data exynos5420_retention_data __initconst
  * Samsung pinctrl driver data for Exynos5420 SoC. Exynos5420 SoC includes
  * four gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos5420_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos5420_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos5420_pin_banks0,
@@ -808,3 +843,8 @@ const struct samsung_pin_ctrl exynos5420_pin_ctrl[] __initconst = {
                 .retention_data = &exynos4_audio_retention_data,
         },
 };
+
+const struct samsung_pinctrl_of_match_data exynos5420_of_data __initconst = {
+        .ctrl           = exynos5420_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos5420_pin_ctrl),
+};
diff --git a/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c b/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c
index fc8f7833bec0..71c9d1d9f345 100644
--- a/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c
+++ b/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c
@@ -175,7 +175,7 @@ static const struct samsung_retention_data exynos5433_fsys_retention_data __init
  * Samsung pinctrl driver data for Exynos5433 SoC. Exynos5433 SoC includes
  * ten gpio/pin-mux/pinconfig controllers.
  */
-const struct samsung_pin_ctrl exynos5433_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos5433_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 data */
                 .pin_banks      = exynos5433_pin_banks0,
@@ -260,6 +260,11 @@ const struct samsung_pin_ctrl exynos5433_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data exynos5433_of_data __initconst = {
+        .ctrl           = exynos5433_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos5433_pin_ctrl),
+};
+
 /* pin banks of exynos7 pin-controller - ALIVE */
 static const struct samsung_pin_bank_data exynos7_pin_banks0[] __initconst = {
         EXYNOS_PIN_BANK_EINTW(8, 0x000, "gpa0", 0x00),
@@ -339,7 +344,7 @@ static const struct samsung_pin_bank_data exynos7_pin_banks9[] __initconst = {
         EXYNOS_PIN_BANK_EINTG(4, 0x020, "gpz1", 0x04),
 };
 
-const struct samsung_pin_ctrl exynos7_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl exynos7_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 0 Alive data */
                 .pin_banks      = exynos7_pin_banks0,
@@ -392,3 +397,8 @@ const struct samsung_pin_ctrl exynos7_pin_ctrl[] __initconst = {
                 .eint_gpio_init = exynos_eint_gpio_init,
         },
 };
+
+const struct samsung_pinctrl_of_match_data exynos7_of_data __initconst = {
+        .ctrl           = exynos7_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(exynos7_pin_ctrl),
+};
diff --git a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c
index 10187cb0e9b9..7e824e4d20f4 100644
--- a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c
+++ b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c
@@ -565,7 +565,7 @@ static const struct samsung_pin_bank_data s3c2412_pin_banks[] __initconst = {
         PIN_BANK_2BIT(13, 0x080, "gpj"),
 };
 
-const struct samsung_pin_ctrl s3c2412_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl s3c2412_pin_ctrl[] __initconst = {
         {
                 .pin_banks      = s3c2412_pin_banks,
                 .nr_banks       = ARRAY_SIZE(s3c2412_pin_banks),
@@ -573,6 +573,11 @@ const struct samsung_pin_ctrl s3c2412_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data s3c2412_of_data __initconst = {
+        .ctrl           = s3c2412_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(s3c2412_pin_ctrl),
+};
+
 static const struct samsung_pin_bank_data s3c2416_pin_banks[] __initconst = {
         PIN_BANK_A(27, 0x000, "gpa"),
         PIN_BANK_2BIT(11, 0x010, "gpb"),
@@ -587,7 +592,7 @@ static const struct samsung_pin_bank_data s3c2416_pin_banks[] __initconst = {
         PIN_BANK_2BIT(2, 0x100, "gpm"),
 };
 
-const struct samsung_pin_ctrl s3c2416_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl s3c2416_pin_ctrl[] __initconst = {
         {
                 .pin_banks      = s3c2416_pin_banks,
                 .nr_banks       = ARRAY_SIZE(s3c2416_pin_banks),
@@ -595,6 +600,11 @@ const struct samsung_pin_ctrl s3c2416_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data s3c2416_of_data __initconst = {
+        .ctrl           = s3c2416_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(s3c2416_pin_ctrl),
+};
+
 static const struct samsung_pin_bank_data s3c2440_pin_banks[] __initconst = {
         PIN_BANK_A(25, 0x000, "gpa"),
         PIN_BANK_2BIT(11, 0x010, "gpb"),
@@ -607,7 +617,7 @@ static const struct samsung_pin_bank_data s3c2440_pin_banks[] __initconst = {
         PIN_BANK_2BIT(13, 0x0d0, "gpj"),
 };
 
-const struct samsung_pin_ctrl s3c2440_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl s3c2440_pin_ctrl[] __initconst = {
         {
                 .pin_banks      = s3c2440_pin_banks,
                 .nr_banks       = ARRAY_SIZE(s3c2440_pin_banks),
@@ -615,6 +625,11 @@ const struct samsung_pin_ctrl s3c2440_pin_ctrl[] __initconst = {
         },
 };
 
+const struct samsung_pinctrl_of_match_data s3c2440_of_data __initconst = {
+        .ctrl           = s3c2440_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(s3c2440_pin_ctrl),
+};
+
 static const struct samsung_pin_bank_data s3c2450_pin_banks[] __initconst = {
         PIN_BANK_A(28, 0x000, "gpa"),
         PIN_BANK_2BIT(11, 0x010, "gpb"),
@@ -630,10 +645,15 @@ static const struct samsung_pin_bank_data s3c2450_pin_banks[] __initconst = {
         PIN_BANK_2BIT(2, 0x100, "gpm"),
 };
 
-const struct samsung_pin_ctrl s3c2450_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl s3c2450_pin_ctrl[] __initconst = {
         {
                 .pin_banks      = s3c2450_pin_banks,
                 .nr_banks       = ARRAY_SIZE(s3c2450_pin_banks),
                 .eint_wkup_init = s3c24xx_eint_init,
         },
 };
+
+const struct samsung_pinctrl_of_match_data s3c2450_of_data __initconst = {
+        .ctrl           = s3c2450_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(s3c2450_pin_ctrl),
+};
diff --git a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
index 679628ac4b31..288e6567ceb1 100644
--- a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
+++ b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
@@ -789,7 +789,7 @@ static const struct samsung_pin_bank_data s3c64xx_pin_banks0[] __initconst = {
  * Samsung pinctrl driver data for S3C64xx SoC. S3C64xx SoC includes
  * one gpio/pin-mux/pinconfig controller.
  */
-const struct samsung_pin_ctrl s3c64xx_pin_ctrl[] __initconst = {
+static const struct samsung_pin_ctrl s3c64xx_pin_ctrl[] __initconst = {
         {
                 /* pin-controller instance 1 data */
                 .pin_banks      = s3c64xx_pin_banks0,
@@ -798,3 +798,8 @@ const struct samsung_pin_ctrl s3c64xx_pin_ctrl[] __initconst = {
                 .eint_wkup_init = s3c64xx_eint_eint0_init,
         },
 };
+
+const struct samsung_pinctrl_of_match_data s3c64xx_of_data __initconst = {
+        .ctrl           = s3c64xx_pin_ctrl,
+        .num_ctrl       = ARRAY_SIZE(s3c64xx_pin_ctrl),
+};
diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c
index da58e4554137..336e88d7bdb9 100644
--- a/drivers/pinctrl/samsung/pinctrl-samsung.c
+++ b/drivers/pinctrl/samsung/pinctrl-samsung.c
@@ -942,12 +942,33 @@ static int samsung_gpiolib_register(struct platform_device *pdev,
         return 0;
 }
 
+static const struct samsung_pin_ctrl *
+samsung_pinctrl_get_soc_data_for_of_alias(struct platform_device *pdev)
+{
+        struct device_node *node = pdev->dev.of_node;
+        const struct samsung_pinctrl_of_match_data *of_data;
+        int id;
+
+        id = of_alias_get_id(node, "pinctrl");
+        if (id < 0) {
+                dev_err(&pdev->dev, "failed to get alias id\n");
+                return NULL;
+        }
+
+        of_data = of_device_get_match_data(&pdev->dev);
+        if (id >= of_data->num_ctrl) {
+                dev_err(&pdev->dev, "invalid alias id %d\n", id);
+                return NULL;
+        }
+
+        return &(of_data->ctrl[id]);
+}
+
 /* retrieve the soc specific data */
 static const struct samsung_pin_ctrl *
 samsung_pinctrl_get_soc_data(struct samsung_pinctrl_drv_data *d,
                              struct platform_device *pdev)
 {
-        int id;
         struct device_node *node = pdev->dev.of_node;
         struct device_node *np;
         const struct samsung_pin_bank_data *bdata;
@@ -957,13 +978,9 @@ samsung_pinctrl_get_soc_data(struct samsung_pinctrl_drv_data *d,
         void __iomem *virt_base[SAMSUNG_PINCTRL_NUM_RESOURCES];
         unsigned int i;
 
-        id = of_alias_get_id(node, "pinctrl");
-        if (id < 0) {
-                dev_err(&pdev->dev, "failed to get alias id\n");
+        ctrl = samsung_pinctrl_get_soc_data_for_of_alias(pdev);
+        if (!ctrl)
                 return ERR_PTR(-ENOENT);
-        }
-        ctrl = of_device_get_match_data(&pdev->dev);
-        ctrl += id;
 
         d->suspend = ctrl->suspend;
         d->resume = ctrl->resume;
@@ -1188,41 +1205,41 @@ static int __maybe_unused samsung_pinctrl_resume(struct device *dev)
 static const struct of_device_id samsung_pinctrl_dt_match[] = {
 #ifdef CONFIG_PINCTRL_EXYNOS_ARM
         { .compatible = "samsung,exynos3250-pinctrl",
-                .data = exynos3250_pin_ctrl },
+                .data = &exynos3250_of_data },
         { .compatible = "samsung,exynos4210-pinctrl",
-                .data = exynos4210_pin_ctrl },
+                .data = &exynos4210_of_data },
         { .compatible = "samsung,exynos4x12-pinctrl",
-                .data = exynos4x12_pin_ctrl },
+                .data = &exynos4x12_of_data },
         { .compatible = "samsung,exynos5250-pinctrl",
-                .data = exynos5250_pin_ctrl },
+                .data = &exynos5250_of_data },
         { .compatible = "samsung,exynos5260-pinctrl",
-                .data = exynos5260_pin_ctrl },
+                .data = &exynos5260_of_data },
         { .compatible = "samsung,exynos5410-pinctrl",
-                .data = exynos5410_pin_ctrl },
+                .data = &exynos5410_of_data },
         { .compatible = "samsung,exynos5420-pinctrl",
-                .data = exynos5420_pin_ctrl },
+                .data = &exynos5420_of_data },
         { .compatible = "samsung,s5pv210-pinctrl",
-                .data = s5pv210_pin_ctrl },
+                .data = &s5pv210_of_data },
 #endif
 #ifdef CONFIG_PINCTRL_EXYNOS_ARM64
         { .compatible = "samsung,exynos5433-pinctrl",
-                .data = exynos5433_pin_ctrl },
+                .data = &exynos5433_of_data },
         { .compatible = "samsung,exynos7-pinctrl",
-                .data = exynos7_pin_ctrl },
+                .data = &exynos7_of_data },
 #endif
 #ifdef CONFIG_PINCTRL_S3C64XX
         { .compatible = "samsung,s3c64xx-pinctrl",
-                .data = s3c64xx_pin_ctrl },
+                .data = &s3c64xx_of_data },
 #endif
 #ifdef CONFIG_PINCTRL_S3C24XX
         { .compatible = "samsung,s3c2412-pinctrl",
-                .data = s3c2412_pin_ctrl },
+                .data = &s3c2412_of_data },
         { .compatible = "samsung,s3c2416-pinctrl",
-                .data = s3c2416_pin_ctrl },
+                .data = &s3c2416_of_data },
         { .compatible = "samsung,s3c2440-pinctrl",
-                .data = s3c2440_pin_ctrl },
+                .data = &s3c2440_of_data },
         { .compatible = "samsung,s3c2450-pinctrl",
-                .data = s3c2450_pin_ctrl },
+                .data = &s3c2450_of_data },
 #endif
         {},
 };
diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.h b/drivers/pinctrl/samsung/pinctrl-samsung.h
index e204f609823b..f0cda9424dfe 100644
--- a/drivers/pinctrl/samsung/pinctrl-samsung.h
+++ b/drivers/pinctrl/samsung/pinctrl-samsung.h
@@ -282,6 +282,16 @@ struct samsung_pinctrl_drv_data {
 };
 
 /**
+ * struct samsung_pinctrl_of_match_data: OF match device specific configuration data.
+ * @ctrl: array of pin controller data.
+ * @num_ctrl: size of array @ctrl.
+ */
+struct samsung_pinctrl_of_match_data {
+        const struct samsung_pin_ctrl   *ctrl;
+        unsigned int                    num_ctrl;
+};
+
+/**
  * struct samsung_pin_group: represent group of pins of a pinmux function.
  * @name: name of the pin group, used to lookup the group.
  * @pins: the pins included in this group.
@@ -309,20 +319,20 @@ struct samsung_pmx_func {
 };
 
 /* list of all exported SoC specific data */
-extern const struct samsung_pin_ctrl exynos3250_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos4210_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos4x12_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos5250_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos5260_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos5410_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos5420_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos5433_pin_ctrl[];
-extern const struct samsung_pin_ctrl exynos7_pin_ctrl[];
-extern const struct samsung_pin_ctrl s3c64xx_pin_ctrl[];
-extern const struct samsung_pin_ctrl s3c2412_pin_ctrl[];
-extern const struct samsung_pin_ctrl s3c2416_pin_ctrl[];
-extern const struct samsung_pin_ctrl s3c2440_pin_ctrl[];
-extern const struct samsung_pin_ctrl s3c2450_pin_ctrl[];
-extern const struct samsung_pin_ctrl s5pv210_pin_ctrl[];
+extern const struct samsung_pinctrl_of_match_data exynos3250_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos4210_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos4x12_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos5250_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos5260_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos5410_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos5420_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos5433_of_data;
+extern const struct samsung_pinctrl_of_match_data exynos7_of_data;
+extern const struct samsung_pinctrl_of_match_data s3c64xx_of_data;
+extern const struct samsung_pinctrl_of_match_data s3c2412_of_data;
+extern const struct samsung_pinctrl_of_match_data s3c2416_of_data;
+extern const struct samsung_pinctrl_of_match_data s3c2440_of_data;
+extern const struct samsung_pinctrl_of_match_data s3c2450_of_data;
+extern const struct samsung_pinctrl_of_match_data s5pv210_of_data;
 
 #endif /* __PINCTRL_SAMSUNG_H */
diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7795.c b/drivers/pinctrl/sh-pfc/pfc-r8a7795.c
index 18aeee592fdc..35951e7b89d2 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7795.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7795.c
@@ -1538,7 +1538,6 @@ static const struct sh_pfc_pin pinmux_pins[] = {
         SH_PFC_PIN_NAMED_CFG('B', 18, AVB_TD1, CFG_FLAGS),
         SH_PFC_PIN_NAMED_CFG('B', 19, AVB_RXC, CFG_FLAGS),
         SH_PFC_PIN_NAMED_CFG('C',  1, PRESETOUT#, CFG_FLAGS),
-        SH_PFC_PIN_NAMED_CFG('F',  1, CLKOUT, CFG_FLAGS),
         SH_PFC_PIN_NAMED_CFG('H', 37, MLB_REF, CFG_FLAGS),
         SH_PFC_PIN_NAMED_CFG('V',  3, QSPI1_SPCLK, CFG_FLAGS),
         SH_PFC_PIN_NAMED_CFG('V',  5, QSPI1_SSL, CFG_FLAGS),
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index dd9464920456..ef22b275d050 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -474,6 +474,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
                 shost->dma_boundary = 0xffffffff;
 
         shost->use_blk_mq = scsi_use_blk_mq;
+        shost->use_blk_mq = scsi_use_blk_mq || shost->hostt->force_blk_mq;
 
         device_initialize(&shost->shost_gendev);
         dev_set_name(&shost->shost_gendev, "host%d", shost->host_no);
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 5293e6827ce5..3a9eca163db8 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -1045,11 +1045,7 @@ static void set_performant_mode(struct ctlr_info *h, struct CommandList *c,
                 c->busaddr |= 1 | (h->blockFetchTable[c->Header.SGList] << 1);
                 if (unlikely(!h->msix_vectors))
                         return;
-                if (likely(reply_queue == DEFAULT_REPLY_QUEUE))
-                        c->Header.ReplyQueue =
-                                raw_smp_processor_id() % h->nreply_queues;
-                else
-                        c->Header.ReplyQueue = reply_queue % h->nreply_queues;
+                c->Header.ReplyQueue = reply_queue;
         }
 }
 
@@ -1063,10 +1059,7 @@ static void set_ioaccel1_performant_mode(struct ctlr_info *h,
          * Tell the controller to post the reply to the queue for this
          * processor.  This seems to give the best I/O throughput.
          */
-        if (likely(reply_queue == DEFAULT_REPLY_QUEUE))
-                cp->ReplyQueue = smp_processor_id() % h->nreply_queues;
-        else
-                cp->ReplyQueue = reply_queue % h->nreply_queues;
+        cp->ReplyQueue = reply_queue;
         /*
          * Set the bits in the address sent down to include:
          *  - performant mode bit (bit 0)
@@ -1087,10 +1080,7 @@ static void set_ioaccel2_tmf_performant_mode(struct ctlr_info *h,
         /* Tell the controller to post the reply to the queue for this
          * processor.  This seems to give the best I/O throughput.
          */
-        if (likely(reply_queue == DEFAULT_REPLY_QUEUE))
-                cp->reply_queue = smp_processor_id() % h->nreply_queues;
-        else
-                cp->reply_queue = reply_queue % h->nreply_queues;
+        cp->reply_queue = reply_queue;
         /* Set the bits in the address sent down to include:
          *  - performant mode bit not used in ioaccel mode 2
          *  - pull count (bits 0-3)
@@ -1109,10 +1099,7 @@ static void set_ioaccel2_performant_mode(struct ctlr_info *h,
          * Tell the controller to post the reply to the queue for this
          * processor.  This seems to give the best I/O throughput.
          */
-        if (likely(reply_queue == DEFAULT_REPLY_QUEUE))
-                cp->reply_queue = smp_processor_id() % h->nreply_queues;
-        else
-                cp->reply_queue = reply_queue % h->nreply_queues;
+        cp->reply_queue = reply_queue;
         /*
          * Set the bits in the address sent down to include:
          *  - performant mode bit not used in ioaccel mode 2
@@ -1157,6 +1144,8 @@ static void __enqueue_cmd_and_start_io(struct ctlr_info *h,
 {
         dial_down_lockup_detection_during_fw_flash(h, c);
         atomic_inc(&h->commands_outstanding);
+
+        reply_queue = h->reply_map[raw_smp_processor_id()];
         switch (c->cmd_type) {
         case CMD_IOACCEL1:
                 set_ioaccel1_performant_mode(h, c, reply_queue);
@@ -7376,6 +7365,26 @@ static void hpsa_disable_interrupt_mode(struct ctlr_info *h)
         h->msix_vectors = 0;
 }
 
+static void hpsa_setup_reply_map(struct ctlr_info *h)
+{
+        const struct cpumask *mask;
+        unsigned int queue, cpu;
+
+        for (queue = 0; queue < h->msix_vectors; queue++) {
+                mask = pci_irq_get_affinity(h->pdev, queue);
+                if (!mask)
+                        goto fallback;
+
+                for_each_cpu(cpu, mask)
+                        h->reply_map[cpu] = queue;
+        }
+        return;
+
+fallback:
+        for_each_possible_cpu(cpu)
+                h->reply_map[cpu] = 0;
+}
+
 /* If MSI/MSI-X is supported by the kernel we will try to enable it on
  * controllers that are capable. If not, we use legacy INTx mode.
  */
@@ -7771,6 +7780,10 @@ static int hpsa_pci_init(struct ctlr_info *h)
         err = hpsa_interrupt_mode(h);
         if (err)
                 goto clean1;
+
+        /* setup mapping between CPU and reply queue */
+        hpsa_setup_reply_map(h);
+
         err = hpsa_pci_find_memory_BAR(h->pdev, &h->paddr);
         if (err)
                 goto clean2;    /* intmode+region, pci */
@@ -8480,6 +8493,28 @@ static struct workqueue_struct *hpsa_create_controller_wq(struct ctlr_info *h,
         return wq;
 }
 
+static void hpda_free_ctlr_info(struct ctlr_info *h)
+{
+        kfree(h->reply_map);
+        kfree(h);
+}
+
+static struct ctlr_info *hpda_alloc_ctlr_info(void)
+{
+        struct ctlr_info *h;
+
+        h = kzalloc(sizeof(*h), GFP_KERNEL);
+        if (!h)
+                return NULL;
+
+        h->reply_map = kzalloc(sizeof(*h->reply_map) * nr_cpu_ids, GFP_KERNEL);
+        if (!h->reply_map) {
+                kfree(h);
+                return NULL;
+        }
+        return h;
+}
+
 static int hpsa_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
         int dac, rc;
@@ -8517,7 +8552,7 @@ reinit_after_soft_reset:
          * the driver.  See comments in hpsa.h for more info.
          */
         BUILD_BUG_ON(sizeof(struct CommandList) % COMMANDLIST_ALIGNMENT);
-        h = kzalloc(sizeof(*h), GFP_KERNEL);
+        h = hpda_alloc_ctlr_info();
         if (!h) {
                 dev_err(&pdev->dev, "Failed to allocate controller head\n");
                 return -ENOMEM;
@@ -8916,7 +8951,7 @@ static void hpsa_remove_one(struct pci_dev *pdev)
         h->lockup_detected = NULL;                      /* init_one 2 */
         /* (void) pci_disable_pcie_error_reporting(pdev); */    /* init_one 1 */
 
-        kfree(h);                                       /* init_one 1 */
+        hpda_free_ctlr_info(h);                         /* init_one 1 */
 }
 
 static int hpsa_suspend(__attribute__((unused)) struct pci_dev *pdev,
diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
index 018f980a701c..fb9f5e7f8209 100644
--- a/drivers/scsi/hpsa.h
+++ b/drivers/scsi/hpsa.h
@@ -158,6 +158,7 @@ struct bmic_controller_parameters {
 #pragma pack()
 
 struct ctlr_info {
+        unsigned int *reply_map;
         int     ctlr;
         char    devname[8];
         char    *product_name;
diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
index b1b1d3a3b173..daefe8172b04 100644
--- a/drivers/scsi/ibmvscsi/ibmvfc.c
+++ b/drivers/scsi/ibmvscsi/ibmvfc.c
@@ -3579,11 +3579,9 @@ static void ibmvfc_tgt_implicit_logout(struct ibmvfc_target *tgt)
 static int ibmvfc_adisc_needs_plogi(struct ibmvfc_passthru_mad *mad,
                                     struct ibmvfc_target *tgt)
 {
-        if (memcmp(&mad->fc_iu.response[2], &tgt->ids.port_name,
-                   sizeof(tgt->ids.port_name)))
+        if (wwn_to_u64((u8 *)&mad->fc_iu.response[2]) != tgt->ids.port_name)
                 return 1;
-        if (memcmp(&mad->fc_iu.response[4], &tgt->ids.node_name,
-                   sizeof(tgt->ids.node_name)))
+        if (wwn_to_u64((u8 *)&mad->fc_iu.response[4]) != tgt->ids.node_name)
                 return 1;
         if (be32_to_cpu(mad->fc_iu.response[6]) != tgt->scsi_id)
                 return 1;
diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
index 6198559abbd8..dd66c11399a2 100644
--- a/drivers/scsi/iscsi_tcp.c
+++ b/drivers/scsi/iscsi_tcp.c
@@ -37,6 +37,7 @@
 #include <linux/kfifo.h>
 #include <linux/scatterlist.h>
 #include <linux/module.h>
+#include <linux/backing-dev.h>
 #include <net/tcp.h>
 #include <scsi/scsi_cmnd.h>
 #include <scsi/scsi_device.h>
@@ -954,6 +955,13 @@ static int iscsi_sw_tcp_slave_alloc(struct scsi_device *sdev)
 
 static int iscsi_sw_tcp_slave_configure(struct scsi_device *sdev)
 {
+        struct iscsi_sw_tcp_host *tcp_sw_host = iscsi_host_priv(sdev->host);
+        struct iscsi_session *session = tcp_sw_host->session;
+        struct iscsi_conn *conn = session->leadconn;
+
+        if (conn->datadgst_en)
+                sdev->request_queue->backing_dev_info->capabilities
+                        |= BDI_CAP_STABLE_WRITES;
         blk_queue_bounce_limit(sdev->request_queue, BLK_BOUNCE_ANY);
         blk_queue_dma_alignment(sdev->request_queue, 0);
         return 0;
diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
index ba6503f37756..27fab8235ea5 100644
--- a/drivers/scsi/megaraid/megaraid_sas.h
+++ b/drivers/scsi/megaraid/megaraid_sas.h
@@ -2128,6 +2128,7 @@ enum MR_PD_TYPE {
 
 struct megasas_instance {
 
+        unsigned int *reply_map;
         __le32 *producer;
         dma_addr_t producer_h;
         __le32 *consumer;
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index a71ee67df084..dde0798b8a91 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -5165,6 +5165,26 @@ skip_alloc:
                 instance->use_seqnum_jbod_fp = false;
 }
 
+static void megasas_setup_reply_map(struct megasas_instance *instance)
+{
+        const struct cpumask *mask;
+        unsigned int queue, cpu;
+
+        for (queue = 0; queue < instance->msix_vectors; queue++) {
+                mask = pci_irq_get_affinity(instance->pdev, queue);
+                if (!mask)
+                        goto fallback;
+
+                for_each_cpu(cpu, mask)
+                        instance->reply_map[cpu] = queue;
+        }
+        return;
+
+fallback:
+        for_each_possible_cpu(cpu)
+                instance->reply_map[cpu] = cpu % instance->msix_vectors;
+}
+
 /**
  * megasas_init_fw -    Initializes the FW
  * @instance:           Adapter soft state
@@ -5343,6 +5363,8 @@ static int megasas_init_fw(struct megasas_instance *instance)
                         goto fail_setup_irqs;
         }
 
+        megasas_setup_reply_map(instance);
+
         dev_info(&instance->pdev->dev,
                 "firmware supports msix\t: (%d)", fw_msix_count);
         dev_info(&instance->pdev->dev,
@@ -6123,20 +6145,29 @@ static inline int megasas_alloc_mfi_ctrl_mem(struct megasas_instance *instance)
  */
 static int megasas_alloc_ctrl_mem(struct megasas_instance *instance)
 {
+        instance->reply_map = kzalloc(sizeof(unsigned int) * nr_cpu_ids,
+                                      GFP_KERNEL);
+        if (!instance->reply_map)
+                return -ENOMEM;
+
         switch (instance->adapter_type) {
         case MFI_SERIES:
                 if (megasas_alloc_mfi_ctrl_mem(instance))
-                        return -ENOMEM;
+                        goto fail;
                 break;
         case VENTURA_SERIES:
         case THUNDERBOLT_SERIES:
         case INVADER_SERIES:
                 if (megasas_alloc_fusion_context(instance))
-                        return -ENOMEM;
+                        goto fail;
                 break;
         }
 
         return 0;
+ fail:
+        kfree(instance->reply_map);
+        instance->reply_map = NULL;
+        return -ENOMEM;
 }
 
 /*
@@ -6148,6 +6179,7 @@ static int megasas_alloc_ctrl_mem(struct megasas_instance *instance)
  */
 static inline void megasas_free_ctrl_mem(struct megasas_instance *instance)
 {
+        kfree(instance->reply_map);
         if (instance->adapter_type == MFI_SERIES) {
                 if (instance->producer)
                         pci_free_consistent(instance->pdev, sizeof(u32),
@@ -6540,7 +6572,6 @@ fail_io_attach:
                 pci_free_irq_vectors(instance->pdev);
 fail_init_mfi:
         scsi_host_put(host);
-
 fail_alloc_instance:
         pci_disable_device(pdev);
 
@@ -6746,6 +6777,8 @@ megasas_resume(struct pci_dev *pdev)
         if (rval < 0)
                 goto fail_reenable_msix;
 
+        megasas_setup_reply_map(instance);
+
         if (instance->adapter_type != MFI_SERIES) {
                 megasas_reset_reply_desc(instance);
                 if (megasas_ioc_init_fusion(instance)) {
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index dc8e850fbfd2..5ec3b74e8aed 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -2641,11 +2641,8 @@ megasas_build_ldio_fusion(struct megasas_instance *instance,
                         fp_possible = (io_info.fpOkForIo > 0) ? true : false;
         }
 
-        /* Use raw_smp_processor_id() for now until cmd->request->cpu is CPU
-           id by default, not CPU group id, otherwise all MSI-X queues won't
-           be utilized */
-        cmd->request_desc->SCSIIO.MSIxIndex = instance->msix_vectors ?
-                raw_smp_processor_id() % instance->msix_vectors : 0;
+        cmd->request_desc->SCSIIO.MSIxIndex =
+                instance->reply_map[raw_smp_processor_id()];
 
         praid_context = &io_request->RaidContext;
 
@@ -2971,10 +2968,9 @@ megasas_build_syspd_fusion(struct megasas_instance *instance,
         }
 
         cmd->request_desc->SCSIIO.DevHandle = io_request->DevHandle;
-        cmd->request_desc->SCSIIO.MSIxIndex =
-                instance->msix_vectors ?
-                (raw_smp_processor_id() % instance->msix_vectors) : 0;
 
+        cmd->request_desc->SCSIIO.MSIxIndex =
+                instance->reply_map[raw_smp_processor_id()];
 
         if (!fp_possible) {
                 /* system pd firmware path */
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 3541caf3fceb..1fa84d6a0f8b 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2484,6 +2484,8 @@ sd_read_capacity(struct scsi_disk *sdkp, unsigned char *buffer)
                                 sector_size = old_sector_size;
                                 goto got_data;
                         }
+                        /* Remember that READ CAPACITY(16) succeeded */
+                        sdp->try_rc_10_first = 0;
                 }
         }
 
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 7c28e8d4955a..45d04631888a 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -91,9 +91,6 @@ struct virtio_scsi_vq {
 struct virtio_scsi_target_state {
         seqcount_t tgt_seq;
 
-        /* Count of outstanding requests. */
-        atomic_t reqs;
-
         /* Currently active virtqueue for requests sent to this target. */
         struct virtio_scsi_vq *req_vq;
 };
@@ -152,8 +149,6 @@ static void virtscsi_complete_cmd(struct virtio_scsi *vscsi, void *buf)
         struct virtio_scsi_cmd *cmd = buf;
         struct scsi_cmnd *sc = cmd->sc;
         struct virtio_scsi_cmd_resp *resp = &cmd->resp.cmd;
-        struct virtio_scsi_target_state *tgt =
-                                scsi_target(sc->device)->hostdata;
 
         dev_dbg(&sc->device->sdev_gendev,
                 "cmd %p response %u status %#02x sense_len %u\n",
@@ -210,8 +205,6 @@ static void virtscsi_complete_cmd(struct virtio_scsi *vscsi, void *buf)
         }
 
         sc->scsi_done(sc);
-
-        atomic_dec(&tgt->reqs);
 }
 
 static void virtscsi_vq_done(struct virtio_scsi *vscsi,
@@ -529,11 +522,20 @@ static void virtio_scsi_init_hdr_pi(struct virtio_device *vdev,
 }
 #endif
 
-static int virtscsi_queuecommand(struct virtio_scsi *vscsi,
-                                 struct virtio_scsi_vq *req_vq,
+static struct virtio_scsi_vq *virtscsi_pick_vq_mq(struct virtio_scsi *vscsi,
+                                                  struct scsi_cmnd *sc)
+{
+        u32 tag = blk_mq_unique_tag(sc->request);
+        u16 hwq = blk_mq_unique_tag_to_hwq(tag);
+
+        return &vscsi->req_vqs[hwq];
+}
+
+static int virtscsi_queuecommand(struct Scsi_Host *shost,
                                  struct scsi_cmnd *sc)
 {
-        struct Scsi_Host *shost = virtio_scsi_host(vscsi->vdev);
+        struct virtio_scsi *vscsi = shost_priv(shost);
+        struct virtio_scsi_vq *req_vq = virtscsi_pick_vq_mq(vscsi, sc);
         struct virtio_scsi_cmd *cmd = scsi_cmd_priv(sc);
         unsigned long flags;
         int req_size;
@@ -576,79 +578,6 @@ static int virtscsi_queuecommand(struct virtio_scsi *vscsi,
         return 0;
 }
 
-static int virtscsi_queuecommand_single(struct Scsi_Host *sh,
-                                        struct scsi_cmnd *sc)
-{
-        struct virtio_scsi *vscsi = shost_priv(sh);
-        struct virtio_scsi_target_state *tgt =
-                                scsi_target(sc->device)->hostdata;
-
-        atomic_inc(&tgt->reqs);
-        return virtscsi_queuecommand(vscsi, &vscsi->req_vqs[0], sc);
-}
-
-static struct virtio_scsi_vq *virtscsi_pick_vq_mq(struct virtio_scsi *vscsi,
-                                                  struct scsi_cmnd *sc)
-{
-        u32 tag = blk_mq_unique_tag(sc->request);
-        u16 hwq = blk_mq_unique_tag_to_hwq(tag);
-
-        return &vscsi->req_vqs[hwq];
-}
-
-static struct virtio_scsi_vq *virtscsi_pick_vq(struct virtio_scsi *vscsi,
-                                               struct virtio_scsi_target_state *tgt)
-{
-        struct virtio_scsi_vq *vq;
-        unsigned long flags;
-        u32 queue_num;
-
-        local_irq_save(flags);
-        if (atomic_inc_return(&tgt->reqs) > 1) {
-                unsigned long seq;
-
-                do {
-                        seq = read_seqcount_begin(&tgt->tgt_seq);
-                        vq = tgt->req_vq;
-                } while (read_seqcount_retry(&tgt->tgt_seq, seq));
-        } else {
-                /* no writes can be concurrent because of atomic_t */
-                write_seqcount_begin(&tgt->tgt_seq);
-
-                /* keep previous req_vq if a reader just arrived */
-                if (unlikely(atomic_read(&tgt->reqs) > 1)) {
-                        vq = tgt->req_vq;
-                        goto unlock;
-                }
-
-                queue_num = smp_processor_id();
-                while (unlikely(queue_num >= vscsi->num_queues))
-                        queue_num -= vscsi->num_queues;
-                tgt->req_vq = vq = &vscsi->req_vqs[queue_num];
- unlock:
-                write_seqcount_end(&tgt->tgt_seq);
-        }
-        local_irq_restore(flags);
-
-        return vq;
-}
-
-static int virtscsi_queuecommand_multi(struct Scsi_Host *sh,
-                                       struct scsi_cmnd *sc)
-{
-        struct virtio_scsi *vscsi = shost_priv(sh);
-        struct virtio_scsi_target_state *tgt =
-                                scsi_target(sc->device)->hostdata;
-        struct virtio_scsi_vq *req_vq;
-
-        if (shost_use_blk_mq(sh))
-                req_vq = virtscsi_pick_vq_mq(vscsi, sc);
-        else
-                req_vq = virtscsi_pick_vq(vscsi, tgt);
-
-        return virtscsi_queuecommand(vscsi, req_vq, sc);
-}
-
 static int virtscsi_tmf(struct virtio_scsi *vscsi, struct virtio_scsi_cmd *cmd)
 {
         DECLARE_COMPLETION_ONSTACK(comp);
@@ -775,7 +704,6 @@ static int virtscsi_target_alloc(struct scsi_target *starget)
                 return -ENOMEM;
 
         seqcount_init(&tgt->tgt_seq);
-        atomic_set(&tgt->reqs, 0);
         tgt->req_vq = &vscsi->req_vqs[0];
 
         starget->hostdata = tgt;
@@ -805,33 +733,13 @@ static enum blk_eh_timer_return virtscsi_eh_timed_out(struct scsi_cmnd *scmnd)
         return BLK_EH_RESET_TIMER;
 }
 
-static struct scsi_host_template virtscsi_host_template_single = {
-        .module = THIS_MODULE,
-        .name = "Virtio SCSI HBA",
-        .proc_name = "virtio_scsi",
-        .this_id = -1,
-        .cmd_size = sizeof(struct virtio_scsi_cmd),
-        .queuecommand = virtscsi_queuecommand_single,
-        .change_queue_depth = virtscsi_change_queue_depth,
-        .eh_abort_handler = virtscsi_abort,
-        .eh_device_reset_handler = virtscsi_device_reset,
-        .eh_timed_out = virtscsi_eh_timed_out,
-        .slave_alloc = virtscsi_device_alloc,
-
-        .dma_boundary = UINT_MAX,
-        .use_clustering = ENABLE_CLUSTERING,
-        .target_alloc = virtscsi_target_alloc,
-        .target_destroy = virtscsi_target_destroy,
-        .track_queue_depth = 1,
-};
-
-static struct scsi_host_template virtscsi_host_template_multi = {
+static struct scsi_host_template virtscsi_host_template = {
         .module = THIS_MODULE,
         .name = "Virtio SCSI HBA",
         .proc_name = "virtio_scsi",
         .this_id = -1,
         .cmd_size = sizeof(struct virtio_scsi_cmd),
-        .queuecommand = virtscsi_queuecommand_multi,
+        .queuecommand = virtscsi_queuecommand,
         .change_queue_depth = virtscsi_change_queue_depth,
         .eh_abort_handler = virtscsi_abort,
         .eh_device_reset_handler = virtscsi_device_reset,
@@ -844,6 +752,7 @@ static struct scsi_host_template virtscsi_host_template_multi = {
         .target_destroy = virtscsi_target_destroy,
         .map_queues = virtscsi_map_queues,
         .track_queue_depth = 1,
+        .force_blk_mq = 1,
 };
 
 #define virtscsi_config_get(vdev, fld) \
@@ -936,7 +845,6 @@ static int virtscsi_probe(struct virtio_device *vdev)
         u32 sg_elems, num_targets;
         u32 cmd_per_lun;
         u32 num_queues;
-        struct scsi_host_template *hostt;
 
         if (!vdev->config->get) {
                 dev_err(&vdev->dev, "%s failure: config access disabled\n",
@@ -949,12 +857,7 @@ static int virtscsi_probe(struct virtio_device *vdev)
 
         num_targets = virtscsi_config_get(vdev, max_target) + 1;
 
-        if (num_queues == 1)
-                hostt = &virtscsi_host_template_single;
-        else
-                hostt = &virtscsi_host_template_multi;
-
-        shost = scsi_host_alloc(hostt,
+        shost = scsi_host_alloc(&virtscsi_host_template,
                 sizeof(*vscsi) + sizeof(vscsi->req_vqs[0]) * num_queues);
         if (!shost)
                 return -ENOMEM;
diff --git a/drivers/staging/ncpfs/ncplib_kernel.c b/drivers/staging/ncpfs/ncplib_kernel.c
index 804adfebba2f..3e047eb4cc7c 100644
--- a/drivers/staging/ncpfs/ncplib_kernel.c
+++ b/drivers/staging/ncpfs/ncplib_kernel.c
@@ -981,6 +981,10 @@ ncp_read_kernel(struct ncp_server *server, const char *file_id,
                 goto out;
         }
         *bytes_read = ncp_reply_be16(server, 0);
+        if (*bytes_read > to_read) {
+                result = -EINVAL;
+                goto out;
+        }
         source = ncp_reply_data(server, 2 + (offset & 1));
 
         memcpy(target, source, *bytes_read);
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 88b902c525d7..b4e57c5a8bba 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -1727,7 +1727,7 @@ static void reset_terminal(struct vc_data *vc, int do_clear)
         default_attr(vc);
         update_attr(vc);
 
-        vc->vc_tab_stop[0]      = 0x01010100;
+        vc->vc_tab_stop[0]      =
         vc->vc_tab_stop[1]      =
         vc->vc_tab_stop[2]      =
         vc->vc_tab_stop[3]      =
@@ -1771,7 +1771,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
                 vc->vc_pos -= (vc->vc_x << 1);
                 while (vc->vc_x < vc->vc_cols - 1) {
                         vc->vc_x++;
-                        if (vc->vc_tab_stop[vc->vc_x >> 5] & (1 << (vc->vc_x & 31)))
+                        if (vc->vc_tab_stop[7 & (vc->vc_x >> 5)] & (1 << (vc->vc_x & 31)))
                                 break;
                 }
                 vc->vc_pos += (vc->vc_x << 1);
@@ -1831,7 +1831,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
                         lf(vc);
                         return;
                 case 'H':
-                        vc->vc_tab_stop[vc->vc_x >> 5] |= (1 << (vc->vc_x & 31));
+                        vc->vc_tab_stop[7 & (vc->vc_x >> 5)] |= (1 << (vc->vc_x & 31));
                         return;
                 case 'Z':
                         respond_ID(tty);
@@ -2024,7 +2024,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
                         return;
                 case 'g':
                         if (!vc->vc_par[0])
-                                vc->vc_tab_stop[vc->vc_x >> 5] &= ~(1 << (vc->vc_x & 31));
+                                vc->vc_tab_stop[7 & (vc->vc_x >> 5)] &= ~(1 << (vc->vc_x & 31));
                         else if (vc->vc_par[0] == 3) {
                                 vc->vc_tab_stop[0] =
                                         vc->vc_tab_stop[1] =
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index b0f759476900..8a1508a8e481 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -207,9 +207,6 @@ static bool vfio_pci_nointx(struct pci_dev *pdev)
                 }
         }
 
-        if (!pdev->irq)
-                return true;
-
         return false;
 }
 
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 6639926eed4e..b67eec3532a1 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -640,7 +640,8 @@ static ssize_t ceph_sync_read(struct kiocb *iocb, struct iov_iter *to,
 struct ceph_aio_request {
         struct kiocb *iocb;
         size_t total_len;
-        int write;
+        bool write;
+        bool should_dirty;
         int error;
         struct list_head osd_reqs;
         unsigned num_reqs;
@@ -750,7 +751,7 @@ static void ceph_aio_complete_req(struct ceph_osd_request *req)
                 }
         }
 
-        ceph_put_page_vector(osd_data->pages, num_pages, !aio_req->write);
+        ceph_put_page_vector(osd_data->pages, num_pages, aio_req->should_dirty);
         ceph_osdc_put_request(req);
 
         if (rc < 0)
@@ -847,6 +848,7 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter,
         size_t count = iov_iter_count(iter);
         loff_t pos = iocb->ki_pos;
         bool write = iov_iter_rw(iter) == WRITE;
+        bool should_dirty = !write && iter_is_iovec(iter);
 
         if (write && ceph_snap(file_inode(file)) != CEPH_NOSNAP)
                 return -EROFS;
@@ -914,6 +916,7 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter,
                         if (aio_req) {
                                 aio_req->iocb = iocb;
                                 aio_req->write = write;
+                                aio_req->should_dirty = should_dirty;
                                 INIT_LIST_HEAD(&aio_req->osd_reqs);
                                 if (write) {
                                         aio_req->mtime = mtime;
@@ -971,7 +974,7 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter,
                                 len = ret;
                 }
 
-                ceph_put_page_vector(pages, num_pages, !write);
+                ceph_put_page_vector(pages, num_pages, should_dirty);
 
                 ceph_osdc_put_request(req);
                 if (ret < 0)
diff --git a/include/linux/fsl_ifc.h b/include/linux/fsl_ifc.h
index c332f0a45607..3fdfede2f0f3 100644
--- a/include/linux/fsl_ifc.h
+++ b/include/linux/fsl_ifc.h
@@ -734,11 +734,7 @@ struct fsl_ifc_nand {
         u32 res19[0x10];
         __be32 nand_fsr;
         u32 res20;
-        /* The V1 nand_eccstat is actually 4 words that overlaps the
-         * V2 nand_eccstat.
-         */
-        __be32 v1_nand_eccstat[2];
-        __be32 v2_nand_eccstat[6];
+        __be32 nand_eccstat[8];
         u32 res21[0x1c];
         __be32 nanndcr;
         u32 res22[0x2];
diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h
index 2168cc6b8b30..b46b541c67c4 100644
--- a/include/linux/jump_label.h
+++ b/include/linux/jump_label.h
@@ -151,7 +151,7 @@ extern struct jump_entry __start___jump_table[];
 extern struct jump_entry __stop___jump_table[];
 
 extern void jump_label_init(void);
-extern void jump_label_invalidate_init(void);
+extern void jump_label_invalidate_initmem(void);
 extern void jump_label_lock(void);
 extern void jump_label_unlock(void);
 extern void arch_jump_label_transform(struct jump_entry *entry,
@@ -199,7 +199,7 @@ static __always_inline void jump_label_init(void)
         static_key_initialized = true;
 }
 
-static inline void jump_label_invalidate_init(void) {}
+static inline void jump_label_invalidate_initmem(void) {}
 
 static __always_inline bool static_key_false(struct static_key *key)
 {
diff --git a/include/rdma/ib_addr.h b/include/rdma/ib_addr.h
index d656809f1217..415e09960017 100644
--- a/include/rdma/ib_addr.h
+++ b/include/rdma/ib_addr.h
@@ -130,6 +130,8 @@ void rdma_copy_addr(struct rdma_dev_addr *dev_addr,
                     const unsigned char *dst_dev_addr);
 
 int rdma_addr_size(struct sockaddr *addr);
+int rdma_addr_size_in6(struct sockaddr_in6 *addr);
+int rdma_addr_size_kss(struct __kernel_sockaddr_storage *addr);
 
 int rdma_addr_find_l2_eth_by_grh(const union ib_gid *sgid,
                                  const union ib_gid *dgid,
diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h
index a8b7bf879ced..9c1e4bad6581 100644
--- a/include/scsi/scsi_host.h
+++ b/include/scsi/scsi_host.h
@@ -452,6 +452,9 @@ struct scsi_host_template {
         /* True if the controller does not support WRITE SAME */
         unsigned no_write_same:1;
 
+        /* True if the low-level driver supports blk-mq only */
+        unsigned force_blk_mq:1;
+
         /*
          * Countdown for host blocking with no commands outstanding.
          */
diff --git a/include/uapi/linux/lirc.h b/include/uapi/linux/lirc.h
index 4fe580d36e41..f5bf06ecd87d 100644
--- a/include/uapi/linux/lirc.h
+++ b/include/uapi/linux/lirc.h
@@ -54,7 +54,6 @@
 #define LIRC_CAN_SEND_RAW              LIRC_MODE2SEND(LIRC_MODE_RAW)
 #define LIRC_CAN_SEND_PULSE            LIRC_MODE2SEND(LIRC_MODE_PULSE)
 #define LIRC_CAN_SEND_MODE2            LIRC_MODE2SEND(LIRC_MODE_MODE2)
-#define LIRC_CAN_SEND_SCANCODE         LIRC_MODE2SEND(LIRC_MODE_SCANCODE)
 #define LIRC_CAN_SEND_LIRCCODE         LIRC_MODE2SEND(LIRC_MODE_LIRCCODE)
 
 #define LIRC_CAN_SEND_MASK             0x0000003f
diff --git a/include/uapi/linux/usb/audio.h b/include/uapi/linux/usb/audio.h
index 17a022c5b414..da3315ed1bcd 100644
--- a/include/uapi/linux/usb/audio.h
+++ b/include/uapi/linux/usb/audio.h
@@ -370,7 +370,7 @@ static inline __u8 uac_processing_unit_bControlSize(struct uac_processing_unit_d
 {
         return (protocol == UAC_VERSION_1) ?
                 desc->baSourceID[desc->bNrInPins + 4] :
-                desc->baSourceID[desc->bNrInPins + 6];
+                2; /* in UAC2, this value is constant */
 }
 
 static inline __u8 *uac_processing_unit_bmControls(struct uac_processing_unit_descriptor *desc,
@@ -378,7 +378,7 @@ static inline __u8 *uac_processing_unit_bmControls(struct uac_processing_unit_de
 {
         return (protocol == UAC_VERSION_1) ?
                 &desc->baSourceID[desc->bNrInPins + 5] :
-                &desc->baSourceID[desc->bNrInPins + 7];
+                &desc->baSourceID[desc->bNrInPins + 6];
 }
 
 static inline __u8 uac_processing_unit_iProcessing(struct uac_processing_unit_descriptor *desc,
diff --git a/init/main.c b/init/main.c
index 969eaf140ef0..21efbf6ace93 100644
--- a/init/main.c
+++ b/init/main.c
@@ -1001,7 +1001,7 @@ static int __ref kernel_init(void *unused)
         /* need to finish all async __init code before freeing the memory */
         async_synchronize_full();
         ftrace_free_init_mem();
-        jump_label_invalidate_init();
+        jump_label_invalidate_initmem();
         free_initmem();
         mark_readonly();
         system_state = SYSTEM_RUNNING;
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index d7f309f74dec..a808f29d4c5a 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -325,9 +325,8 @@ err:
 static int mqueue_fill_super(struct super_block *sb, void *data, int silent)
 {
         struct inode *inode;
-        struct ipc_namespace *ns = data;
+        struct ipc_namespace *ns = sb->s_fs_info;
 
-        sb->s_fs_info = ns;
         sb->s_iflags |= SB_I_NOEXEC | SB_I_NODEV;
         sb->s_blocksize = PAGE_SIZE;
         sb->s_blocksize_bits = PAGE_SHIFT;
@@ -344,44 +343,18 @@ static int mqueue_fill_super(struct super_block *sb, void *data, int silent)
         return 0;
 }
 
-static struct file_system_type mqueue_fs_type;
-/*
- * Return value is pinned only by reference in ->mq_mnt; it will
- * live until ipcns dies.  Caller does not need to drop it.
- */
-static struct vfsmount *mq_internal_mount(void)
-{
-        struct ipc_namespace *ns = current->nsproxy->ipc_ns;
-        struct vfsmount *m = ns->mq_mnt;
-        if (m)
-                return m;
-        m = kern_mount_data(&mqueue_fs_type, ns);
-        spin_lock(&mq_lock);
-        if (unlikely(ns->mq_mnt)) {
-                spin_unlock(&mq_lock);
-                if (!IS_ERR(m))
-                        kern_unmount(m);
-                return ns->mq_mnt;
-        }
-        if (!IS_ERR(m))
-                ns->mq_mnt = m;
-        spin_unlock(&mq_lock);
-        return m;
-}
-
 static struct dentry *mqueue_mount(struct file_system_type *fs_type,
                          int flags, const char *dev_name,
                          void *data)
 {
-        struct vfsmount *m;
-        if (flags & SB_KERNMOUNT)
-                return mount_nodev(fs_type, flags, data, mqueue_fill_super);
-        m = mq_internal_mount();
-        if (IS_ERR(m))
-                return ERR_CAST(m);
-        atomic_inc(&m->mnt_sb->s_active);
-        down_write(&m->mnt_sb->s_umount);
-        return dget(m->mnt_root);
+        struct ipc_namespace *ns;
+        if (flags & SB_KERNMOUNT) {
+                ns = data;
+                data = NULL;
+        } else {
+                ns = current->nsproxy->ipc_ns;
+        }
+        return mount_ns(fs_type, flags, data, ns, ns->user_ns, mqueue_fill_super);
 }
 
 static void init_once(void *foo)
@@ -771,16 +744,13 @@ static int prepare_open(struct dentry *dentry, int oflag, int ro,
 static int do_mq_open(const char __user *u_name, int oflag, umode_t mode,
                       struct mq_attr *attr)
 {
-        struct vfsmount *mnt = mq_internal_mount();
-        struct dentry *root;
+        struct vfsmount *mnt = current->nsproxy->ipc_ns->mq_mnt;
+        struct dentry *root = mnt->mnt_root;
         struct filename *name;
         struct path path;
         int fd, error;
         int ro;
 
-        if (IS_ERR(mnt))
-                return PTR_ERR(mnt);
-
         audit_mq_open(oflag, mode, attr);
 
         if (IS_ERR(name = getname(u_name)))
@@ -791,7 +761,6 @@ static int do_mq_open(const char __user *u_name, int oflag, umode_t mode,
                 goto out_putname;
 
         ro = mnt_want_write(mnt);       /* we'll drop it in any case */
-        root = mnt->mnt_root;
         inode_lock(d_inode(root));
         path.dentry = lookup_one_len(name->name, root, strlen(name->name));
         if (IS_ERR(path.dentry)) {
@@ -840,9 +809,6 @@ SYSCALL_DEFINE1(mq_unlink, const char __user *, u_name)
         struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
         struct vfsmount *mnt = ipc_ns->mq_mnt;
 
-        if (!mnt)
-                return -ENOENT;
-
         name = getname(u_name);
         if (IS_ERR(name))
                 return PTR_ERR(name);
@@ -1569,26 +1535,28 @@ int mq_init_ns(struct ipc_namespace *ns)
         ns->mq_msgsize_max   = DFLT_MSGSIZEMAX;
         ns->mq_msg_default   = DFLT_MSG;
         ns->mq_msgsize_default  = DFLT_MSGSIZE;
-        ns->mq_mnt = NULL;
 
+        ns->mq_mnt = kern_mount_data(&mqueue_fs_type, ns);
+        if (IS_ERR(ns->mq_mnt)) {
+                int err = PTR_ERR(ns->mq_mnt);
+                ns->mq_mnt = NULL;
+                return err;
+        }
         return 0;
 }
 
 void mq_clear_sbinfo(struct ipc_namespace *ns)
 {
-        if (ns->mq_mnt)
-                ns->mq_mnt->mnt_sb->s_fs_info = NULL;
+        ns->mq_mnt->mnt_sb->s_fs_info = NULL;
 }
 
 void mq_put_mnt(struct ipc_namespace *ns)
 {
-        if (ns->mq_mnt)
-                kern_unmount(ns->mq_mnt);
+        kern_unmount(ns->mq_mnt);
 }
 
 static int __init init_mqueue_fs(void)
 {
-        struct vfsmount *m;
         int error;
 
         mqueue_inode_cachep = kmem_cache_create("mqueue_inode_cache",
@@ -1610,10 +1578,6 @@ static int __init init_mqueue_fs(void)
         if (error)
                 goto out_filesystem;
 
-        m = kern_mount_data(&mqueue_fs_type, &init_ipc_ns);
-        if (IS_ERR(m))
-                goto out_filesystem;
-        init_ipc_ns.mq_mnt = m;
         return 0;
 
 out_filesystem:
diff --git a/ipc/shm.c b/ipc/shm.c
index 4643865e9171..93e0e3a4d009 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -386,6 +386,17 @@ static int shm_fault(struct vm_fault *vmf)
         return sfd->vm_ops->fault(vmf);
 }
 
+static int shm_split(struct vm_area_struct *vma, unsigned long addr)
+{
+        struct file *file = vma->vm_file;
+        struct shm_file_data *sfd = shm_file_data(file);
+
+        if (sfd->vm_ops && sfd->vm_ops->split)
+                return sfd->vm_ops->split(vma, addr);
+
+        return 0;
+}
+
 #ifdef CONFIG_NUMA
 static int shm_set_policy(struct vm_area_struct *vma, struct mempolicy *new)
 {
@@ -510,6 +521,7 @@ static const struct vm_operations_struct shm_vm_ops = {
         .open   = shm_open,     /* callback for a new vm-area open */
         .close  = shm_close,    /* callback for when the vm-area is released */
         .fault  = shm_fault,
+        .split  = shm_split,
 #if defined(CONFIG_NUMA)
         .set_policy = shm_set_policy,
         .get_policy = shm_get_policy,
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 4b838470fac4..709a55b9ad97 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -724,9 +724,15 @@ static inline void __update_cgrp_time(struct perf_cgroup *cgrp)
 
 static inline void update_cgrp_time_from_cpuctx(struct perf_cpu_context *cpuctx)
 {
-        struct perf_cgroup *cgrp_out = cpuctx->cgrp;
-        if (cgrp_out)
-                __update_cgrp_time(cgrp_out);
+        struct perf_cgroup *cgrp = cpuctx->cgrp;
+        struct cgroup_subsys_state *css;
+
+        if (cgrp) {
+                for (css = &cgrp->css; css; css = css->parent) {
+                        cgrp = container_of(css, struct perf_cgroup, css);
+                        __update_cgrp_time(cgrp);
+                }
+        }
 }
 
 static inline void update_cgrp_time_from_event(struct perf_event *event)
@@ -754,6 +760,7 @@ perf_cgroup_set_timestamp(struct task_struct *task,
 {
         struct perf_cgroup *cgrp;
         struct perf_cgroup_info *info;
+        struct cgroup_subsys_state *css;
 
         /*
          * ctx->lock held by caller
@@ -764,8 +771,12 @@ perf_cgroup_set_timestamp(struct task_struct *task,
                 return;
 
         cgrp = perf_cgroup_from_task(task, ctx);
-        info = this_cpu_ptr(cgrp->info);
-        info->timestamp = ctx->timestamp;
+
+        for (css = &cgrp->css; css; css = css->parent) {
+                cgrp = container_of(css, struct perf_cgroup, css);
+                info = this_cpu_ptr(cgrp->info);
+                info->timestamp = ctx->timestamp;
+        }
 }
 
 static DEFINE_PER_CPU(struct list_head, cgrp_cpuctx_list);
diff --git a/kernel/jump_label.c b/kernel/jump_label.c
index e7214093dcd1..01ebdf1f9f40 100644
--- a/kernel/jump_label.c
+++ b/kernel/jump_label.c
@@ -16,6 +16,7 @@
 #include <linux/jump_label_ratelimit.h>
 #include <linux/bug.h>
 #include <linux/cpu.h>
+#include <asm/sections.h>
 
 #ifdef HAVE_JUMP_LABEL
 
@@ -421,15 +422,15 @@ void __init jump_label_init(void)
         cpus_read_unlock();
 }
 
-/* Disable any jump label entries in __init code */
-void __init jump_label_invalidate_init(void)
+/* Disable any jump label entries in __init/__exit code */
+void __init jump_label_invalidate_initmem(void)
 {
         struct jump_entry *iter_start = __start___jump_table;
         struct jump_entry *iter_stop = __stop___jump_table;
         struct jump_entry *iter;
 
         for (iter = iter_start; iter < iter_stop; iter++) {
-                if (init_kernel_text(iter->code))
+                if (init_section_contains((void *)(unsigned long)iter->code, 1))
                         iter->code = 0;
         }
 }
diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
index 858a07590e39..2048359f33d2 100644
--- a/kernel/locking/mutex.c
+++ b/kernel/locking/mutex.c
@@ -1082,15 +1082,16 @@ static noinline int __sched
 __mutex_lock_interruptible_slowpath(struct mutex *lock);
 
 /**
- * mutex_lock_interruptible - acquire the mutex, interruptible
- * @lock: the mutex to be acquired
+ * mutex_lock_interruptible() - Acquire the mutex, interruptible by signals.
+ * @lock: The mutex to be acquired.
  *
- * Lock the mutex like mutex_lock(), and return 0 if the mutex has
- * been acquired or sleep until the mutex becomes available. If a
- * signal arrives while waiting for the lock then this function
- * returns -EINTR.
+ * Lock the mutex like mutex_lock().  If a signal is delivered while the
+ * process is sleeping, this function will return without acquiring the
+ * mutex.
  *
- * This function is similar to (but not equivalent to) down_interruptible().
+ * Context: Process context.
+ * Return: 0 if the lock was successfully acquired or %-EINTR if a
+ * signal arrived.
  */
 int __sched mutex_lock_interruptible(struct mutex *lock)
 {
@@ -1104,6 +1105,18 @@ int __sched mutex_lock_interruptible(struct mutex *lock)
 
 EXPORT_SYMBOL(mutex_lock_interruptible);
 
+/**
+ * mutex_lock_killable() - Acquire the mutex, interruptible by fatal signals.
+ * @lock: The mutex to be acquired.
+ *
+ * Lock the mutex like mutex_lock().  If a signal which will be fatal to
+ * the current process is delivered while the process is sleeping, this
+ * function will return without acquiring the mutex.
+ *
+ * Context: Process context.
+ * Return: 0 if the lock was successfully acquired or %-EINTR if a
+ * fatal signal arrived.
+ */
 int __sched mutex_lock_killable(struct mutex *lock)
 {
         might_sleep();
@@ -1115,6 +1128,16 @@ int __sched mutex_lock_killable(struct mutex *lock)
 }
 EXPORT_SYMBOL(mutex_lock_killable);
 
+/**
+ * mutex_lock_io() - Acquire the mutex and mark the process as waiting for I/O
+ * @lock: The mutex to be acquired.
+ *
+ * Lock the mutex like mutex_lock().  While the task is waiting for this
+ * mutex, it will be accounted as being in the IO wait state by the
+ * scheduler.
+ *
+ * Context: Process context.
+ */
 void __sched mutex_lock_io(struct mutex *lock)
 {
         int token;
diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
index 1ca0130ed4f9..72c401b3b15c 100644
--- a/kernel/sched/debug.c
+++ b/kernel/sched/debug.c
@@ -32,7 +32,7 @@ static DEFINE_SPINLOCK(sched_debug_lock);
         if (m)                                  \
                 seq_printf(m, x);               \
         else                                    \
-                printk(x);                      \
+                pr_cont(x);                     \
  } while (0)
 
 /*
@@ -501,12 +501,12 @@ static void print_rq(struct seq_file *m, struct rq *rq, int rq_cpu)
 {
         struct task_struct *g, *p;
 
-        SEQ_printf(m,
-        "\nrunnable tasks:\n"
-        " S           task   PID         tree-key  switches  prio"
-        "     wait-time             sum-exec        sum-sleep\n"
-        "-------------------------------------------------------"
-        "----------------------------------------------------\n");
+        SEQ_printf(m, "\n");
+        SEQ_printf(m, "runnable tasks:\n");
+        SEQ_printf(m, " S           task   PID         tree-key  switches  prio"
+                   "     wait-time             sum-exec        sum-sleep\n");
+        SEQ_printf(m, "-------------------------------------------------------"
+                   "----------------------------------------------------\n");
 
         rcu_read_lock();
         for_each_process_thread(g, p) {
@@ -527,9 +527,11 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
         unsigned long flags;
 
 #ifdef CONFIG_FAIR_GROUP_SCHED
-        SEQ_printf(m, "\ncfs_rq[%d]:%s\n", cpu, task_group_path(cfs_rq->tg));
+        SEQ_printf(m, "\n");
+        SEQ_printf(m, "cfs_rq[%d]:%s\n", cpu, task_group_path(cfs_rq->tg));
 #else
-        SEQ_printf(m, "\ncfs_rq[%d]:\n", cpu);
+        SEQ_printf(m, "\n");
+        SEQ_printf(m, "cfs_rq[%d]:\n", cpu);
 #endif
         SEQ_printf(m, "  .%-30s: %Ld.%06ld\n", "exec_clock",
                         SPLIT_NS(cfs_rq->exec_clock));
@@ -595,9 +597,11 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
 void print_rt_rq(struct seq_file *m, int cpu, struct rt_rq *rt_rq)
 {
 #ifdef CONFIG_RT_GROUP_SCHED
-        SEQ_printf(m, "\nrt_rq[%d]:%s\n", cpu, task_group_path(rt_rq->tg));
+        SEQ_printf(m, "\n");
+        SEQ_printf(m, "rt_rq[%d]:%s\n", cpu, task_group_path(rt_rq->tg));
 #else
-        SEQ_printf(m, "\nrt_rq[%d]:\n", cpu);
+        SEQ_printf(m, "\n");
+        SEQ_printf(m, "rt_rq[%d]:\n", cpu);
 #endif
 
 #define P(x) \
@@ -624,7 +628,8 @@ void print_dl_rq(struct seq_file *m, int cpu, struct dl_rq *dl_rq)
 {
         struct dl_bw *dl_bw;
 
-        SEQ_printf(m, "\ndl_rq[%d]:\n", cpu);
+        SEQ_printf(m, "\n");
+        SEQ_printf(m, "dl_rq[%d]:\n", cpu);
 
 #define PU(x) \
         SEQ_printf(m, "  .%-30s: %lu\n", #x, (unsigned long)(dl_rq->x))
diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
index 75043046914e..10b7186d0638 100644
--- a/kernel/time/posix-timers.c
+++ b/kernel/time/posix-timers.c
@@ -50,6 +50,7 @@
 #include <linux/export.h>
 #include <linux/hashtable.h>
 #include <linux/compat.h>
+#include <linux/nospec.h>
 
 #include "timekeeping.h"
 #include "posix-timers.h"
@@ -1346,11 +1347,15 @@ static const struct k_clock * const posix_clocks[] = {
 
 static const struct k_clock *clockid_to_kclock(const clockid_t id)
 {
-        if (id < 0)
+        clockid_t idx = id;
+
+        if (id < 0) {
                 return (id & CLOCKFD_MASK) == CLOCKFD ?
                         &clock_posix_dynamic : &clock_posix_cpu;
+        }
 
-        if (id >= ARRAY_SIZE(posix_clocks) || !posix_clocks[id])
+        if (id >= ARRAY_SIZE(posix_clocks))
                 return NULL;
-        return posix_clocks[id];
+
+        return posix_clocks[array_index_nospec(idx, ARRAY_SIZE(posix_clocks))];
 }
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 1fad24acd444..ae4147eaebd4 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -659,7 +659,7 @@ static int create_trace_kprobe(int argc, char **argv)
         char *symbol = NULL, *event = NULL, *group = NULL;
         int maxactive = 0;
         char *arg;
-        unsigned long offset = 0;
+        long offset = 0;
         void *addr = NULL;
         char buf[MAX_EVENT_NAME_LEN];
 
@@ -747,7 +747,7 @@ static int create_trace_kprobe(int argc, char **argv)
                 symbol = argv[1];
                 /* TODO: support .init module functions */
                 ret = traceprobe_split_symbol_offset(symbol, &offset);
-                if (ret) {
+                if (ret || offset < 0 || offset > UINT_MAX) {
                         pr_info("Failed to parse either an address or a symbol.\n");
                         return ret;
                 }
diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
index d59357308677..daf54bda4dc8 100644
--- a/kernel/trace/trace_probe.c
+++ b/kernel/trace/trace_probe.c
@@ -320,7 +320,7 @@ static fetch_func_t get_fetch_size_function(const struct fetch_type *type,
 }
 
 /* Split symbol and offset. */
-int traceprobe_split_symbol_offset(char *symbol, unsigned long *offset)
+int traceprobe_split_symbol_offset(char *symbol, long *offset)
 {
         char *tmp;
         int ret;
@@ -328,13 +328,11 @@ int traceprobe_split_symbol_offset(char *symbol, unsigned long *offset)
         if (!offset)
                 return -EINVAL;
 
-        tmp = strchr(symbol, '+');
+        tmp = strpbrk(symbol, "+-");
         if (tmp) {
-                /* skip sign because kstrtoul doesn't accept '+' */
-                ret = kstrtoul(tmp + 1, 0, offset);
+                ret = kstrtol(tmp, 0, offset);
                 if (ret)
                         return ret;
-
                 *tmp = '\0';
         } else
                 *offset = 0;
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index e101c5bb9eda..6a4d3fa94042 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -365,7 +365,7 @@ extern int traceprobe_conflict_field_name(const char *name,
 extern void traceprobe_update_arg(struct probe_arg *arg);
 extern void traceprobe_free_probe_arg(struct probe_arg *arg);
 
-extern int traceprobe_split_symbol_offset(char *symbol, unsigned long *offset);
+extern int traceprobe_split_symbol_offset(char *symbol, long *offset);
 
 /* Sum up total data length for dynamic arraies (strings) */
 static nokprobe_inline int
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index e83987c55a08..46c2290a08f1 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1657,8 +1657,7 @@ static void start_scan_thread(void)
 }
 
 /*
- * Stop the automatic memory scanning thread. This function must be called
- * with the scan_mutex held.
+ * Stop the automatic memory scanning thread.
  */
 static void stop_scan_thread(void)
 {
@@ -1921,12 +1920,15 @@ static void kmemleak_do_cleanup(struct work_struct *work)
 {
         stop_scan_thread();
 
+        mutex_lock(&scan_mutex);
         /*
-         * Once the scan thread has stopped, it is safe to no longer track
-         * object freeing. Ordering of the scan thread stopping and the memory
-         * accesses below is guaranteed by the kthread_stop() function.
+         * Once it is made sure that kmemleak_scan has stopped, it is safe to no
+         * longer track object freeing. Ordering of the scan thread stopping and
+         * the memory accesses below is guaranteed by the kthread_stop()
+         * function.
          */
         kmemleak_free_enabled = 0;
+        mutex_unlock(&scan_mutex);
 
         if (!kmemleak_found_leaks)
                 __kmemleak_do_cleanup();
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 670e99b68aa6..9ec024b862ac 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -714,9 +714,9 @@ static struct mem_cgroup *get_mem_cgroup_from_mm(struct mm_struct *mm)
  * invocations for reference counting, or use mem_cgroup_iter_break()
  * to cancel a hierarchy walk before the round-trip is complete.
  *
- * Reclaimers can specify a zone and a priority level in @reclaim to
+ * Reclaimers can specify a node and a priority level in @reclaim to
  * divide up the memcgs in the hierarchy among all concurrent
- * reclaimers operating on the same zone and priority.
+ * reclaimers operating on the same node and priority.
  */
 struct mem_cgroup *mem_cgroup_iter(struct mem_cgroup *root,
                                    struct mem_cgroup *prev,
@@ -2299,7 +2299,7 @@ void memcg_kmem_put_cache(struct kmem_cache *cachep)
 }
 
 /**
- * memcg_kmem_charge: charge a kmem page
+ * memcg_kmem_charge_memcg: charge a kmem page
  * @page: page to charge
  * @gfp: reclaim mode
  * @order: allocation order
diff --git a/mm/page_owner.c b/mm/page_owner.c
index 9886c6073828..7172e0a80e13 100644
--- a/mm/page_owner.c
+++ b/mm/page_owner.c
@@ -123,13 +123,13 @@ void __reset_page_owner(struct page *page, unsigned int order)
 static inline bool check_recursive_alloc(struct stack_trace *trace,
                                         unsigned long ip)
 {
-        int i, count;
+        int i;
 
         if (!trace->nr_entries)
                 return false;
 
-        for (i = 0, count = 0; i < trace->nr_entries; i++) {
-                if (trace->entries[i] == ip && ++count == 2)
+        for (i = 0; i < trace->nr_entries; i++) {
+                if (trace->entries[i] == ip)
                         return true;
         }
 
diff --git a/mm/slab.c b/mm/slab.c
index 324446621b3e..9095c3945425 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -1283,6 +1283,7 @@ void __init kmem_cache_init(void)
                                   nr_node_ids * sizeof(struct kmem_cache_node *),
                                   SLAB_HWCACHE_ALIGN, 0, 0);
         list_add(&kmem_cache->list, &slab_caches);
+        memcg_link_cache(kmem_cache);
         slab_state = PARTIAL;
 
         /*
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 40b2db6db6b1..33581be705f0 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -1839,9 +1839,11 @@ static void vmstat_update(struct work_struct *w)
                  * to occur in the future. Keep on running the
                  * update worker thread.
                  */
+                preempt_disable();
                 queue_delayed_work_on(smp_processor_id(), mm_percpu_wq,
                                 this_cpu_ptr(&vmstat_work),
                                 round_jiffies_relative(sysctl_stat_interval));
+                preempt_enable();
         }
 }
 
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index 02298c9c6020..441405081195 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1326,7 +1326,7 @@ static ssize_t snd_pcm_oss_write2(struct snd_pcm_substream *substream, const cha
 static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const char __user *buf, size_t bytes)
 {
         size_t xfer = 0;
-        ssize_t tmp;
+        ssize_t tmp = 0;
         struct snd_pcm_runtime *runtime = substream->runtime;
 
         if (atomic_read(&substream->mmap_count))
@@ -1433,7 +1433,7 @@ static ssize_t snd_pcm_oss_read2(struct snd_pcm_substream *substream, char *buf,
 static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __user *buf, size_t bytes)
 {
         size_t xfer = 0;
-        ssize_t tmp;
+        ssize_t tmp = 0;
         struct snd_pcm_runtime *runtime = substream->runtime;
 
         if (atomic_read(&substream->mmap_count))
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 77ba50ddcf9e..d18b3982548b 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -3422,7 +3422,7 @@ int snd_pcm_lib_default_mmap(struct snd_pcm_substream *substream,
                                          area,
                                          substream->runtime->dma_area,
                                          substream->runtime->dma_addr,
-                                         area->vm_end - area->vm_start);
+                                         substream->runtime->dma_bytes);
 #endif /* CONFIG_X86 */
         /* mmap with fault handler */
         area->vm_ops = &snd_pcm_vm_ops_data_fault;
diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
index 0333143a1fa7..1063a4377502 100644
--- a/sound/drivers/aloop.c
+++ b/sound/drivers/aloop.c
@@ -192,6 +192,11 @@ static inline void loopback_timer_stop(struct loopback_pcm *dpcm)
         dpcm->timer.expires = 0;
 }
 
+static inline void loopback_timer_stop_sync(struct loopback_pcm *dpcm)
+{
+        del_timer_sync(&dpcm->timer);
+}
+
 #define CABLE_VALID_PLAYBACK    (1 << SNDRV_PCM_STREAM_PLAYBACK)
 #define CABLE_VALID_CAPTURE     (1 << SNDRV_PCM_STREAM_CAPTURE)
 #define CABLE_VALID_BOTH        (CABLE_VALID_PLAYBACK|CABLE_VALID_CAPTURE)
@@ -326,6 +331,8 @@ static int loopback_prepare(struct snd_pcm_substream *substream)
         struct loopback_cable *cable = dpcm->cable;
         int bps, salign;
 
+        loopback_timer_stop_sync(dpcm);
+
         salign = (snd_pcm_format_width(runtime->format) *
                                                 runtime->channels) / 8;
         bps = salign * runtime->rate;
@@ -659,7 +666,9 @@ static void free_cable(struct snd_pcm_substream *substream)
                 return;
         if (cable->streams[!substream->stream]) {
                 /* other stream is still alive */
+                spin_lock_irq(&cable->lock);
                 cable->streams[substream->stream] = NULL;
+                spin_unlock_irq(&cable->lock);
         } else {
                 /* free the cable */
                 loopback->cables[substream->number][dev] = NULL;
@@ -698,7 +707,6 @@ static int loopback_open(struct snd_pcm_substream *substream)
                 loopback->cables[substream->number][dev] = cable;
         }
         dpcm->cable = cable;
-        cable->streams[substream->stream] = dpcm;
 
         snd_pcm_hw_constraint_integer(runtime, SNDRV_PCM_HW_PARAM_PERIODS);
 
@@ -730,6 +738,11 @@ static int loopback_open(struct snd_pcm_substream *substream)
                 runtime->hw = loopback_pcm_hardware;
         else
                 runtime->hw = cable->hw;
+
+        spin_lock_irq(&cable->lock);
+        cable->streams[substream->stream] = dpcm;
+        spin_unlock_irq(&cable->lock);
+
  unlock:
         if (err < 0) {
                 free_cable(substream);
@@ -744,7 +757,7 @@ static int loopback_close(struct snd_pcm_substream *substream)
         struct loopback *loopback = substream->private_data;
         struct loopback_pcm *dpcm = substream->runtime->private_data;
 
-        loopback_timer_stop(dpcm);
+        loopback_timer_stop_sync(dpcm);
         mutex_lock(&loopback->cable_lock);
         free_cable(substream);
         mutex_unlock(&loopback->cable_lock);
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index d5017adf9feb..c507c69029e3 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -375,6 +375,7 @@ enum {
                                         ((pci)->device == 0x160c))
 
 #define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98)
+#define IS_CFL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa348)
 
 static char *driver_short_names[] = {
         [AZX_DRIVER_ICH] = "HDA Intel",
@@ -1744,6 +1745,10 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci,
         else
                 chip->bdl_pos_adj = bdl_pos_adj[dev];
 
+        /* Workaround for a communication error on CFL (bko#199007) */
+        if (IS_CFL(pci))
+                chip->polling_mode = 1;
+
         err = azx_bus_init(chip, model[dev], &pci_hda_io_ops);
         if (err < 0) {
                 kfree(hda);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 9af301c6bba2..aef1f52db7d9 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3130,6 +3130,8 @@ static void alc256_init(struct hda_codec *codec)
 
         alc_update_coef_idx(codec, 0x46, 3 << 12, 0);
         alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x4); /* Hight power */
+        alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 1 << 15); /* Clear bit */
+        alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 0 << 15);
 }
 
 static void alc256_shutup(struct hda_codec *codec)
@@ -3596,8 +3598,12 @@ static void alc269_fixup_mic_mute_hook(void *private_data, int enabled)
         pinval = snd_hda_codec_get_pin_target(codec, spec->mute_led_nid);
         pinval &= ~AC_PINCTL_VREFEN;
         pinval |= enabled ? AC_PINCTL_VREF_HIZ : AC_PINCTL_VREF_80;
-        if (spec->mute_led_nid)
+        if (spec->mute_led_nid) {
+                /* temporarily power up/down for setting VREF */
+                snd_hda_power_up_pm(codec);
                 snd_hda_set_pin_ctl_cache(codec, spec->mute_led_nid, pinval);
+                snd_hda_power_down_pm(codec);
+        }
 }
 
 /* Make sure the led works even in runtime suspend */
@@ -5497,6 +5503,7 @@ enum {
         ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
         ALC298_FIXUP_TPT470_DOCK,
         ALC255_FIXUP_DUMMY_LINEOUT_VERB,
+        ALC255_FIXUP_DELL_HEADSET_MIC,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -6357,6 +6364,13 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
         },
+        [ALC255_FIXUP_DELL_HEADSET_MIC] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+                        { }
+                },
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -6411,6 +6425,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
         SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
         SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+        SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
+        SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
         SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB),
         SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
@@ -7154,6 +7170,8 @@ static int patch_alc269(struct hda_codec *codec)
                 break;
         case 0x10ec0257:
                 spec->codec_variant = ALC269_TYPE_ALC257;
+                spec->shutup = alc256_shutup;
+                spec->init_hook = alc256_init;
                 spec->gen.mixer_nid = 0;
                 break;
         case 0x10ec0215:
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index ea8f3de92fa4..794224e1d6df 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1171,6 +1171,7 @@ static bool is_teac_dsd_dac(unsigned int id)
         switch (id) {
         case USB_ID(0x0644, 0x8043): /* TEAC UD-501/UD-503/NT-503 */
         case USB_ID(0x0644, 0x8044): /* Esoteric D-05X */
+        case USB_ID(0x0644, 0x804a): /* TEAC UD-301 */
                 return true;
         }
         return false;
diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_string.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_string.tc
new file mode 100644
index 000000000000..5ba73035e1d9
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_string.tc
@@ -0,0 +1,46 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0
+# description: Kprobe event string type argument
+
+[ -f kprobe_events ] || exit_unsupported # this is configurable
+
+echo 0 > events/enable
+echo > kprobe_events
+
+case `uname -m` in
+x86_64)
+  ARG2=%si
+  OFFS=8
+;;
+i[3456]86)
+  ARG2=%cx
+  OFFS=4
+;;
+aarch64)
+  ARG2=%x1
+  OFFS=8
+;;
+arm*)
+  ARG2=%r1
+  OFFS=4
+;;
+*)
+  echo "Please implement other architecture here"
+  exit_untested
+esac
+
+: "Test get argument (1)"
+echo "p:testprobe create_trace_kprobe arg1=+0(+0(${ARG2})):string" > kprobe_events
+echo 1 > events/kprobes/testprobe/enable
+! echo test >> kprobe_events
+tail -n 1 trace | grep -qe "testprobe.* arg1=\"test\""
+
+echo 0 > events/kprobes/testprobe/enable
+: "Test get argument (2)"
+echo "p:testprobe create_trace_kprobe arg1=+0(+0(${ARG2})):string arg2=+0(+${OFFS}(${ARG2})):string" > kprobe_events
+echo 1 > events/kprobes/testprobe/enable
+! echo test1 test2 >> kprobe_events
+tail -n 1 trace | grep -qe "testprobe.* arg1=\"test1\" arg2=\"test2\""
+
+echo 0 > events/enable
+echo > kprobe_events
diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc
new file mode 100644
index 000000000000..231bcd2c4eb5
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc
@@ -0,0 +1,97 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0
+# description: Kprobe event argument syntax
+
+[ -f kprobe_events ] || exit_unsupported # this is configurable
+
+grep "x8/16/32/64" README > /dev/null || exit_unsupported # version issue
+
+echo 0 > events/enable
+echo > kprobe_events
+
+PROBEFUNC="vfs_read"
+GOODREG=
+BADREG=
+GOODSYM="_sdata"
+if ! grep -qw ${GOODSYM} /proc/kallsyms ; then
+  GOODSYM=$PROBEFUNC
+fi
+BADSYM="deaqswdefr"
+SYMADDR=0x`grep -w ${GOODSYM} /proc/kallsyms | cut -f 1 -d " "`
+GOODTYPE="x16"
+BADTYPE="y16"
+
+case `uname -m` in
+x86_64|i[3456]86)
+  GOODREG=%ax
+  BADREG=%ex
+;;
+aarch64)
+  GOODREG=%x0
+  BADREG=%ax
+;;
+arm*)
+  GOODREG=%r0
+  BADREG=%ax
+;;
+esac
+
+test_goodarg() # Good-args
+{
+  while [ "$1" ]; do
+    echo "p ${PROBEFUNC} $1" > kprobe_events
+    shift 1
+  done;
+}
+
+test_badarg() # Bad-args
+{
+  while [ "$1" ]; do
+    ! echo "p ${PROBEFUNC} $1" > kprobe_events
+    shift 1
+  done;
+}
+
+echo > kprobe_events
+
+: "Register access"
+test_goodarg ${GOODREG}
+test_badarg ${BADREG}
+
+: "Symbol access"
+test_goodarg "@${GOODSYM}" "@${SYMADDR}" "@${GOODSYM}+10" "@${GOODSYM}-10"
+test_badarg "@" "@${BADSYM}" "@${GOODSYM}*10" "@${GOODSYM}/10" \
+            "@${GOODSYM}%10" "@${GOODSYM}&10" "@${GOODSYM}|10"
+
+: "Stack access"
+test_goodarg "\$stack" "\$stack0" "\$stack1"
+test_badarg "\$stackp" "\$stack0+10" "\$stack1-10"
+
+: "Retval access"
+echo "r ${PROBEFUNC} \$retval" > kprobe_events
+! echo "p ${PROBEFUNC} \$retval" > kprobe_events
+
+: "Comm access"
+test_goodarg "\$comm"
+
+: "Indirect memory access"
+test_goodarg "+0(${GOODREG})" "-0(${GOODREG})" "+10(\$stack)" \
+        "+0(\$stack1)" "+10(@${GOODSYM}-10)" "+0(+10(+20(\$stack)))"
+test_badarg "+(${GOODREG})" "(${GOODREG}+10)" "-(${GOODREG})" "(${GOODREG})" \
+        "+10(\$comm)" "+0(${GOODREG})+10"
+
+: "Name assignment"
+test_goodarg "varname=${GOODREG}"
+test_badarg "varname=varname2=${GOODREG}"
+
+: "Type syntax"
+test_goodarg "${GOODREG}:${GOODTYPE}"
+test_badarg "${GOODREG}::${GOODTYPE}" "${GOODREG}:${BADTYPE}" \
+        "${GOODTYPE}:${GOODREG}"
+
+: "Combination check"
+
+test_goodarg "\$comm:string" "+0(\$stack):string"
+test_badarg "\$comm:x64" "\$stack:string" "${GOODREG}:string"
+
+echo > kprobe_events
diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc b/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc
new file mode 100644
index 000000000000..4fda01a08da4
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc
@@ -0,0 +1,43 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0
+# description: Kprobe events - probe points
+
+[ -f kprobe_events ] || exit_unsupported # this is configurable
+
+TARGET_FUNC=create_trace_kprobe
+
+dec_addr() { # hexaddr
+  printf "%d" "0x"`echo $1 | tail -c 8`
+}
+
+set_offs() { # prev target next
+  A1=`dec_addr $1`
+  A2=`dec_addr $2`
+  A3=`dec_addr $3`
+  TARGET="0x$2" # an address
+  PREV=`expr $A1 - $A2` # offset to previous symbol
+  NEXT=+`expr $A3 - $A2` # offset to next symbol
+  OVERFLOW=+`printf "0x%x" ${PREV}` # overflow offset to previous symbol
+}
+
+# We have to decode symbol addresses to get correct offsets.
+# If the offset is not an instruction boundary, it cause -EILSEQ.
+set_offs `grep -A1 -B1 ${TARGET_FUNC} /proc/kallsyms | cut -f 1 -d " " | xargs`
+
+UINT_TEST=no
+# printf "%x" -1 returns (unsigned long)-1.
+if [ `printf "%x" -1 | wc -c` != 9 ]; then
+  UINT_TEST=yes
+fi
+
+echo 0 > events/enable
+echo > kprobe_events
+echo "p:testprobe ${TARGET_FUNC}" > kprobe_events
+echo "p:testprobe ${TARGET}" > kprobe_events
+echo "p:testprobe ${TARGET_FUNC}${NEXT}" > kprobe_events
+! echo "p:testprobe ${TARGET_FUNC}${PREV}" > kprobe_events
+if [ "${UINT_TEST}" = yes ]; then
+! echo "p:testprobe ${TARGET_FUNC}${OVERFLOW}" > kprobe_events
+fi
+echo > kprobe_events
+clear_trace
diff --git a/tools/testing/selftests/x86/ptrace_syscall.c b/tools/testing/selftests/x86/ptrace_syscall.c
index 1ae1c5a7392e..6f22238f3217 100644
--- a/tools/testing/selftests/x86/ptrace_syscall.c
+++ b/tools/testing/selftests/x86/ptrace_syscall.c
@@ -183,8 +183,10 @@ static void test_ptrace_syscall_restart(void)
                 if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0)
                         err(1, "PTRACE_TRACEME");
 
+                pid_t pid = getpid(), tid = syscall(SYS_gettid);
+
                 printf("\tChild will make one syscall\n");
-                raise(SIGSTOP);
+                syscall(SYS_tgkill, pid, tid, SIGSTOP);
 
                 syscall(SYS_gettid, 10, 11, 12, 13, 14, 15);
                 _exit(0);
@@ -301,9 +303,11 @@ static void test_restart_under_ptrace(void)
                 if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0)
                         err(1, "PTRACE_TRACEME");
 
+                pid_t pid = getpid(), tid = syscall(SYS_gettid);
+
                 printf("\tChild will take a nap until signaled\n");
                 setsigign(SIGUSR1, SA_RESTART);
-                raise(SIGSTOP);
+                syscall(SYS_tgkill, pid, tid, SIGSTOP);
 
                 syscall(SYS_pause, 0, 0, 0, 0, 0, 0);
                 _exit(0);