320 files changed, 2917 insertions, 1806 deletions

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 9871e649ffef..64a3bf54b974 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -3523,6 +3523,12 @@
         ramdisk_size=   [RAM] Sizes of RAM disks in kilobytes
                         See Documentation/blockdev/ramdisk.txt.
 
+        random.trust_cpu={on,off}
+                        [KNL] Enable or disable trusting the use of the
+                        CPU's random number generator (if available) to
+                        fully seed the kernel's CRNG. Default is controlled
+                        by CONFIG_RANDOM_TRUST_CPU.
+
         ras=option[,option,...] [KNL] RAS-specific options
 
                 cec_disable     [X86]
diff --git a/Documentation/devicetree/bindings/i2c/i2c-imx-lpi2c.txt b/Documentation/devicetree/bindings/i2c/i2c-imx-lpi2c.txt
index 00e4365d7206..091c8dfd3229 100644
--- a/Documentation/devicetree/bindings/i2c/i2c-imx-lpi2c.txt
+++ b/Documentation/devicetree/bindings/i2c/i2c-imx-lpi2c.txt
@@ -3,7 +3,6 @@
 Required properties:
 - compatible :
   - "fsl,imx7ulp-lpi2c" for LPI2C compatible with the one integrated on i.MX7ULP soc
-  - "fsl,imx8dv-lpi2c" for LPI2C compatible with the one integrated on i.MX8DV soc
 - reg : address and length of the lpi2c master registers
 - interrupts : lpi2c interrupt
 - clocks : lpi2c clock specifier
@@ -11,7 +10,7 @@ Required properties:
 Examples:
 
 lpi2c7: lpi2c7@40a50000 {
-        compatible = "fsl,imx8dv-lpi2c";
+        compatible = "fsl,imx7ulp-lpi2c";
         reg = <0x40A50000 0x10000>;
         interrupt-parent = <&intc>;
         interrupts = <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>;
diff --git a/Documentation/process/changes.rst b/Documentation/process/changes.rst
index 61f918b10a0c..d1bf143b446f 100644
--- a/Documentation/process/changes.rst
+++ b/Documentation/process/changes.rst
@@ -86,7 +86,7 @@ pkg-config
 
 The build system, as of 4.18, requires pkg-config to check for installed
 kconfig tools and to determine flags settings for use in
-'make {menu,n,g,x}config'.  Previously pkg-config was being used but not
+'make {g,x}config'.  Previously pkg-config was being used but not
 verified or documented.
 
 Flex
diff --git a/Documentation/scsi/scsi-parameters.txt b/Documentation/scsi/scsi-parameters.txt
index 25a4b4cf04a6..92999d4e0cb8 100644
--- a/Documentation/scsi/scsi-parameters.txt
+++ b/Documentation/scsi/scsi-parameters.txt
@@ -97,6 +97,11 @@ parameters may be changed at runtime by the command
                         allowing boot to proceed.  none ignores them, expecting
                         user space to do the scan.
 
+        scsi_mod.use_blk_mq=
+                        [SCSI] use blk-mq I/O path by default
+                        See SCSI_MQ_DEFAULT in drivers/scsi/Kconfig.
+                        Format: <y/n>
+
         sim710=         [SCSI,HW]
                         See header of drivers/scsi/sim710.c.
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 9ad052aeac39..d870cb57c887 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2311,6 +2311,7 @@ F:	drivers/clocksource/cadence_ttc_timer.c
 F:      drivers/i2c/busses/i2c-cadence.c
 F:      drivers/mmc/host/sdhci-of-arasan.c
 F:      drivers/edac/synopsys_edac.c
+F:      drivers/i2c/busses/i2c-xiic.c
 
 ARM64 PORT (AARCH64 ARCHITECTURE)
 M:      Catalin Marinas <catalin.marinas@arm.com>
diff --git a/Makefile b/Makefile
index 19948e556941..4d5c883a98e5 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 4
 PATCHLEVEL = 19
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc3
 NAME = Merciless Moray
 
 # *DOCUMENTATION*
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index 6d5eb8267e42..b4441b0764d7 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -9,6 +9,7 @@
 config ARC
         def_bool y
         select ARC_TIMERS
+        select ARCH_HAS_PTE_SPECIAL
         select ARCH_HAS_SYNC_DMA_FOR_CPU
         select ARCH_HAS_SYNC_DMA_FOR_DEVICE
         select ARCH_HAS_SG_CHAIN
@@ -28,8 +29,12 @@ config ARC
         select GENERIC_SMP_IDLE_THREAD
         select HAVE_ARCH_KGDB
         select HAVE_ARCH_TRACEHOOK
+        select HAVE_DEBUG_STACKOVERFLOW
         select HAVE_FUTEX_CMPXCHG if FUTEX
+        select HAVE_GENERIC_DMA_COHERENT
         select HAVE_IOREMAP_PROT
+        select HAVE_KERNEL_GZIP
+        select HAVE_KERNEL_LZMA
         select HAVE_KPROBES
         select HAVE_KRETPROBES
         select HAVE_MEMBLOCK
@@ -44,11 +49,6 @@ config ARC
         select OF_EARLY_FLATTREE
         select OF_RESERVED_MEM
         select PERF_USE_VMALLOC if ARC_CACHE_VIPT_ALIASING
-        select HAVE_DEBUG_STACKOVERFLOW
-        select HAVE_GENERIC_DMA_COHERENT
-        select HAVE_KERNEL_GZIP
-        select HAVE_KERNEL_LZMA
-        select ARCH_HAS_PTE_SPECIAL
 
 config ARCH_HAS_CACHE_LINE_SIZE
         def_bool y
diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index fb026196aaab..99cce77ab98f 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -43,10 +43,7 @@ ifdef CONFIG_ARC_CURR_IN_REG
 LINUXINCLUDE    +=  -include ${src}/arch/arc/include/asm/current.h
 endif
 
-upto_gcc44    :=  $(call cc-ifversion, -le, 0404, y)
-atleast_gcc44 :=  $(call cc-ifversion, -ge, 0404, y)
-
-cflags-$(atleast_gcc44)                 += -fsection-anchors
+cflags-y                                += -fsection-anchors
 
 cflags-$(CONFIG_ARC_HAS_LLSC)           += -mlock
 cflags-$(CONFIG_ARC_HAS_SWAPE)          += -mswape
@@ -82,11 +79,6 @@ cflags-$(disable_small_data)		+= -mno-sdata -fcall-used-gp
 cflags-$(CONFIG_CPU_BIG_ENDIAN)         += -mbig-endian
 ldflags-$(CONFIG_CPU_BIG_ENDIAN)        += -EB
 
-# STAR 9000518362: (fixed with binutils shipping with gcc 4.8)
-# arc-linux-uclibc-ld (buildroot) or arceb-elf32-ld (EZChip) don't accept
-# --build-id w/o "-marclinux". Default arc-elf32-ld is OK
-ldflags-$(upto_gcc44)                   += -marclinux
-
 LIBGCC  := $(shell $(CC) $(cflags-y) --print-libgcc-file-name)
 
 # Modules with short calls might break for calls into builtin-kernel
diff --git a/arch/arc/boot/dts/axc003.dtsi b/arch/arc/boot/dts/axc003.dtsi
index dc91c663bcc0..d75d65ddf8e3 100644
--- a/arch/arc/boot/dts/axc003.dtsi
+++ b/arch/arc/boot/dts/axc003.dtsi
@@ -94,6 +94,32 @@
         };
 
         /*
+         * Mark DMA peripherals connected via IOC port as dma-coherent. We do
+         * it via overlay because peripherals defined in axs10x_mb.dtsi are
+         * used for both AXS101 and AXS103 boards and only AXS103 has IOC (so
+         * only AXS103 board has HW-coherent DMA peripherals)
+         * We don't need to mark pgu@17000 as dma-coherent because it uses
+         * external DMA buffer located outside of IOC aperture.
+         */
+        axs10x_mb {
+                ethernet@0x18000 {
+                        dma-coherent;
+                };
+
+                ehci@0x40000 {
+                        dma-coherent;
+                };
+
+                ohci@0x60000 {
+                        dma-coherent;
+                };
+
+                mmc@0x15000 {
+                        dma-coherent;
+                };
+        };
+
+        /*
          * The DW APB ICTL intc on MB is connected to CPU intc via a
          * DT "invisible" DW APB GPIO block, configured to simply pass thru
          * interrupts - setup accordinly in platform init (plat-axs10x/ax10x.c)
diff --git a/arch/arc/boot/dts/axc003_idu.dtsi b/arch/arc/boot/dts/axc003_idu.dtsi
index 69ff4895f2ba..a05bb737ea63 100644
--- a/arch/arc/boot/dts/axc003_idu.dtsi
+++ b/arch/arc/boot/dts/axc003_idu.dtsi
@@ -101,6 +101,32 @@
         };
 
         /*
+         * Mark DMA peripherals connected via IOC port as dma-coherent. We do
+         * it via overlay because peripherals defined in axs10x_mb.dtsi are
+         * used for both AXS101 and AXS103 boards and only AXS103 has IOC (so
+         * only AXS103 board has HW-coherent DMA peripherals)
+         * We don't need to mark pgu@17000 as dma-coherent because it uses
+         * external DMA buffer located outside of IOC aperture.
+         */
+        axs10x_mb {
+                ethernet@0x18000 {
+                        dma-coherent;
+                };
+
+                ehci@0x40000 {
+                        dma-coherent;
+                };
+
+                ohci@0x60000 {
+                        dma-coherent;
+                };
+
+                mmc@0x15000 {
+                        dma-coherent;
+                };
+        };
+
+        /*
          * This INTC is actually connected to DW APB GPIO
          * which acts as a wire between MB INTC and CPU INTC.
          * GPIO INTC is configured in platform init code
diff --git a/arch/arc/boot/dts/axs10x_mb.dtsi b/arch/arc/boot/dts/axs10x_mb.dtsi
index 47b74fbc403c..37bafd44e36d 100644
--- a/arch/arc/boot/dts/axs10x_mb.dtsi
+++ b/arch/arc/boot/dts/axs10x_mb.dtsi
@@ -9,6 +9,10 @@
  */
 
 / {
+        aliases {
+                ethernet = &gmac;
+        };
+
         axs10x_mb {
                 compatible = "simple-bus";
                 #address-cells = <1>;
@@ -68,7 +72,7 @@
                         };
                 };
 
-                ethernet@0x18000 {
+                gmac: ethernet@0x18000 {
                         #interrupt-cells = <1>;
                         compatible = "snps,dwmac";
                         reg = < 0x18000 0x2000 >;
@@ -81,6 +85,7 @@
                         max-speed = <100>;
                         resets = <&creg_rst 5>;
                         reset-names = "stmmaceth";
+                        mac-address = [00 00 00 00 00 00]; /* Filled in by U-Boot */
                 };
 
                 ehci@0x40000 {
diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts
index 006aa3de5348..ef149f59929a 100644
--- a/arch/arc/boot/dts/hsdk.dts
+++ b/arch/arc/boot/dts/hsdk.dts
@@ -25,6 +25,10 @@
                 bootargs = "earlycon=uart8250,mmio32,0xf0005000,115200n8 console=ttyS0,115200n8 debug print-fatal-signals=1";
         };
 
+        aliases {
+                ethernet = &gmac;
+        };
+
         cpus {
                 #address-cells = <1>;
                 #size-cells = <0>;
@@ -163,7 +167,7 @@
                         #clock-cells = <0>;
                 };
 
-                ethernet@8000 {
+                gmac: ethernet@8000 {
                         #interrupt-cells = <1>;
                         compatible = "snps,dwmac";
                         reg = <0x8000 0x2000>;
@@ -176,6 +180,8 @@
                         phy-handle = <&phy0>;
                         resets = <&cgu_rst HSDK_ETH_RESET>;
                         reset-names = "stmmaceth";
+                        mac-address = [00 00 00 00 00 00]; /* Filled in by U-Boot */
+                        dma-coherent;
 
                         mdio {
                                 #address-cells = <1>;
@@ -194,12 +200,14 @@
                         compatible = "snps,hsdk-v1.0-ohci", "generic-ohci";
                         reg = <0x60000 0x100>;
                         interrupts = <15>;
+                        dma-coherent;
                 };
 
                 ehci@40000 {
                         compatible = "snps,hsdk-v1.0-ehci", "generic-ehci";
                         reg = <0x40000 0x100>;
                         interrupts = <15>;
+                        dma-coherent;
                 };
 
                 mmc@a000 {
@@ -212,6 +220,7 @@
                         clock-names = "biu", "ciu";
                         interrupts = <12>;
                         bus-width = <4>;
+                        dma-coherent;
                 };
         };
 
diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig
index a635ea972304..41bc08be6a3b 100644
--- a/arch/arc/configs/axs101_defconfig
+++ b/arch/arc/configs/axs101_defconfig
@@ -1,5 +1,3 @@
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
-# CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set
@@ -63,7 +61,6 @@ CONFIG_MOUSE_PS2_TOUCHKIT=y
 CONFIG_MOUSE_SERIAL=y
 CONFIG_MOUSE_SYNAPTICS_USB=y
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_DW=y
diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig
index aa507e423075..1e1c4a8011b5 100644
--- a/arch/arc/configs/axs103_defconfig
+++ b/arch/arc/configs/axs103_defconfig
@@ -1,5 +1,3 @@
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
-# CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set
@@ -64,7 +62,6 @@ CONFIG_MOUSE_PS2_TOUCHKIT=y
 CONFIG_MOUSE_SERIAL=y
 CONFIG_MOUSE_SYNAPTICS_USB=y
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_DW=y
diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig
index eba07f468654..6b0c0cfd5c30 100644
--- a/arch/arc/configs/axs103_smp_defconfig
+++ b/arch/arc/configs/axs103_smp_defconfig
@@ -1,5 +1,3 @@
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
-# CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set
@@ -65,7 +63,6 @@ CONFIG_MOUSE_PS2_TOUCHKIT=y
 CONFIG_MOUSE_SERIAL=y
 CONFIG_MOUSE_SYNAPTICS_USB=y
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_DW=y
diff --git a/arch/arc/configs/haps_hs_defconfig b/arch/arc/configs/haps_hs_defconfig
index 098b19fbaa51..240dd2cd5148 100644
--- a/arch/arc/configs/haps_hs_defconfig
+++ b/arch/arc/configs/haps_hs_defconfig
@@ -1,4 +1,3 @@
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -57,7 +56,6 @@ CONFIG_MOUSE_PS2_TOUCHKIT=y
 # CONFIG_SERIO_SERPORT is not set
 CONFIG_SERIO_ARC_PS2=y
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=1
diff --git a/arch/arc/configs/haps_hs_smp_defconfig b/arch/arc/configs/haps_hs_smp_defconfig
index 0104c404d897..14ae7e5acc7c 100644
--- a/arch/arc/configs/haps_hs_smp_defconfig
+++ b/arch/arc/configs/haps_hs_smp_defconfig
@@ -1,4 +1,3 @@
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -60,7 +59,6 @@ CONFIG_MOUSE_PS2_TOUCHKIT=y
 # CONFIG_SERIO_SERPORT is not set
 CONFIG_SERIO_ARC_PS2=y
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=1
diff --git a/arch/arc/configs/hsdk_defconfig b/arch/arc/configs/hsdk_defconfig
index 6491be0ddbc9..1dec2b4bc5e6 100644
--- a/arch/arc/configs/hsdk_defconfig
+++ b/arch/arc/configs/hsdk_defconfig
@@ -1,4 +1,3 @@
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 CONFIG_SYSVIPC=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set
 CONFIG_NO_HZ_IDLE=y
diff --git a/arch/arc/configs/nps_defconfig b/arch/arc/configs/nps_defconfig
index 7c9c706ae7f6..31ba224bbfb4 100644
--- a/arch/arc/configs/nps_defconfig
+++ b/arch/arc/configs/nps_defconfig
@@ -59,7 +59,6 @@ CONFIG_NETCONSOLE=y
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=1
diff --git a/arch/arc/configs/nsim_700_defconfig b/arch/arc/configs/nsim_700_defconfig
index 99e05cf63fca..8e0b8b134cd9 100644
--- a/arch/arc/configs/nsim_700_defconfig
+++ b/arch/arc/configs/nsim_700_defconfig
@@ -1,5 +1,4 @@
 # CONFIG_LOCALVERSION_AUTO is not set
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -44,7 +43,6 @@ CONFIG_LXT_PHY=y
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_ARC=y
 CONFIG_SERIAL_ARC_CONSOLE=y
 # CONFIG_HW_RANDOM is not set
diff --git a/arch/arc/configs/nsim_hs_defconfig b/arch/arc/configs/nsim_hs_defconfig
index 0dc4f9b737e7..739b90e5e893 100644
--- a/arch/arc/configs/nsim_hs_defconfig
+++ b/arch/arc/configs/nsim_hs_defconfig
@@ -1,5 +1,4 @@
 # CONFIG_LOCALVERSION_AUTO is not set
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -45,7 +44,6 @@ CONFIG_DEVTMPFS=y
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_ARC=y
 CONFIG_SERIAL_ARC_CONSOLE=y
 # CONFIG_HW_RANDOM is not set
diff --git a/arch/arc/configs/nsim_hs_smp_defconfig b/arch/arc/configs/nsim_hs_smp_defconfig
index be3c30a15e54..b5895bdf3a93 100644
--- a/arch/arc/configs/nsim_hs_smp_defconfig
+++ b/arch/arc/configs/nsim_hs_smp_defconfig
@@ -1,5 +1,4 @@
 # CONFIG_LOCALVERSION_AUTO is not set
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
 # CONFIG_CROSS_MEMORY_ATTACH is not set
 CONFIG_HIGH_RES_TIMERS=y
@@ -44,7 +43,6 @@ CONFIG_DEVTMPFS=y
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_ARC=y
 CONFIG_SERIAL_ARC_CONSOLE=y
 # CONFIG_HW_RANDOM is not set
diff --git a/arch/arc/configs/nsimosci_defconfig b/arch/arc/configs/nsimosci_defconfig
index 3a74b9b21772..f14eeff7d308 100644
--- a/arch/arc/configs/nsimosci_defconfig
+++ b/arch/arc/configs/nsimosci_defconfig
@@ -1,5 +1,4 @@
 # CONFIG_LOCALVERSION_AUTO is not set
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set
@@ -48,7 +47,6 @@ CONFIG_MOUSE_PS2_TOUCHKIT=y
 # CONFIG_SERIO_SERPORT is not set
 CONFIG_SERIO_ARC_PS2=y
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=1
diff --git a/arch/arc/configs/nsimosci_hs_defconfig b/arch/arc/configs/nsimosci_hs_defconfig
index ea2834b4dc1d..025298a48305 100644
--- a/arch/arc/configs/nsimosci_hs_defconfig
+++ b/arch/arc/configs/nsimosci_hs_defconfig
@@ -1,5 +1,4 @@
 # CONFIG_LOCALVERSION_AUTO is not set
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set
@@ -47,7 +46,6 @@ CONFIG_MOUSE_PS2_TOUCHKIT=y
 # CONFIG_SERIO_SERPORT is not set
 CONFIG_SERIO_ARC_PS2=y
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=1
diff --git a/arch/arc/configs/nsimosci_hs_smp_defconfig b/arch/arc/configs/nsimosci_hs_smp_defconfig
index 80a5a1b4924b..df7b77b13b82 100644
--- a/arch/arc/configs/nsimosci_hs_smp_defconfig
+++ b/arch/arc/configs/nsimosci_hs_smp_defconfig
@@ -1,4 +1,3 @@
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set
@@ -58,7 +57,6 @@ CONFIG_MOUSE_PS2_TOUCHKIT=y
 # CONFIG_SERIO_SERPORT is not set
 CONFIG_SERIO_ARC_PS2=y
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=1
diff --git a/arch/arc/configs/tb10x_defconfig b/arch/arc/configs/tb10x_defconfig
index 2cc87f909747..a7f65313f84a 100644
--- a/arch/arc/configs/tb10x_defconfig
+++ b/arch/arc/configs/tb10x_defconfig
@@ -57,7 +57,6 @@ CONFIG_STMMAC_ETH=y
 # CONFIG_SERIO is not set
 # CONFIG_VT is not set
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=1
diff --git a/arch/arc/configs/vdk_hs38_defconfig b/arch/arc/configs/vdk_hs38_defconfig
index f629493929ea..db47c3541f15 100644
--- a/arch/arc/configs/vdk_hs38_defconfig
+++ b/arch/arc/configs/vdk_hs38_defconfig
@@ -1,5 +1,4 @@
 # CONFIG_LOCALVERSION_AUTO is not set
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_CROSS_MEMORY_ATTACH is not set
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_IKCONFIG=y
@@ -53,7 +52,6 @@ CONFIG_NATIONAL_PHY=y
 CONFIG_MOUSE_PS2_TOUCHKIT=y
 CONFIG_SERIO_ARC_PS2=y
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_DW=y
diff --git a/arch/arc/configs/vdk_hs38_smp_defconfig b/arch/arc/configs/vdk_hs38_smp_defconfig
index 21f0ca26a05d..a8ac5e917d9a 100644
--- a/arch/arc/configs/vdk_hs38_smp_defconfig
+++ b/arch/arc/configs/vdk_hs38_smp_defconfig
@@ -1,5 +1,4 @@
 # CONFIG_LOCALVERSION_AUTO is not set
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_CROSS_MEMORY_ATTACH is not set
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_IKCONFIG=y
diff --git a/arch/arc/include/asm/atomic.h b/arch/arc/include/asm/atomic.h
index 4e0072730241..158af079838d 100644
--- a/arch/arc/include/asm/atomic.h
+++ b/arch/arc/include/asm/atomic.h
@@ -84,7 +84,7 @@ static inline int atomic_fetch_##op(int i, atomic_t *v)			\
         "1:     llock   %[orig], [%[ctr]]               \n"             \
         "       " #asm_op " %[val], %[orig], %[i]       \n"             \
         "       scond   %[val], [%[ctr]]                \n"             \
-        "                                               \n"             \
+        "       bnz     1b                              \n"             \
         : [val] "=&r"   (val),                                          \
           [orig] "=&r" (orig)                                           \
         : [ctr] "r"     (&v->counter),                                  \
diff --git a/arch/arc/include/asm/dma-mapping.h b/arch/arc/include/asm/dma-mapping.h
new file mode 100644
index 000000000000..c946c0a83e76
--- /dev/null
+++ b/arch/arc/include/asm/dma-mapping.h
@@ -0,0 +1,13 @@
+// SPDX-License-Identifier:  GPL-2.0
+// (C) 2018 Synopsys, Inc. (www.synopsys.com)
+
+#ifndef ASM_ARC_DMA_MAPPING_H
+#define ASM_ARC_DMA_MAPPING_H
+
+#include <asm-generic/dma-mapping.h>
+
+void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
+                        const struct iommu_ops *iommu, bool coherent);
+#define arch_setup_dma_ops arch_setup_dma_ops
+
+#endif
diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c
index 783b20354f8b..e8d9fb452346 100644
--- a/arch/arc/kernel/troubleshoot.c
+++ b/arch/arc/kernel/troubleshoot.c
@@ -83,9 +83,6 @@ done:
 static void show_faulting_vma(unsigned long address, char *buf)
 {
         struct vm_area_struct *vma;
-        struct inode *inode;
-        unsigned long ino = 0;
-        dev_t dev = 0;
         char *nm = buf;
         struct mm_struct *active_mm = current->active_mm;
 
@@ -99,12 +96,10 @@ static void show_faulting_vma(unsigned long address, char *buf)
          * if the container VMA is not found
          */
         if (vma && (vma->vm_start <= address)) {
-                struct file *file = vma->vm_file;
-                if (file) {
-                        nm = file_path(file, buf, PAGE_SIZE - 1);
-                        inode = file_inode(vma->vm_file);
-                        dev = inode->i_sb->s_dev;
-                        ino = inode->i_ino;
+                if (vma->vm_file) {
+                        nm = file_path(vma->vm_file, buf, PAGE_SIZE - 1);
+                        if (IS_ERR(nm))
+                                nm = "?";
                 }
                 pr_info("    @off 0x%lx in [%s]\n"
                         "    VMA: 0x%08lx to 0x%08lx\n",
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index 25c631942500..f2701c13a66b 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -65,7 +65,7 @@ char *arc_cache_mumbojumbo(int c, char *buf, int len)
 
         n += scnprintf(buf + n, len - n, "Peripherals\t: %#lx%s%s\n",
                        perip_base,
-                       IS_AVAIL3(ioc_exists, ioc_enable, ", IO-Coherency "));
+                       IS_AVAIL3(ioc_exists, ioc_enable, ", IO-Coherency (per-device) "));
 
         return buf;
 }
@@ -897,15 +897,6 @@ static void __dma_cache_wback_slc(phys_addr_t start, unsigned long sz)
 }
 
 /*
- * DMA ops for systems with IOC
- * IOC hardware snoops all DMA traffic keeping the caches consistent with
- * memory - eliding need for any explicit cache maintenance of DMA buffers
- */
-static void __dma_cache_wback_inv_ioc(phys_addr_t start, unsigned long sz) {}
-static void __dma_cache_inv_ioc(phys_addr_t start, unsigned long sz) {}
-static void __dma_cache_wback_ioc(phys_addr_t start, unsigned long sz) {}
-
-/*
  * Exported DMA API
  */
 void dma_cache_wback_inv(phys_addr_t start, unsigned long sz)
@@ -1153,6 +1144,19 @@ noinline void __init arc_ioc_setup(void)
 {
         unsigned int ioc_base, mem_sz;
 
+        /*
+         * As for today we don't support both IOC and ZONE_HIGHMEM enabled
+         * simultaneously. This happens because as of today IOC aperture covers
+         * only ZONE_NORMAL (low mem) and any dma transactions outside this
+         * region won't be HW coherent.
+         * If we want to use both IOC and ZONE_HIGHMEM we can use
+         * bounce_buffer to handle dma transactions to HIGHMEM.
+         * Also it is possible to modify dma_direct cache ops or increase IOC
+         * aperture size if we are planning to use HIGHMEM without PAE.
+         */
+        if (IS_ENABLED(CONFIG_HIGHMEM))
+                panic("IOC and HIGHMEM can't be used simultaneously");
+
         /* Flush + invalidate + disable L1 dcache */
         __dc_disable();
 
@@ -1264,11 +1268,7 @@ void __init arc_cache_init_master(void)
         if (is_isa_arcv2() && ioc_enable)
                 arc_ioc_setup();
 
-        if (is_isa_arcv2() && ioc_enable) {
-                __dma_cache_wback_inv = __dma_cache_wback_inv_ioc;
-                __dma_cache_inv = __dma_cache_inv_ioc;
-                __dma_cache_wback = __dma_cache_wback_ioc;
-        } else if (is_isa_arcv2() && l2_line_sz && slc_enable) {
+        if (is_isa_arcv2() && l2_line_sz && slc_enable) {
                 __dma_cache_wback_inv = __dma_cache_wback_inv_slc;
                 __dma_cache_inv = __dma_cache_inv_slc;
                 __dma_cache_wback = __dma_cache_wback_slc;
@@ -1277,6 +1277,12 @@ void __init arc_cache_init_master(void)
                 __dma_cache_inv = __dma_cache_inv_l1;
                 __dma_cache_wback = __dma_cache_wback_l1;
         }
+        /*
+         * In case of IOC (say IOC+SLC case), pointers above could still be set
+         * but end up not being relevant as the first function in chain is not
+         * called at all for @dma_direct_ops
+         *     arch_sync_dma_for_cpu() -> dma_cache_*() -> __dma_cache_*()
+         */
 }
 
 void __ref arc_cache_init(void)
diff --git a/arch/arc/mm/dma.c b/arch/arc/mm/dma.c
index ec47e6079f5d..c75d5c3470e3 100644
--- a/arch/arc/mm/dma.c
+++ b/arch/arc/mm/dma.c
@@ -6,20 +6,17 @@
  * published by the Free Software Foundation.
  */
 
-/*
- * DMA Coherent API Notes
- *
- * I/O is inherently non-coherent on ARC. So a coherent DMA buffer is
- * implemented by accessing it using a kernel virtual address, with
- * Cache bit off in the TLB entry.
- *
- * The default DMA address == Phy address which is 0x8000_0000 based.
- */
-
 #include <linux/dma-noncoherent.h>
 #include <asm/cache.h>
 #include <asm/cacheflush.h>
 
+/*
+ * ARCH specific callbacks for generic noncoherent DMA ops (dma/noncoherent.c)
+ *  - hardware IOC not available (or "dma-coherent" not set for device in DT)
+ *  - But still handle both coherent and non-coherent requests from caller
+ *
+ * For DMA coherent hardware (IOC) generic code suffices
+ */
 void *arch_dma_alloc(struct device *dev, size_t size, dma_addr_t *dma_handle,
                 gfp_t gfp, unsigned long attrs)
 {
@@ -27,42 +24,29 @@ void *arch_dma_alloc(struct device *dev, size_t size, dma_addr_t *dma_handle,
         struct page *page;
         phys_addr_t paddr;
         void *kvaddr;
-        int need_coh = 1, need_kvaddr = 0;
-
-        page = alloc_pages(gfp, order);
-        if (!page)
-                return NULL;
+        bool need_coh = !(attrs & DMA_ATTR_NON_CONSISTENT);
 
         /*
-         * IOC relies on all data (even coherent DMA data) being in cache
-         * Thus allocate normal cached memory
-         *
-         * The gains with IOC are two pronged:
-         *   -For streaming data, elides need for cache maintenance, saving
-         *    cycles in flush code, and bus bandwidth as all the lines of a
-         *    buffer need to be flushed out to memory
-         *   -For coherent data, Read/Write to buffers terminate early in cache
-         *   (vs. always going to memory - thus are faster)
+         * __GFP_HIGHMEM flag is cleared by upper layer functions
+         * (in include/linux/dma-mapping.h) so we should never get a
+         * __GFP_HIGHMEM here.
          */
-        if ((is_isa_arcv2() && ioc_enable) ||
-            (attrs & DMA_ATTR_NON_CONSISTENT))
-                need_coh = 0;
+        BUG_ON(gfp & __GFP_HIGHMEM);
 
-        /*
-         * - A coherent buffer needs MMU mapping to enforce non-cachability
-         * - A highmem page needs a virtual handle (hence MMU mapping)
-         *   independent of cachability
-         */
-        if (PageHighMem(page) || need_coh)
-                need_kvaddr = 1;
+        page = alloc_pages(gfp, order);
+        if (!page)
+                return NULL;
 
         /* This is linear addr (0x8000_0000 based) */
         paddr = page_to_phys(page);
 
         *dma_handle = paddr;
 
-        /* This is kernel Virtual address (0x7000_0000 based) */
-        if (need_kvaddr) {
+        /*
+         * A coherent buffer needs MMU mapping to enforce non-cachability.
+         * kvaddr is kernel Virtual address (0x7000_0000 based).
+         */
+        if (need_coh) {
                 kvaddr = ioremap_nocache(paddr, size);
                 if (kvaddr == NULL) {
                         __free_pages(page, order);
@@ -93,12 +77,8 @@ void arch_dma_free(struct device *dev, size_t size, void *vaddr,
 {
         phys_addr_t paddr = dma_handle;
         struct page *page = virt_to_page(paddr);
-        int is_non_coh = 1;
-
-        is_non_coh = (attrs & DMA_ATTR_NON_CONSISTENT) ||
-                        (is_isa_arcv2() && ioc_enable);
 
-        if (PageHighMem(page) || !is_non_coh)
+        if (!(attrs & DMA_ATTR_NON_CONSISTENT))
                 iounmap((void __force __iomem *)vaddr);
 
         __free_pages(page, get_order(size));
@@ -185,3 +165,23 @@ void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr,
                 break;
         }
 }
+
+/*
+ * Plug in coherent or noncoherent dma ops
+ */
+void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
+                        const struct iommu_ops *iommu, bool coherent)
+{
+        /*
+         * IOC hardware snoops all DMA traffic keeping the caches consistent
+         * with memory - eliding need for any explicit cache maintenance of
+         * DMA buffers - so we can use dma_direct cache ops.
+         */
+        if (is_isa_arcv2() && ioc_enable && coherent) {
+                set_dma_ops(dev, &dma_direct_ops);
+                dev_info(dev, "use dma_direct_ops cache ops\n");
+        } else {
+                set_dma_ops(dev, &dma_noncoherent_ops);
+                dev_info(dev, "use dma_noncoherent_ops cache ops\n");
+        }
+}
diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h
index 79906cecb091..3ad482d2f1eb 100644
--- a/arch/arm/include/asm/kvm_host.h
+++ b/arch/arm/include/asm/kvm_host.h
@@ -223,7 +223,6 @@ int __kvm_arm_vcpu_set_events(struct kvm_vcpu *vcpu,
                               struct kvm_vcpu_events *events);
 
 #define KVM_ARCH_WANT_MMU_NOTIFIER
-int kvm_unmap_hva(struct kvm *kvm, unsigned long hva);
 int kvm_unmap_hva_range(struct kvm *kvm,
                         unsigned long start, unsigned long end);
 void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte);
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
index ceffc40810ee..48daec7f78ba 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
@@ -46,6 +46,7 @@
         pinctrl-0 = <&mmc0_pins>;
         vmmc-supply = <&reg_cldo1>;
         cd-gpios = <&pio 5 6 GPIO_ACTIVE_LOW>;
+        bus-width = <4>;
         status = "okay";
 };
 
@@ -56,6 +57,7 @@
         vqmmc-supply = <&reg_bldo2>;
         non-removable;
         cap-mmc-hw-reset;
+        bus-width = <8>;
         status = "okay";
 };
 
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index f26055f2306e..3d6d7336f871 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -61,8 +61,7 @@ struct kvm_arch {
         u64    vmid_gen;
         u32    vmid;
 
-        /* 1-level 2nd stage table and lock */
-        spinlock_t pgd_lock;
+        /* 1-level 2nd stage table, protected by kvm->mmu_lock */
         pgd_t *pgd;
 
         /* VTTBR value associated with above pgd and vmid */
@@ -357,7 +356,6 @@ int __kvm_arm_vcpu_set_events(struct kvm_vcpu *vcpu,
                               struct kvm_vcpu_events *events);
 
 #define KVM_ARCH_WANT_MMU_NOTIFIER
-int kvm_unmap_hva(struct kvm *kvm, unsigned long hva);
 int kvm_unmap_hva_range(struct kvm *kvm,
                         unsigned long start, unsigned long end);
 void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte);
diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
index d496ef579859..ca46153d7915 100644
--- a/arch/arm64/kvm/hyp/switch.c
+++ b/arch/arm64/kvm/hyp/switch.c
@@ -98,8 +98,10 @@ static void activate_traps_vhe(struct kvm_vcpu *vcpu)
         val = read_sysreg(cpacr_el1);
         val |= CPACR_EL1_TTA;
         val &= ~CPACR_EL1_ZEN;
-        if (!update_fp_enabled(vcpu))
+        if (!update_fp_enabled(vcpu)) {
                 val &= ~CPACR_EL1_FPEN;
+                __activate_traps_fpsimd32(vcpu);
+        }
 
         write_sysreg(val, cpacr_el1);
 
@@ -114,8 +116,10 @@ static void __hyp_text __activate_traps_nvhe(struct kvm_vcpu *vcpu)
 
         val = CPTR_EL2_DEFAULT;
         val |= CPTR_EL2_TTA | CPTR_EL2_TZ;
-        if (!update_fp_enabled(vcpu))
+        if (!update_fp_enabled(vcpu)) {
                 val |= CPTR_EL2_TFP;
+                __activate_traps_fpsimd32(vcpu);
+        }
 
         write_sysreg(val, cptr_el2);
 }
@@ -129,7 +133,6 @@ static void __hyp_text __activate_traps(struct kvm_vcpu *vcpu)
         if (cpus_have_const_cap(ARM64_HAS_RAS_EXTN) && (hcr & HCR_VSE))
                 write_sysreg_s(vcpu->arch.vsesr_el2, SYS_VSESR_EL2);
 
-        __activate_traps_fpsimd32(vcpu);
         if (has_vhe())
                 activate_traps_vhe(vcpu);
         else
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 65f86271f02b..8080c9f489c3 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -985,8 +985,9 @@ int pmd_free_pte_page(pmd_t *pmdp, unsigned long addr)
 
         pmd = READ_ONCE(*pmdp);
 
-        /* No-op for empty entry and WARN_ON for valid entry */
-        if (!pmd_present(pmd) || !pmd_table(pmd)) {
+        if (!pmd_present(pmd))
+                return 1;
+        if (!pmd_table(pmd)) {
                 VM_WARN_ON(!pmd_table(pmd));
                 return 1;
         }
@@ -1007,8 +1008,9 @@ int pud_free_pmd_page(pud_t *pudp, unsigned long addr)
 
         pud = READ_ONCE(*pudp);
 
-        /* No-op for empty entry and WARN_ON for valid entry */
-        if (!pud_present(pud) || !pud_table(pud)) {
+        if (!pud_present(pud))
+                return 1;
+        if (!pud_table(pud)) {
                 VM_WARN_ON(!pud_table(pud));
                 return 1;
         }
diff --git a/arch/m68k/mm/mcfmmu.c b/arch/m68k/mm/mcfmmu.c
index 70dde040779b..f5453d944ff5 100644
--- a/arch/m68k/mm/mcfmmu.c
+++ b/arch/m68k/mm/mcfmmu.c
@@ -172,7 +172,7 @@ void __init cf_bootmem_alloc(void)
         high_memory = (void *)_ramend;
 
         /* Reserve kernel text/data/bss */
-        memblock_reserve(memstart, memstart - _rambase);
+        memblock_reserve(_rambase, memstart - _rambase);
 
         m68k_virt_to_node_shift = fls(_ramend - 1) - 6;
         module_fixup(NULL, __start_fixup, __stop_fixup);
diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h
index a9af1d2dcd69..2c1c53d12179 100644
--- a/arch/mips/include/asm/kvm_host.h
+++ b/arch/mips/include/asm/kvm_host.h
@@ -931,7 +931,6 @@ enum kvm_mips_fault_result kvm_trap_emul_gva_fault(struct kvm_vcpu *vcpu,
                                                    bool write);
 
 #define KVM_ARCH_WANT_MMU_NOTIFIER
-int kvm_unmap_hva(struct kvm *kvm, unsigned long hva);
 int kvm_unmap_hva_range(struct kvm *kvm,
                         unsigned long start, unsigned long end);
 void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte);
diff --git a/arch/mips/include/asm/mach-lantiq/xway/xway_dma.h b/arch/mips/include/asm/mach-lantiq/xway/xway_dma.h
index 4901833498f7..8441b2698e64 100644
--- a/arch/mips/include/asm/mach-lantiq/xway/xway_dma.h
+++ b/arch/mips/include/asm/mach-lantiq/xway/xway_dma.h
@@ -40,6 +40,7 @@ struct ltq_dma_channel {
         int desc;                       /* the current descriptor */
         struct ltq_dma_desc *desc_base; /* the descriptor base */
         int phys;                       /* physical addr */
+        struct device *dev;
 };
 
 enum {
diff --git a/arch/mips/kernel/vdso.c b/arch/mips/kernel/vdso.c
index 019035d7225c..8f845f6e5f42 100644
--- a/arch/mips/kernel/vdso.c
+++ b/arch/mips/kernel/vdso.c
@@ -13,6 +13,7 @@
 #include <linux/err.h>
 #include <linux/init.h>
 #include <linux/ioport.h>
+#include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
@@ -20,6 +21,7 @@
 
 #include <asm/abi.h>
 #include <asm/mips-cps.h>
+#include <asm/page.h>
 #include <asm/vdso.h>
 
 /* Kernel-provided data used by the VDSO. */
@@ -128,12 +130,30 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
         vvar_size = gic_size + PAGE_SIZE;
         size = vvar_size + image->size;
 
+        /*
+         * Find a region that's large enough for us to perform the
+         * colour-matching alignment below.
+         */
+        if (cpu_has_dc_aliases)
+                size += shm_align_mask + 1;
+
         base = get_unmapped_area(NULL, 0, size, 0, 0);
         if (IS_ERR_VALUE(base)) {
                 ret = base;
                 goto out;
         }
 
+        /*
+         * If we suffer from dcache aliasing, ensure that the VDSO data page
+         * mapping is coloured the same as the kernel's mapping of that memory.
+         * This ensures that when the kernel updates the VDSO data userland
+         * will observe it without requiring cache invalidations.
+         */
+        if (cpu_has_dc_aliases) {
+                base = __ALIGN_MASK(base, shm_align_mask);
+                base += ((unsigned long)&vdso_data - gic_size) & shm_align_mask;
+        }
+
         data_addr = base + gic_size;
         vdso_addr = data_addr + PAGE_SIZE;
 
diff --git a/arch/mips/kvm/mmu.c b/arch/mips/kvm/mmu.c
index ee64db032793..d8dcdb350405 100644
--- a/arch/mips/kvm/mmu.c
+++ b/arch/mips/kvm/mmu.c
@@ -512,16 +512,6 @@ static int kvm_unmap_hva_handler(struct kvm *kvm, gfn_t gfn, gfn_t gfn_end,
         return 1;
 }
 
-int kvm_unmap_hva(struct kvm *kvm, unsigned long hva)
-{
-        unsigned long end = hva + PAGE_SIZE;
-
-        handle_hva_to_gpa(kvm, hva, end, &kvm_unmap_hva_handler, NULL);
-
-        kvm_mips_callbacks->flush_shadow_all(kvm);
-        return 0;
-}
-
 int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end)
 {
         handle_hva_to_gpa(kvm, start, end, &kvm_unmap_hva_handler, NULL);
diff --git a/arch/mips/lantiq/xway/dma.c b/arch/mips/lantiq/xway/dma.c
index 4b9fbb6744ad..664f2f7f55c1 100644
--- a/arch/mips/lantiq/xway/dma.c
+++ b/arch/mips/lantiq/xway/dma.c
@@ -130,7 +130,7 @@ ltq_dma_alloc(struct ltq_dma_channel *ch)
         unsigned long flags;
 
         ch->desc = 0;
-        ch->desc_base = dma_zalloc_coherent(NULL,
+        ch->desc_base = dma_zalloc_coherent(ch->dev,
                                 LTQ_DESC_NUM * LTQ_DESC_SIZE,
                                 &ch->phys, GFP_ATOMIC);
 
@@ -182,7 +182,7 @@ ltq_dma_free(struct ltq_dma_channel *ch)
         if (!ch->desc_base)
                 return;
         ltq_dma_close(ch);
-        dma_free_coherent(NULL, LTQ_DESC_NUM * LTQ_DESC_SIZE,
+        dma_free_coherent(ch->dev, LTQ_DESC_NUM * LTQ_DESC_SIZE,
                 ch->desc_base, ch->phys);
 }
 EXPORT_SYMBOL_GPL(ltq_dma_free);
diff --git a/arch/nds32/Kconfig b/arch/nds32/Kconfig
index 1d4248fa55e9..7068f341133d 100644
--- a/arch/nds32/Kconfig
+++ b/arch/nds32/Kconfig
@@ -40,6 +40,10 @@ config NDS32
         select NO_IOPORT_MAP
         select RTC_LIB
         select THREAD_INFO_IN_TASK
+        select HAVE_FUNCTION_TRACER
+        select HAVE_FUNCTION_GRAPH_TRACER
+        select HAVE_FTRACE_MCOUNT_RECORD
+        select HAVE_DYNAMIC_FTRACE
         help
           Andes(nds32) Linux support.
 
diff --git a/arch/nds32/Makefile b/arch/nds32/Makefile
index 63f4f173e5f4..3509fac10491 100644
--- a/arch/nds32/Makefile
+++ b/arch/nds32/Makefile
@@ -5,6 +5,10 @@ KBUILD_DEFCONFIG := defconfig
 
 comma = ,
 
+ifdef CONFIG_FUNCTION_TRACER
+arch-y += -malways-save-lp -mno-relax
+endif
+
 KBUILD_CFLAGS   += $(call cc-option, -mno-sched-prolog-epilog)
 KBUILD_CFLAGS   += -mcmodel=large
 
diff --git a/arch/nds32/include/asm/elf.h b/arch/nds32/include/asm/elf.h
index 56c479058802..f5f9cf7e0544 100644
--- a/arch/nds32/include/asm/elf.h
+++ b/arch/nds32/include/asm/elf.h
@@ -121,9 +121,9 @@ struct elf32_hdr;
  */
 #define ELF_CLASS       ELFCLASS32
 #ifdef __NDS32_EB__
-#define ELF_DATA        ELFDATA2MSB;
+#define ELF_DATA        ELFDATA2MSB
 #else
-#define ELF_DATA        ELFDATA2LSB;
+#define ELF_DATA        ELFDATA2LSB
 #endif
 #define ELF_ARCH        EM_NDS32
 #define USE_ELF_CORE_DUMP
diff --git a/arch/nds32/include/asm/ftrace.h b/arch/nds32/include/asm/ftrace.h
new file mode 100644
index 000000000000..2f96cc96aa35
--- /dev/null
+++ b/arch/nds32/include/asm/ftrace.h
@@ -0,0 +1,46 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#ifndef __ASM_NDS32_FTRACE_H
+#define __ASM_NDS32_FTRACE_H
+
+#ifdef CONFIG_FUNCTION_TRACER
+
+#define HAVE_FUNCTION_GRAPH_FP_TEST
+
+#define MCOUNT_ADDR ((unsigned long)(_mcount))
+/* mcount call is composed of three instructions:
+ * sethi + ori + jral
+ */
+#define MCOUNT_INSN_SIZE 12
+
+extern void _mcount(unsigned long parent_ip);
+
+#ifdef CONFIG_DYNAMIC_FTRACE
+
+#define FTRACE_ADDR ((unsigned long)_ftrace_caller)
+
+#ifdef __NDS32_EL__
+#define INSN_NOP                0x09000040
+#define INSN_SIZE(insn)         (((insn & 0x00000080) == 0) ? 4 : 2)
+#define IS_SETHI(insn)          ((insn & 0x000000fe) == 0x00000046)
+#define ENDIAN_CONVERT(insn)    be32_to_cpu(insn)
+#else /* __NDS32_EB__ */
+#define INSN_NOP                0x40000009
+#define INSN_SIZE(insn)         (((insn & 0x80000000) == 0) ? 4 : 2)
+#define IS_SETHI(insn)          ((insn & 0xfe000000) == 0x46000000)
+#define ENDIAN_CONVERT(insn)    (insn)
+#endif
+
+extern void _ftrace_caller(unsigned long parent_ip);
+static inline unsigned long ftrace_call_adjust(unsigned long addr)
+{
+        return addr;
+}
+struct dyn_arch_ftrace {
+};
+
+#endif /* CONFIG_DYNAMIC_FTRACE */
+
+#endif /* CONFIG_FUNCTION_TRACER */
+
+#endif /* __ASM_NDS32_FTRACE_H */
diff --git a/arch/nds32/include/asm/nds32.h b/arch/nds32/include/asm/nds32.h
index 19b19394a936..68c38151c3e4 100644
--- a/arch/nds32/include/asm/nds32.h
+++ b/arch/nds32/include/asm/nds32.h
@@ -17,6 +17,7 @@
 #else
 #define FP_OFFSET (-2)
 #endif
+#define LP_OFFSET (-1)
 
 extern void __init early_trap_init(void);
 static inline void GIE_ENABLE(void)
diff --git a/arch/nds32/include/asm/uaccess.h b/arch/nds32/include/asm/uaccess.h
index 18a009f3804d..362a32d9bd16 100644
--- a/arch/nds32/include/asm/uaccess.h
+++ b/arch/nds32/include/asm/uaccess.h
@@ -38,7 +38,7 @@ struct exception_table_entry {
 extern int fixup_exception(struct pt_regs *regs);
 
 #define KERNEL_DS       ((mm_segment_t) { ~0UL })
-#define USER_DS         ((mm_segment_t) {TASK_SIZE - 1})
+#define USER_DS         ((mm_segment_t) {TASK_SIZE - 1})
 
 #define get_ds()        (KERNEL_DS)
 #define get_fs()        (current_thread_info()->addr_limit)
@@ -49,11 +49,11 @@ static inline void set_fs(mm_segment_t fs)
         current_thread_info()->addr_limit = fs;
 }
 
-#define segment_eq(a, b)    ((a) == (b))
+#define segment_eq(a, b)        ((a) == (b))
 
 #define __range_ok(addr, size) (size <= get_fs() && addr <= (get_fs() -size))
 
-#define access_ok(type, addr, size)                 \
+#define access_ok(type, addr, size)     \
         __range_ok((unsigned long)addr, (unsigned long)size)
 /*
  * Single-value transfer routines.  They automatically use the right
@@ -75,70 +75,73 @@ static inline void set_fs(mm_segment_t fs)
  * versions are void (ie, don't return a value as such).
  */
 
-#define get_user(x,p)                                                   \
-({                                                                      \
-        long __e = -EFAULT;                                             \
-        if(likely(access_ok(VERIFY_READ,  p, sizeof(*p)))) {            \
-                __e = __get_user(x,p);                                  \
-        } else                                                          \
-                x = 0;                                                  \
-        __e;                                                            \
-})
-#define __get_user(x,ptr)                                               \
+#define get_user        __get_user                                      \
+
+#define __get_user(x, ptr)                                              \
 ({                                                                      \
         long __gu_err = 0;                                              \
-        __get_user_err((x),(ptr),__gu_err);                             \
+        __get_user_check((x), (ptr), __gu_err);                         \
         __gu_err;                                                       \
 })
 
-#define __get_user_error(x,ptr,err)                                     \
+#define __get_user_error(x, ptr, err)                                   \
 ({                                                                      \
-        __get_user_err((x),(ptr),err);                                  \
-        (void) 0;                                                       \
+        __get_user_check((x), (ptr), (err));                            \
+        (void)0;                                                        \
 })
 
-#define __get_user_err(x,ptr,err)                                       \
+#define __get_user_check(x, ptr, err)                                   \
+({                                                                      \
+        const __typeof__(*(ptr)) __user *__p = (ptr);                   \
+        might_fault();                                                  \
+        if (access_ok(VERIFY_READ, __p, sizeof(*__p))) {                \
+                __get_user_err((x), __p, (err));                        \
+        } else {                                                        \
+                (x) = 0; (err) = -EFAULT;                               \
+        }                                                               \
+})
+
+#define __get_user_err(x, ptr, err)                                     \
 do {                                                                    \
-        unsigned long __gu_addr = (unsigned long)(ptr);                 \
         unsigned long __gu_val;                                         \
         __chk_user_ptr(ptr);                                            \
         switch (sizeof(*(ptr))) {                                       \
         case 1:                                                         \
-                __get_user_asm("lbi",__gu_val,__gu_addr,err);           \
+                __get_user_asm("lbi", __gu_val, (ptr), (err));          \
                 break;                                                  \
         case 2:                                                         \
-                __get_user_asm("lhi",__gu_val,__gu_addr,err);           \
+                __get_user_asm("lhi", __gu_val, (ptr), (err));          \
                 break;                                                  \
         case 4:                                                         \
-                __get_user_asm("lwi",__gu_val,__gu_addr,err);           \
+                __get_user_asm("lwi", __gu_val, (ptr), (err));          \
                 break;                                                  \
         case 8:                                                         \
-                __get_user_asm_dword(__gu_val,__gu_addr,err);           \
+                __get_user_asm_dword(__gu_val, (ptr), (err));           \
                 break;                                                  \
         default:                                                        \
                 BUILD_BUG();                                            \
                 break;                                                  \
         }                                                               \
-        (x) = (__typeof__(*(ptr)))__gu_val;                             \
+        (x) = (__force __typeof__(*(ptr)))__gu_val;                     \
 } while (0)
 
-#define __get_user_asm(inst,x,addr,err)                                 \
-        asm volatile(                                                   \
-        "1:     "inst"  %1,[%2]\n"                                      \
-        "2:\n"                                                          \
-        "       .section .fixup,\"ax\"\n"                               \
-        "       .align  2\n"                                            \
-        "3:     move %0, %3\n"                                          \
-        "       move %1, #0\n"                                          \
-        "       b       2b\n"                                           \
-        "       .previous\n"                                            \
-        "       .section __ex_table,\"a\"\n"                            \
-        "       .align  3\n"                                            \
-        "       .long   1b, 3b\n"                                       \
-        "       .previous"                                              \
-        : "+r" (err), "=&r" (x)                                         \
-        : "r" (addr), "i" (-EFAULT)                                     \
-        : "cc")
+#define __get_user_asm(inst, x, addr, err)                              \
+        __asm__ __volatile__ (                                          \
+                "1:     "inst"  %1,[%2]\n"                              \
+                "2:\n"                                                  \
+                "       .section .fixup,\"ax\"\n"                       \
+                "       .align  2\n"                                    \
+                "3:     move %0, %3\n"                                  \
+                "       move %1, #0\n"                                  \
+                "       b       2b\n"                                   \
+                "       .previous\n"                                    \
+                "       .section __ex_table,\"a\"\n"                    \
+                "       .align  3\n"                                    \
+                "       .long   1b, 3b\n"                               \
+                "       .previous"                                      \
+                : "+r" (err), "=&r" (x)                                 \
+                : "r" (addr), "i" (-EFAULT)                             \
+                : "cc")
 
 #ifdef __NDS32_EB__
 #define __gu_reg_oper0 "%H1"
@@ -149,61 +152,66 @@ do {									\
 #endif
 
 #define __get_user_asm_dword(x, addr, err)                              \
-        asm volatile(                                                   \
-        "\n1:\tlwi " __gu_reg_oper0 ",[%2]\n"                           \
-        "\n2:\tlwi " __gu_reg_oper1 ",[%2+4]\n"                         \
-        "3:\n"                                                          \
-        "       .section .fixup,\"ax\"\n"                               \
-        "       .align  2\n"                                            \
-        "4:     move    %0, %3\n"                                       \
-        "       b       3b\n"                                           \
-        "       .previous\n"                                            \
-        "       .section __ex_table,\"a\"\n"                            \
-        "       .align  3\n"                                            \
-        "       .long   1b, 4b\n"                                       \
-        "       .long   2b, 4b\n"                                       \
-        "       .previous"                                              \
-        : "+r"(err), "=&r"(x)                                           \
-        : "r"(addr), "i"(-EFAULT)                                       \
-        : "cc")
-#define put_user(x,p)                                                   \
-({                                                                      \
-        long __e = -EFAULT;                                             \
-        if(likely(access_ok(VERIFY_WRITE,  p, sizeof(*p)))) {           \
-                __e = __put_user(x,p);                                  \
-        }                                                               \
-        __e;                                                            \
-})
-#define __put_user(x,ptr)                                               \
+        __asm__ __volatile__ (                                          \
+                "\n1:\tlwi " __gu_reg_oper0 ",[%2]\n"                   \
+                "\n2:\tlwi " __gu_reg_oper1 ",[%2+4]\n"                 \
+                "3:\n"                                                  \
+                "       .section .fixup,\"ax\"\n"                       \
+                "       .align  2\n"                                    \
+                "4:     move    %0, %3\n"                               \
+                "       b       3b\n"                                   \
+                "       .previous\n"                                    \
+                "       .section __ex_table,\"a\"\n"                    \
+                "       .align  3\n"                                    \
+                "       .long   1b, 4b\n"                               \
+                "       .long   2b, 4b\n"                               \
+                "       .previous"                                      \
+                : "+r"(err), "=&r"(x)                                   \
+                : "r"(addr), "i"(-EFAULT)                               \
+                : "cc")
+
+#define put_user        __put_user                                      \
+
+#define __put_user(x, ptr)                                              \
 ({                                                                      \
         long __pu_err = 0;                                              \
-        __put_user_err((x),(ptr),__pu_err);                             \
+        __put_user_err((x), (ptr), __pu_err);                           \
         __pu_err;                                                       \
 })
 
-#define __put_user_error(x,ptr,err)                                     \
+#define __put_user_error(x, ptr, err)                                   \
+({                                                                      \
+        __put_user_err((x), (ptr), (err));                              \
+        (void)0;                                                        \
+})
+
+#define __put_user_check(x, ptr, err)                                   \
 ({                                                                      \
-        __put_user_err((x),(ptr),err);                                  \
-        (void) 0;                                                       \
+        __typeof__(*(ptr)) __user *__p = (ptr);                         \
+        might_fault();                                                  \
+        if (access_ok(VERIFY_WRITE, __p, sizeof(*__p))) {               \
+                __put_user_err((x), __p, (err));                        \
+        } else  {                                                       \
+                (err) = -EFAULT;                                        \
+        }                                                               \
 })
 
-#define __put_user_err(x,ptr,err)                                       \
+#define __put_user_err(x, ptr, err)                                     \
 do {                                                                    \
-        unsigned long __pu_addr = (unsigned long)(ptr);                 \
         __typeof__(*(ptr)) __pu_val = (x);                              \
         __chk_user_ptr(ptr);                                            \
         switch (sizeof(*(ptr))) {                                       \
         case 1:                                                         \
-                __put_user_asm("sbi",__pu_val,__pu_addr,err);           \
+                __put_user_asm("sbi", __pu_val, (ptr), (err));          \
                 break;                                                  \
         case 2:                                                         \
-                __put_user_asm("shi",__pu_val,__pu_addr,err);           \
+                __put_user_asm("shi", __pu_val, (ptr), (err));          \
                 break;                                                  \
         case 4:                                                         \
-                __put_user_asm("swi",__pu_val,__pu_addr,err);           \
+                __put_user_asm("swi", __pu_val, (ptr), (err));          \
                 break;                                                  \
         case 8:                                                         \
-                __put_user_asm_dword(__pu_val,__pu_addr,err);           \
+                __put_user_asm_dword(__pu_val, (ptr), (err));           \
                 break;                                                  \
         default:                                                        \
                 BUILD_BUG();                                            \
@@ -211,22 +219,22 @@ do {									\
         }                                                               \
 } while (0)
 
-#define __put_user_asm(inst,x,addr,err)                                 \
-        asm volatile(                                                   \
-        "1:     "inst"  %1,[%2]\n"                                      \
-        "2:\n"                                                          \
-        "       .section .fixup,\"ax\"\n"                               \
-        "       .align  2\n"                                            \
-        "3:     move    %0, %3\n"                                       \
-        "       b       2b\n"                                           \
-        "       .previous\n"                                            \
-        "       .section __ex_table,\"a\"\n"                            \
-        "       .align  3\n"                                            \
-        "       .long   1b, 3b\n"                                       \
-        "       .previous"                                              \
-        : "+r" (err)                                                    \
-        : "r" (x), "r" (addr), "i" (-EFAULT)                            \
-        : "cc")
+#define __put_user_asm(inst, x, addr, err)                              \
+        __asm__ __volatile__ (                                          \
+                "1:     "inst"  %1,[%2]\n"                              \
+                "2:\n"                                                  \
+                "       .section .fixup,\"ax\"\n"                       \
+                "       .align  2\n"                                    \
+                "3:     move    %0, %3\n"                               \
+                "       b       2b\n"                                   \
+                "       .previous\n"                                    \
+                "       .section __ex_table,\"a\"\n"                    \
+                "       .align  3\n"                                    \
+                "       .long   1b, 3b\n"                               \
+                "       .previous"                                      \
+                : "+r" (err)                                            \
+                : "r" (x), "r" (addr), "i" (-EFAULT)                    \
+                : "cc")
 
 #ifdef __NDS32_EB__
 #define __pu_reg_oper0 "%H2"
@@ -237,23 +245,24 @@ do {									\
 #endif
 
 #define __put_user_asm_dword(x, addr, err)                              \
-        asm volatile(                                                   \
-        "\n1:\tswi " __pu_reg_oper0 ",[%1]\n"                           \
-        "\n2:\tswi " __pu_reg_oper1 ",[%1+4]\n"                         \
-        "3:\n"                                                          \
-        "       .section .fixup,\"ax\"\n"                               \
-        "       .align  2\n"                                            \
-        "4:     move    %0, %3\n"                                       \
-        "       b       3b\n"                                           \
-        "       .previous\n"                                            \
-        "       .section __ex_table,\"a\"\n"                            \
-        "       .align  3\n"                                            \
-        "       .long   1b, 4b\n"                                       \
-        "       .long   2b, 4b\n"                                       \
-        "       .previous"                                              \
-        : "+r"(err)                                                     \
-        : "r"(addr), "r"(x), "i"(-EFAULT)                               \
-        : "cc")
+        __asm__ __volatile__ (                                          \
+                "\n1:\tswi " __pu_reg_oper0 ",[%1]\n"                   \
+                "\n2:\tswi " __pu_reg_oper1 ",[%1+4]\n"                 \
+                "3:\n"                                                  \
+                "       .section .fixup,\"ax\"\n"                       \
+                "       .align  2\n"                                    \
+                "4:     move    %0, %3\n"                               \
+                "       b       3b\n"                                   \
+                "       .previous\n"                                    \
+                "       .section __ex_table,\"a\"\n"                    \
+                "       .align  3\n"                                    \
+                "       .long   1b, 4b\n"                               \
+                "       .long   2b, 4b\n"                               \
+                "       .previous"                                      \
+                : "+r"(err)                                             \
+                : "r"(addr), "r"(x), "i"(-EFAULT)                       \
+                : "cc")
+
 extern unsigned long __arch_clear_user(void __user * addr, unsigned long n);
 extern long strncpy_from_user(char *dest, const char __user * src, long count);
 extern __must_check long strlen_user(const char __user * str);
diff --git a/arch/nds32/kernel/Makefile b/arch/nds32/kernel/Makefile
index 42792743e8b9..27cded39fa66 100644
--- a/arch/nds32/kernel/Makefile
+++ b/arch/nds32/kernel/Makefile
@@ -21,3 +21,9 @@ extra-y := head.o vmlinux.lds
 
 
 obj-y                           += vdso/
+
+obj-$(CONFIG_FUNCTION_TRACER)   += ftrace.o
+
+ifdef CONFIG_FUNCTION_TRACER
+CFLAGS_REMOVE_ftrace.o = $(CC_FLAGS_FTRACE)
+endif
diff --git a/arch/nds32/kernel/atl2c.c b/arch/nds32/kernel/atl2c.c
index 0c6d031a1c4a..0c5386e72098 100644
--- a/arch/nds32/kernel/atl2c.c
+++ b/arch/nds32/kernel/atl2c.c
@@ -9,7 +9,8 @@
 
 void __iomem *atl2c_base;
 static const struct of_device_id atl2c_ids[] __initconst = {
-        {.compatible = "andestech,atl2c",}
+        {.compatible = "andestech,atl2c",},
+        {}
 };
 
 static int __init atl2c_of_init(void)
diff --git a/arch/nds32/kernel/ex-entry.S b/arch/nds32/kernel/ex-entry.S
index b8ae4e9a6b93..21a144071566 100644
--- a/arch/nds32/kernel/ex-entry.S
+++ b/arch/nds32/kernel/ex-entry.S
@@ -118,7 +118,7 @@ common_exception_handler:
         /* interrupt */
 2:
 #ifdef CONFIG_TRACE_IRQFLAGS
-        jal     trace_hardirqs_off
+        jal     __trace_hardirqs_off
 #endif
         move    $r0, $sp
         sethi   $lp, hi20(ret_from_intr)
diff --git a/arch/nds32/kernel/ex-exit.S b/arch/nds32/kernel/ex-exit.S
index 03e4f7788a18..f00af92f7e22 100644
--- a/arch/nds32/kernel/ex-exit.S
+++ b/arch/nds32/kernel/ex-exit.S
@@ -138,8 +138,8 @@ no_work_pending:
 #ifdef CONFIG_TRACE_IRQFLAGS
         lwi     $p0, [$sp+(#IPSW_OFFSET)]
         andi    $p0, $p0, #0x1
-        la      $r10, trace_hardirqs_off
-        la      $r9, trace_hardirqs_on
+        la      $r10, __trace_hardirqs_off
+        la      $r9, __trace_hardirqs_on
         cmovz   $r9, $p0, $r10
         jral    $r9
 #endif
diff --git a/arch/nds32/kernel/ftrace.c b/arch/nds32/kernel/ftrace.c
new file mode 100644
index 000000000000..a0a9679ad5de
--- /dev/null
+++ b/arch/nds32/kernel/ftrace.c
@@ -0,0 +1,309 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/ftrace.h>
+#include <linux/uaccess.h>
+#include <asm/cacheflush.h>
+
+#ifndef CONFIG_DYNAMIC_FTRACE
+extern void (*ftrace_trace_function)(unsigned long, unsigned long,
+                                     struct ftrace_ops*, struct pt_regs*);
+extern int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace);
+extern void ftrace_graph_caller(void);
+
+noinline void __naked ftrace_stub(unsigned long ip, unsigned long parent_ip,
+                                  struct ftrace_ops *op, struct pt_regs *regs)
+{
+        __asm__ ("");  /* avoid to optimize as pure function */
+}
+
+noinline void _mcount(unsigned long parent_ip)
+{
+        /* save all state by the compiler prologue */
+
+        unsigned long ip = (unsigned long)__builtin_return_address(0);
+
+        if (ftrace_trace_function != ftrace_stub)
+                ftrace_trace_function(ip - MCOUNT_INSN_SIZE, parent_ip,
+                                      NULL, NULL);
+
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+        if (ftrace_graph_return != (trace_func_graph_ret_t)ftrace_stub
+            || ftrace_graph_entry != ftrace_graph_entry_stub)
+                ftrace_graph_caller();
+#endif
+
+        /* restore all state by the compiler epilogue */
+}
+EXPORT_SYMBOL(_mcount);
+
+#else /* CONFIG_DYNAMIC_FTRACE */
+
+noinline void __naked ftrace_stub(unsigned long ip, unsigned long parent_ip,
+                                  struct ftrace_ops *op, struct pt_regs *regs)
+{
+        __asm__ ("");  /* avoid to optimize as pure function */
+}
+
+noinline void __naked _mcount(unsigned long parent_ip)
+{
+        __asm__ ("");  /* avoid to optimize as pure function */
+}
+EXPORT_SYMBOL(_mcount);
+
+#define XSTR(s) STR(s)
+#define STR(s) #s
+void _ftrace_caller(unsigned long parent_ip)
+{
+        /* save all state needed by the compiler prologue */
+
+        /*
+         * prepare arguments for real tracing function
+         * first  arg : __builtin_return_address(0) - MCOUNT_INSN_SIZE
+         * second arg : parent_ip
+         */
+        __asm__ __volatile__ (
+                "move $r1, %0                              \n\t"
+                "addi $r0, %1, #-" XSTR(MCOUNT_INSN_SIZE) "\n\t"
+                :
+                : "r" (parent_ip), "r" (__builtin_return_address(0)));
+
+        /* a placeholder for the call to a real tracing function */
+        __asm__ __volatile__ (
+                "ftrace_call:           \n\t"
+                "nop                    \n\t"
+                "nop                    \n\t"
+                "nop                    \n\t");
+
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+        /* a placeholder for the call to ftrace_graph_caller */
+        __asm__ __volatile__ (
+                "ftrace_graph_call:     \n\t"
+                "nop                    \n\t"
+                "nop                    \n\t"
+                "nop                    \n\t");
+#endif
+        /* restore all state needed by the compiler epilogue */
+}
+
+int __init ftrace_dyn_arch_init(void)
+{
+        return 0;
+}
+
+int ftrace_arch_code_modify_prepare(void)
+{
+        set_all_modules_text_rw();
+        return 0;
+}
+
+int ftrace_arch_code_modify_post_process(void)
+{
+        set_all_modules_text_ro();
+        return 0;
+}
+
+static unsigned long gen_sethi_insn(unsigned long addr)
+{
+        unsigned long opcode = 0x46000000;
+        unsigned long imm = addr >> 12;
+        unsigned long rt_num = 0xf << 20;
+
+        return ENDIAN_CONVERT(opcode | rt_num | imm);
+}
+
+static unsigned long gen_ori_insn(unsigned long addr)
+{
+        unsigned long opcode = 0x58000000;
+        unsigned long imm = addr & 0x0000fff;
+        unsigned long rt_num = 0xf << 20;
+        unsigned long ra_num = 0xf << 15;
+
+        return ENDIAN_CONVERT(opcode | rt_num | ra_num | imm);
+}
+
+static unsigned long gen_jral_insn(unsigned long addr)
+{
+        unsigned long opcode = 0x4a000001;
+        unsigned long rt_num = 0x1e << 20;
+        unsigned long rb_num = 0xf << 10;
+
+        return ENDIAN_CONVERT(opcode | rt_num | rb_num);
+}
+
+static void ftrace_gen_call_insn(unsigned long *call_insns,
+                                 unsigned long addr)
+{
+        call_insns[0] = gen_sethi_insn(addr); /* sethi $r15, imm20u       */
+        call_insns[1] = gen_ori_insn(addr);   /* ori   $r15, $r15, imm15u */
+        call_insns[2] = gen_jral_insn(addr);  /* jral  $lp,  $r15         */
+}
+
+static int __ftrace_modify_code(unsigned long pc, unsigned long *old_insn,
+                                unsigned long *new_insn, bool validate)
+{
+        unsigned long orig_insn[3];
+
+        if (validate) {
+                if (probe_kernel_read(orig_insn, (void *)pc, MCOUNT_INSN_SIZE))
+                        return -EFAULT;
+                if (memcmp(orig_insn, old_insn, MCOUNT_INSN_SIZE))
+                        return -EINVAL;
+        }
+
+        if (probe_kernel_write((void *)pc, new_insn, MCOUNT_INSN_SIZE))
+                return -EPERM;
+
+        return 0;
+}
+
+static int ftrace_modify_code(unsigned long pc, unsigned long *old_insn,
+                              unsigned long *new_insn, bool validate)
+{
+        int ret;
+
+        ret = __ftrace_modify_code(pc, old_insn, new_insn, validate);
+        if (ret)
+                return ret;
+
+        flush_icache_range(pc, pc + MCOUNT_INSN_SIZE);
+
+        return ret;
+}
+
+int ftrace_update_ftrace_func(ftrace_func_t func)
+{
+        unsigned long pc = (unsigned long)&ftrace_call;
+        unsigned long old_insn[3] = {INSN_NOP, INSN_NOP, INSN_NOP};
+        unsigned long new_insn[3] = {INSN_NOP, INSN_NOP, INSN_NOP};
+
+        if (func != ftrace_stub)
+                ftrace_gen_call_insn(new_insn, (unsigned long)func);
+
+        return ftrace_modify_code(pc, old_insn, new_insn, false);
+}
+
+int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
+{
+        unsigned long pc = rec->ip;
+        unsigned long nop_insn[3] = {INSN_NOP, INSN_NOP, INSN_NOP};
+        unsigned long call_insn[3] = {INSN_NOP, INSN_NOP, INSN_NOP};
+
+        ftrace_gen_call_insn(call_insn, addr);
+
+        return ftrace_modify_code(pc, nop_insn, call_insn, true);
+}
+
+int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec,
+                    unsigned long addr)
+{
+        unsigned long pc = rec->ip;
+        unsigned long nop_insn[3] = {INSN_NOP, INSN_NOP, INSN_NOP};
+        unsigned long call_insn[3] = {INSN_NOP, INSN_NOP, INSN_NOP};
+
+        ftrace_gen_call_insn(call_insn, addr);
+
+        return ftrace_modify_code(pc, call_insn, nop_insn, true);
+}
+#endif /* CONFIG_DYNAMIC_FTRACE */
+
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
+                           unsigned long frame_pointer)
+{
+        unsigned long return_hooker = (unsigned long)&return_to_handler;
+        struct ftrace_graph_ent trace;
+        unsigned long old;
+        int err;
+
+        if (unlikely(atomic_read(&current->tracing_graph_pause)))
+                return;
+
+        old = *parent;
+
+        trace.func = self_addr;
+        trace.depth = current->curr_ret_stack + 1;
+
+        /* Only trace if the calling function expects to */
+        if (!ftrace_graph_entry(&trace))
+                return;
+
+        err = ftrace_push_return_trace(old, self_addr, &trace.depth,
+                                       frame_pointer, NULL);
+
+        if (err == -EBUSY)
+                return;
+
+        *parent = return_hooker;
+}
+
+noinline void ftrace_graph_caller(void)
+{
+        unsigned long *parent_ip =
+                (unsigned long *)(__builtin_frame_address(2) - 4);
+
+        unsigned long selfpc =
+                (unsigned long)(__builtin_return_address(1) - MCOUNT_INSN_SIZE);
+
+        unsigned long frame_pointer =
+                (unsigned long)__builtin_frame_address(3);
+
+        prepare_ftrace_return(parent_ip, selfpc, frame_pointer);
+}
+
+extern unsigned long ftrace_return_to_handler(unsigned long frame_pointer);
+void __naked return_to_handler(void)
+{
+        __asm__ __volatile__ (
+                /* save state needed by the ABI     */
+                "smw.adm $r0,[$sp],$r1,#0x0  \n\t"
+
+                /* get original return address      */
+                "move $r0, $fp               \n\t"
+                "bal ftrace_return_to_handler\n\t"
+                "move $lp, $r0               \n\t"
+
+                /* restore state nedded by the ABI  */
+                "lmw.bim $r0,[$sp],$r1,#0x0  \n\t");
+}
+
+#ifdef CONFIG_DYNAMIC_FTRACE
+extern unsigned long ftrace_graph_call;
+
+static int ftrace_modify_graph_caller(bool enable)
+{
+        unsigned long pc = (unsigned long)&ftrace_graph_call;
+        unsigned long nop_insn[3] = {INSN_NOP, INSN_NOP, INSN_NOP};
+        unsigned long call_insn[3] = {INSN_NOP, INSN_NOP, INSN_NOP};
+
+        ftrace_gen_call_insn(call_insn, (unsigned long)ftrace_graph_caller);
+
+        if (enable)
+                return ftrace_modify_code(pc, nop_insn, call_insn, true);
+        else
+                return ftrace_modify_code(pc, call_insn, nop_insn, true);
+}
+
+int ftrace_enable_ftrace_graph_caller(void)
+{
+        return ftrace_modify_graph_caller(true);
+}
+
+int ftrace_disable_ftrace_graph_caller(void)
+{
+        return ftrace_modify_graph_caller(false);
+}
+#endif /* CONFIG_DYNAMIC_FTRACE */
+
+#endif /* CONFIG_FUNCTION_GRAPH_TRACER */
+
+
+#ifdef CONFIG_TRACE_IRQFLAGS
+noinline void __trace_hardirqs_off(void)
+{
+        trace_hardirqs_off();
+}
+noinline void __trace_hardirqs_on(void)
+{
+        trace_hardirqs_on();
+}
+#endif /* CONFIG_TRACE_IRQFLAGS */
diff --git a/arch/nds32/kernel/module.c b/arch/nds32/kernel/module.c
index 4167283d8293..1e31829cbc2a 100644
--- a/arch/nds32/kernel/module.c
+++ b/arch/nds32/kernel/module.c
@@ -40,7 +40,7 @@ void do_reloc16(unsigned int val, unsigned int *loc, unsigned int val_mask,
 
         tmp2 = tmp & loc_mask;
         if (partial_in_place) {
-                tmp &= (!loc_mask);
+                tmp &= (~loc_mask);
                 tmp =
                     tmp2 | ((tmp + ((val & val_mask) >> val_shift)) & val_mask);
         } else {
@@ -70,7 +70,7 @@ void do_reloc32(unsigned int val, unsigned int *loc, unsigned int val_mask,
 
         tmp2 = tmp & loc_mask;
         if (partial_in_place) {
-                tmp &= (!loc_mask);
+                tmp &= (~loc_mask);
                 tmp =
                     tmp2 | ((tmp + ((val & val_mask) >> val_shift)) & val_mask);
         } else {
diff --git a/arch/nds32/kernel/stacktrace.c b/arch/nds32/kernel/stacktrace.c
index 8b231e910ea6..d974c0c1c65f 100644
--- a/arch/nds32/kernel/stacktrace.c
+++ b/arch/nds32/kernel/stacktrace.c
@@ -4,6 +4,7 @@
 #include <linux/sched/debug.h>
 #include <linux/sched/task_stack.h>
 #include <linux/stacktrace.h>
+#include <linux/ftrace.h>
 
 void save_stack_trace(struct stack_trace *trace)
 {
@@ -16,6 +17,7 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace)
         unsigned long *fpn;
         int skip = trace->skip;
         int savesched;
+        int graph_idx = 0;
 
         if (tsk == current) {
                 __asm__ __volatile__("\tori\t%0, $fp, #0\n":"=r"(fpn));
@@ -29,10 +31,12 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace)
                && (fpn >= (unsigned long *)TASK_SIZE)) {
                 unsigned long lpp, fpp;
 
-                lpp = fpn[-1];
+                lpp = fpn[LP_OFFSET];
                 fpp = fpn[FP_OFFSET];
                 if (!__kernel_text_address(lpp))
                         break;
+                else
+                        lpp = ftrace_graph_ret_addr(tsk, &graph_idx, lpp, NULL);
 
                 if (savesched || !in_sched_functions(lpp)) {
                         if (skip) {
diff --git a/arch/nds32/kernel/traps.c b/arch/nds32/kernel/traps.c
index a6205fd4db52..1496aab48998 100644
--- a/arch/nds32/kernel/traps.c
+++ b/arch/nds32/kernel/traps.c
@@ -8,6 +8,7 @@
 #include <linux/kdebug.h>
 #include <linux/sched/task_stack.h>
 #include <linux/uaccess.h>
+#include <linux/ftrace.h>
 
 #include <asm/proc-fns.h>
 #include <asm/unistd.h>
@@ -94,28 +95,6 @@ static void dump_instr(struct pt_regs *regs)
         set_fs(fs);
 }
 
-#ifdef CONFIG_FUNCTION_GRAPH_TRACER
-#include <linux/ftrace.h>
-static void
-get_real_ret_addr(unsigned long *addr, struct task_struct *tsk, int *graph)
-{
-        if (*addr == (unsigned long)return_to_handler) {
-                int index = tsk->curr_ret_stack;
-
-                if (tsk->ret_stack && index >= *graph) {
-                        index -= *graph;
-                        *addr = tsk->ret_stack[index].ret;
-                        (*graph)++;
-                }
-        }
-}
-#else
-static inline void
-get_real_ret_addr(unsigned long *addr, struct task_struct *tsk, int *graph)
-{
-}
-#endif
-
 #define LOOP_TIMES (100)
 static void __dump(struct task_struct *tsk, unsigned long *base_reg)
 {
@@ -126,7 +105,8 @@ static void __dump(struct task_struct *tsk, unsigned long *base_reg)
                 while (!kstack_end(base_reg)) {
                         ret_addr = *base_reg++;
                         if (__kernel_text_address(ret_addr)) {
-                                get_real_ret_addr(&ret_addr, tsk, &graph);
+                                ret_addr = ftrace_graph_ret_addr(
+                                                tsk, &graph, ret_addr, NULL);
                                 print_ip_sym(ret_addr);
                         }
                         if (--cnt < 0)
@@ -137,15 +117,12 @@ static void __dump(struct task_struct *tsk, unsigned long *base_reg)
                        !((unsigned long)base_reg & 0x3) &&
                        ((unsigned long)base_reg >= TASK_SIZE)) {
                         unsigned long next_fp;
-#if !defined(NDS32_ABI_2)
-                        ret_addr = base_reg[0];
-                        next_fp = base_reg[1];
-#else
-                        ret_addr = base_reg[-1];
+                        ret_addr = base_reg[LP_OFFSET];
                         next_fp = base_reg[FP_OFFSET];
-#endif
                         if (__kernel_text_address(ret_addr)) {
-                                get_real_ret_addr(&ret_addr, tsk, &graph);
+
+                                ret_addr = ftrace_graph_ret_addr(
+                                                tsk, &graph, ret_addr, NULL);
                                 print_ip_sym(ret_addr);
                         }
                         if (--cnt < 0)
@@ -196,11 +173,10 @@ void die(const char *str, struct pt_regs *regs, int err)
         pr_emerg("CPU: %i\n", smp_processor_id());
         show_regs(regs);
         pr_emerg("Process %s (pid: %d, stack limit = 0x%p)\n",
-                 tsk->comm, tsk->pid, task_thread_info(tsk) + 1);
+                 tsk->comm, tsk->pid, end_of_stack(tsk));
 
         if (!user_mode(regs) || in_interrupt()) {
-                dump_mem("Stack: ", regs->sp,
-                         THREAD_SIZE + (unsigned long)task_thread_info(tsk));
+                dump_mem("Stack: ", regs->sp, (regs->sp + PAGE_SIZE) & PAGE_MASK);
                 dump_instr(regs);
                 dump_stack();
         }
diff --git a/arch/nds32/kernel/vmlinux.lds.S b/arch/nds32/kernel/vmlinux.lds.S
index 288313b886ef..9e90f30a181d 100644
--- a/arch/nds32/kernel/vmlinux.lds.S
+++ b/arch/nds32/kernel/vmlinux.lds.S
@@ -13,14 +13,26 @@ OUTPUT_ARCH(nds32)
 ENTRY(_stext_lma)
 jiffies = jiffies_64;
 
+#if defined(CONFIG_GCOV_KERNEL)
+#define NDS32_EXIT_KEEP(x)      x
+#else
+#define NDS32_EXIT_KEEP(x)
+#endif
+
 SECTIONS
 {
         _stext_lma = TEXTADDR - LOAD_OFFSET;
         . = TEXTADDR;
         __init_begin = .;
         HEAD_TEXT_SECTION
+        .exit.text : {
+                NDS32_EXIT_KEEP(EXIT_TEXT)
+        }
         INIT_TEXT_SECTION(PAGE_SIZE)
         INIT_DATA_SECTION(16)
+        .exit.data : {
+                NDS32_EXIT_KEEP(EXIT_DATA)
+        }
         PERCPU_SECTION(L1_CACHE_BYTES)
         __init_end = .;
 
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index 3c0e8fb2b773..68e14afecac8 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -358,7 +358,7 @@ static int kvmppc_mmu_book3s_64_hv_xlate(struct kvm_vcpu *vcpu, gva_t eaddr,
         unsigned long pp, key;
         unsigned long v, orig_v, gr;
         __be64 *hptep;
-        int index;
+        long int index;
         int virtmode = vcpu->arch.shregs.msr & (data ? MSR_DR : MSR_IR);
 
         if (kvm_is_radix(vcpu->kvm))
diff --git a/arch/powerpc/kvm/book3s_64_mmu_radix.c b/arch/powerpc/kvm/book3s_64_mmu_radix.c
index 0af1c0aea1fe..fd6e8c13685f 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_radix.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_radix.c
@@ -725,10 +725,10 @@ int kvm_unmap_radix(struct kvm *kvm, struct kvm_memory_slot *memslot,
                                               gpa, shift);
                 kvmppc_radix_tlbie_page(kvm, gpa, shift);
                 if ((old & _PAGE_DIRTY) && memslot->dirty_bitmap) {
-                        unsigned long npages = 1;
+                        unsigned long psize = PAGE_SIZE;
                         if (shift)
-                                npages = 1ul << (shift - PAGE_SHIFT);
-                        kvmppc_update_dirty_map(memslot, gfn, npages);
+                                psize = 1ul << shift;
+                        kvmppc_update_dirty_map(memslot, gfn, psize);
                 }
         }
         return 0;                               
diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
index db20dc630e7e..aee603123030 100644
--- a/arch/riscv/kernel/setup.c
+++ b/arch/riscv/kernel/setup.c
@@ -85,15 +85,8 @@ atomic_t hart_lottery;
 #ifdef CONFIG_BLK_DEV_INITRD
 static void __init setup_initrd(void)
 {
-        extern char __initramfs_start[];
-        extern unsigned long __initramfs_size;
         unsigned long size;
 
-        if (__initramfs_size > 0) {
-                initrd_start = (unsigned long)(&__initramfs_start);
-                initrd_end = initrd_start + __initramfs_size;
-        }
-
         if (initrd_start >= initrd_end) {
                 printk(KERN_INFO "initrd not found or empty");
                 goto disable;
diff --git a/arch/s390/include/asm/mmu.h b/arch/s390/include/asm/mmu.h
index f31a15044c24..a8418e1379eb 100644
--- a/arch/s390/include/asm/mmu.h
+++ b/arch/s390/include/asm/mmu.h
@@ -16,7 +16,13 @@ typedef struct {
         unsigned long asce;
         unsigned long asce_limit;
         unsigned long vdso_base;
-        /* The mmu context allocates 4K page tables. */
+        /*
+         * The following bitfields need a down_write on the mm
+         * semaphore when they are written to. As they are only
+         * written once, they can be read without a lock.
+         *
+         * The mmu context allocates 4K page tables.
+         */
         unsigned int alloc_pgste:1;
         /* The mmu context uses extended page tables. */
         unsigned int has_pgste:1;
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 91ad4a9425c0..f69333fd2fa3 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -695,7 +695,9 @@ static int kvm_vm_ioctl_enable_cap(struct kvm *kvm, struct kvm_enable_cap *cap)
                         r = -EINVAL;
                 else {
                         r = 0;
+                        down_write(&kvm->mm->mmap_sem);
                         kvm->mm->context.allow_gmap_hpage_1m = 1;
+                        up_write(&kvm->mm->mmap_sem);
                         /*
                          * We might have to create fake 4k page
                          * tables. To avoid that the hardware works on
diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index d68f10441a16..8679bd74d337 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -280,9 +280,11 @@ retry:
                         goto retry;
                 }
         }
-        if (rc)
-                return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
         up_read(&current->mm->mmap_sem);
+        if (rc == -EFAULT)
+                return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
+        if (rc < 0)
+                return rc;
         vcpu->run->s.regs.gprs[reg1] &= ~0xff;
         vcpu->run->s.regs.gprs[reg1] |= key;
         return 0;
@@ -324,9 +326,11 @@ retry:
                         goto retry;
                 }
         }
-        if (rc < 0)
-                return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
         up_read(&current->mm->mmap_sem);
+        if (rc == -EFAULT)
+                return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
+        if (rc < 0)
+                return rc;
         kvm_s390_set_psw_cc(vcpu, rc);
         return 0;
 }
@@ -390,12 +394,12 @@ static int handle_sske(struct kvm_vcpu *vcpu)
                                               FAULT_FLAG_WRITE, &unlocked);
                         rc = !rc ? -EAGAIN : rc;
                 }
+                up_read(&current->mm->mmap_sem);
                 if (rc == -EFAULT)
                         return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
-
-                up_read(&current->mm->mmap_sem);
-                if (rc >= 0)
-                        start += PAGE_SIZE;
+                if (rc < 0)
+                        return rc;
+                start += PAGE_SIZE;
         }
 
         if (m3 & (SSKE_MC | SSKE_MR)) {
@@ -1002,13 +1006,15 @@ static int handle_pfmf(struct kvm_vcpu *vcpu)
                                                       FAULT_FLAG_WRITE, &unlocked);
                                 rc = !rc ? -EAGAIN : rc;
                         }
+                        up_read(&current->mm->mmap_sem);
                         if (rc == -EFAULT)
                                 return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
-
-                        up_read(&current->mm->mmap_sem);
-                        if (rc >= 0)
-                                start += PAGE_SIZE;
+                        if (rc == -EAGAIN)
+                                continue;
+                        if (rc < 0)
+                                return rc;
                 }
+                start += PAGE_SIZE;
         }
         if (vcpu->run->s.regs.gprs[reg1] & PFMF_FSC) {
                 if (psw_bits(vcpu->arch.sie_block->gpsw).eaba == PSW_BITS_AMODE_64BIT) {
diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
index 63844b95c22c..a2b28cd1e3fe 100644
--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -173,7 +173,8 @@ static int shadow_crycb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
                 return set_validity_icpt(scb_s, 0x0039U);
 
         /* copy only the wrapping keys */
-        if (read_guest_real(vcpu, crycb_addr + 72, &vsie_page->crycb, 56))
+        if (read_guest_real(vcpu, crycb_addr + 72,
+                            vsie_page->crycb.dea_wrapping_key_mask, 56))
                 return set_validity_icpt(scb_s, 0x0035U);
 
         scb_s->ecb3 |= ecb3_flags;
diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h
index b143717b92b3..ce84388e540c 100644
--- a/arch/x86/include/asm/atomic.h
+++ b/arch/x86/include/asm/atomic.h
@@ -80,11 +80,11 @@ static __always_inline void arch_atomic_sub(int i, atomic_t *v)
  * true if the result is zero, or false for all
  * other cases.
  */
-#define arch_atomic_sub_and_test arch_atomic_sub_and_test
 static __always_inline bool arch_atomic_sub_and_test(int i, atomic_t *v)
 {
         GEN_BINARY_RMWcc(LOCK_PREFIX "subl", v->counter, "er", i, "%0", e);
 }
+#define arch_atomic_sub_and_test arch_atomic_sub_and_test
 
 /**
  * arch_atomic_inc - increment atomic variable
@@ -92,12 +92,12 @@ static __always_inline bool arch_atomic_sub_and_test(int i, atomic_t *v)
  *
  * Atomically increments @v by 1.
  */
-#define arch_atomic_inc arch_atomic_inc
 static __always_inline void arch_atomic_inc(atomic_t *v)
 {
         asm volatile(LOCK_PREFIX "incl %0"
                      : "+m" (v->counter));
 }
+#define arch_atomic_inc arch_atomic_inc
 
 /**
  * arch_atomic_dec - decrement atomic variable
@@ -105,12 +105,12 @@ static __always_inline void arch_atomic_inc(atomic_t *v)
  *
  * Atomically decrements @v by 1.
  */
-#define arch_atomic_dec arch_atomic_dec
 static __always_inline void arch_atomic_dec(atomic_t *v)
 {
         asm volatile(LOCK_PREFIX "decl %0"
                      : "+m" (v->counter));
 }
+#define arch_atomic_dec arch_atomic_dec
 
 /**
  * arch_atomic_dec_and_test - decrement and test
@@ -120,11 +120,11 @@ static __always_inline void arch_atomic_dec(atomic_t *v)
  * returns true if the result is 0, or false for all other
  * cases.
  */
-#define arch_atomic_dec_and_test arch_atomic_dec_and_test
 static __always_inline bool arch_atomic_dec_and_test(atomic_t *v)
 {
         GEN_UNARY_RMWcc(LOCK_PREFIX "decl", v->counter, "%0", e);
 }
+#define arch_atomic_dec_and_test arch_atomic_dec_and_test
 
 /**
  * arch_atomic_inc_and_test - increment and test
@@ -134,11 +134,11 @@ static __always_inline bool arch_atomic_dec_and_test(atomic_t *v)
  * and returns true if the result is zero, or false for all
  * other cases.
  */
-#define arch_atomic_inc_and_test arch_atomic_inc_and_test
 static __always_inline bool arch_atomic_inc_and_test(atomic_t *v)
 {
         GEN_UNARY_RMWcc(LOCK_PREFIX "incl", v->counter, "%0", e);
 }
+#define arch_atomic_inc_and_test arch_atomic_inc_and_test
 
 /**
  * arch_atomic_add_negative - add and test if negative
@@ -149,11 +149,11 @@ static __always_inline bool arch_atomic_inc_and_test(atomic_t *v)
  * if the result is negative, or false when
  * result is greater than or equal to zero.
  */
-#define arch_atomic_add_negative arch_atomic_add_negative
 static __always_inline bool arch_atomic_add_negative(int i, atomic_t *v)
 {
         GEN_BINARY_RMWcc(LOCK_PREFIX "addl", v->counter, "er", i, "%0", s);
 }
+#define arch_atomic_add_negative arch_atomic_add_negative
 
 /**
  * arch_atomic_add_return - add integer and return
diff --git a/arch/x86/include/asm/atomic64_32.h b/arch/x86/include/asm/atomic64_32.h
index ef959f02d070..6a5b0ec460da 100644
--- a/arch/x86/include/asm/atomic64_32.h
+++ b/arch/x86/include/asm/atomic64_32.h
@@ -205,12 +205,12 @@ static inline long long arch_atomic64_sub(long long i, atomic64_t *v)
  *
  * Atomically increments @v by 1.
  */
-#define arch_atomic64_inc arch_atomic64_inc
 static inline void arch_atomic64_inc(atomic64_t *v)
 {
         __alternative_atomic64(inc, inc_return, /* no output */,
                                "S" (v) : "memory", "eax", "ecx", "edx");
 }
+#define arch_atomic64_inc arch_atomic64_inc
 
 /**
  * arch_atomic64_dec - decrement atomic64 variable
@@ -218,12 +218,12 @@ static inline void arch_atomic64_inc(atomic64_t *v)
  *
  * Atomically decrements @v by 1.
  */
-#define arch_atomic64_dec arch_atomic64_dec
 static inline void arch_atomic64_dec(atomic64_t *v)
 {
         __alternative_atomic64(dec, dec_return, /* no output */,
                                "S" (v) : "memory", "eax", "ecx", "edx");
 }
+#define arch_atomic64_dec arch_atomic64_dec
 
 /**
  * arch_atomic64_add_unless - add unless the number is a given value
@@ -245,7 +245,6 @@ static inline int arch_atomic64_add_unless(atomic64_t *v, long long a,
         return (int)a;
 }
 
-#define arch_atomic64_inc_not_zero arch_atomic64_inc_not_zero
 static inline int arch_atomic64_inc_not_zero(atomic64_t *v)
 {
         int r;
@@ -253,8 +252,8 @@ static inline int arch_atomic64_inc_not_zero(atomic64_t *v)
                              "S" (v) : "ecx", "edx", "memory");
         return r;
 }
+#define arch_atomic64_inc_not_zero arch_atomic64_inc_not_zero
 
-#define arch_atomic64_dec_if_positive arch_atomic64_dec_if_positive
 static inline long long arch_atomic64_dec_if_positive(atomic64_t *v)
 {
         long long r;
@@ -262,6 +261,7 @@ static inline long long arch_atomic64_dec_if_positive(atomic64_t *v)
                              "S" (v) : "ecx", "memory");
         return r;
 }
+#define arch_atomic64_dec_if_positive arch_atomic64_dec_if_positive
 
 #undef alternative_atomic64
 #undef __alternative_atomic64
diff --git a/arch/x86/include/asm/atomic64_64.h b/arch/x86/include/asm/atomic64_64.h
index 4343d9b4f30e..5f851d92eecd 100644
--- a/arch/x86/include/asm/atomic64_64.h
+++ b/arch/x86/include/asm/atomic64_64.h
@@ -71,11 +71,11 @@ static inline void arch_atomic64_sub(long i, atomic64_t *v)
  * true if the result is zero, or false for all
  * other cases.
  */
-#define arch_atomic64_sub_and_test arch_atomic64_sub_and_test
 static inline bool arch_atomic64_sub_and_test(long i, atomic64_t *v)
 {
         GEN_BINARY_RMWcc(LOCK_PREFIX "subq", v->counter, "er", i, "%0", e);
 }
+#define arch_atomic64_sub_and_test arch_atomic64_sub_and_test
 
 /**
  * arch_atomic64_inc - increment atomic64 variable
@@ -83,13 +83,13 @@ static inline bool arch_atomic64_sub_and_test(long i, atomic64_t *v)
  *
  * Atomically increments @v by 1.
  */
-#define arch_atomic64_inc arch_atomic64_inc
 static __always_inline void arch_atomic64_inc(atomic64_t *v)
 {
         asm volatile(LOCK_PREFIX "incq %0"
                      : "=m" (v->counter)
                      : "m" (v->counter));
 }
+#define arch_atomic64_inc arch_atomic64_inc
 
 /**
  * arch_atomic64_dec - decrement atomic64 variable
@@ -97,13 +97,13 @@ static __always_inline void arch_atomic64_inc(atomic64_t *v)
  *
  * Atomically decrements @v by 1.
  */
-#define arch_atomic64_dec arch_atomic64_dec
 static __always_inline void arch_atomic64_dec(atomic64_t *v)
 {
         asm volatile(LOCK_PREFIX "decq %0"
                      : "=m" (v->counter)
                      : "m" (v->counter));
 }
+#define arch_atomic64_dec arch_atomic64_dec
 
 /**
  * arch_atomic64_dec_and_test - decrement and test
@@ -113,11 +113,11 @@ static __always_inline void arch_atomic64_dec(atomic64_t *v)
  * returns true if the result is 0, or false for all other
  * cases.
  */
-#define arch_atomic64_dec_and_test arch_atomic64_dec_and_test
 static inline bool arch_atomic64_dec_and_test(atomic64_t *v)
 {
         GEN_UNARY_RMWcc(LOCK_PREFIX "decq", v->counter, "%0", e);
 }
+#define arch_atomic64_dec_and_test arch_atomic64_dec_and_test
 
 /**
  * arch_atomic64_inc_and_test - increment and test
@@ -127,11 +127,11 @@ static inline bool arch_atomic64_dec_and_test(atomic64_t *v)
  * and returns true if the result is zero, or false for all
  * other cases.
  */
-#define arch_atomic64_inc_and_test arch_atomic64_inc_and_test
 static inline bool arch_atomic64_inc_and_test(atomic64_t *v)
 {
         GEN_UNARY_RMWcc(LOCK_PREFIX "incq", v->counter, "%0", e);
 }
+#define arch_atomic64_inc_and_test arch_atomic64_inc_and_test
 
 /**
  * arch_atomic64_add_negative - add and test if negative
@@ -142,11 +142,11 @@ static inline bool arch_atomic64_inc_and_test(atomic64_t *v)
  * if the result is negative, or false when
  * result is greater than or equal to zero.
  */
-#define arch_atomic64_add_negative arch_atomic64_add_negative
 static inline bool arch_atomic64_add_negative(long i, atomic64_t *v)
 {
         GEN_BINARY_RMWcc(LOCK_PREFIX "addq", v->counter, "er", i, "%0", s);
 }
+#define arch_atomic64_add_negative arch_atomic64_add_negative
 
 /**
  * arch_atomic64_add_return - add and return
diff --git a/arch/x86/include/asm/kdebug.h b/arch/x86/include/asm/kdebug.h
index 395c9631e000..75f1e35e7c15 100644
--- a/arch/x86/include/asm/kdebug.h
+++ b/arch/x86/include/asm/kdebug.h
@@ -22,10 +22,20 @@ enum die_val {
         DIE_NMIUNKNOWN,
 };
 
+enum show_regs_mode {
+        SHOW_REGS_SHORT,
+        /*
+         * For when userspace crashed, but we don't think it's our fault, and
+         * therefore don't print kernel registers.
+         */
+        SHOW_REGS_USER,
+        SHOW_REGS_ALL
+};
+
 extern void die(const char *, struct pt_regs *,long);
 extern int __must_check __die(const char *, struct pt_regs *, long);
 extern void show_stack_regs(struct pt_regs *regs);
-extern void __show_regs(struct pt_regs *regs, int all);
+extern void __show_regs(struct pt_regs *regs, enum show_regs_mode);
 extern void show_iret_regs(struct pt_regs *regs);
 extern unsigned long oops_begin(void);
 extern void oops_end(unsigned long, struct pt_regs *, int signr);
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 00ddb0c9e612..8e90488c3d56 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -1237,19 +1237,12 @@ enum emulation_result {
 #define EMULTYPE_NO_DECODE          (1 << 0)
 #define EMULTYPE_TRAP_UD            (1 << 1)
 #define EMULTYPE_SKIP               (1 << 2)
-#define EMULTYPE_RETRY              (1 << 3)
-#define EMULTYPE_NO_REEXECUTE       (1 << 4)
-#define EMULTYPE_NO_UD_ON_FAIL      (1 << 5)
-#define EMULTYPE_VMWARE             (1 << 6)
-int x86_emulate_instruction(struct kvm_vcpu *vcpu, unsigned long cr2,
-                            int emulation_type, void *insn, int insn_len);
-
-static inline int emulate_instruction(struct kvm_vcpu *vcpu,
-                        int emulation_type)
-{
-        return x86_emulate_instruction(vcpu, 0,
-                        emulation_type | EMULTYPE_NO_REEXECUTE, NULL, 0);
-}
+#define EMULTYPE_ALLOW_RETRY        (1 << 3)
+#define EMULTYPE_NO_UD_ON_FAIL      (1 << 4)
+#define EMULTYPE_VMWARE             (1 << 5)
+int kvm_emulate_instruction(struct kvm_vcpu *vcpu, int emulation_type);
+int kvm_emulate_instruction_from_buffer(struct kvm_vcpu *vcpu,
+                                        void *insn, int insn_len);
 
 void kvm_enable_efer_bits(u64);
 bool kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer);
@@ -1450,7 +1443,6 @@ asmlinkage void kvm_spurious_fault(void);
         ____kvm_handle_fault_on_reboot(insn, "")
 
 #define KVM_ARCH_WANT_MMU_NOTIFIER
-int kvm_unmap_hva(struct kvm *kvm, unsigned long hva);
 int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end);
 int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end);
 int kvm_test_age_hva(struct kvm *kvm, unsigned long hva);
@@ -1463,7 +1455,7 @@ void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event);
 void kvm_vcpu_reload_apic_access_page(struct kvm_vcpu *vcpu);
 
 int kvm_pv_send_ipi(struct kvm *kvm, unsigned long ipi_bitmap_low,
-                    unsigned long ipi_bitmap_high, int min,
+                    unsigned long ipi_bitmap_high, u32 min,
                     unsigned long icr, int op_64_bit);
 
 u64 kvm_get_arch_capabilities(void);
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index e4ffa565a69f..690c0307afed 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -1195,7 +1195,7 @@ static inline pmd_t pmdp_establish(struct vm_area_struct *vma,
                 return xchg(pmdp, pmd);
         } else {
                 pmd_t old = *pmdp;
-                *pmdp = pmd;
+                WRITE_ONCE(*pmdp, pmd);
                 return old;
         }
 }
diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
index f773d5e6c8cc..ce2b59047cb8 100644
--- a/arch/x86/include/asm/pgtable_64.h
+++ b/arch/x86/include/asm/pgtable_64.h
@@ -55,15 +55,15 @@ struct mm_struct;
 void set_pte_vaddr_p4d(p4d_t *p4d_page, unsigned long vaddr, pte_t new_pte);
 void set_pte_vaddr_pud(pud_t *pud_page, unsigned long vaddr, pte_t new_pte);
 
-static inline void native_pte_clear(struct mm_struct *mm, unsigned long addr,
-                                    pte_t *ptep)
+static inline void native_set_pte(pte_t *ptep, pte_t pte)
 {
-        *ptep = native_make_pte(0);
+        WRITE_ONCE(*ptep, pte);
 }
 
-static inline void native_set_pte(pte_t *ptep, pte_t pte)
+static inline void native_pte_clear(struct mm_struct *mm, unsigned long addr,
+                                    pte_t *ptep)
 {
-        *ptep = pte;
+        native_set_pte(ptep, native_make_pte(0));
 }
 
 static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
@@ -73,7 +73,7 @@ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
 
 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
 {
-        *pmdp = pmd;
+        WRITE_ONCE(*pmdp, pmd);
 }
 
 static inline void native_pmd_clear(pmd_t *pmd)
@@ -109,7 +109,7 @@ static inline pmd_t native_pmdp_get_and_clear(pmd_t *xp)
 
 static inline void native_set_pud(pud_t *pudp, pud_t pud)
 {
-        *pudp = pud;
+        WRITE_ONCE(*pudp, pud);
 }
 
 static inline void native_pud_clear(pud_t *pud)
@@ -137,13 +137,13 @@ static inline void native_set_p4d(p4d_t *p4dp, p4d_t p4d)
         pgd_t pgd;
 
         if (pgtable_l5_enabled() || !IS_ENABLED(CONFIG_PAGE_TABLE_ISOLATION)) {
-                *p4dp = p4d;
+                WRITE_ONCE(*p4dp, p4d);
                 return;
         }
 
         pgd = native_make_pgd(native_p4d_val(p4d));
         pgd = pti_set_user_pgtbl((pgd_t *)p4dp, pgd);
-        *p4dp = native_make_p4d(native_pgd_val(pgd));
+        WRITE_ONCE(*p4dp, native_make_p4d(native_pgd_val(pgd)));
 }
 
 static inline void native_p4d_clear(p4d_t *p4d)
@@ -153,7 +153,7 @@ static inline void native_p4d_clear(p4d_t *p4d)
 
 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
 {
-        *pgdp = pti_set_user_pgtbl(pgdp, pgd);
+        WRITE_ONCE(*pgdp, pti_set_user_pgtbl(pgdp, pgd));
 }
 
 static inline void native_pgd_clear(pgd_t *pgd)
diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
index 9f148e3d45b4..7654febd5102 100644
--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -413,7 +413,7 @@ static int activate_managed(struct irq_data *irqd)
         if (WARN_ON_ONCE(cpumask_empty(vector_searchmask))) {
                 /* Something in the core code broke! Survive gracefully */
                 pr_err("Managed startup for irq %u, but no CPU\n", irqd->irq);
-                return EINVAL;
+                return -EINVAL;
         }
 
         ret = assign_managed_vector(irqd, vector_searchmask);
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index 0624957aa068..07b5fc00b188 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -504,6 +504,7 @@ static enum ucode_state apply_microcode_amd(int cpu)
         struct microcode_amd *mc_amd;
         struct ucode_cpu_info *uci;
         struct ucode_patch *p;
+        enum ucode_state ret;
         u32 rev, dummy;
 
         BUG_ON(raw_smp_processor_id() != cpu);
@@ -521,9 +522,8 @@ static enum ucode_state apply_microcode_amd(int cpu)
 
         /* need to apply patch? */
         if (rev >= mc_amd->hdr.patch_id) {
-                c->microcode = rev;
-                uci->cpu_sig.rev = rev;
-                return UCODE_OK;
+                ret = UCODE_OK;
+                goto out;
         }
 
         if (__apply_microcode_amd(mc_amd)) {
@@ -531,13 +531,21 @@ static enum ucode_state apply_microcode_amd(int cpu)
                         cpu, mc_amd->hdr.patch_id);
                 return UCODE_ERROR;
         }
-        pr_info("CPU%d: new patch_level=0x%08x\n", cpu,
-                mc_amd->hdr.patch_id);
 
-        uci->cpu_sig.rev = mc_amd->hdr.patch_id;
-        c->microcode = mc_amd->hdr.patch_id;
+        rev = mc_amd->hdr.patch_id;
+        ret = UCODE_UPDATED;
+
+        pr_info("CPU%d: new patch_level=0x%08x\n", cpu, rev);
 
-        return UCODE_UPDATED;
+out:
+        uci->cpu_sig.rev = rev;
+        c->microcode     = rev;
+
+        /* Update boot_cpu_data's revision too, if we're on the BSP: */
+        if (c->cpu_index == boot_cpu_data.cpu_index)
+                boot_cpu_data.microcode = rev;
+
+        return ret;
 }
 
 static int install_equiv_cpu_table(const u8 *buf)
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index 97ccf4c3b45b..16936a24795c 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -795,6 +795,7 @@ static enum ucode_state apply_microcode_intel(int cpu)
         struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
         struct cpuinfo_x86 *c = &cpu_data(cpu);
         struct microcode_intel *mc;
+        enum ucode_state ret;
         static int prev_rev;
         u32 rev;
 
@@ -817,9 +818,8 @@ static enum ucode_state apply_microcode_intel(int cpu)
          */
         rev = intel_get_microcode_revision();
         if (rev >= mc->hdr.rev) {
-                uci->cpu_sig.rev = rev;
-                c->microcode = rev;
-                return UCODE_OK;
+                ret = UCODE_OK;
+                goto out;
         }
 
         /*
@@ -848,10 +848,17 @@ static enum ucode_state apply_microcode_intel(int cpu)
                 prev_rev = rev;
         }
 
+        ret = UCODE_UPDATED;
+
+out:
         uci->cpu_sig.rev = rev;
-        c->microcode = rev;
+        c->microcode     = rev;
+
+        /* Update boot_cpu_data's revision too, if we're on the BSP: */
+        if (c->cpu_index == boot_cpu_data.cpu_index)
+                boot_cpu_data.microcode = rev;
 
-        return UCODE_UPDATED;
+        return ret;
 }
 
 static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size,
diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
index f56895106ccf..2b5886401e5f 100644
--- a/arch/x86/kernel/dumpstack.c
+++ b/arch/x86/kernel/dumpstack.c
@@ -146,7 +146,7 @@ static void show_regs_if_on_stack(struct stack_info *info, struct pt_regs *regs,
          * they can be printed in the right context.
          */
         if (!partial && on_stack(info, regs, sizeof(*regs))) {
-                __show_regs(regs, 0);
+                __show_regs(regs, SHOW_REGS_SHORT);
 
         } else if (partial && on_stack(info, (void *)regs + IRET_FRAME_OFFSET,
                                        IRET_FRAME_SIZE)) {
@@ -344,7 +344,7 @@ void oops_end(unsigned long flags, struct pt_regs *regs, int signr)
         oops_exit();
 
         /* Executive summary in case the oops scrolled away */
-        __show_regs(&exec_summary_regs, true);
+        __show_regs(&exec_summary_regs, SHOW_REGS_ALL);
 
         if (!signr)
                 return;
@@ -407,14 +407,9 @@ void die(const char *str, struct pt_regs *regs, long err)
 
 void show_regs(struct pt_regs *regs)
 {
-        bool all = true;
-
         show_regs_print_info(KERN_DEFAULT);
 
-        if (IS_ENABLED(CONFIG_X86_32))
-                all = !user_mode(regs);
-
-        __show_regs(regs, all);
+        __show_regs(regs, user_mode(regs) ? SHOW_REGS_USER : SHOW_REGS_ALL);
 
         /*
          * When in-kernel, we also print out the stack at the time of the fault..
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index 2924fd447e61..5046a3c9dec2 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -59,7 +59,7 @@
 #include <asm/intel_rdt_sched.h>
 #include <asm/proto.h>
 
-void __show_regs(struct pt_regs *regs, int all)
+void __show_regs(struct pt_regs *regs, enum show_regs_mode mode)
 {
         unsigned long cr0 = 0L, cr2 = 0L, cr3 = 0L, cr4 = 0L;
         unsigned long d0, d1, d2, d3, d6, d7;
@@ -85,7 +85,7 @@ void __show_regs(struct pt_regs *regs, int all)
         printk(KERN_DEFAULT "DS: %04x ES: %04x FS: %04x GS: %04x SS: %04x EFLAGS: %08lx\n",
                (u16)regs->ds, (u16)regs->es, (u16)regs->fs, gs, ss, regs->flags);
 
-        if (!all)
+        if (mode != SHOW_REGS_ALL)
                 return;
 
         cr0 = read_cr0();
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index a451bc374b9b..ea5ea850348d 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -62,7 +62,7 @@
 __visible DEFINE_PER_CPU(unsigned long, rsp_scratch);
 
 /* Prints also some state that isn't saved in the pt_regs */
-void __show_regs(struct pt_regs *regs, int all)
+void __show_regs(struct pt_regs *regs, enum show_regs_mode mode)
 {
         unsigned long cr0 = 0L, cr2 = 0L, cr3 = 0L, cr4 = 0L, fs, gs, shadowgs;
         unsigned long d0, d1, d2, d3, d6, d7;
@@ -87,9 +87,17 @@ void __show_regs(struct pt_regs *regs, int all)
         printk(KERN_DEFAULT "R13: %016lx R14: %016lx R15: %016lx\n",
                regs->r13, regs->r14, regs->r15);
 
-        if (!all)
+        if (mode == SHOW_REGS_SHORT)
                 return;
 
+        if (mode == SHOW_REGS_USER) {
+                rdmsrl(MSR_FS_BASE, fs);
+                rdmsrl(MSR_KERNEL_GS_BASE, shadowgs);
+                printk(KERN_DEFAULT "FS:  %016lx GS:  %016lx\n",
+                       fs, shadowgs);
+                return;
+        }
+
         asm("movl %%ds,%0" : "=r" (ds));
         asm("movl %%cs,%0" : "=r" (cs));
         asm("movl %%es,%0" : "=r" (es));
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 1463468ba9a0..6490f618e096 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -1415,7 +1415,7 @@ static bool __init determine_cpu_tsc_frequencies(bool early)
 
 static unsigned long __init get_loops_per_jiffy(void)
 {
-        unsigned long lpj = tsc_khz * KHZ;
+        u64 lpj = (u64)tsc_khz * KHZ;
 
         do_div(lpj, HZ);
         return lpj;
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 0cefba28c864..17c0472c5b34 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -548,7 +548,7 @@ int kvm_apic_set_irq(struct kvm_vcpu *vcpu, struct kvm_lapic_irq *irq,
 }
 
 int kvm_pv_send_ipi(struct kvm *kvm, unsigned long ipi_bitmap_low,
-                    unsigned long ipi_bitmap_high, int min,
+                    unsigned long ipi_bitmap_high, u32 min,
                     unsigned long icr, int op_64_bit)
 {
         int i;
@@ -571,18 +571,31 @@ int kvm_pv_send_ipi(struct kvm *kvm, unsigned long ipi_bitmap_low,
         rcu_read_lock();
         map = rcu_dereference(kvm->arch.apic_map);
 
+        if (min > map->max_apic_id)
+                goto out;
         /* Bits above cluster_size are masked in the caller.  */
-        for_each_set_bit(i, &ipi_bitmap_low, BITS_PER_LONG) {
-                vcpu = map->phys_map[min + i]->vcpu;
-                count += kvm_apic_set_irq(vcpu, &irq, NULL);
+        for_each_set_bit(i, &ipi_bitmap_low,
+                min((u32)BITS_PER_LONG, (map->max_apic_id - min + 1))) {
+                if (map->phys_map[min + i]) {
+                        vcpu = map->phys_map[min + i]->vcpu;
+                        count += kvm_apic_set_irq(vcpu, &irq, NULL);
+                }
         }
 
         min += cluster_size;
-        for_each_set_bit(i, &ipi_bitmap_high, BITS_PER_LONG) {
-                vcpu = map->phys_map[min + i]->vcpu;
-                count += kvm_apic_set_irq(vcpu, &irq, NULL);
+
+        if (min > map->max_apic_id)
+                goto out;
+
+        for_each_set_bit(i, &ipi_bitmap_high,
+                min((u32)BITS_PER_LONG, (map->max_apic_id - min + 1))) {
+                if (map->phys_map[min + i]) {
+                        vcpu = map->phys_map[min + i]->vcpu;
+                        count += kvm_apic_set_irq(vcpu, &irq, NULL);
+                }
         }
 
+out:
         rcu_read_unlock();
         return count;
 }
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index a282321329b5..e24ea7067373 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -1853,11 +1853,6 @@ static int kvm_handle_hva(struct kvm *kvm, unsigned long hva,
         return kvm_handle_hva_range(kvm, hva, hva + 1, data, handler);
 }
 
-int kvm_unmap_hva(struct kvm *kvm, unsigned long hva)
-{
-        return kvm_handle_hva(kvm, hva, 0, kvm_unmap_rmapp);
-}
-
 int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end)
 {
         return kvm_handle_hva_range(kvm, start, end, 0, kvm_unmap_rmapp);
@@ -5217,7 +5212,7 @@ static int make_mmu_pages_available(struct kvm_vcpu *vcpu)
 int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u64 error_code,
                        void *insn, int insn_len)
 {
-        int r, emulation_type = EMULTYPE_RETRY;
+        int r, emulation_type = 0;
         enum emulation_result er;
         bool direct = vcpu->arch.mmu.direct_map;
 
@@ -5230,10 +5225,8 @@ int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u64 error_code,
         r = RET_PF_INVALID;
         if (unlikely(error_code & PFERR_RSVD_MASK)) {
                 r = handle_mmio_page_fault(vcpu, cr2, direct);
-                if (r == RET_PF_EMULATE) {
-                        emulation_type = 0;
+                if (r == RET_PF_EMULATE)
                         goto emulate;
-                }
         }
 
         if (r == RET_PF_INVALID) {
@@ -5260,8 +5253,19 @@ int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u64 error_code,
                 return 1;
         }
 
-        if (mmio_info_in_cache(vcpu, cr2, direct))
-                emulation_type = 0;
+        /*
+         * vcpu->arch.mmu.page_fault returned RET_PF_EMULATE, but we can still
+         * optimistically try to just unprotect the page and let the processor
+         * re-execute the instruction that caused the page fault.  Do not allow
+         * retrying MMIO emulation, as it's not only pointless but could also
+         * cause us to enter an infinite loop because the processor will keep
+         * faulting on the non-existent MMIO address.  Retrying an instruction
+         * from a nested guest is also pointless and dangerous as we are only
+         * explicitly shadowing L1's page tables, i.e. unprotecting something
+         * for L1 isn't going to magically fix whatever issue cause L2 to fail.
+         */
+        if (!mmio_info_in_cache(vcpu, cr2, direct) && !is_guest_mode(vcpu))
+                emulation_type = EMULTYPE_ALLOW_RETRY;
 emulate:
         /*
          * On AMD platforms, under certain conditions insn_len may be zero on #NPF.
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 6276140044d0..89c4c5aa15f1 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -776,7 +776,7 @@ static void skip_emulated_instruction(struct kvm_vcpu *vcpu)
         }
 
         if (!svm->next_rip) {
-                if (emulate_instruction(vcpu, EMULTYPE_SKIP) !=
+                if (kvm_emulate_instruction(vcpu, EMULTYPE_SKIP) !=
                                 EMULATE_DONE)
                         printk(KERN_DEBUG "%s: NOP\n", __func__);
                 return;
@@ -2715,7 +2715,7 @@ static int gp_interception(struct vcpu_svm *svm)
 
         WARN_ON_ONCE(!enable_vmware_backdoor);
 
-        er = emulate_instruction(vcpu,
+        er = kvm_emulate_instruction(vcpu,
                 EMULTYPE_VMWARE | EMULTYPE_NO_UD_ON_FAIL);
         if (er == EMULATE_USER_EXIT)
                 return 0;
@@ -2819,7 +2819,7 @@ static int io_interception(struct vcpu_svm *svm)
         string = (io_info & SVM_IOIO_STR_MASK) != 0;
         in = (io_info & SVM_IOIO_TYPE_MASK) != 0;
         if (string)
-                return emulate_instruction(vcpu, 0) == EMULATE_DONE;
+                return kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE;
 
         port = io_info >> 16;
         size = (io_info & SVM_IOIO_SIZE_MASK) >> SVM_IOIO_SIZE_SHIFT;
@@ -3861,7 +3861,7 @@ static int iret_interception(struct vcpu_svm *svm)
 static int invlpg_interception(struct vcpu_svm *svm)
 {
         if (!static_cpu_has(X86_FEATURE_DECODEASSISTS))
-                return emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE;
+                return kvm_emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE;
 
         kvm_mmu_invlpg(&svm->vcpu, svm->vmcb->control.exit_info_1);
         return kvm_skip_emulated_instruction(&svm->vcpu);
@@ -3869,13 +3869,13 @@ static int invlpg_interception(struct vcpu_svm *svm)
 
 static int emulate_on_interception(struct vcpu_svm *svm)
 {
-        return emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE;
+        return kvm_emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE;
 }
 
 static int rsm_interception(struct vcpu_svm *svm)
 {
-        return x86_emulate_instruction(&svm->vcpu, 0, 0,
-                                       rsm_ins_bytes, 2) == EMULATE_DONE;
+        return kvm_emulate_instruction_from_buffer(&svm->vcpu,
+                                        rsm_ins_bytes, 2) == EMULATE_DONE;
 }
 
 static int rdpmc_interception(struct vcpu_svm *svm)
@@ -4700,7 +4700,7 @@ static int avic_unaccelerated_access_interception(struct vcpu_svm *svm)
                 ret = avic_unaccel_trap_write(svm);
         } else {
                 /* Handling Fault */
-                ret = (emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE);
+                ret = (kvm_emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE);
         }
 
         return ret;
@@ -6747,7 +6747,7 @@ e_free:
 static int sev_dbg_crypt(struct kvm *kvm, struct kvm_sev_cmd *argp, bool dec)
 {
         unsigned long vaddr, vaddr_end, next_vaddr;
-        unsigned long dst_vaddr, dst_vaddr_end;
+        unsigned long dst_vaddr;
         struct page **src_p, **dst_p;
         struct kvm_sev_dbg debug;
         unsigned long n;
@@ -6763,7 +6763,6 @@ static int sev_dbg_crypt(struct kvm *kvm, struct kvm_sev_cmd *argp, bool dec)
         size = debug.len;
         vaddr_end = vaddr + size;
         dst_vaddr = debug.dst_uaddr;
-        dst_vaddr_end = dst_vaddr + size;
 
         for (; vaddr < vaddr_end; vaddr = next_vaddr) {
                 int len, s_off, d_off;
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 1d26f3c4985b..533a327372c8 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -6983,7 +6983,7 @@ static int handle_rmode_exception(struct kvm_vcpu *vcpu,
          * Cause the #SS fault with 0 error code in VM86 mode.
          */
         if (((vec == GP_VECTOR) || (vec == SS_VECTOR)) && err_code == 0) {
-                if (emulate_instruction(vcpu, 0) == EMULATE_DONE) {
+                if (kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE) {
                         if (vcpu->arch.halt_request) {
                                 vcpu->arch.halt_request = 0;
                                 return kvm_vcpu_halt(vcpu);
@@ -7054,7 +7054,7 @@ static int handle_exception(struct kvm_vcpu *vcpu)
 
         if (!vmx->rmode.vm86_active && is_gp_fault(intr_info)) {
                 WARN_ON_ONCE(!enable_vmware_backdoor);
-                er = emulate_instruction(vcpu,
+                er = kvm_emulate_instruction(vcpu,
                         EMULTYPE_VMWARE | EMULTYPE_NO_UD_ON_FAIL);
                 if (er == EMULATE_USER_EXIT)
                         return 0;
@@ -7157,7 +7157,7 @@ static int handle_io(struct kvm_vcpu *vcpu)
         ++vcpu->stat.io_exits;
 
         if (string)
-                return emulate_instruction(vcpu, 0) == EMULATE_DONE;
+                return kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE;
 
         port = exit_qualification >> 16;
         size = (exit_qualification & 7) + 1;
@@ -7231,7 +7231,7 @@ static int handle_set_cr4(struct kvm_vcpu *vcpu, unsigned long val)
 static int handle_desc(struct kvm_vcpu *vcpu)
 {
         WARN_ON(!(vcpu->arch.cr4 & X86_CR4_UMIP));
-        return emulate_instruction(vcpu, 0) == EMULATE_DONE;
+        return kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE;
 }
 
 static int handle_cr(struct kvm_vcpu *vcpu)
@@ -7480,7 +7480,7 @@ static int handle_vmcall(struct kvm_vcpu *vcpu)
 
 static int handle_invd(struct kvm_vcpu *vcpu)
 {
-        return emulate_instruction(vcpu, 0) == EMULATE_DONE;
+        return kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE;
 }
 
 static int handle_invlpg(struct kvm_vcpu *vcpu)
@@ -7547,7 +7547,7 @@ static int handle_apic_access(struct kvm_vcpu *vcpu)
                         return kvm_skip_emulated_instruction(vcpu);
                 }
         }
-        return emulate_instruction(vcpu, 0) == EMULATE_DONE;
+        return kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE;
 }
 
 static int handle_apic_eoi_induced(struct kvm_vcpu *vcpu)
@@ -7704,8 +7704,8 @@ static int handle_ept_misconfig(struct kvm_vcpu *vcpu)
                 if (!static_cpu_has(X86_FEATURE_HYPERVISOR))
                         return kvm_skip_emulated_instruction(vcpu);
                 else
-                        return x86_emulate_instruction(vcpu, gpa, EMULTYPE_SKIP,
-                                                       NULL, 0) == EMULATE_DONE;
+                        return kvm_emulate_instruction(vcpu, EMULTYPE_SKIP) ==
+                                                                EMULATE_DONE;
         }
 
         return kvm_mmu_page_fault(vcpu, gpa, PFERR_RSVD_MASK, NULL, 0);
@@ -7748,7 +7748,7 @@ static int handle_invalid_guest_state(struct kvm_vcpu *vcpu)
                 if (kvm_test_request(KVM_REQ_EVENT, vcpu))
                         return 1;
 
-                err = emulate_instruction(vcpu, 0);
+                err = kvm_emulate_instruction(vcpu, 0);
 
                 if (err == EMULATE_USER_EXIT) {
                         ++vcpu->stat.mmio_exits;
@@ -12537,8 +12537,11 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, u32 *exit_qual)
         struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
         bool from_vmentry = !!exit_qual;
         u32 dummy_exit_qual;
+        u32 vmcs01_cpu_exec_ctrl;
         int r = 0;
 
+        vmcs01_cpu_exec_ctrl = vmcs_read32(CPU_BASED_VM_EXEC_CONTROL);
+
         enter_guest_mode(vcpu);
 
         if (!(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS))
@@ -12575,6 +12578,25 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, u32 *exit_qual)
         }
 
         /*
+         * If L1 had a pending IRQ/NMI until it executed
+         * VMLAUNCH/VMRESUME which wasn't delivered because it was
+         * disallowed (e.g. interrupts disabled), L0 needs to
+         * evaluate if this pending event should cause an exit from L2
+         * to L1 or delivered directly to L2 (e.g. In case L1 don't
+         * intercept EXTERNAL_INTERRUPT).
+         *
+         * Usually this would be handled by L0 requesting a
+         * IRQ/NMI window by setting VMCS accordingly. However,
+         * this setting was done on VMCS01 and now VMCS02 is active
+         * instead. Thus, we force L0 to perform pending event
+         * evaluation by requesting a KVM_REQ_EVENT.
+         */
+        if (vmcs01_cpu_exec_ctrl &
+                (CPU_BASED_VIRTUAL_INTR_PENDING | CPU_BASED_VIRTUAL_NMI_PENDING)) {
+                kvm_make_request(KVM_REQ_EVENT, vcpu);
+        }
+
+        /*
          * Note no nested_vmx_succeed or nested_vmx_fail here. At this point
          * we are no longer running L1, and VMLAUNCH/VMRESUME has not yet
          * returned as far as L1 is concerned. It will only return (and set
@@ -13988,9 +14010,6 @@ static int vmx_set_nested_state(struct kvm_vcpu *vcpu,
             check_vmentry_postreqs(vcpu, vmcs12, &exit_qual))
                 return -EINVAL;
 
-        if (kvm_state->flags & KVM_STATE_NESTED_RUN_PENDING)
-                vmx->nested.nested_run_pending = 1;
-
         vmx->nested.dirty_vmcs12 = true;
         ret = enter_vmx_non_root_mode(vcpu, NULL);
         if (ret)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 506bd2b4b8bb..542f6315444d 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -4987,7 +4987,7 @@ int handle_ud(struct kvm_vcpu *vcpu)
                 emul_type = 0;
         }
 
-        er = emulate_instruction(vcpu, emul_type);
+        er = kvm_emulate_instruction(vcpu, emul_type);
         if (er == EMULATE_USER_EXIT)
                 return 0;
         if (er != EMULATE_DONE)
@@ -5870,7 +5870,10 @@ static bool reexecute_instruction(struct kvm_vcpu *vcpu, gva_t cr2,
         gpa_t gpa = cr2;
         kvm_pfn_t pfn;
 
-        if (emulation_type & EMULTYPE_NO_REEXECUTE)
+        if (!(emulation_type & EMULTYPE_ALLOW_RETRY))
+                return false;
+
+        if (WARN_ON_ONCE(is_guest_mode(vcpu)))
                 return false;
 
         if (!vcpu->arch.mmu.direct_map) {
@@ -5958,7 +5961,10 @@ static bool retry_instruction(struct x86_emulate_ctxt *ctxt,
          */
         vcpu->arch.last_retry_eip = vcpu->arch.last_retry_addr = 0;
 
-        if (!(emulation_type & EMULTYPE_RETRY))
+        if (!(emulation_type & EMULTYPE_ALLOW_RETRY))
+                return false;
+
+        if (WARN_ON_ONCE(is_guest_mode(vcpu)))
                 return false;
 
         if (x86_page_table_writing_insn(ctxt))
@@ -6276,7 +6282,19 @@ restart:
 
         return r;
 }
-EXPORT_SYMBOL_GPL(x86_emulate_instruction);
+
+int kvm_emulate_instruction(struct kvm_vcpu *vcpu, int emulation_type)
+{
+        return x86_emulate_instruction(vcpu, 0, emulation_type, NULL, 0);
+}
+EXPORT_SYMBOL_GPL(kvm_emulate_instruction);
+
+int kvm_emulate_instruction_from_buffer(struct kvm_vcpu *vcpu,
+                                        void *insn, int insn_len)
+{
+        return x86_emulate_instruction(vcpu, 0, 0, insn, insn_len);
+}
+EXPORT_SYMBOL_GPL(kvm_emulate_instruction_from_buffer);
 
 static int kvm_fast_pio_out(struct kvm_vcpu *vcpu, int size,
                             unsigned short port)
@@ -7734,7 +7752,7 @@ static inline int complete_emulated_io(struct kvm_vcpu *vcpu)
 {
         int r;
         vcpu->srcu_idx = srcu_read_lock(&vcpu->kvm->srcu);
-        r = emulate_instruction(vcpu, EMULTYPE_NO_DECODE);
+        r = kvm_emulate_instruction(vcpu, EMULTYPE_NO_DECODE);
         srcu_read_unlock(&vcpu->kvm->srcu, vcpu->srcu_idx);
         if (r != EMULATE_DONE)
                 return 0;
diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index 257f27620bc2..67b9568613f3 100644
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -274,6 +274,8 @@ int kvm_mtrr_get_msr(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata);
 bool kvm_mtrr_check_gfn_range_consistency(struct kvm_vcpu *vcpu, gfn_t gfn,
                                           int page_num);
 bool kvm_vector_hashing_enabled(void);
+int x86_emulate_instruction(struct kvm_vcpu *vcpu, unsigned long cr2,
+                            int emulation_type, void *insn, int insn_len);
 
 #define KVM_SUPPORTED_XCR0     (XFEATURE_MASK_FP | XFEATURE_MASK_SSE \
                                 | XFEATURE_MASK_YMM | XFEATURE_MASK_BNDREGS \
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index e848a4811785..ae394552fb94 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -269,7 +269,7 @@ static void mop_up_one_pmd(struct mm_struct *mm, pgd_t *pgdp)
         if (pgd_val(pgd) != 0) {
                 pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
 
-                *pgdp = native_make_pgd(0);
+                pgd_clear(pgdp);
 
                 paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
                 pmd_free(mm, pmd);
@@ -494,7 +494,7 @@ int ptep_set_access_flags(struct vm_area_struct *vma,
         int changed = !pte_same(*ptep, entry);
 
         if (changed && dirty)
-                *ptep = entry;
+                set_pte(ptep, entry);
 
         return changed;
 }
@@ -509,7 +509,7 @@ int pmdp_set_access_flags(struct vm_area_struct *vma,
         VM_BUG_ON(address & ~HPAGE_PMD_MASK);
 
         if (changed && dirty) {
-                *pmdp = entry;
+                set_pmd(pmdp, entry);
                 /*
                  * We had a write-protection fault here and changed the pmd
                  * to to more permissive. No need to flush the TLB for that,
@@ -529,7 +529,7 @@ int pudp_set_access_flags(struct vm_area_struct *vma, unsigned long address,
         VM_BUG_ON(address & ~HPAGE_PUD_MASK);
 
         if (changed && dirty) {
-                *pudp = entry;
+                set_pud(pudp, entry);
                 /*
                  * We had a write-protection fault here and changed the pud
                  * to to more permissive. No need to flush the TLB for that,
diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
index 58c6efa9f9a9..9fe5952d117d 100644
--- a/block/bfq-cgroup.c
+++ b/block/bfq-cgroup.c
@@ -275,9 +275,9 @@ static void bfqg_and_blkg_get(struct bfq_group *bfqg)
 
 void bfqg_and_blkg_put(struct bfq_group *bfqg)
 {
-        bfqg_put(bfqg);
-
         blkg_put(bfqg_to_blkg(bfqg));
+
+        bfqg_put(bfqg);
 }
 
 /* @stats = 0 */
diff --git a/block/bio.c b/block/bio.c
index b12966e415d3..8c680a776171 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -2015,7 +2015,8 @@ int bio_associate_blkg(struct bio *bio, struct blkcg_gq *blkg)
 {
         if (unlikely(bio->bi_blkg))
                 return -EBUSY;
-        blkg_get(blkg);
+        if (!blkg_try_get(blkg))
+                return -ENODEV;
         bio->bi_blkg = blkg;
         return 0;
 }
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 694595b29b8f..c19f9078da1e 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -310,28 +310,11 @@ struct blkcg_gq *blkg_lookup_create(struct blkcg *blkcg,
         }
 }
 
-static void blkg_pd_offline(struct blkcg_gq *blkg)
-{
-        int i;
-
-        lockdep_assert_held(blkg->q->queue_lock);
-        lockdep_assert_held(&blkg->blkcg->lock);
-
-        for (i = 0; i < BLKCG_MAX_POLS; i++) {
-                struct blkcg_policy *pol = blkcg_policy[i];
-
-                if (blkg->pd[i] && !blkg->pd[i]->offline &&
-                    pol->pd_offline_fn) {
-                        pol->pd_offline_fn(blkg->pd[i]);
-                        blkg->pd[i]->offline = true;
-                }
-        }
-}
-
 static void blkg_destroy(struct blkcg_gq *blkg)
 {
         struct blkcg *blkcg = blkg->blkcg;
         struct blkcg_gq *parent = blkg->parent;
+        int i;
 
         lockdep_assert_held(blkg->q->queue_lock);
         lockdep_assert_held(&blkcg->lock);
@@ -340,6 +323,13 @@ static void blkg_destroy(struct blkcg_gq *blkg)
         WARN_ON_ONCE(list_empty(&blkg->q_node));
         WARN_ON_ONCE(hlist_unhashed(&blkg->blkcg_node));
 
+        for (i = 0; i < BLKCG_MAX_POLS; i++) {
+                struct blkcg_policy *pol = blkcg_policy[i];
+
+                if (blkg->pd[i] && pol->pd_offline_fn)
+                        pol->pd_offline_fn(blkg->pd[i]);
+        }
+
         if (parent) {
                 blkg_rwstat_add_aux(&parent->stat_bytes, &blkg->stat_bytes);
                 blkg_rwstat_add_aux(&parent->stat_ios, &blkg->stat_ios);
@@ -382,7 +372,6 @@ static void blkg_destroy_all(struct request_queue *q)
                 struct blkcg *blkcg = blkg->blkcg;
 
                 spin_lock(&blkcg->lock);
-                blkg_pd_offline(blkg);
                 blkg_destroy(blkg);
                 spin_unlock(&blkcg->lock);
         }
@@ -1053,59 +1042,64 @@ static struct cftype blkcg_legacy_files[] = {
         { }     /* terminate */
 };
 
+/*
+ * blkcg destruction is a three-stage process.
+ *
+ * 1. Destruction starts.  The blkcg_css_offline() callback is invoked
+ *    which offlines writeback.  Here we tie the next stage of blkg destruction
+ *    to the completion of writeback associated with the blkcg.  This lets us
+ *    avoid punting potentially large amounts of outstanding writeback to root
+ *    while maintaining any ongoing policies.  The next stage is triggered when
+ *    the nr_cgwbs count goes to zero.
+ *
+ * 2. When the nr_cgwbs count goes to zero, blkcg_destroy_blkgs() is called
+ *    and handles the destruction of blkgs.  Here the css reference held by
+ *    the blkg is put back eventually allowing blkcg_css_free() to be called.
+ *    This work may occur in cgwb_release_workfn() on the cgwb_release
+ *    workqueue.  Any submitted ios that fail to get the blkg ref will be
+ *    punted to the root_blkg.
+ *
+ * 3. Once the blkcg ref count goes to zero, blkcg_css_free() is called.
+ *    This finally frees the blkcg.
+ */
+
 /**
  * blkcg_css_offline - cgroup css_offline callback
  * @css: css of interest
  *
- * This function is called when @css is about to go away and responsible
- * for offlining all blkgs pd and killing all wbs associated with @css.
- * blkgs pd offline should be done while holding both q and blkcg locks.
- * As blkcg lock is nested inside q lock, this function performs reverse
- * double lock dancing.
- *
- * This is the blkcg counterpart of ioc_release_fn().
+ * This function is called when @css is about to go away.  Here the cgwbs are
+ * offlined first and only once writeback associated with the blkcg has
+ * finished do we start step 2 (see above).
  */
 static void blkcg_css_offline(struct cgroup_subsys_state *css)
 {
         struct blkcg *blkcg = css_to_blkcg(css);
-        struct blkcg_gq *blkg;
-
-        spin_lock_irq(&blkcg->lock);
-
-        hlist_for_each_entry(blkg, &blkcg->blkg_list, blkcg_node) {
-                struct request_queue *q = blkg->q;
-
-                if (spin_trylock(q->queue_lock)) {
-                        blkg_pd_offline(blkg);
-                        spin_unlock(q->queue_lock);
-                } else {
-                        spin_unlock_irq(&blkcg->lock);
-                        cpu_relax();
-                        spin_lock_irq(&blkcg->lock);
-                }
-        }
-
-        spin_unlock_irq(&blkcg->lock);
 
+        /* this prevents anyone from attaching or migrating to this blkcg */
         wb_blkcg_offline(blkcg);
+
+        /* put the base cgwb reference allowing step 2 to be triggered */
+        blkcg_cgwb_put(blkcg);
 }
 
 /**
- * blkcg_destroy_all_blkgs - destroy all blkgs associated with a blkcg
+ * blkcg_destroy_blkgs - responsible for shooting down blkgs
  * @blkcg: blkcg of interest
  *
- * This function is called when blkcg css is about to free and responsible for
- * destroying all blkgs associated with @blkcg.
- * blkgs should be removed while holding both q and blkcg locks. As blkcg lock
+ * blkgs should be removed while holding both q and blkcg locks.  As blkcg lock
  * is nested inside q lock, this function performs reverse double lock dancing.
+ * Destroying the blkgs releases the reference held on the blkcg's css allowing
+ * blkcg_css_free to eventually be called.
+ *
+ * This is the blkcg counterpart of ioc_release_fn().
  */
-static void blkcg_destroy_all_blkgs(struct blkcg *blkcg)
+void blkcg_destroy_blkgs(struct blkcg *blkcg)
 {
         spin_lock_irq(&blkcg->lock);
+
         while (!hlist_empty(&blkcg->blkg_list)) {
                 struct blkcg_gq *blkg = hlist_entry(blkcg->blkg_list.first,
-                                                    struct blkcg_gq,
-                                                    blkcg_node);
+                                                struct blkcg_gq, blkcg_node);
                 struct request_queue *q = blkg->q;
 
                 if (spin_trylock(q->queue_lock)) {
@@ -1117,6 +1111,7 @@ static void blkcg_destroy_all_blkgs(struct blkcg *blkcg)
                         spin_lock_irq(&blkcg->lock);
                 }
         }
+
         spin_unlock_irq(&blkcg->lock);
 }
 
@@ -1125,8 +1120,6 @@ static void blkcg_css_free(struct cgroup_subsys_state *css)
         struct blkcg *blkcg = css_to_blkcg(css);
         int i;
 
-        blkcg_destroy_all_blkgs(blkcg);
-
         mutex_lock(&blkcg_pol_mutex);
 
         list_del(&blkcg->all_blkcgs_node);
@@ -1189,6 +1182,7 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
         INIT_HLIST_HEAD(&blkcg->blkg_list);
 #ifdef CONFIG_CGROUP_WRITEBACK
         INIT_LIST_HEAD(&blkcg->cgwb_list);
+        refcount_set(&blkcg->cgwb_refcnt, 1);
 #endif
         list_add_tail(&blkcg->all_blkcgs_node, &all_blkcgs);
 
@@ -1480,11 +1474,8 @@ void blkcg_deactivate_policy(struct request_queue *q,
 
         list_for_each_entry(blkg, &q->blkg_list, q_node) {
                 if (blkg->pd[pol->plid]) {
-                        if (!blkg->pd[pol->plid]->offline &&
-                            pol->pd_offline_fn) {
+                        if (pol->pd_offline_fn)
                                 pol->pd_offline_fn(blkg->pd[pol->plid]);
-                                blkg->pd[pol->plid]->offline = true;
-                        }
                         pol->pd_free_fn(blkg->pd[pol->plid]);
                         blkg->pd[pol->plid] = NULL;
                 }
diff --git a/block/blk-core.c b/block/blk-core.c
index dee56c282efb..4dbc93f43b38 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -2163,9 +2163,12 @@ static inline bool bio_check_ro(struct bio *bio, struct hd_struct *part)
 {
         const int op = bio_op(bio);
 
-        if (part->policy && (op_is_write(op) && !op_is_flush(op))) {
+        if (part->policy && op_is_write(op)) {
                 char b[BDEVNAME_SIZE];
 
+                if (op_is_flush(bio->bi_opf) && !bio_sectors(bio))
+                        return false;
+
                 WARN_ONCE(1,
                        "generic_make_request: Trying to write "
                         "to read-only block-device %s (partno %d)\n",
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index a3eede00d302..01d0620a4e4a 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -2129,8 +2129,9 @@ static inline void throtl_update_latency_buckets(struct throtl_data *td)
 static void blk_throtl_assoc_bio(struct throtl_grp *tg, struct bio *bio)
 {
 #ifdef CONFIG_BLK_DEV_THROTTLING_LOW
-        if (bio->bi_css)
-                bio_associate_blkg(bio, tg_to_blkg(tg));
+        /* fallback to root_blkg if we fail to get a blkg ref */
+        if (bio->bi_css && (bio_associate_blkg(bio, tg_to_blkg(tg)) == -ENODEV))
+                bio_associate_blkg(bio, bio->bi_disk->queue->root_blkg);
         bio_issue_init(&bio->bi_issue, bio_sectors(bio));
 #endif
 }
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index 9706613eecf9..bf64cfa30feb 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -879,7 +879,7 @@ static void acpi_lpss_dismiss(struct device *dev)
 #define LPSS_GPIODEF0_DMA_LLP           BIT(13)
 
 static DEFINE_MUTEX(lpss_iosf_mutex);
-static bool lpss_iosf_d3_entered;
+static bool lpss_iosf_d3_entered = true;
 
 static void lpss_iosf_enter_d3_state(void)
 {
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 292088fcc624..d2e29a19890d 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -35,11 +35,11 @@
 #include <linux/delay.h>
 #ifdef CONFIG_X86
 #include <asm/mpspec.h>
+#include <linux/dmi.h>
 #endif
 #include <linux/acpi_iort.h>
 #include <linux/pci.h>
 #include <acpi/apei.h>
-#include <linux/dmi.h>
 #include <linux/suspend.h>
 
 #include "internal.h"
@@ -82,10 +82,6 @@ static const struct dmi_system_id dsdt_dmi_table[] __initconst = {
         },
         {}
 };
-#else
-static const struct dmi_system_id dsdt_dmi_table[] __initconst = {
-        {}
-};
 #endif
 
 /* --------------------------------------------------------------------------
@@ -1033,11 +1029,16 @@ void __init acpi_early_init(void)
 
         acpi_permanent_mmap = true;
 
+#ifdef CONFIG_X86
         /*
          * If the machine falls into the DMI check table,
-         * DSDT will be copied to memory
+         * DSDT will be copied to memory.
+         * Note that calling dmi_check_system() here on other architectures
+         * would not be OK because only x86 initializes dmi early enough.
+         * Thankfully only x86 systems need such quirks for now.
          */
         dmi_check_system(dsdt_dmi_table);
+#endif
 
         status = acpi_reallocate_root_table();
         if (ACPI_FAILURE(status)) {
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 172e32840256..599e01bcdef2 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -7394,4 +7394,4 @@ EXPORT_SYMBOL_GPL(ata_cable_unknown);
 EXPORT_SYMBOL_GPL(ata_cable_ignore);
 EXPORT_SYMBOL_GPL(ata_cable_sata);
 EXPORT_SYMBOL_GPL(ata_host_get);
-EXPORT_SYMBOL_GPL(ata_host_put);
\ No newline at end of file
+EXPORT_SYMBOL_GPL(ata_host_put);
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index c8a1cb0b6136..817320c7c4c1 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -417,25 +417,23 @@ static ssize_t show_valid_zones(struct device *dev,
         int nid;
 
         /*
-         * The block contains more than one zone can not be offlined.
-         * This can happen e.g. for ZONE_DMA and ZONE_DMA32
-         */
-        if (!test_pages_in_a_zone(start_pfn, start_pfn + nr_pages, &valid_start_pfn, &valid_end_pfn))
-                return sprintf(buf, "none\n");
-
-        start_pfn = valid_start_pfn;
-        nr_pages = valid_end_pfn - start_pfn;
-
-        /*
          * Check the existing zone. Make sure that we do that only on the
          * online nodes otherwise the page_zone is not reliable
          */
         if (mem->state == MEM_ONLINE) {
+                /*
+                 * The block contains more than one zone can not be offlined.
+                 * This can happen e.g. for ZONE_DMA and ZONE_DMA32
+                 */
+                if (!test_pages_in_a_zone(start_pfn, start_pfn + nr_pages,
+                                          &valid_start_pfn, &valid_end_pfn))
+                        return sprintf(buf, "none\n");
+                start_pfn = valid_start_pfn;
                 strcat(buf, page_zone(pfn_to_page(start_pfn))->name);
                 goto out;
         }
 
-        nid = pfn_to_nid(start_pfn);
+        nid = mem->nid;
         default_zone = zone_for_pfn_range(MMOP_ONLINE_KEEP, nid, start_pfn, nr_pages);
         strcat(buf, default_zone->name);
 
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 3863c00372bb..14a51254c3db 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1239,6 +1239,9 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
         case NBD_SET_SOCK:
                 return nbd_add_socket(nbd, arg, false);
         case NBD_SET_BLKSIZE:
+                if (!arg || !is_power_of_2(arg) || arg < 512 ||
+                    arg > PAGE_SIZE)
+                        return -EINVAL;
                 nbd_size_set(nbd, arg,
                              div_s64(config->bytesize, arg));
                 return 0;
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 7915f3b03736..73ed5f3a862d 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -4207,11 +4207,13 @@ static ssize_t rbd_parent_show(struct device *dev,
 
                 count += sprintf(&buf[count], "%s"
                             "pool_id %llu\npool_name %s\n"
+                            "pool_ns %s\n"
                             "image_id %s\nimage_name %s\n"
                             "snap_id %llu\nsnap_name %s\n"
                             "overlap %llu\n",
                             !count ? "" : "\n", /* first? */
                             spec->pool_id, spec->pool_name,
+                            spec->pool_ns ?: "",
                             spec->image_id, spec->image_name ?: "(unknown)",
                             spec->snap_id, spec->snap_name,
                             rbd_dev->parent_overlap);
@@ -4584,47 +4586,177 @@ static int rbd_dev_v2_features(struct rbd_device *rbd_dev)
                                                 &rbd_dev->header.features);
 }
 
+struct parent_image_info {
+        u64             pool_id;
+        const char      *pool_ns;
+        const char      *image_id;
+        u64             snap_id;
+
+        bool            has_overlap;
+        u64             overlap;
+};
+
+/*
+ * The caller is responsible for @pii.
+ */
+static int decode_parent_image_spec(void **p, void *end,
+                                    struct parent_image_info *pii)
+{
+        u8 struct_v;
+        u32 struct_len;
+        int ret;
+
+        ret = ceph_start_decoding(p, end, 1, "ParentImageSpec",
+                                  &struct_v, &struct_len);
+        if (ret)
+                return ret;
+
+        ceph_decode_64_safe(p, end, pii->pool_id, e_inval);
+        pii->pool_ns = ceph_extract_encoded_string(p, end, NULL, GFP_KERNEL);
+        if (IS_ERR(pii->pool_ns)) {
+                ret = PTR_ERR(pii->pool_ns);
+                pii->pool_ns = NULL;
+                return ret;
+        }
+        pii->image_id = ceph_extract_encoded_string(p, end, NULL, GFP_KERNEL);
+        if (IS_ERR(pii->image_id)) {
+                ret = PTR_ERR(pii->image_id);
+                pii->image_id = NULL;
+                return ret;
+        }
+        ceph_decode_64_safe(p, end, pii->snap_id, e_inval);
+        return 0;
+
+e_inval:
+        return -EINVAL;
+}
+
+static int __get_parent_info(struct rbd_device *rbd_dev,
+                             struct page *req_page,
+                             struct page *reply_page,
+                             struct parent_image_info *pii)
+{
+        struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
+        size_t reply_len = PAGE_SIZE;
+        void *p, *end;
+        int ret;
+
+        ret = ceph_osdc_call(osdc, &rbd_dev->header_oid, &rbd_dev->header_oloc,
+                             "rbd", "parent_get", CEPH_OSD_FLAG_READ,
+                             req_page, sizeof(u64), reply_page, &reply_len);
+        if (ret)
+                return ret == -EOPNOTSUPP ? 1 : ret;
+
+        p = page_address(reply_page);
+        end = p + reply_len;
+        ret = decode_parent_image_spec(&p, end, pii);
+        if (ret)
+                return ret;
+
+        ret = ceph_osdc_call(osdc, &rbd_dev->header_oid, &rbd_dev->header_oloc,
+                             "rbd", "parent_overlap_get", CEPH_OSD_FLAG_READ,
+                             req_page, sizeof(u64), reply_page, &reply_len);
+        if (ret)
+                return ret;
+
+        p = page_address(reply_page);
+        end = p + reply_len;
+        ceph_decode_8_safe(&p, end, pii->has_overlap, e_inval);
+        if (pii->has_overlap)
+                ceph_decode_64_safe(&p, end, pii->overlap, e_inval);
+
+        return 0;
+
+e_inval:
+        return -EINVAL;
+}
+
+/*
+ * The caller is responsible for @pii.
+ */
+static int __get_parent_info_legacy(struct rbd_device *rbd_dev,
+                                    struct page *req_page,
+                                    struct page *reply_page,
+                                    struct parent_image_info *pii)
+{
+        struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
+        size_t reply_len = PAGE_SIZE;
+        void *p, *end;
+        int ret;
+
+        ret = ceph_osdc_call(osdc, &rbd_dev->header_oid, &rbd_dev->header_oloc,
+                             "rbd", "get_parent", CEPH_OSD_FLAG_READ,
+                             req_page, sizeof(u64), reply_page, &reply_len);
+        if (ret)
+                return ret;
+
+        p = page_address(reply_page);
+        end = p + reply_len;
+        ceph_decode_64_safe(&p, end, pii->pool_id, e_inval);
+        pii->image_id = ceph_extract_encoded_string(&p, end, NULL, GFP_KERNEL);
+        if (IS_ERR(pii->image_id)) {
+                ret = PTR_ERR(pii->image_id);
+                pii->image_id = NULL;
+                return ret;
+        }
+        ceph_decode_64_safe(&p, end, pii->snap_id, e_inval);
+        pii->has_overlap = true;
+        ceph_decode_64_safe(&p, end, pii->overlap, e_inval);
+
+        return 0;
+
+e_inval:
+        return -EINVAL;
+}
+
+static int get_parent_info(struct rbd_device *rbd_dev,
+                           struct parent_image_info *pii)
+{
+        struct page *req_page, *reply_page;
+        void *p;
+        int ret;
+
+        req_page = alloc_page(GFP_KERNEL);
+        if (!req_page)
+                return -ENOMEM;
+
+        reply_page = alloc_page(GFP_KERNEL);
+        if (!reply_page) {
+                __free_page(req_page);
+                return -ENOMEM;
+        }
+
+        p = page_address(req_page);
+        ceph_encode_64(&p, rbd_dev->spec->snap_id);
+        ret = __get_parent_info(rbd_dev, req_page, reply_page, pii);
+        if (ret > 0)
+                ret = __get_parent_info_legacy(rbd_dev, req_page, reply_page,
+                                               pii);
+
+        __free_page(req_page);
+        __free_page(reply_page);
+        return ret;
+}
+
 static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
 {
         struct rbd_spec *parent_spec;
-        size_t size;
-        void *reply_buf = NULL;
-        __le64 snapid;
-        void *p;
-        void *end;
-        u64 pool_id;
-        char *image_id;
-        u64 snap_id;
-        u64 overlap;
+        struct parent_image_info pii = { 0 };
         int ret;
 
         parent_spec = rbd_spec_alloc();
         if (!parent_spec)
                 return -ENOMEM;
 
-        size = sizeof (__le64) +                                /* pool_id */
-                sizeof (__le32) + RBD_IMAGE_ID_LEN_MAX +        /* image_id */
-                sizeof (__le64) +                               /* snap_id */
-                sizeof (__le64);                                /* overlap */
-        reply_buf = kmalloc(size, GFP_KERNEL);
-        if (!reply_buf) {
-                ret = -ENOMEM;
+        ret = get_parent_info(rbd_dev, &pii);
+        if (ret)
                 goto out_err;
-        }
 
-        snapid = cpu_to_le64(rbd_dev->spec->snap_id);
-        ret = rbd_obj_method_sync(rbd_dev, &rbd_dev->header_oid,
-                                  &rbd_dev->header_oloc, "get_parent",
-                                  &snapid, sizeof(snapid), reply_buf, size);
-        dout("%s: rbd_obj_method_sync returned %d\n", __func__, ret);
-        if (ret < 0)
-                goto out_err;
+        dout("%s pool_id %llu pool_ns %s image_id %s snap_id %llu has_overlap %d overlap %llu\n",
+             __func__, pii.pool_id, pii.pool_ns, pii.image_id, pii.snap_id,
+             pii.has_overlap, pii.overlap);
 
-        p = reply_buf;
-        end = reply_buf + ret;
-        ret = -ERANGE;
-        ceph_decode_64_safe(&p, end, pool_id, out_err);
-        if (pool_id == CEPH_NOPOOL) {
+        if (pii.pool_id == CEPH_NOPOOL || !pii.has_overlap) {
                 /*
                  * Either the parent never existed, or we have
                  * record of it but the image got flattened so it no
@@ -4633,6 +4765,10 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
                  * overlap to 0.  The effect of this is that all new
                  * requests will be treated as if the image had no
                  * parent.
+                 *
+                 * If !pii.has_overlap, the parent image spec is not
+                 * applicable.  It's there to avoid duplication in each
+                 * snapshot record.
                  */
                 if (rbd_dev->parent_overlap) {
                         rbd_dev->parent_overlap = 0;
@@ -4647,51 +4783,36 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
         /* The ceph file layout needs to fit pool id in 32 bits */
 
         ret = -EIO;
-        if (pool_id > (u64)U32_MAX) {
+        if (pii.pool_id > (u64)U32_MAX) {
                 rbd_warn(NULL, "parent pool id too large (%llu > %u)",
-                        (unsigned long long)pool_id, U32_MAX);
+                        (unsigned long long)pii.pool_id, U32_MAX);
                 goto out_err;
         }
 
-        image_id = ceph_extract_encoded_string(&p, end, NULL, GFP_KERNEL);
-        if (IS_ERR(image_id)) {
-                ret = PTR_ERR(image_id);
-                goto out_err;
-        }
-        ceph_decode_64_safe(&p, end, snap_id, out_err);
-        ceph_decode_64_safe(&p, end, overlap, out_err);
-
         /*
          * The parent won't change (except when the clone is
          * flattened, already handled that).  So we only need to
          * record the parent spec we have not already done so.
          */
         if (!rbd_dev->parent_spec) {
-                parent_spec->pool_id = pool_id;
-                parent_spec->image_id = image_id;
-                parent_spec->snap_id = snap_id;
-
-                /* TODO: support cloning across namespaces */
-                if (rbd_dev->spec->pool_ns) {
-                        parent_spec->pool_ns = kstrdup(rbd_dev->spec->pool_ns,
-                                                       GFP_KERNEL);
-                        if (!parent_spec->pool_ns) {
-                                ret = -ENOMEM;
-                                goto out_err;
-                        }
+                parent_spec->pool_id = pii.pool_id;
+                if (pii.pool_ns && *pii.pool_ns) {
+                        parent_spec->pool_ns = pii.pool_ns;
+                        pii.pool_ns = NULL;
                 }
+                parent_spec->image_id = pii.image_id;
+                pii.image_id = NULL;
+                parent_spec->snap_id = pii.snap_id;
 
                 rbd_dev->parent_spec = parent_spec;
                 parent_spec = NULL;     /* rbd_dev now owns this */
-        } else {
-                kfree(image_id);
         }
 
         /*
          * We always update the parent overlap.  If it's zero we issue
          * a warning, as we will proceed as if there was no parent.
          */
-        if (!overlap) {
+        if (!pii.overlap) {
                 if (parent_spec) {
                         /* refresh, careful to warn just once */
                         if (rbd_dev->parent_overlap)
@@ -4702,14 +4823,14 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
                         rbd_warn(rbd_dev, "clone is standalone (overlap 0)");
                 }
         }
-        rbd_dev->parent_overlap = overlap;
+        rbd_dev->parent_overlap = pii.overlap;
 
 out:
         ret = 0;
 out_err:
-        kfree(reply_buf);
+        kfree(pii.pool_ns);
+        kfree(pii.image_id);
         rbd_spec_put(parent_spec);
-
         return ret;
 }
 
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index ce277ee0a28a..40728491f37b 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -566,5 +566,5 @@ config RANDOM_TRUST_CPU
         that CPU manufacturer (perhaps with the insistence or mandate
         of a Nation State's intelligence or law enforcement agencies)
         has not installed a hidden back door to compromise the CPU's
-        random number generation facilities.
-
+        random number generation facilities. This can also be configured
+        at boot with "random.trust_cpu=on/off".
diff --git a/drivers/char/random.c b/drivers/char/random.c
index bf5f99fc36f1..c75b6cdf0053 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -779,6 +779,13 @@ static struct crng_state **crng_node_pool __read_mostly;
 
 static void invalidate_batched_entropy(void);
 
+static bool trust_cpu __ro_after_init = IS_ENABLED(CONFIG_RANDOM_TRUST_CPU);
+static int __init parse_trust_cpu(char *arg)
+{
+        return kstrtobool(arg, &trust_cpu);
+}
+early_param("random.trust_cpu", parse_trust_cpu);
+
 static void crng_initialize(struct crng_state *crng)
 {
         int             i;
@@ -799,12 +806,10 @@ static void crng_initialize(struct crng_state *crng)
                 }
                 crng->state[i] ^= rv;
         }
-#ifdef CONFIG_RANDOM_TRUST_CPU
-        if (arch_init) {
+        if (trust_cpu && arch_init) {
                 crng_init = 2;
                 pr_notice("random: crng done (trusting CPU's manufacturer)\n");
         }
-#endif
         crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1;
 }
 
diff --git a/drivers/dax/device.c b/drivers/dax/device.c
index 6fd46083e629..bbe4d72ca105 100644
--- a/drivers/dax/device.c
+++ b/drivers/dax/device.c
@@ -392,7 +392,8 @@ static vm_fault_t dev_dax_huge_fault(struct vm_fault *vmf,
 {
         struct file *filp = vmf->vma->vm_file;
         unsigned long fault_size;
-        int rc, id;
+        vm_fault_t rc = VM_FAULT_SIGBUS;
+        int id;
         pfn_t pfn;
         struct dev_dax *dev_dax = filp->private_data;
 
diff --git a/drivers/firmware/arm_scmi/perf.c b/drivers/firmware/arm_scmi/perf.c
index 721e6c57beae..64342944d917 100644
--- a/drivers/firmware/arm_scmi/perf.c
+++ b/drivers/firmware/arm_scmi/perf.c
@@ -166,7 +166,13 @@ scmi_perf_domain_attributes_get(const struct scmi_handle *handle, u32 domain,
                                         le32_to_cpu(attr->sustained_freq_khz);
                 dom_info->sustained_perf_level =
                                         le32_to_cpu(attr->sustained_perf_level);
-                dom_info->mult_factor = (dom_info->sustained_freq_khz * 1000) /
+                if (!dom_info->sustained_freq_khz ||
+                    !dom_info->sustained_perf_level)
+                        /* CPUFreq converts to kHz, hence default 1000 */
+                        dom_info->mult_factor = 1000;
+                else
+                        dom_info->mult_factor =
+                                        (dom_info->sustained_freq_khz * 1000) /
                                         dom_info->sustained_perf_level;
                 memcpy(dom_info->name, attr->name, SCMI_MAX_STR_SIZE);
         }
diff --git a/drivers/gpio/gpio-adp5588.c b/drivers/gpio/gpio-adp5588.c
index 3530ccd17e04..da9781a2ef4a 100644
--- a/drivers/gpio/gpio-adp5588.c
+++ b/drivers/gpio/gpio-adp5588.c
@@ -41,6 +41,8 @@ struct adp5588_gpio {
         uint8_t int_en[3];
         uint8_t irq_mask[3];
         uint8_t irq_stat[3];
+        uint8_t int_input_en[3];
+        uint8_t int_lvl_cached[3];
 };
 
 static int adp5588_gpio_read(struct i2c_client *client, u8 reg)
@@ -173,12 +175,28 @@ static void adp5588_irq_bus_sync_unlock(struct irq_data *d)
         struct adp5588_gpio *dev = irq_data_get_irq_chip_data(d);
         int i;
 
-        for (i = 0; i <= ADP5588_BANK(ADP5588_MAXGPIO); i++)
+        for (i = 0; i <= ADP5588_BANK(ADP5588_MAXGPIO); i++) {
+                if (dev->int_input_en[i]) {
+                        mutex_lock(&dev->lock);
+                        dev->dir[i] &= ~dev->int_input_en[i];
+                        dev->int_input_en[i] = 0;
+                        adp5588_gpio_write(dev->client, GPIO_DIR1 + i,
+                                           dev->dir[i]);
+                        mutex_unlock(&dev->lock);
+                }
+
+                if (dev->int_lvl_cached[i] != dev->int_lvl[i]) {
+                        dev->int_lvl_cached[i] = dev->int_lvl[i];
+                        adp5588_gpio_write(dev->client, GPIO_INT_LVL1 + i,
+                                           dev->int_lvl[i]);
+                }
+
                 if (dev->int_en[i] ^ dev->irq_mask[i]) {
                         dev->int_en[i] = dev->irq_mask[i];
                         adp5588_gpio_write(dev->client, GPIO_INT_EN1 + i,
                                            dev->int_en[i]);
                 }
+        }
 
         mutex_unlock(&dev->irq_lock);
 }
@@ -221,9 +239,7 @@ static int adp5588_irq_set_type(struct irq_data *d, unsigned int type)
         else
                 return -EINVAL;
 
-        adp5588_gpio_direction_input(&dev->gpio_chip, gpio);
-        adp5588_gpio_write(dev->client, GPIO_INT_LVL1 + bank,
-                           dev->int_lvl[bank]);
+        dev->int_input_en[bank] |= bit;
 
         return 0;
 }
diff --git a/drivers/gpio/gpio-dwapb.c b/drivers/gpio/gpio-dwapb.c
index 28da700f5f52..044888fd96a1 100644
--- a/drivers/gpio/gpio-dwapb.c
+++ b/drivers/gpio/gpio-dwapb.c
@@ -728,6 +728,7 @@ static int dwapb_gpio_probe(struct platform_device *pdev)
 out_unregister:
         dwapb_gpio_unregister(gpio);
         dwapb_irq_teardown(gpio);
+        clk_disable_unprepare(gpio->clk);
 
         return err;
 }
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index c48ed9d89ff5..8b9d7e42c600 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -25,7 +25,6 @@
 
 struct acpi_gpio_event {
         struct list_head node;
-        struct list_head initial_sync_list;
         acpi_handle handle;
         unsigned int pin;
         unsigned int irq;
@@ -49,10 +48,19 @@ struct acpi_gpio_chip {
         struct mutex conn_lock;
         struct gpio_chip *chip;
         struct list_head events;
+        struct list_head deferred_req_irqs_list_entry;
 };
 
-static LIST_HEAD(acpi_gpio_initial_sync_list);
-static DEFINE_MUTEX(acpi_gpio_initial_sync_list_lock);
+/*
+ * For gpiochips which call acpi_gpiochip_request_interrupts() before late_init
+ * (so builtin drivers) we register the ACPI GpioInt event handlers from a
+ * late_initcall_sync handler, so that other builtin drivers can register their
+ * OpRegions before the event handlers can run.  This list contains gpiochips
+ * for which the acpi_gpiochip_request_interrupts() has been deferred.
+ */
+static DEFINE_MUTEX(acpi_gpio_deferred_req_irqs_lock);
+static LIST_HEAD(acpi_gpio_deferred_req_irqs_list);
+static bool acpi_gpio_deferred_req_irqs_done;
 
 static int acpi_gpiochip_find(struct gpio_chip *gc, void *data)
 {
@@ -89,21 +97,6 @@ static struct gpio_desc *acpi_get_gpiod(char *path, int pin)
         return gpiochip_get_desc(chip, pin);
 }
 
-static void acpi_gpio_add_to_initial_sync_list(struct acpi_gpio_event *event)
-{
-        mutex_lock(&acpi_gpio_initial_sync_list_lock);
-        list_add(&event->initial_sync_list, &acpi_gpio_initial_sync_list);
-        mutex_unlock(&acpi_gpio_initial_sync_list_lock);
-}
-
-static void acpi_gpio_del_from_initial_sync_list(struct acpi_gpio_event *event)
-{
-        mutex_lock(&acpi_gpio_initial_sync_list_lock);
-        if (!list_empty(&event->initial_sync_list))
-                list_del_init(&event->initial_sync_list);
-        mutex_unlock(&acpi_gpio_initial_sync_list_lock);
-}
-
 static irqreturn_t acpi_gpio_irq_handler(int irq, void *data)
 {
         struct acpi_gpio_event *event = data;
@@ -186,7 +179,7 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
 
         gpiod_direction_input(desc);
 
-        value = gpiod_get_value(desc);
+        value = gpiod_get_value_cansleep(desc);
 
         ret = gpiochip_lock_as_irq(chip, pin);
         if (ret) {
@@ -229,7 +222,6 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
         event->irq = irq;
         event->pin = pin;
         event->desc = desc;
-        INIT_LIST_HEAD(&event->initial_sync_list);
 
         ret = request_threaded_irq(event->irq, NULL, handler, irqflags,
                                    "ACPI:Event", event);
@@ -251,10 +243,9 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
          * may refer to OperationRegions from other (builtin) drivers which
          * may be probed after us.
          */
-        if (handler == acpi_gpio_irq_handler &&
-            (((irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
-             ((irqflags & IRQF_TRIGGER_FALLING) && value == 0)))
-                acpi_gpio_add_to_initial_sync_list(event);
+        if (((irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
+            ((irqflags & IRQF_TRIGGER_FALLING) && value == 0))
+                handler(event->irq, event);
 
         return AE_OK;
 
@@ -283,6 +274,7 @@ void acpi_gpiochip_request_interrupts(struct gpio_chip *chip)
         struct acpi_gpio_chip *acpi_gpio;
         acpi_handle handle;
         acpi_status status;
+        bool defer;
 
         if (!chip->parent || !chip->to_irq)
                 return;
@@ -295,6 +287,16 @@ void acpi_gpiochip_request_interrupts(struct gpio_chip *chip)
         if (ACPI_FAILURE(status))
                 return;
 
+        mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
+        defer = !acpi_gpio_deferred_req_irqs_done;
+        if (defer)
+                list_add(&acpi_gpio->deferred_req_irqs_list_entry,
+                         &acpi_gpio_deferred_req_irqs_list);
+        mutex_unlock(&acpi_gpio_deferred_req_irqs_lock);
+
+        if (defer)
+                return;
+
         acpi_walk_resources(handle, "_AEI",
                             acpi_gpiochip_request_interrupt, acpi_gpio);
 }
@@ -325,11 +327,14 @@ void acpi_gpiochip_free_interrupts(struct gpio_chip *chip)
         if (ACPI_FAILURE(status))
                 return;
 
+        mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
+        if (!list_empty(&acpi_gpio->deferred_req_irqs_list_entry))
+                list_del_init(&acpi_gpio->deferred_req_irqs_list_entry);
+        mutex_unlock(&acpi_gpio_deferred_req_irqs_lock);
+
         list_for_each_entry_safe_reverse(event, ep, &acpi_gpio->events, node) {
                 struct gpio_desc *desc;
 
-                acpi_gpio_del_from_initial_sync_list(event);
-
                 if (irqd_is_wakeup_set(irq_get_irq_data(event->irq)))
                         disable_irq_wake(event->irq);
 
@@ -1052,6 +1057,7 @@ void acpi_gpiochip_add(struct gpio_chip *chip)
 
         acpi_gpio->chip = chip;
         INIT_LIST_HEAD(&acpi_gpio->events);
+        INIT_LIST_HEAD(&acpi_gpio->deferred_req_irqs_list_entry);
 
         status = acpi_attach_data(handle, acpi_gpio_chip_dh, acpi_gpio);
         if (ACPI_FAILURE(status)) {
@@ -1198,20 +1204,28 @@ bool acpi_can_fallback_to_crs(struct acpi_device *adev, const char *con_id)
         return con_id == NULL;
 }
 
-/* Sync the initial state of handlers after all builtin drivers have probed */
-static int acpi_gpio_initial_sync(void)
+/* Run deferred acpi_gpiochip_request_interrupts() */
+static int acpi_gpio_handle_deferred_request_interrupts(void)
 {
-        struct acpi_gpio_event *event, *ep;
+        struct acpi_gpio_chip *acpi_gpio, *tmp;
+
+        mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
+        list_for_each_entry_safe(acpi_gpio, tmp,
+                                 &acpi_gpio_deferred_req_irqs_list,
+                                 deferred_req_irqs_list_entry) {
+                acpi_handle handle;
 
-        mutex_lock(&acpi_gpio_initial_sync_list_lock);
-        list_for_each_entry_safe(event, ep, &acpi_gpio_initial_sync_list,
-                                 initial_sync_list) {
-                acpi_evaluate_object(event->handle, NULL, NULL, NULL);
-                list_del_init(&event->initial_sync_list);
+                handle = ACPI_HANDLE(acpi_gpio->chip->parent);
+                acpi_walk_resources(handle, "_AEI",
+                                    acpi_gpiochip_request_interrupt, acpi_gpio);
+
+                list_del_init(&acpi_gpio->deferred_req_irqs_list_entry);
         }
-        mutex_unlock(&acpi_gpio_initial_sync_list_lock);
+
+        acpi_gpio_deferred_req_irqs_done = true;
+        mutex_unlock(&acpi_gpio_deferred_req_irqs_lock);
 
         return 0;
 }
 /* We must use _sync so that this runs after the first deferred_probe run */
-late_initcall_sync(acpi_gpio_initial_sync);
+late_initcall_sync(acpi_gpio_handle_deferred_request_interrupts);
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index a4f1157d6aa0..d4e7a09598fa 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -31,6 +31,7 @@ static int of_gpiochip_match_node_and_xlate(struct gpio_chip *chip, void *data)
         struct of_phandle_args *gpiospec = data;
 
         return chip->gpiodev->dev.of_node == gpiospec->np &&
+                                chip->of_xlate &&
                                 chip->of_xlate(chip, gpiospec, NULL) >= 0;
 }
 
diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c b/drivers/gpu/drm/i915/gvt/dmabuf.c
index 6e3f56684f4e..51ed99a37803 100644
--- a/drivers/gpu/drm/i915/gvt/dmabuf.c
+++ b/drivers/gpu/drm/i915/gvt/dmabuf.c
@@ -170,20 +170,22 @@ static struct drm_i915_gem_object *vgpu_create_gem(struct drm_device *dev,
                 unsigned int tiling_mode = 0;
                 unsigned int stride = 0;
 
-                switch (info->drm_format_mod << 10) {
-                case PLANE_CTL_TILED_LINEAR:
+                switch (info->drm_format_mod) {
+                case DRM_FORMAT_MOD_LINEAR:
                         tiling_mode = I915_TILING_NONE;
                         break;
-                case PLANE_CTL_TILED_X:
+                case I915_FORMAT_MOD_X_TILED:
                         tiling_mode = I915_TILING_X;
                         stride = info->stride;
                         break;
-                case PLANE_CTL_TILED_Y:
+                case I915_FORMAT_MOD_Y_TILED:
+                case I915_FORMAT_MOD_Yf_TILED:
                         tiling_mode = I915_TILING_Y;
                         stride = info->stride;
                         break;
                 default:
-                        gvt_dbg_core("not supported tiling mode\n");
+                        gvt_dbg_core("invalid drm_format_mod %llx for tiling\n",
+                                     info->drm_format_mod);
                 }
                 obj->tiling_and_stride = tiling_mode | stride;
         } else {
@@ -222,9 +224,26 @@ static int vgpu_get_plane_info(struct drm_device *dev,
                 info->height = p.height;
                 info->stride = p.stride;
                 info->drm_format = p.drm_format;
-                info->drm_format_mod = p.tiled;
+
+                switch (p.tiled) {
+                case PLANE_CTL_TILED_LINEAR:
+                        info->drm_format_mod = DRM_FORMAT_MOD_LINEAR;
+                        break;
+                case PLANE_CTL_TILED_X:
+                        info->drm_format_mod = I915_FORMAT_MOD_X_TILED;
+                        break;
+                case PLANE_CTL_TILED_Y:
+                        info->drm_format_mod = I915_FORMAT_MOD_Y_TILED;
+                        break;
+                case PLANE_CTL_TILED_YF:
+                        info->drm_format_mod = I915_FORMAT_MOD_Yf_TILED;
+                        break;
+                default:
+                        gvt_vgpu_err("invalid tiling mode: %x\n", p.tiled);
+                }
+
                 info->size = (((p.stride * p.height * p.bpp) / 8) +
-                                (PAGE_SIZE - 1)) >> PAGE_SHIFT;
+                              (PAGE_SIZE - 1)) >> PAGE_SHIFT;
         } else if (plane_id == DRM_PLANE_TYPE_CURSOR) {
                 ret = intel_vgpu_decode_cursor_plane(vgpu, &c);
                 if (ret)
diff --git a/drivers/gpu/drm/i915/gvt/fb_decoder.c b/drivers/gpu/drm/i915/gvt/fb_decoder.c
index face664be3e8..481896fb712a 100644
--- a/drivers/gpu/drm/i915/gvt/fb_decoder.c
+++ b/drivers/gpu/drm/i915/gvt/fb_decoder.c
@@ -220,8 +220,7 @@ int intel_vgpu_decode_primary_plane(struct intel_vgpu *vgpu,
         if (IS_SKYLAKE(dev_priv)
                 || IS_KABYLAKE(dev_priv)
                 || IS_BROXTON(dev_priv)) {
-                plane->tiled = (val & PLANE_CTL_TILED_MASK) >>
-                _PLANE_CTL_TILED_SHIFT;
+                plane->tiled = val & PLANE_CTL_TILED_MASK;
                 fmt = skl_format_to_drm(
                         val & PLANE_CTL_FORMAT_MASK,
                         val & PLANE_CTL_ORDER_RGBX,
@@ -260,7 +259,7 @@ int intel_vgpu_decode_primary_plane(struct intel_vgpu *vgpu,
                 return  -EINVAL;
         }
 
-        plane->stride = intel_vgpu_get_stride(vgpu, pipe, (plane->tiled << 10),
+        plane->stride = intel_vgpu_get_stride(vgpu, pipe, plane->tiled,
                 (IS_SKYLAKE(dev_priv)
                 || IS_KABYLAKE(dev_priv)
                 || IS_BROXTON(dev_priv)) ?
diff --git a/drivers/gpu/drm/i915/gvt/fb_decoder.h b/drivers/gpu/drm/i915/gvt/fb_decoder.h
index cb055f3c81a2..60c155085029 100644
--- a/drivers/gpu/drm/i915/gvt/fb_decoder.h
+++ b/drivers/gpu/drm/i915/gvt/fb_decoder.h
@@ -101,7 +101,7 @@ struct intel_gvt;
 /* color space conversion and gamma correction are not included */
 struct intel_vgpu_primary_plane_format {
         u8      enabled;        /* plane is enabled */
-        u8      tiled;          /* X-tiled */
+        u32     tiled;          /* tiling mode: linear, X-tiled, Y tiled, etc */
         u8      bpp;            /* bits per pixel */
         u32     hw_format;      /* format field in the PRI_CTL register */
         u32     drm_format;     /* format in DRM definition */
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 7a58ca555197..72afa518edd9 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -1296,6 +1296,19 @@ static int power_well_ctl_mmio_write(struct intel_vgpu *vgpu,
         return 0;
 }
 
+static int gen9_dbuf_ctl_mmio_write(struct intel_vgpu *vgpu,
+                unsigned int offset, void *p_data, unsigned int bytes)
+{
+        write_vreg(vgpu, offset, p_data, bytes);
+
+        if (vgpu_vreg(vgpu, offset) & DBUF_POWER_REQUEST)
+                vgpu_vreg(vgpu, offset) |= DBUF_POWER_STATE;
+        else
+                vgpu_vreg(vgpu, offset) &= ~DBUF_POWER_STATE;
+
+        return 0;
+}
+
 static int fpga_dbg_mmio_write(struct intel_vgpu *vgpu,
         unsigned int offset, void *p_data, unsigned int bytes)
 {
@@ -1525,9 +1538,15 @@ static int bxt_phy_ctl_family_write(struct intel_vgpu *vgpu,
         u32 v = *(u32 *)p_data;
         u32 data = v & COMMON_RESET_DIS ? BXT_PHY_LANE_ENABLED : 0;
 
-        vgpu_vreg(vgpu, _BXT_PHY_CTL_DDI_A) = data;
-        vgpu_vreg(vgpu, _BXT_PHY_CTL_DDI_B) = data;
-        vgpu_vreg(vgpu, _BXT_PHY_CTL_DDI_C) = data;
+        switch (offset) {
+        case _PHY_CTL_FAMILY_EDP:
+                vgpu_vreg(vgpu, _BXT_PHY_CTL_DDI_A) = data;
+                break;
+        case _PHY_CTL_FAMILY_DDI:
+                vgpu_vreg(vgpu, _BXT_PHY_CTL_DDI_B) = data;
+                vgpu_vreg(vgpu, _BXT_PHY_CTL_DDI_C) = data;
+                break;
+        }
 
         vgpu_vreg(vgpu, offset) = v;
 
@@ -2812,6 +2831,8 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         MMIO_DH(HSW_PWR_WELL_CTL_DRIVER(SKL_DISP_PW_MISC_IO), D_SKL_PLUS, NULL,
                 skl_power_well_ctl_write);
 
+        MMIO_DH(DBUF_CTL, D_SKL_PLUS, NULL, gen9_dbuf_ctl_mmio_write);
+
         MMIO_D(_MMIO(0xa210), D_SKL_PLUS);
         MMIO_D(GEN9_MEDIA_PG_IDLE_HYSTERESIS, D_SKL_PLUS);
         MMIO_D(GEN9_RENDER_PG_IDLE_HYSTERESIS, D_SKL_PLUS);
@@ -2987,8 +3008,6 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
                 NULL, gen9_trtte_write);
         MMIO_DH(_MMIO(0x4dfc), D_SKL_PLUS, NULL, gen9_trtt_chicken_write);
 
-        MMIO_D(_MMIO(0x45008), D_SKL_PLUS);
-
         MMIO_D(_MMIO(0x46430), D_SKL_PLUS);
 
         MMIO_D(_MMIO(0x46520), D_SKL_PLUS);
@@ -3025,7 +3044,9 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         MMIO_D(_MMIO(0x44500), D_SKL_PLUS);
         MMIO_DFH(GEN9_CSFE_CHICKEN1_RCS, D_SKL_PLUS, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(GEN8_HDC_CHICKEN1, D_SKL_PLUS, F_MODE_MASK | F_CMD_ACCESS,
-                NULL, NULL);
+                 NULL, NULL);
+        MMIO_DFH(GEN9_WM_CHICKEN3, D_SKL_PLUS, F_MODE_MASK | F_CMD_ACCESS,
+                 NULL, NULL);
 
         MMIO_D(_MMIO(0x4ab8), D_KBL);
         MMIO_D(_MMIO(0x2248), D_KBL | D_SKL);
diff --git a/drivers/gpu/drm/i915/gvt/mmio_context.c b/drivers/gpu/drm/i915/gvt/mmio_context.c
index 42e1e6bdcc2c..e872f4847fbe 100644
--- a/drivers/gpu/drm/i915/gvt/mmio_context.c
+++ b/drivers/gpu/drm/i915/gvt/mmio_context.c
@@ -562,11 +562,9 @@ void intel_gvt_switch_mmio(struct intel_vgpu *pre,
          * performace for batch mmio read/write, so we need
          * handle forcewake mannually.
          */
-        intel_runtime_pm_get(dev_priv);
         intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
         switch_mmio(pre, next, ring_id);
         intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
-        intel_runtime_pm_put(dev_priv);
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/gvt/sched_policy.c b/drivers/gpu/drm/i915/gvt/sched_policy.c
index 09d7bb72b4ff..c32e7d5e8629 100644
--- a/drivers/gpu/drm/i915/gvt/sched_policy.c
+++ b/drivers/gpu/drm/i915/gvt/sched_policy.c
@@ -47,11 +47,15 @@ static bool vgpu_has_pending_workload(struct intel_vgpu *vgpu)
         return false;
 }
 
+/* We give 2 seconds higher prio for vGPU during start */
+#define GVT_SCHED_VGPU_PRI_TIME  2
+
 struct vgpu_sched_data {
         struct list_head lru_list;
         struct intel_vgpu *vgpu;
         bool active;
-
+        bool pri_sched;
+        ktime_t pri_time;
         ktime_t sched_in_time;
         ktime_t sched_time;
         ktime_t left_ts;
@@ -183,6 +187,14 @@ static struct intel_vgpu *find_busy_vgpu(struct gvt_sched_data *sched_data)
                 if (!vgpu_has_pending_workload(vgpu_data->vgpu))
                         continue;
 
+                if (vgpu_data->pri_sched) {
+                        if (ktime_before(ktime_get(), vgpu_data->pri_time)) {
+                                vgpu = vgpu_data->vgpu;
+                                break;
+                        } else
+                                vgpu_data->pri_sched = false;
+                }
+
                 /* Return the vGPU only if it has time slice left */
                 if (vgpu_data->left_ts > 0) {
                         vgpu = vgpu_data->vgpu;
@@ -202,6 +214,7 @@ static void tbs_sched_func(struct gvt_sched_data *sched_data)
         struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
         struct vgpu_sched_data *vgpu_data;
         struct intel_vgpu *vgpu = NULL;
+
         /* no active vgpu or has already had a target */
         if (list_empty(&sched_data->lru_runq_head) || scheduler->next_vgpu)
                 goto out;
@@ -209,12 +222,13 @@ static void tbs_sched_func(struct gvt_sched_data *sched_data)
         vgpu = find_busy_vgpu(sched_data);
         if (vgpu) {
                 scheduler->next_vgpu = vgpu;
-
-                /* Move the last used vGPU to the tail of lru_list */
                 vgpu_data = vgpu->sched_data;
-                list_del_init(&vgpu_data->lru_list);
-                list_add_tail(&vgpu_data->lru_list,
-                                &sched_data->lru_runq_head);
+                if (!vgpu_data->pri_sched) {
+                        /* Move the last used vGPU to the tail of lru_list */
+                        list_del_init(&vgpu_data->lru_list);
+                        list_add_tail(&vgpu_data->lru_list,
+                                      &sched_data->lru_runq_head);
+                }
         } else {
                 scheduler->next_vgpu = gvt->idle_vgpu;
         }
@@ -328,11 +342,17 @@ static void tbs_sched_start_schedule(struct intel_vgpu *vgpu)
 {
         struct gvt_sched_data *sched_data = vgpu->gvt->scheduler.sched_data;
         struct vgpu_sched_data *vgpu_data = vgpu->sched_data;
+        ktime_t now;
 
         if (!list_empty(&vgpu_data->lru_list))
                 return;
 
-        list_add_tail(&vgpu_data->lru_list, &sched_data->lru_runq_head);
+        now = ktime_get();
+        vgpu_data->pri_time = ktime_add(now,
+                                        ktime_set(GVT_SCHED_VGPU_PRI_TIME, 0));
+        vgpu_data->pri_sched = true;
+
+        list_add(&vgpu_data->lru_list, &sched_data->lru_runq_head);
 
         if (!hrtimer_active(&sched_data->timer))
                 hrtimer_start(&sched_data->timer, ktime_add_ns(ktime_get(),
@@ -426,6 +446,7 @@ void intel_vgpu_stop_schedule(struct intel_vgpu *vgpu)
                 &vgpu->gvt->scheduler;
         int ring_id;
         struct vgpu_sched_data *vgpu_data = vgpu->sched_data;
+        struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
 
         if (!vgpu_data->active)
                 return;
@@ -444,6 +465,7 @@ void intel_vgpu_stop_schedule(struct intel_vgpu *vgpu)
                 scheduler->current_vgpu = NULL;
         }
 
+        intel_runtime_pm_get(dev_priv);
         spin_lock_bh(&scheduler->mmio_context_lock);
         for (ring_id = 0; ring_id < I915_NUM_ENGINES; ring_id++) {
                 if (scheduler->engine_owner[ring_id] == vgpu) {
@@ -452,5 +474,6 @@ void intel_vgpu_stop_schedule(struct intel_vgpu *vgpu)
                 }
         }
         spin_unlock_bh(&scheduler->mmio_context_lock);
+        intel_runtime_pm_put(dev_priv);
         mutex_unlock(&vgpu->gvt->sched_lock);
 }
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 08ec7446282e..9e63cd47b60f 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -10422,7 +10422,7 @@ enum skl_power_gate {
                                                            _ICL_DSC0_PICTURE_PARAMETER_SET_4_PB, \
                                                            _ICL_DSC0_PICTURE_PARAMETER_SET_4_PC)
 #define ICL_DSC1_PICTURE_PARAMETER_SET_4(pipe)  _MMIO_PIPE((pipe) - PIPE_B, \
-                                                           _ICL_DSC0_PICTURE_PARAMETER_SET_4_PB, \
+                                                           _ICL_DSC1_PICTURE_PARAMETER_SET_4_PB, \
                                                            _ICL_DSC1_PICTURE_PARAMETER_SET_4_PC)
 #define  DSC_INITIAL_DEC_DELAY(dec_delay)       ((dec_delay) << 16)
 #define  DSC_INITIAL_XMIT_DELAY(xmit_delay)     ((xmit_delay) << 0)
@@ -10437,7 +10437,7 @@ enum skl_power_gate {
                                                            _ICL_DSC0_PICTURE_PARAMETER_SET_5_PB, \
                                                            _ICL_DSC0_PICTURE_PARAMETER_SET_5_PC)
 #define ICL_DSC1_PICTURE_PARAMETER_SET_5(pipe)  _MMIO_PIPE((pipe) - PIPE_B, \
-                                                           _ICL_DSC1_PICTURE_PARAMETER_SET_5_PC, \
+                                                           _ICL_DSC1_PICTURE_PARAMETER_SET_5_PB, \
                                                            _ICL_DSC1_PICTURE_PARAMETER_SET_5_PC)
 #define  DSC_SCALE_DEC_INTINT(scale_dec)        ((scale_dec) << 16)
 #define  DSC_SCALE_INC_INT(scale_inc)           ((scale_inc) << 0)
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 8761513f3532..c9af34861d9e 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -2708,7 +2708,8 @@ static void intel_ddi_pre_enable_dp(struct intel_encoder *encoder,
         if (port != PORT_A || INTEL_GEN(dev_priv) >= 9)
                 intel_dp_stop_link_train(intel_dp);
 
-        intel_ddi_enable_pipe_clock(crtc_state);
+        if (!is_mst)
+                intel_ddi_enable_pipe_clock(crtc_state);
 }
 
 static void intel_ddi_pre_enable_hdmi(struct intel_encoder *encoder,
@@ -2810,14 +2811,14 @@ static void intel_ddi_post_disable_dp(struct intel_encoder *encoder,
         bool is_mst = intel_crtc_has_type(old_crtc_state,
                                           INTEL_OUTPUT_DP_MST);
 
-        intel_ddi_disable_pipe_clock(old_crtc_state);
-
-        /*
-         * Power down sink before disabling the port, otherwise we end
-         * up getting interrupts from the sink on detecting link loss.
-         */
-        if (!is_mst)
+        if (!is_mst) {
+                intel_ddi_disable_pipe_clock(old_crtc_state);
+                /*
+                 * Power down sink before disabling the port, otherwise we end
+                 * up getting interrupts from the sink on detecting link loss.
+                 */
                 intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF);
+        }
 
         intel_disable_ddi_buf(encoder);
 
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index cd0f649b57a5..1193202766a2 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -4160,18 +4160,6 @@ intel_dp_needs_link_retrain(struct intel_dp *intel_dp)
         return !drm_dp_channel_eq_ok(link_status, intel_dp->lane_count);
 }
 
-/*
- * If display is now connected check links status,
- * there has been known issues of link loss triggering
- * long pulse.
- *
- * Some sinks (eg. ASUS PB287Q) seem to perform some
- * weird HPD ping pong during modesets. So we can apparently
- * end up with HPD going low during a modeset, and then
- * going back up soon after. And once that happens we must
- * retrain the link to get a picture. That's in case no
- * userspace component reacted to intermittent HPD dip.
- */
 int intel_dp_retrain_link(struct intel_encoder *encoder,
                           struct drm_modeset_acquire_ctx *ctx)
 {
@@ -4661,7 +4649,8 @@ intel_dp_unset_edid(struct intel_dp *intel_dp)
 }
 
 static int
-intel_dp_long_pulse(struct intel_connector *connector)
+intel_dp_long_pulse(struct intel_connector *connector,
+                    struct drm_modeset_acquire_ctx *ctx)
 {
         struct drm_i915_private *dev_priv = to_i915(connector->base.dev);
         struct intel_dp *intel_dp = intel_attached_dp(&connector->base);
@@ -4720,6 +4709,22 @@ intel_dp_long_pulse(struct intel_connector *connector)
                  */
                 status = connector_status_disconnected;
                 goto out;
+        } else {
+                /*
+                 * If display is now connected check links status,
+                 * there has been known issues of link loss triggering
+                 * long pulse.
+                 *
+                 * Some sinks (eg. ASUS PB287Q) seem to perform some
+                 * weird HPD ping pong during modesets. So we can apparently
+                 * end up with HPD going low during a modeset, and then
+                 * going back up soon after. And once that happens we must
+                 * retrain the link to get a picture. That's in case no
+                 * userspace component reacted to intermittent HPD dip.
+                 */
+                struct intel_encoder *encoder = &dp_to_dig_port(intel_dp)->base;
+
+                intel_dp_retrain_link(encoder, ctx);
         }
 
         /*
@@ -4781,7 +4786,7 @@ intel_dp_detect(struct drm_connector *connector,
                                 return ret;
                 }
 
-                status = intel_dp_long_pulse(intel_dp->attached_connector);
+                status = intel_dp_long_pulse(intel_dp->attached_connector, ctx);
         }
 
         intel_dp->detect_done = false;
diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c
index 7e3e01607643..4ecd65375603 100644
--- a/drivers/gpu/drm/i915/intel_dp_mst.c
+++ b/drivers/gpu/drm/i915/intel_dp_mst.c
@@ -166,6 +166,8 @@ static void intel_mst_post_disable_dp(struct intel_encoder *encoder,
         struct intel_connector *connector =
                 to_intel_connector(old_conn_state->connector);
 
+        intel_ddi_disable_pipe_clock(old_crtc_state);
+
         /* this can fail */
         drm_dp_check_act_status(&intel_dp->mst_mgr);
         /* and this can also fail */
@@ -252,6 +254,8 @@ static void intel_mst_pre_enable_dp(struct intel_encoder *encoder,
         I915_WRITE(DP_TP_STATUS(port), temp);
 
         ret = drm_dp_update_payload_part1(&intel_dp->mst_mgr);
+
+        intel_ddi_enable_pipe_clock(pipe_config);
 }
 
 static void intel_mst_enable_dp(struct intel_encoder *encoder,
diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
index 8412119bd940..5691dfa1db6f 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
@@ -1123,17 +1123,21 @@ nv50_mstm_enable(struct nv50_mstm *mstm, u8 dpcd, int state)
         int ret;
 
         if (dpcd >= 0x12) {
-                ret = drm_dp_dpcd_readb(mstm->mgr.aux, DP_MSTM_CTRL, &dpcd);
+                /* Even if we're enabling MST, start with disabling the
+                 * branching unit to clear any sink-side MST topology state
+                 * that wasn't set by us
+                 */
+                ret = drm_dp_dpcd_writeb(mstm->mgr.aux, DP_MSTM_CTRL, 0);
                 if (ret < 0)
                         return ret;
 
-                dpcd &= ~DP_MST_EN;
-                if (state)
-                        dpcd |= DP_MST_EN;
-
-                ret = drm_dp_dpcd_writeb(mstm->mgr.aux, DP_MSTM_CTRL, dpcd);
-                if (ret < 0)
-                        return ret;
+                if (state) {
+                        /* Now, start initializing */
+                        ret = drm_dp_dpcd_writeb(mstm->mgr.aux, DP_MSTM_CTRL,
+                                                 DP_MST_EN);
+                        if (ret < 0)
+                                return ret;
+                }
         }
 
         return nvif_mthd(disp, 0, &args, sizeof(args));
@@ -1142,31 +1146,58 @@ nv50_mstm_enable(struct nv50_mstm *mstm, u8 dpcd, int state)
 int
 nv50_mstm_detect(struct nv50_mstm *mstm, u8 dpcd[8], int allow)
 {
-        int ret, state = 0;
+        struct drm_dp_aux *aux;
+        int ret;
+        bool old_state, new_state;
+        u8 mstm_ctrl;
 
         if (!mstm)
                 return 0;
 
-        if (dpcd[0] >= 0x12) {
-                ret = drm_dp_dpcd_readb(mstm->mgr.aux, DP_MSTM_CAP, &dpcd[1]);
+        mutex_lock(&mstm->mgr.lock);
+
+        old_state = mstm->mgr.mst_state;
+        new_state = old_state;
+        aux = mstm->mgr.aux;
+
+        if (old_state) {
+                /* Just check that the MST hub is still as we expect it */
+                ret = drm_dp_dpcd_readb(aux, DP_MSTM_CTRL, &mstm_ctrl);
+                if (ret < 0 || !(mstm_ctrl & DP_MST_EN)) {
+                        DRM_DEBUG_KMS("Hub gone, disabling MST topology\n");
+                        new_state = false;
+                }
+        } else if (dpcd[0] >= 0x12) {
+                ret = drm_dp_dpcd_readb(aux, DP_MSTM_CAP, &dpcd[1]);
                 if (ret < 0)
-                        return ret;
+                        goto probe_error;
 
                 if (!(dpcd[1] & DP_MST_CAP))
                         dpcd[0] = 0x11;
                 else
-                        state = allow;
+                        new_state = allow;
+        }
+
+        if (new_state == old_state) {
+                mutex_unlock(&mstm->mgr.lock);
+                return new_state;
         }
 
-        ret = nv50_mstm_enable(mstm, dpcd[0], state);
+        ret = nv50_mstm_enable(mstm, dpcd[0], new_state);
         if (ret)
-                return ret;
+                goto probe_error;
+
+        mutex_unlock(&mstm->mgr.lock);
 
-        ret = drm_dp_mst_topology_mgr_set_mst(&mstm->mgr, state);
+        ret = drm_dp_mst_topology_mgr_set_mst(&mstm->mgr, new_state);
         if (ret)
                 return nv50_mstm_enable(mstm, dpcd[0], 0);
 
-        return mstm->mgr.mst_state;
+        return new_state;
+
+probe_error:
+        mutex_unlock(&mstm->mgr.lock);
+        return ret;
 }
 
 static void
@@ -2074,7 +2105,7 @@ nv50_disp_atomic_state_alloc(struct drm_device *dev)
 static const struct drm_mode_config_funcs
 nv50_disp_func = {
         .fb_create = nouveau_user_framebuffer_create,
-        .output_poll_changed = drm_fb_helper_output_poll_changed,
+        .output_poll_changed = nouveau_fbcon_output_poll_changed,
         .atomic_check = nv50_disp_atomic_check,
         .atomic_commit = nv50_disp_atomic_commit,
         .atomic_state_alloc = nv50_disp_atomic_state_alloc,
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index 51932c72334e..247f72cc4d10 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -409,59 +409,45 @@ static struct nouveau_encoder *
 nouveau_connector_ddc_detect(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
-        struct nouveau_connector *nv_connector = nouveau_connector(connector);
-        struct nouveau_drm *drm = nouveau_drm(dev);
-        struct nvkm_gpio *gpio = nvxx_gpio(&drm->client.device);
-        struct nouveau_encoder *nv_encoder = NULL;
+        struct nouveau_encoder *nv_encoder = NULL, *found = NULL;
         struct drm_encoder *encoder;
-        int i, panel = -ENODEV;
-
-        /* eDP panels need powering on by us (if the VBIOS doesn't default it
-         * to on) before doing any AUX channel transactions.  LVDS panel power
-         * is handled by the SOR itself, and not required for LVDS DDC.
-         */
-        if (nv_connector->type == DCB_CONNECTOR_eDP) {
-                panel = nvkm_gpio_get(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff);
-                if (panel == 0) {
-                        nvkm_gpio_set(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff, 1);
-                        msleep(300);
-                }
-        }
+        int i, ret;
+        bool switcheroo_ddc = false;
 
         drm_connector_for_each_possible_encoder(connector, encoder, i) {
                 nv_encoder = nouveau_encoder(encoder);
 
-                if (nv_encoder->dcb->type == DCB_OUTPUT_DP) {
-                        int ret = nouveau_dp_detect(nv_encoder);
+                switch (nv_encoder->dcb->type) {
+                case DCB_OUTPUT_DP:
+                        ret = nouveau_dp_detect(nv_encoder);
                         if (ret == NOUVEAU_DP_MST)
                                 return NULL;
-                        if (ret == NOUVEAU_DP_SST)
-                                break;
-                } else
-                if ((vga_switcheroo_handler_flags() &
-                     VGA_SWITCHEROO_CAN_SWITCH_DDC) &&
-                    nv_encoder->dcb->type == DCB_OUTPUT_LVDS &&
-                    nv_encoder->i2c) {
-                        int ret;
-                        vga_switcheroo_lock_ddc(dev->pdev);
-                        ret = nvkm_probe_i2c(nv_encoder->i2c, 0x50);
-                        vga_switcheroo_unlock_ddc(dev->pdev);
-                        if (ret)
+                        else if (ret == NOUVEAU_DP_SST)
+                                found = nv_encoder;
+
+                        break;
+                case DCB_OUTPUT_LVDS:
+                        switcheroo_ddc = !!(vga_switcheroo_handler_flags() &
+                                            VGA_SWITCHEROO_CAN_SWITCH_DDC);
+                /* fall-through */
+                default:
+                        if (!nv_encoder->i2c)
                                 break;
-                } else
-                if (nv_encoder->i2c) {
+
+                        if (switcheroo_ddc)
+                                vga_switcheroo_lock_ddc(dev->pdev);
                         if (nvkm_probe_i2c(nv_encoder->i2c, 0x50))
-                                break;
+                                found = nv_encoder;
+                        if (switcheroo_ddc)
+                                vga_switcheroo_unlock_ddc(dev->pdev);
+
+                        break;
                 }
+                if (found)
+                        break;
         }
 
-        /* eDP panel not detected, restore panel power GPIO to previous
-         * state to avoid confusing the SOR for other output types.
-         */
-        if (!nv_encoder && panel == 0)
-                nvkm_gpio_set(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff, panel);
-
-        return nv_encoder;
+        return found;
 }
 
 static struct nouveau_encoder *
@@ -555,12 +541,16 @@ nouveau_connector_detect(struct drm_connector *connector, bool force)
                 nv_connector->edid = NULL;
         }
 
-        /* Outputs are only polled while runtime active, so acquiring a
-         * runtime PM ref here is unnecessary (and would deadlock upon
-         * runtime suspend because it waits for polling to finish).
+        /* Outputs are only polled while runtime active, so resuming the
+         * device here is unnecessary (and would deadlock upon runtime suspend
+         * because it waits for polling to finish). We do however, want to
+         * prevent the autosuspend timer from elapsing during this operation
+         * if possible.
          */
-        if (!drm_kms_helper_is_poll_worker()) {
-                ret = pm_runtime_get_sync(connector->dev->dev);
+        if (drm_kms_helper_is_poll_worker()) {
+                pm_runtime_get_noresume(dev->dev);
+        } else {
+                ret = pm_runtime_get_sync(dev->dev);
                 if (ret < 0 && ret != -EACCES)
                         return conn_status;
         }
@@ -638,10 +628,8 @@ detect_analog:
 
  out:
 
-        if (!drm_kms_helper_is_poll_worker()) {
-                pm_runtime_mark_last_busy(connector->dev->dev);
-                pm_runtime_put_autosuspend(connector->dev->dev);
-        }
+        pm_runtime_mark_last_busy(dev->dev);
+        pm_runtime_put_autosuspend(dev->dev);
 
         return conn_status;
 }
@@ -1105,6 +1093,26 @@ nouveau_connector_hotplug(struct nvif_notify *notify)
         const struct nvif_notify_conn_rep_v0 *rep = notify->data;
         const char *name = connector->name;
         struct nouveau_encoder *nv_encoder;
+        int ret;
+
+        ret = pm_runtime_get(drm->dev->dev);
+        if (ret == 0) {
+                /* We can't block here if there's a pending PM request
+                 * running, as we'll deadlock nouveau_display_fini() when it
+                 * calls nvif_put() on our nvif_notify struct. So, simply
+                 * defer the hotplug event until the device finishes resuming
+                 */
+                NV_DEBUG(drm, "Deferring HPD on %s until runtime resume\n",
+                         name);
+                schedule_work(&drm->hpd_work);
+
+                pm_runtime_put_noidle(drm->dev->dev);
+                return NVIF_NOTIFY_KEEP;
+        } else if (ret != 1 && ret != -EACCES) {
+                NV_WARN(drm, "HPD on %s dropped due to RPM failure: %d\n",
+                        name, ret);
+                return NVIF_NOTIFY_DROP;
+        }
 
         if (rep->mask & NVIF_NOTIFY_CONN_V0_IRQ) {
                 NV_DEBUG(drm, "service %s\n", name);
@@ -1122,6 +1130,8 @@ nouveau_connector_hotplug(struct nvif_notify *notify)
                 drm_helper_hpd_irq_event(connector->dev);
         }
 
+        pm_runtime_mark_last_busy(drm->dev->dev);
+        pm_runtime_put_autosuspend(drm->dev->dev);
         return NVIF_NOTIFY_KEEP;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 139368b31916..540c0cbbfcee 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -293,7 +293,7 @@ nouveau_user_framebuffer_create(struct drm_device *dev,
 
 static const struct drm_mode_config_funcs nouveau_mode_config_funcs = {
         .fb_create = nouveau_user_framebuffer_create,
-        .output_poll_changed = drm_fb_helper_output_poll_changed,
+        .output_poll_changed = nouveau_fbcon_output_poll_changed,
 };
 
 
@@ -355,8 +355,6 @@ nouveau_display_hpd_work(struct work_struct *work)
         pm_runtime_get_sync(drm->dev->dev);
 
         drm_helper_hpd_irq_event(drm->dev);
-        /* enable polling for external displays */
-        drm_kms_helper_poll_enable(drm->dev);
 
         pm_runtime_mark_last_busy(drm->dev->dev);
         pm_runtime_put_sync(drm->dev->dev);
@@ -379,15 +377,29 @@ nouveau_display_acpi_ntfy(struct notifier_block *nb, unsigned long val,
 {
         struct nouveau_drm *drm = container_of(nb, typeof(*drm), acpi_nb);
         struct acpi_bus_event *info = data;
+        int ret;
 
         if (!strcmp(info->device_class, ACPI_VIDEO_CLASS)) {
                 if (info->type == ACPI_VIDEO_NOTIFY_PROBE) {
-                        /*
-                         * This may be the only indication we receive of a
-                         * connector hotplug on a runtime suspended GPU,
-                         * schedule hpd_work to check.
-                         */
-                        schedule_work(&drm->hpd_work);
+                        ret = pm_runtime_get(drm->dev->dev);
+                        if (ret == 1 || ret == -EACCES) {
+                                /* If the GPU is already awake, or in a state
+                                 * where we can't wake it up, it can handle
+                                 * it's own hotplug events.
+                                 */
+                                pm_runtime_put_autosuspend(drm->dev->dev);
+                        } else if (ret == 0) {
+                                /* This may be the only indication we receive
+                                 * of a connector hotplug on a runtime
+                                 * suspended GPU, schedule hpd_work to check.
+                                 */
+                                NV_DEBUG(drm, "ACPI requested connector reprobe\n");
+                                schedule_work(&drm->hpd_work);
+                                pm_runtime_put_noidle(drm->dev->dev);
+                        } else {
+                                NV_WARN(drm, "Dropped ACPI reprobe event due to RPM error: %d\n",
+                                        ret);
+                        }
 
                         /* acpi-video should not generate keypresses for this */
                         return NOTIFY_BAD;
@@ -411,6 +423,11 @@ nouveau_display_init(struct drm_device *dev)
         if (ret)
                 return ret;
 
+        /* enable connector detection and polling for connectors without HPD
+         * support
+         */
+        drm_kms_helper_poll_enable(dev);
+
         /* enable hotplug interrupts */
         drm_connector_list_iter_begin(dev, &conn_iter);
         nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
@@ -425,7 +442,7 @@ nouveau_display_init(struct drm_device *dev)
 }
 
 void
-nouveau_display_fini(struct drm_device *dev, bool suspend)
+nouveau_display_fini(struct drm_device *dev, bool suspend, bool runtime)
 {
         struct nouveau_display *disp = nouveau_display(dev);
         struct nouveau_drm *drm = nouveau_drm(dev);
@@ -450,6 +467,9 @@ nouveau_display_fini(struct drm_device *dev, bool suspend)
         }
         drm_connector_list_iter_end(&conn_iter);
 
+        if (!runtime)
+                cancel_work_sync(&drm->hpd_work);
+
         drm_kms_helper_poll_disable(dev);
         disp->fini(dev);
 }
@@ -618,11 +638,11 @@ nouveau_display_suspend(struct drm_device *dev, bool runtime)
                         }
                 }
 
-                nouveau_display_fini(dev, true);
+                nouveau_display_fini(dev, true, runtime);
                 return 0;
         }
 
-        nouveau_display_fini(dev, true);
+        nouveau_display_fini(dev, true, runtime);
 
         list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
                 struct nouveau_framebuffer *nouveau_fb;
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.h b/drivers/gpu/drm/nouveau/nouveau_display.h
index 54aa7c3fa42d..ff92b54ce448 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.h
+++ b/drivers/gpu/drm/nouveau/nouveau_display.h
@@ -62,7 +62,7 @@ nouveau_display(struct drm_device *dev)
 int  nouveau_display_create(struct drm_device *dev);
 void nouveau_display_destroy(struct drm_device *dev);
 int  nouveau_display_init(struct drm_device *dev);
-void nouveau_display_fini(struct drm_device *dev, bool suspend);
+void nouveau_display_fini(struct drm_device *dev, bool suspend, bool runtime);
 int  nouveau_display_suspend(struct drm_device *dev, bool runtime);
 void nouveau_display_resume(struct drm_device *dev, bool runtime);
 int  nouveau_display_vblank_enable(struct drm_device *, unsigned int);
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index c7ec86d6c3c9..74d2283f2c28 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -230,7 +230,7 @@ nouveau_cli_init(struct nouveau_drm *drm, const char *sname,
                 mutex_unlock(&drm->master.lock);
         }
         if (ret) {
-                NV_ERROR(drm, "Client allocation failed: %d\n", ret);
+                NV_PRINTK(err, cli, "Client allocation failed: %d\n", ret);
                 goto done;
         }
 
@@ -240,37 +240,37 @@ nouveau_cli_init(struct nouveau_drm *drm, const char *sname,
                                }, sizeof(struct nv_device_v0),
                                &cli->device);
         if (ret) {
-                NV_ERROR(drm, "Device allocation failed: %d\n", ret);
+                NV_PRINTK(err, cli, "Device allocation failed: %d\n", ret);
                 goto done;
         }
 
         ret = nvif_mclass(&cli->device.object, mmus);
         if (ret < 0) {
-                NV_ERROR(drm, "No supported MMU class\n");
+                NV_PRINTK(err, cli, "No supported MMU class\n");
                 goto done;
         }
 
         ret = nvif_mmu_init(&cli->device.object, mmus[ret].oclass, &cli->mmu);
         if (ret) {
-                NV_ERROR(drm, "MMU allocation failed: %d\n", ret);
+                NV_PRINTK(err, cli, "MMU allocation failed: %d\n", ret);
                 goto done;
         }
 
         ret = nvif_mclass(&cli->mmu.object, vmms);
         if (ret < 0) {
-                NV_ERROR(drm, "No supported VMM class\n");
+                NV_PRINTK(err, cli, "No supported VMM class\n");
                 goto done;
         }
 
         ret = nouveau_vmm_init(cli, vmms[ret].oclass, &cli->vmm);
         if (ret) {
-                NV_ERROR(drm, "VMM allocation failed: %d\n", ret);
+                NV_PRINTK(err, cli, "VMM allocation failed: %d\n", ret);
                 goto done;
         }
 
         ret = nvif_mclass(&cli->mmu.object, mems);
         if (ret < 0) {
-                NV_ERROR(drm, "No supported MEM class\n");
+                NV_PRINTK(err, cli, "No supported MEM class\n");
                 goto done;
         }
 
@@ -592,10 +592,8 @@ nouveau_drm_load(struct drm_device *dev, unsigned long flags)
                 pm_runtime_allow(dev->dev);
                 pm_runtime_mark_last_busy(dev->dev);
                 pm_runtime_put(dev->dev);
-        } else {
-                /* enable polling for external displays */
-                drm_kms_helper_poll_enable(dev);
         }
+
         return 0;
 
 fail_dispinit:
@@ -629,7 +627,7 @@ nouveau_drm_unload(struct drm_device *dev)
         nouveau_debugfs_fini(drm);
 
         if (dev->mode_config.num_crtc)
-                nouveau_display_fini(dev, false);
+                nouveau_display_fini(dev, false, false);
         nouveau_display_destroy(dev);
 
         nouveau_bios_takedown(dev);
@@ -835,7 +833,6 @@ nouveau_pmops_runtime_suspend(struct device *dev)
                 return -EBUSY;
         }
 
-        drm_kms_helper_poll_disable(drm_dev);
         nouveau_switcheroo_optimus_dsm();
         ret = nouveau_do_suspend(drm_dev, true);
         pci_save_state(pdev);
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 844498c4267c..0f64c0a1d4b3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -466,6 +466,7 @@ nouveau_fbcon_set_suspend_work(struct work_struct *work)
         console_unlock();
 
         if (state == FBINFO_STATE_RUNNING) {
+                nouveau_fbcon_hotplug_resume(drm->fbcon);
                 pm_runtime_mark_last_busy(drm->dev->dev);
                 pm_runtime_put_sync(drm->dev->dev);
         }
@@ -487,6 +488,61 @@ nouveau_fbcon_set_suspend(struct drm_device *dev, int state)
         schedule_work(&drm->fbcon_work);
 }
 
+void
+nouveau_fbcon_output_poll_changed(struct drm_device *dev)
+{
+        struct nouveau_drm *drm = nouveau_drm(dev);
+        struct nouveau_fbdev *fbcon = drm->fbcon;
+        int ret;
+
+        if (!fbcon)
+                return;
+
+        mutex_lock(&fbcon->hotplug_lock);
+
+        ret = pm_runtime_get(dev->dev);
+        if (ret == 1 || ret == -EACCES) {
+                drm_fb_helper_hotplug_event(&fbcon->helper);
+
+                pm_runtime_mark_last_busy(dev->dev);
+                pm_runtime_put_autosuspend(dev->dev);
+        } else if (ret == 0) {
+                /* If the GPU was already in the process of suspending before
+                 * this event happened, then we can't block here as we'll
+                 * deadlock the runtime pmops since they wait for us to
+                 * finish. So, just defer this event for when we runtime
+                 * resume again. It will be handled by fbcon_work.
+                 */
+                NV_DEBUG(drm, "fbcon HPD event deferred until runtime resume\n");
+                fbcon->hotplug_waiting = true;
+                pm_runtime_put_noidle(drm->dev->dev);
+        } else {
+                DRM_WARN("fbcon HPD event lost due to RPM failure: %d\n",
+                         ret);
+        }
+
+        mutex_unlock(&fbcon->hotplug_lock);
+}
+
+void
+nouveau_fbcon_hotplug_resume(struct nouveau_fbdev *fbcon)
+{
+        struct nouveau_drm *drm;
+
+        if (!fbcon)
+                return;
+        drm = nouveau_drm(fbcon->helper.dev);
+
+        mutex_lock(&fbcon->hotplug_lock);
+        if (fbcon->hotplug_waiting) {
+                fbcon->hotplug_waiting = false;
+
+                NV_DEBUG(drm, "Handling deferred fbcon HPD events\n");
+                drm_fb_helper_hotplug_event(&fbcon->helper);
+        }
+        mutex_unlock(&fbcon->hotplug_lock);
+}
+
 int
 nouveau_fbcon_init(struct drm_device *dev)
 {
@@ -505,6 +561,7 @@ nouveau_fbcon_init(struct drm_device *dev)
 
         drm->fbcon = fbcon;
         INIT_WORK(&drm->fbcon_work, nouveau_fbcon_set_suspend_work);
+        mutex_init(&fbcon->hotplug_lock);
 
         drm_fb_helper_prepare(dev, &fbcon->helper, &nouveau_fbcon_helper_funcs);
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.h b/drivers/gpu/drm/nouveau/nouveau_fbcon.h
index a6f192ea3fa6..db9d52047ef8 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.h
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.h
@@ -41,6 +41,9 @@ struct nouveau_fbdev {
         struct nvif_object gdi;
         struct nvif_object blit;
         struct nvif_object twod;
+
+        struct mutex hotplug_lock;
+        bool hotplug_waiting;
 };
 
 void nouveau_fbcon_restore(void);
@@ -68,6 +71,8 @@ void nouveau_fbcon_set_suspend(struct drm_device *dev, int state);
 void nouveau_fbcon_accel_save_disable(struct drm_device *dev);
 void nouveau_fbcon_accel_restore(struct drm_device *dev);
 
+void nouveau_fbcon_output_poll_changed(struct drm_device *dev);
+void nouveau_fbcon_hotplug_resume(struct nouveau_fbdev *fbcon);
 extern int nouveau_nofbaccel;
 
 #endif /* __NV50_FBCON_H__ */
diff --git a/drivers/gpu/drm/nouveau/nouveau_vga.c b/drivers/gpu/drm/nouveau/nouveau_vga.c
index 3da5a4305aa4..8f1ce4833230 100644
--- a/drivers/gpu/drm/nouveau/nouveau_vga.c
+++ b/drivers/gpu/drm/nouveau/nouveau_vga.c
@@ -46,12 +46,10 @@ nouveau_switcheroo_set_state(struct pci_dev *pdev,
                 pr_err("VGA switcheroo: switched nouveau on\n");
                 dev->switch_power_state = DRM_SWITCH_POWER_CHANGING;
                 nouveau_pmops_resume(&pdev->dev);
-                drm_kms_helper_poll_enable(dev);
                 dev->switch_power_state = DRM_SWITCH_POWER_ON;
         } else {
                 pr_err("VGA switcheroo: switched nouveau off\n");
                 dev->switch_power_state = DRM_SWITCH_POWER_CHANGING;
-                drm_kms_helper_poll_disable(dev);
                 nouveau_switcheroo_optimus_dsm();
                 nouveau_pmops_suspend(&pdev->dev);
                 dev->switch_power_state = DRM_SWITCH_POWER_OFF;
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c
index 32fa94a9773f..cbd33e87b799 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c
@@ -275,6 +275,7 @@ nvkm_disp_oneinit(struct nvkm_engine *engine)
         struct nvkm_outp *outp, *outt, *pair;
         struct nvkm_conn *conn;
         struct nvkm_head *head;
+        struct nvkm_ior *ior;
         struct nvbios_connE connE;
         struct dcb_output dcbE;
         u8  hpd = 0, ver, hdr;
@@ -399,6 +400,19 @@ nvkm_disp_oneinit(struct nvkm_engine *engine)
                         return ret;
         }
 
+        /* Enforce identity-mapped SOR assignment for panels, which have
+         * certain bits (ie. backlight controls) wired to a specific SOR.
+         */
+        list_for_each_entry(outp, &disp->outp, head) {
+                if (outp->conn->info.type == DCB_CONNECTOR_LVDS ||
+                    outp->conn->info.type == DCB_CONNECTOR_eDP) {
+                        ior = nvkm_ior_find(disp, SOR, ffs(outp->info.or) - 1);
+                        if (!WARN_ON(!ior))
+                                ior->identity = true;
+                        outp->identity = true;
+                }
+        }
+
         i = 0;
         list_for_each_entry(head, &disp->head, head)
                 i = max(i, head->id + 1);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
index 7c5bed29ffef..5f301e632599 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
@@ -28,6 +28,7 @@
 
 #include <subdev/bios.h>
 #include <subdev/bios/init.h>
+#include <subdev/gpio.h>
 #include <subdev/i2c.h>
 
 #include <nvif/event.h>
@@ -412,14 +413,10 @@ nvkm_dp_train(struct nvkm_dp *dp, u32 dataKBps)
 }
 
 static void
-nvkm_dp_release(struct nvkm_outp *outp, struct nvkm_ior *ior)
+nvkm_dp_disable(struct nvkm_outp *outp, struct nvkm_ior *ior)
 {
         struct nvkm_dp *dp = nvkm_dp(outp);
 
-        /* Prevent link from being retrained if sink sends an IRQ. */
-        atomic_set(&dp->lt.done, 0);
-        ior->dp.nr = 0;
-
         /* Execute DisableLT script from DP Info Table. */
         nvbios_init(&ior->disp->engine.subdev, dp->info.script[4],
                 init.outp = &dp->outp.info;
@@ -428,6 +425,16 @@ nvkm_dp_release(struct nvkm_outp *outp, struct nvkm_ior *ior)
         );
 }
 
+static void
+nvkm_dp_release(struct nvkm_outp *outp)
+{
+        struct nvkm_dp *dp = nvkm_dp(outp);
+
+        /* Prevent link from being retrained if sink sends an IRQ. */
+        atomic_set(&dp->lt.done, 0);
+        dp->outp.ior->dp.nr = 0;
+}
+
 static int
 nvkm_dp_acquire(struct nvkm_outp *outp)
 {
@@ -491,7 +498,7 @@ done:
         return ret;
 }
 
-static void
+static bool
 nvkm_dp_enable(struct nvkm_dp *dp, bool enable)
 {
         struct nvkm_i2c_aux *aux = dp->aux;
@@ -505,7 +512,7 @@ nvkm_dp_enable(struct nvkm_dp *dp, bool enable)
 
                 if (!nvkm_rdaux(aux, DPCD_RC00_DPCD_REV, dp->dpcd,
                                 sizeof(dp->dpcd)))
-                        return;
+                        return true;
         }
 
         if (dp->present) {
@@ -515,6 +522,7 @@ nvkm_dp_enable(struct nvkm_dp *dp, bool enable)
         }
 
         atomic_set(&dp->lt.done, 0);
+        return false;
 }
 
 static int
@@ -555,9 +563,38 @@ nvkm_dp_fini(struct nvkm_outp *outp)
 static void
 nvkm_dp_init(struct nvkm_outp *outp)
 {
+        struct nvkm_gpio *gpio = outp->disp->engine.subdev.device->gpio;
         struct nvkm_dp *dp = nvkm_dp(outp);
+
         nvkm_notify_put(&dp->outp.conn->hpd);
-        nvkm_dp_enable(dp, true);
+
+        /* eDP panels need powering on by us (if the VBIOS doesn't default it
+         * to on) before doing any AUX channel transactions.  LVDS panel power
+         * is handled by the SOR itself, and not required for LVDS DDC.
+         */
+        if (dp->outp.conn->info.type == DCB_CONNECTOR_eDP) {
+                int power = nvkm_gpio_get(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff);
+                if (power == 0)
+                        nvkm_gpio_set(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff, 1);
+
+                /* We delay here unconditionally, even if already powered,
+                 * because some laptop panels having a significant resume
+                 * delay before the panel begins responding.
+                 *
+                 * This is likely a bit of a hack, but no better idea for
+                 * handling this at the moment.
+                 */
+                msleep(300);
+
+                /* If the eDP panel can't be detected, we need to restore
+                 * the panel power GPIO to avoid breaking another output.
+                 */
+                if (!nvkm_dp_enable(dp, true) && power == 0)
+                        nvkm_gpio_set(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff, 0);
+        } else {
+                nvkm_dp_enable(dp, true);
+        }
+
         nvkm_notify_get(&dp->hpd);
 }
 
@@ -576,6 +613,7 @@ nvkm_dp_func = {
         .fini = nvkm_dp_fini,
         .acquire = nvkm_dp_acquire,
         .release = nvkm_dp_release,
+        .disable = nvkm_dp_disable,
 };
 
 static int
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h b/drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h
index e0b4e0c5704e..19911211a12a 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h
@@ -16,6 +16,7 @@ struct nvkm_ior {
         char name[8];
 
         struct list_head head;
+        bool identity;
 
         struct nvkm_ior_state {
                 struct nvkm_outp *outp;
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
index f89c7b977aa5..def005dd5fda 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
@@ -501,11 +501,11 @@ nv50_disp_super_2_0(struct nv50_disp *disp, struct nvkm_head *head)
         nv50_disp_super_ied_off(head, ior, 2);
 
         /* If we're shutting down the OR's only active head, execute
-         * the output path's release function.
+         * the output path's disable function.
          */
         if (ior->arm.head == (1 << head->id)) {
-                if ((outp = ior->arm.outp) && outp->func->release)
-                        outp->func->release(outp, ior);
+                if ((outp = ior->arm.outp) && outp->func->disable)
+                        outp->func->disable(outp, ior);
         }
 }
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
index be9e7f8c3b23..c62030c96fba 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
@@ -93,6 +93,8 @@ nvkm_outp_release(struct nvkm_outp *outp, u8 user)
         if (ior) {
                 outp->acquired &= ~user;
                 if (!outp->acquired) {
+                        if (outp->func->release && outp->ior)
+                                outp->func->release(outp);
                         outp->ior->asy.outp = NULL;
                         outp->ior = NULL;
                 }
@@ -127,17 +129,26 @@ nvkm_outp_acquire(struct nvkm_outp *outp, u8 user)
         if (proto == UNKNOWN)
                 return -ENOSYS;
 
+        /* Deal with panels requiring identity-mapped SOR assignment. */
+        if (outp->identity) {
+                ior = nvkm_ior_find(outp->disp, SOR, ffs(outp->info.or) - 1);
+                if (WARN_ON(!ior))
+                        return -ENOSPC;
+                return nvkm_outp_acquire_ior(outp, user, ior);
+        }
+
         /* First preference is to reuse the OR that is currently armed
          * on HW, if any, in order to prevent unnecessary switching.
          */
         list_for_each_entry(ior, &outp->disp->ior, head) {
-                if (!ior->asy.outp && ior->arm.outp == outp)
+                if (!ior->identity && !ior->asy.outp && ior->arm.outp == outp)
                         return nvkm_outp_acquire_ior(outp, user, ior);
         }
 
         /* Failing that, a completely unused OR is the next best thing. */
         list_for_each_entry(ior, &outp->disp->ior, head) {
-                if (!ior->asy.outp && ior->type == type && !ior->arm.outp &&
+                if (!ior->identity &&
+                    !ior->asy.outp && ior->type == type && !ior->arm.outp &&
                     (ior->func->route.set || ior->id == __ffs(outp->info.or)))
                         return nvkm_outp_acquire_ior(outp, user, ior);
         }
@@ -146,7 +157,7 @@ nvkm_outp_acquire(struct nvkm_outp *outp, u8 user)
          * but will be released during the next modeset.
          */
         list_for_each_entry(ior, &outp->disp->ior, head) {
-                if (!ior->asy.outp && ior->type == type &&
+                if (!ior->identity && !ior->asy.outp && ior->type == type &&
                     (ior->func->route.set || ior->id == __ffs(outp->info.or)))
                         return nvkm_outp_acquire_ior(outp, user, ior);
         }
@@ -245,7 +256,6 @@ nvkm_outp_ctor(const struct nvkm_outp_func *func, struct nvkm_disp *disp,
         outp->index = index;
         outp->info = *dcbE;
         outp->i2c = nvkm_i2c_bus_find(i2c, dcbE->i2c_index);
-        outp->or = ffs(outp->info.or) - 1;
 
         OUTP_DBG(outp, "type %02x loc %d or %d link %d con %x "
                        "edid %x bus %d head %x",
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h
index ea84d7d5741a..6c8aa5cfed9d 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h
@@ -13,10 +13,10 @@ struct nvkm_outp {
         struct dcb_output info;
 
         struct nvkm_i2c_bus *i2c;
-        int or;
 
         struct list_head head;
         struct nvkm_conn *conn;
+        bool identity;
 
         /* Assembly state. */
 #define NVKM_OUTP_PRIV 1
@@ -41,7 +41,8 @@ struct nvkm_outp_func {
         void (*init)(struct nvkm_outp *);
         void (*fini)(struct nvkm_outp *);
         int (*acquire)(struct nvkm_outp *);
-        void (*release)(struct nvkm_outp *, struct nvkm_ior *);
+        void (*release)(struct nvkm_outp *);
+        void (*disable)(struct nvkm_outp *, struct nvkm_ior *);
 };
 
 #define OUTP_MSG(o,l,f,a...) do {                                              \
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c
index b80618e35491..d65959ef0564 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c
@@ -158,7 +158,8 @@ gm200_devinit_post(struct nvkm_devinit *base, bool post)
         }
 
         /* load and execute some other ucode image (bios therm?) */
-        return pmu_load(init, 0x01, post, NULL, NULL);
+        pmu_load(init, 0x01, post, NULL, NULL);
+        return 0;
 }
 
 static const struct nvkm_devinit_func
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
index de269eb482dd..7459def78d50 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
@@ -1423,7 +1423,7 @@ nvkm_vmm_get(struct nvkm_vmm *vmm, u8 page, u64 size, struct nvkm_vma **pvma)
 void
 nvkm_vmm_part(struct nvkm_vmm *vmm, struct nvkm_memory *inst)
 {
-        if (vmm->func->part && inst) {
+        if (inst && vmm->func->part) {
                 mutex_lock(&vmm->mutex);
                 vmm->func->part(vmm, inst);
                 mutex_unlock(&vmm->mutex);
diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index 25b7bd56ae11..1cb41992aaa1 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -335,7 +335,8 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                 struct hid_field *field, struct hid_usage *usage,
                 unsigned long **bit, int *max)
 {
-        if (usage->hid == (HID_UP_CUSTOM | 0x0003)) {
+        if (usage->hid == (HID_UP_CUSTOM | 0x0003) ||
+                        usage->hid == (HID_UP_MSVENDOR | 0x0003)) {
                 /* The fn key on Apple USB keyboards */
                 set_bit(EV_REP, hi->input->evbit);
                 hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_FN);
@@ -472,6 +473,12 @@ static const struct hid_device_id apple_devices[] = {
                 .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI),
                 .driver_data = APPLE_HAS_FN },
+        { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI),
+                .driver_data = APPLE_HAS_FN },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI),
+                .driver_data = APPLE_HAS_FN },
+        { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI),
+                .driver_data = APPLE_HAS_FN },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING_ANSI),
                 .driver_data = APPLE_HAS_FN },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING_ISO),
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 3da354af7a0a..44564f61e9cc 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1000,7 +1000,7 @@ int hid_open_report(struct hid_device *device)
         parser = vzalloc(sizeof(struct hid_parser));
         if (!parser) {
                 ret = -ENOMEM;
-                goto err;
+                goto alloc_err;
         }
 
         parser->device = device;
@@ -1039,6 +1039,7 @@ int hid_open_report(struct hid_device *device)
                                 hid_err(device, "unbalanced delimiter at end of report description\n");
                                 goto err;
                         }
+                        kfree(parser->collection_stack);
                         vfree(parser);
                         device->status |= HID_STAT_PARSED;
                         return 0;
@@ -1047,6 +1048,8 @@ int hid_open_report(struct hid_device *device)
 
         hid_err(device, "item fetching failed at offset %d\n", (int)(end - start));
 err:
+        kfree(parser->collection_stack);
+alloc_err:
         vfree(parser);
         hid_close_report(device);
         return ret;
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 79bdf0c7e351..5146ee029db4 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -88,6 +88,7 @@
 #define USB_DEVICE_ID_ANTON_TOUCH_PAD   0x3101
 
 #define USB_VENDOR_ID_APPLE             0x05ac
+#define BT_VENDOR_ID_APPLE              0x004c
 #define USB_DEVICE_ID_APPLE_MIGHTYMOUSE 0x0304
 #define USB_DEVICE_ID_APPLE_MAGICMOUSE  0x030d
 #define USB_DEVICE_ID_APPLE_MAGICTRACKPAD       0x030e
@@ -157,6 +158,7 @@
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO   0x0256
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_JIS   0x0257
 #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI   0x0267
+#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI   0x026c
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI    0x0290
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO     0x0291
 #define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS     0x0292
@@ -528,9 +530,6 @@
 #define I2C_VENDOR_ID_HANTICK           0x0911
 #define I2C_PRODUCT_ID_HANTICK_5288     0x5288
 
-#define I2C_VENDOR_ID_RAYD              0x2386
-#define I2C_PRODUCT_ID_RAYD_3118        0x3118
-
 #define USB_VENDOR_ID_HANWANG           0x0b57
 #define USB_DEVICE_ID_HANWANG_TABLET_FIRST      0x5000
 #define USB_DEVICE_ID_HANWANG_TABLET_LAST       0x8fff
@@ -950,6 +949,7 @@
 #define USB_DEVICE_ID_SAITEK_RUMBLEPAD  0xff17
 #define USB_DEVICE_ID_SAITEK_PS1000     0x0621
 #define USB_DEVICE_ID_SAITEK_RAT7_OLD   0x0ccb
+#define USB_DEVICE_ID_SAITEK_RAT7_CONTAGION     0x0ccd
 #define USB_DEVICE_ID_SAITEK_RAT7       0x0cd7
 #define USB_DEVICE_ID_SAITEK_RAT9       0x0cfa
 #define USB_DEVICE_ID_SAITEK_MMO7       0x0cd0
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 4e94ea3e280a..a481eaf39e88 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -1582,6 +1582,7 @@ static struct hid_input *hidinput_allocate(struct hid_device *hid,
         input_dev->dev.parent = &hid->dev;
 
         hidinput->input = input_dev;
+        hidinput->application = application;
         list_add_tail(&hidinput->list, &hid->inputs);
 
         INIT_LIST_HEAD(&hidinput->reports);
@@ -1677,8 +1678,7 @@ static struct hid_input *hidinput_match_application(struct hid_report *report)
         struct hid_input *hidinput;
 
         list_for_each_entry(hidinput, &hid->inputs, list) {
-                if (hidinput->report &&
-                    hidinput->report->application == report->application)
+                if (hidinput->application == report->application)
                         return hidinput;
         }
 
@@ -1815,6 +1815,7 @@ void hidinput_disconnect(struct hid_device *hid)
                         input_unregister_device(hidinput->input);
                 else
                         input_free_device(hidinput->input);
+                kfree(hidinput->name);
                 kfree(hidinput);
         }
 
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 40fbb7c52723..da954f3f4da7 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1375,7 +1375,8 @@ static bool mt_need_to_apply_feature(struct hid_device *hdev,
                                      struct hid_usage *usage,
                                      enum latency_mode latency,
                                      bool surface_switch,
-                                     bool button_switch)
+                                     bool button_switch,
+                                     bool *inputmode_found)
 {
         struct mt_device *td = hid_get_drvdata(hdev);
         struct mt_class *cls = &td->mtclass;
@@ -1387,6 +1388,14 @@ static bool mt_need_to_apply_feature(struct hid_device *hdev,
 
         switch (usage->hid) {
         case HID_DG_INPUTMODE:
+                /*
+                 * Some elan panels wrongly declare 2 input mode features,
+                 * and silently ignore when we set the value in the second
+                 * field. Skip the second feature and hope for the best.
+                 */
+                if (*inputmode_found)
+                        return false;
+
                 if (cls->quirks & MT_QUIRK_FORCE_GET_FEATURE) {
                         report_len = hid_report_len(report);
                         buf = hid_alloc_report_buf(report, GFP_KERNEL);
@@ -1402,6 +1411,7 @@ static bool mt_need_to_apply_feature(struct hid_device *hdev,
                 }
 
                 field->value[index] = td->inputmode_value;
+                *inputmode_found = true;
                 return true;
 
         case HID_DG_CONTACTMAX:
@@ -1439,6 +1449,7 @@ static void mt_set_modes(struct hid_device *hdev, enum latency_mode latency,
         struct hid_usage *usage;
         int i, j;
         bool update_report;
+        bool inputmode_found = false;
 
         rep_enum = &hdev->report_enum[HID_FEATURE_REPORT];
         list_for_each_entry(rep, &rep_enum->report_list, list) {
@@ -1457,7 +1468,8 @@ static void mt_set_modes(struct hid_device *hdev, enum latency_mode latency,
                                                              usage,
                                                              latency,
                                                              surface_switch,
-                                                             button_switch))
+                                                             button_switch,
+                                                             &inputmode_found))
                                         update_report = true;
                         }
                 }
@@ -1685,6 +1697,9 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
          */
         hdev->quirks |= HID_QUIRK_INPUT_PER_APP;
 
+        if (id->group != HID_GROUP_MULTITOUCH_WIN_8)
+                hdev->quirks |= HID_QUIRK_MULTI_INPUT;
+
         timer_setup(&td->release_timer, mt_expired_timeout, 0);
 
         ret = hid_parse(hdev);
diff --git a/drivers/hid/hid-saitek.c b/drivers/hid/hid-saitek.c
index 39e642686ff0..683861f324e3 100644
--- a/drivers/hid/hid-saitek.c
+++ b/drivers/hid/hid-saitek.c
@@ -183,6 +183,8 @@ static const struct hid_device_id saitek_devices[] = {
                 .driver_data = SAITEK_RELEASE_MODE_RAT7 },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7),
                 .driver_data = SAITEK_RELEASE_MODE_RAT7 },
+        { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7_CONTAGION),
+                .driver_data = SAITEK_RELEASE_MODE_RAT7 },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT9),
                 .driver_data = SAITEK_RELEASE_MODE_RAT7 },
         { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT9),
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index 50af72baa5ca..2b63487057c2 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -579,6 +579,28 @@ void sensor_hub_device_close(struct hid_sensor_hub_device *hsdev)
 }
 EXPORT_SYMBOL_GPL(sensor_hub_device_close);
 
+static __u8 *sensor_hub_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+                unsigned int *rsize)
+{
+        /*
+         * Checks if the report descriptor of Thinkpad Helix 2 has a logical
+         * minimum for magnetic flux axis greater than the maximum.
+         */
+        if (hdev->product == USB_DEVICE_ID_TEXAS_INSTRUMENTS_LENOVO_YOGA &&
+                *rsize == 2558 && rdesc[913] == 0x17 && rdesc[914] == 0x40 &&
+                rdesc[915] == 0x81 && rdesc[916] == 0x08 &&
+                rdesc[917] == 0x00 && rdesc[918] == 0x27 &&
+                rdesc[921] == 0x07 && rdesc[922] == 0x00) {
+                /* Sets negative logical minimum for mag x, y and z */
+                rdesc[914] = rdesc[935] = rdesc[956] = 0xc0;
+                rdesc[915] = rdesc[936] = rdesc[957] = 0x7e;
+                rdesc[916] = rdesc[937] = rdesc[958] = 0xf7;
+                rdesc[917] = rdesc[938] = rdesc[959] = 0xff;
+        }
+
+        return rdesc;
+}
+
 static int sensor_hub_probe(struct hid_device *hdev,
                                 const struct hid_device_id *id)
 {
@@ -743,6 +765,7 @@ static struct hid_driver sensor_hub_driver = {
         .probe = sensor_hub_probe,
         .remove = sensor_hub_remove,
         .raw_event = sensor_hub_raw_event,
+        .report_fixup = sensor_hub_report_fixup,
 #ifdef CONFIG_PM
         .suspend = sensor_hub_suspend,
         .resume = sensor_hub_resume,
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 2ce194a84868..f3076659361a 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -170,8 +170,6 @@ static const struct i2c_hid_quirks {
                 I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV },
         { I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288,
                 I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
-        { I2C_VENDOR_ID_RAYD, I2C_PRODUCT_ID_RAYD_3118,
-                I2C_HID_QUIRK_RESEND_REPORT_DESCR },
         { USB_VENDOR_ID_SIS_TOUCH, USB_DEVICE_ID_SIS10FB_TOUCH,
                 I2C_HID_QUIRK_RESEND_REPORT_DESCR },
         { 0, 0 }
@@ -1235,11 +1233,16 @@ static int i2c_hid_resume(struct device *dev)
         pm_runtime_enable(dev);
 
         enable_irq(client->irq);
-        ret = i2c_hid_hwreset(client);
+
+        /* Instead of resetting device, simply powers the device on. This
+         * solves "incomplete reports" on Raydium devices 2386:3118 and
+         * 2386:4B33
+         */
+        ret = i2c_hid_set_power(client, I2C_HID_PWR_ON);
         if (ret)
                 return ret;
 
-        /* RAYDIUM device (2386:3118) need to re-send report descr cmd
+        /* Some devices need to re-send report descr cmd
          * after resume, after this it will be back normal.
          * otherwise it issues too many incomplete reports.
          */
diff --git a/drivers/hid/intel-ish-hid/ipc/hw-ish.h b/drivers/hid/intel-ish-hid/ipc/hw-ish.h
index 97869b7410eb..da133716bed0 100644
--- a/drivers/hid/intel-ish-hid/ipc/hw-ish.h
+++ b/drivers/hid/intel-ish-hid/ipc/hw-ish.h
@@ -29,6 +29,7 @@
 #define CNL_Ax_DEVICE_ID        0x9DFC
 #define GLK_Ax_DEVICE_ID        0x31A2
 #define CNL_H_DEVICE_ID         0xA37C
+#define SPT_H_DEVICE_ID         0xA135
 
 #define REVISION_ID_CHT_A0      0x6
 #define REVISION_ID_CHT_Ax_SI   0x0
diff --git a/drivers/hid/intel-ish-hid/ipc/pci-ish.c b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
index 050f9872f5c0..a1125a5c7965 100644
--- a/drivers/hid/intel-ish-hid/ipc/pci-ish.c
+++ b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
@@ -38,6 +38,7 @@ static const struct pci_device_id ish_pci_tbl[] = {
         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, CNL_Ax_DEVICE_ID)},
         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, GLK_Ax_DEVICE_ID)},
         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, CNL_H_DEVICE_ID)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, SPT_H_DEVICE_ID)},
         {0, }
 };
 MODULE_DEVICE_TABLE(pci, ish_pci_tbl);
diff --git a/drivers/hwmon/raspberrypi-hwmon.c b/drivers/hwmon/raspberrypi-hwmon.c
index fb4e4a6bb1f6..be5ba4690895 100644
--- a/drivers/hwmon/raspberrypi-hwmon.c
+++ b/drivers/hwmon/raspberrypi-hwmon.c
@@ -164,3 +164,4 @@ module_platform_driver(rpi_hwmon_driver);
 MODULE_AUTHOR("Stefan Wahren <stefan.wahren@i2se.com>");
 MODULE_DESCRIPTION("Raspberry Pi voltage sensor driver");
 MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:raspberrypi-hwmon");
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 04b60a349d7e..c91e145ef5a5 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -140,6 +140,7 @@
 
 #define SBREG_BAR               0x10
 #define SBREG_SMBCTRL           0xc6000c
+#define SBREG_SMBCTRL_DNV       0xcf000c
 
 /* Host status bits for SMBPCISTS */
 #define SMBPCISTS_INTS          BIT(3)
@@ -1399,7 +1400,11 @@ static void i801_add_tco(struct i801_priv *priv)
         spin_unlock(&p2sb_spinlock);
 
         res = &tco_res[ICH_RES_MEM_OFF];
-        res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL;
+        if (pci_dev->device == PCI_DEVICE_ID_INTEL_DNV_SMBUS)
+                res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL_DNV;
+        else
+                res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL;
+
         res->end = res->start + 3;
         res->flags = IORESOURCE_MEM;
 
diff --git a/drivers/i2c/busses/i2c-imx-lpi2c.c b/drivers/i2c/busses/i2c-imx-lpi2c.c
index 6d975f5221ca..06c4c767af32 100644
--- a/drivers/i2c/busses/i2c-imx-lpi2c.c
+++ b/drivers/i2c/busses/i2c-imx-lpi2c.c
@@ -538,7 +538,6 @@ static const struct i2c_algorithm lpi2c_imx_algo = {
 
 static const struct of_device_id lpi2c_imx_of_match[] = {
         { .compatible = "fsl,imx7ulp-lpi2c" },
-        { .compatible = "fsl,imx8dv-lpi2c" },
         { },
 };
 MODULE_DEVICE_TABLE(of, lpi2c_imx_of_match);
diff --git a/drivers/i2c/busses/i2c-uniphier-f.c b/drivers/i2c/busses/i2c-uniphier-f.c
index 9918bdd81619..a403e8579b65 100644
--- a/drivers/i2c/busses/i2c-uniphier-f.c
+++ b/drivers/i2c/busses/i2c-uniphier-f.c
@@ -401,11 +401,8 @@ static int uniphier_fi2c_master_xfer(struct i2c_adapter *adap,
                 return ret;
 
         for (msg = msgs; msg < emsg; msg++) {
-                /* If next message is read, skip the stop condition */
-                bool stop = !(msg + 1 < emsg && msg[1].flags & I2C_M_RD);
-                /* but, force it if I2C_M_STOP is set */
-                if (msg->flags & I2C_M_STOP)
-                        stop = true;
+                /* Emit STOP if it is the last message or I2C_M_STOP is set. */
+                bool stop = (msg + 1 == emsg) || (msg->flags & I2C_M_STOP);
 
                 ret = uniphier_fi2c_master_xfer_one(adap, msg, stop);
                 if (ret)
diff --git a/drivers/i2c/busses/i2c-uniphier.c b/drivers/i2c/busses/i2c-uniphier.c
index bb181b088291..454f914ae66d 100644
--- a/drivers/i2c/busses/i2c-uniphier.c
+++ b/drivers/i2c/busses/i2c-uniphier.c
@@ -248,11 +248,8 @@ static int uniphier_i2c_master_xfer(struct i2c_adapter *adap,
                 return ret;
 
         for (msg = msgs; msg < emsg; msg++) {
-                /* If next message is read, skip the stop condition */
-                bool stop = !(msg + 1 < emsg && msg[1].flags & I2C_M_RD);
-                /* but, force it if I2C_M_STOP is set */
-                if (msg->flags & I2C_M_STOP)
-                        stop = true;
+                /* Emit STOP if it is the last message or I2C_M_STOP is set. */
+                bool stop = (msg + 1 == emsg) || (msg->flags & I2C_M_STOP);
 
                 ret = uniphier_i2c_master_xfer_one(adap, msg, stop);
                 if (ret)
diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
index 9a71e50d21f1..0c51c0ffdda9 100644
--- a/drivers/i2c/busses/i2c-xiic.c
+++ b/drivers/i2c/busses/i2c-xiic.c
@@ -532,6 +532,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c)
 {
         u8 rx_watermark;
         struct i2c_msg *msg = i2c->rx_msg = i2c->tx_msg;
+        unsigned long flags;
 
         /* Clear and enable Rx full interrupt. */
         xiic_irq_clr_en(i2c, XIIC_INTR_RX_FULL_MASK | XIIC_INTR_TX_ERROR_MASK);
@@ -547,6 +548,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c)
                 rx_watermark = IIC_RX_FIFO_DEPTH;
         xiic_setreg8(i2c, XIIC_RFD_REG_OFFSET, rx_watermark - 1);
 
+        local_irq_save(flags);
         if (!(msg->flags & I2C_M_NOSTART))
                 /* write the address */
                 xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET,
@@ -556,6 +558,8 @@ static void xiic_start_recv(struct xiic_i2c *i2c)
 
         xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET,
                 msg->len | ((i2c->nmsgs == 1) ? XIIC_TX_DYN_STOP_MASK : 0));
+        local_irq_restore(flags);
+
         if (i2c->nmsgs == 1)
                 /* very last, enable bus not busy as well */
                 xiic_irq_clr_en(i2c, XIIC_INTR_BNB_MASK);
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index f72677291b69..a36c94930c31 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -724,6 +724,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
         dgid = (union ib_gid *) &addr->sib_addr;
         pkey = ntohs(addr->sib_pkey);
 
+        mutex_lock(&lock);
         list_for_each_entry(cur_dev, &dev_list, list) {
                 for (p = 1; p <= cur_dev->device->phys_port_cnt; ++p) {
                         if (!rdma_cap_af_ib(cur_dev->device, p))
@@ -750,18 +751,19 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
                                         cma_dev = cur_dev;
                                         sgid = gid;
                                         id_priv->id.port_num = p;
+                                        goto found;
                                 }
                         }
                 }
         }
-
-        if (!cma_dev)
-                return -ENODEV;
+        mutex_unlock(&lock);
+        return -ENODEV;
 
 found:
         cma_attach_to_dev(id_priv, cma_dev);
-        addr = (struct sockaddr_ib *) cma_src_addr(id_priv);
-        memcpy(&addr->sib_addr, &sgid, sizeof sgid);
+        mutex_unlock(&lock);
+        addr = (struct sockaddr_ib *)cma_src_addr(id_priv);
+        memcpy(&addr->sib_addr, &sgid, sizeof(sgid));
         cma_translate_ib(addr, &id_priv->id.route.addr.dev_addr);
         return 0;
 }
diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
index 6eb64c6f0802..c4118bcd5103 100644
--- a/drivers/infiniband/core/rdma_core.c
+++ b/drivers/infiniband/core/rdma_core.c
@@ -882,6 +882,8 @@ static int __uverbs_cleanup_ufile(struct ib_uverbs_file *ufile,
                 WARN_ON(uverbs_try_lock_object(obj, UVERBS_LOOKUP_WRITE));
                 if (!uverbs_destroy_uobject(obj, reason))
                         ret = 0;
+                else
+                        atomic_set(&obj->usecnt, 0);
         }
         return ret;
 }
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index ec8fb289621f..5f437d1570fb 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -124,6 +124,8 @@ static DEFINE_MUTEX(mut);
 static DEFINE_IDR(ctx_idr);
 static DEFINE_IDR(multicast_idr);
 
+static const struct file_operations ucma_fops;
+
 static inline struct ucma_context *_ucma_find_context(int id,
                                                       struct ucma_file *file)
 {
@@ -1581,6 +1583,10 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file,
         f = fdget(cmd.fd);
         if (!f.file)
                 return -ENOENT;
+        if (f.file->f_op != &ucma_fops) {
+                ret = -EINVAL;
+                goto file_put;
+        }
 
         /* Validate current fd and prevent destruction of id. */
         ctx = ucma_get_ctx(f.file->private_data, cmd.id);
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 823beca448e1..6d974e2363df 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -1050,7 +1050,7 @@ static void ib_uverbs_add_one(struct ib_device *device)
         uverbs_dev->num_comp_vectors = device->num_comp_vectors;
 
         if (ib_uverbs_create_uapi(device, uverbs_dev))
-                goto err;
+                goto err_uapi;
 
         cdev_init(&uverbs_dev->cdev, NULL);
         uverbs_dev->cdev.owner = THIS_MODULE;
@@ -1077,11 +1077,10 @@ static void ib_uverbs_add_one(struct ib_device *device)
 
 err_class:
         device_destroy(uverbs_class, uverbs_dev->cdev.dev);
-
 err_cdev:
         cdev_del(&uverbs_dev->cdev);
+err_uapi:
         clear_bit(devnum, dev_map);
-
 err:
         if (atomic_dec_and_test(&uverbs_dev->refcount))
                 ib_uverbs_comp_dev(uverbs_dev);
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index bbfb86eb2d24..bc2b9e038439 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -833,6 +833,8 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp)
                                 "Failed to destroy Shadow QP");
                         return rc;
                 }
+                bnxt_qplib_free_qp_res(&rdev->qplib_res,
+                                       &rdev->qp1_sqp->qplib_qp);
                 mutex_lock(&rdev->qp_lock);
                 list_del(&rdev->qp1_sqp->list);
                 atomic_dec(&rdev->qp_count);
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index e426b990c1dd..6ad0d46ab879 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -196,7 +196,7 @@ static int bnxt_qplib_alloc_qp_hdr_buf(struct bnxt_qplib_res *res,
                                        struct bnxt_qplib_qp *qp)
 {
         struct bnxt_qplib_q *rq = &qp->rq;
-        struct bnxt_qplib_q *sq = &qp->rq;
+        struct bnxt_qplib_q *sq = &qp->sq;
         int rc = 0;
 
         if (qp->sq_hdr_buf_size && sq->hwq.max_elements) {
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index b3203afa3b1d..347fe18b1a41 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -1685,6 +1685,12 @@ static void flush_qp(struct c4iw_qp *qhp)
         schp = to_c4iw_cq(qhp->ibqp.send_cq);
 
         if (qhp->ibqp.uobject) {
+
+                /* for user qps, qhp->wq.flushed is protected by qhp->mutex */
+                if (qhp->wq.flushed)
+                        return;
+
+                qhp->wq.flushed = 1;
                 t4_set_wq_in_error(&qhp->wq, 0);
                 t4_set_cq_in_error(&rchp->cq);
                 spin_lock_irqsave(&rchp->comp_handler_lock, flag);
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index ca0f1ee26091..0bbeaaae47e0 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -517,9 +517,11 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
         props->page_size_cap       = dev->dev->caps.page_size_cap;
         props->max_qp              = dev->dev->quotas.qp;
         props->max_qp_wr           = dev->dev->caps.max_wqes - MLX4_IB_SQ_MAX_SPARE;
-        props->max_send_sge        = dev->dev->caps.max_sq_sg;
-        props->max_recv_sge        = dev->dev->caps.max_rq_sg;
-        props->max_sge_rd          = MLX4_MAX_SGE_RD;
+        props->max_send_sge =
+                min(dev->dev->caps.max_sq_sg, dev->dev->caps.max_rq_sg);
+        props->max_recv_sge =
+                min(dev->dev->caps.max_sq_sg, dev->dev->caps.max_rq_sg);
+        props->max_sge_rd = MLX4_MAX_SGE_RD;
         props->max_cq              = dev->dev->quotas.cq;
         props->max_cqe             = dev->dev->caps.max_cqes;
         props->max_mr              = dev->dev->quotas.mpt;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index ea01b8dd2be6..3d5424f335cb 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1027,12 +1027,14 @@ static int ipoib_cm_rep_handler(struct ib_cm_id *cm_id,
 
         skb_queue_head_init(&skqueue);
 
+        netif_tx_lock_bh(p->dev);
         spin_lock_irq(&priv->lock);
         set_bit(IPOIB_FLAG_OPER_UP, &p->flags);
         if (p->neigh)
                 while ((skb = __skb_dequeue(&p->neigh->queue)))
                         __skb_queue_tail(&skqueue, skb);
         spin_unlock_irq(&priv->lock);
+        netif_tx_unlock_bh(p->dev);
 
         while ((skb = __skb_dequeue(&skqueue))) {
                 skb->dev = p->dev;
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 316a57530f6d..c2df341ff6fa 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1439,6 +1439,7 @@ static struct irq_chip its_irq_chip = {
  * The consequence of the above is that allocation is cost is low, but
  * freeing is expensive. We assumes that freeing rarely occurs.
  */
+#define ITS_MAX_LPI_NRBITS      16 /* 64K LPIs */
 
 static DEFINE_MUTEX(lpi_range_lock);
 static LIST_HEAD(lpi_range_list);
@@ -1625,7 +1626,8 @@ static int __init its_alloc_lpi_tables(void)
 {
         phys_addr_t paddr;
 
-        lpi_id_bits = GICD_TYPER_ID_BITS(gic_rdists->gicd_typer);
+        lpi_id_bits = min_t(u32, GICD_TYPER_ID_BITS(gic_rdists->gicd_typer),
+                                ITS_MAX_LPI_NRBITS);
         gic_rdists->prop_page = its_allocate_prop_table(GFP_NOWAIT);
         if (!gic_rdists->prop_page) {
                 pr_err("Failed to allocate PROPBASE\n");
diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
index 94329e03001e..0b2af6e74fc3 100644
--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -1276,18 +1276,18 @@ static int resync_info_update(struct mddev *mddev, sector_t lo, sector_t hi)
 static int resync_finish(struct mddev *mddev)
 {
         struct md_cluster_info *cinfo = mddev->cluster_info;
+        int ret = 0;
 
         clear_bit(MD_RESYNCING_REMOTE, &mddev->recovery);
-        dlm_unlock_sync(cinfo->resync_lockres);
 
         /*
          * If resync thread is interrupted so we can't say resync is finished,
          * another node will launch resync thread to continue.
          */
-        if (test_bit(MD_CLOSING, &mddev->flags))
-                return 0;
-        else
-                return resync_info_update(mddev, 0, 0);
+        if (!test_bit(MD_CLOSING, &mddev->flags))
+                ret = resync_info_update(mddev, 0, 0);
+        dlm_unlock_sync(cinfo->resync_lockres);
+        return ret;
 }
 
 static int area_resyncing(struct mddev *mddev, int direction,
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 981898049491..d6f7978b4449 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -4529,11 +4529,12 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr,
                 allow_barrier(conf);
         }
 
+        raise_barrier(conf, 0);
 read_more:
         /* Now schedule reads for blocks from sector_nr to last */
         r10_bio = raid10_alloc_init_r10buf(conf);
         r10_bio->state = 0;
-        raise_barrier(conf, sectors_done != 0);
+        raise_barrier(conf, 1);
         atomic_set(&r10_bio->remaining, 0);
         r10_bio->mddev = mddev;
         r10_bio->sector = sector_nr;
@@ -4629,6 +4630,8 @@ read_more:
         if (sector_nr <= last)
                 goto read_more;
 
+        lower_barrier(conf);
+
         /* Now that we have done the whole section we can
          * update reshape_progress
          */
diff --git a/drivers/md/raid5-log.h b/drivers/md/raid5-log.h
index a001808a2b77..bfb811407061 100644
--- a/drivers/md/raid5-log.h
+++ b/drivers/md/raid5-log.h
@@ -46,6 +46,11 @@ extern int ppl_modify_log(struct r5conf *conf, struct md_rdev *rdev, bool add);
 extern void ppl_quiesce(struct r5conf *conf, int quiesce);
 extern int ppl_handle_flush_request(struct r5l_log *log, struct bio *bio);
 
+static inline bool raid5_has_log(struct r5conf *conf)
+{
+        return test_bit(MD_HAS_JOURNAL, &conf->mddev->flags);
+}
+
 static inline bool raid5_has_ppl(struct r5conf *conf)
 {
         return test_bit(MD_HAS_PPL, &conf->mddev->flags);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 4ce0d7502fad..e4e98f47865d 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -733,7 +733,7 @@ static bool stripe_can_batch(struct stripe_head *sh)
 {
         struct r5conf *conf = sh->raid_conf;
 
-        if (conf->log || raid5_has_ppl(conf))
+        if (raid5_has_log(conf) || raid5_has_ppl(conf))
                 return false;
         return test_bit(STRIPE_BATCH_READY, &sh->state) &&
                 !test_bit(STRIPE_BITMAP_PENDING, &sh->state) &&
@@ -7737,7 +7737,7 @@ static int raid5_resize(struct mddev *mddev, sector_t sectors)
         sector_t newsize;
         struct r5conf *conf = mddev->private;
 
-        if (conf->log || raid5_has_ppl(conf))
+        if (raid5_has_log(conf) || raid5_has_ppl(conf))
                 return -EINVAL;
         sectors &= ~((sector_t)conf->chunk_sectors - 1);
         newsize = raid5_size(mddev, sectors, mddev->raid_disks);
@@ -7788,7 +7788,7 @@ static int check_reshape(struct mddev *mddev)
 {
         struct r5conf *conf = mddev->private;
 
-        if (conf->log || raid5_has_ppl(conf))
+        if (raid5_has_log(conf) || raid5_has_ppl(conf))
                 return -EINVAL;
         if (mddev->delta_disks == 0 &&
             mddev->new_layout == mddev->layout &&
diff --git a/drivers/memory/ti-aemif.c b/drivers/memory/ti-aemif.c
index 31112f622b88..475e5b3790ed 100644
--- a/drivers/memory/ti-aemif.c
+++ b/drivers/memory/ti-aemif.c
@@ -411,7 +411,7 @@ static int aemif_probe(struct platform_device *pdev)
                         if (ret < 0)
                                 goto error;
                 }
-        } else {
+        } else if (pdata) {
                 for (i = 0; i < pdata->num_sub_devices; i++) {
                         pdata->sub_devices[i].dev.parent = dev;
                         ret = platform_device_register(&pdata->sub_devices[i]);
diff --git a/drivers/net/appletalk/ipddp.c b/drivers/net/appletalk/ipddp.c
index 9375cef22420..3d27616d9c85 100644
--- a/drivers/net/appletalk/ipddp.c
+++ b/drivers/net/appletalk/ipddp.c
@@ -283,8 +283,12 @@ static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                 case SIOCFINDIPDDPRT:
                         spin_lock_bh(&ipddp_route_lock);
                         rp = __ipddp_find_route(&rcp);
-                        if (rp)
-                                memcpy(&rcp2, rp, sizeof(rcp2));
+                        if (rp) {
+                                memset(&rcp2, 0, sizeof(rcp2));
+                                rcp2.ip    = rp->ip;
+                                rcp2.at    = rp->at;
+                                rcp2.flags = rp->flags;
+                        }
                         spin_unlock_bh(&ipddp_route_lock);
 
                         if (rp) {
diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
index 7a637b51c7d2..e08301d833e2 100644
--- a/drivers/net/ethernet/lantiq_etop.c
+++ b/drivers/net/ethernet/lantiq_etop.c
@@ -274,6 +274,7 @@ ltq_etop_hw_init(struct net_device *dev)
                 struct ltq_etop_chan *ch = &priv->ch[i];
 
                 ch->idx = ch->dma.nr = i;
+                ch->dma.dev = &priv->pdev->dev;
 
                 if (IS_TX(i)) {
                         ltq_dma_alloc_tx(&ch->dma);
diff --git a/drivers/net/ethernet/netronome/nfp/flower/action.c b/drivers/net/ethernet/netronome/nfp/flower/action.c
index 9044496803e6..46ba0cf257c6 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/action.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/action.c
@@ -52,6 +52,7 @@
 #define NFP_FL_TUNNEL_CSUM                      cpu_to_be16(0x01)
 #define NFP_FL_TUNNEL_KEY                       cpu_to_be16(0x04)
 #define NFP_FL_TUNNEL_GENEVE_OPT                cpu_to_be16(0x0800)
+#define NFP_FL_SUPPORTED_TUNNEL_INFO_FLAGS      IP_TUNNEL_INFO_TX
 #define NFP_FL_SUPPORTED_IPV4_UDP_TUN_FLAGS     (NFP_FL_TUNNEL_CSUM | \
                                                  NFP_FL_TUNNEL_KEY | \
                                                  NFP_FL_TUNNEL_GENEVE_OPT)
@@ -741,11 +742,16 @@ nfp_flower_loop_action(struct nfp_app *app, const struct tc_action *a,
                 nfp_fl_push_vlan(psh_v, a);
                 *a_len += sizeof(struct nfp_fl_push_vlan);
         } else if (is_tcf_tunnel_set(a)) {
+                struct ip_tunnel_info *ip_tun = tcf_tunnel_info(a);
                 struct nfp_repr *repr = netdev_priv(netdev);
+
                 *tun_type = nfp_fl_get_tun_from_act_l4_port(repr->app, a);
                 if (*tun_type == NFP_FL_TUNNEL_NONE)
                         return -EOPNOTSUPP;
 
+                if (ip_tun->mode & ~NFP_FL_SUPPORTED_TUNNEL_INFO_FLAGS)
+                        return -EOPNOTSUPP;
+
                 /* Pre-tunnel action is required for tunnel encap.
                  * This checks for next hop entries on NFP.
                  * If none, the packet falls back before applying other actions.
diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.h b/drivers/net/ethernet/netronome/nfp/flower/main.h
index 85f8209bf007..81d941ab895c 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/main.h
+++ b/drivers/net/ethernet/netronome/nfp/flower/main.h
@@ -70,6 +70,7 @@ struct nfp_app;
 #define NFP_FL_FEATS_GENEVE             BIT(0)
 #define NFP_FL_NBI_MTU_SETTING          BIT(1)
 #define NFP_FL_FEATS_GENEVE_OPT         BIT(2)
+#define NFP_FL_FEATS_VLAN_PCP           BIT(3)
 #define NFP_FL_FEATS_LAG                BIT(31)
 
 struct nfp_fl_mask_id {
diff --git a/drivers/net/ethernet/netronome/nfp/flower/match.c b/drivers/net/ethernet/netronome/nfp/flower/match.c
index a0c72f277faa..17acb8cc6044 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/match.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/match.c
@@ -56,7 +56,7 @@ nfp_flower_compile_meta_tci(struct nfp_flower_meta_tci *frame,
                                                       FLOW_DISSECTOR_KEY_VLAN,
                                                       target);
                 /* Populate the tci field. */
-                if (flow_vlan->vlan_id) {
+                if (flow_vlan->vlan_id || flow_vlan->vlan_priority) {
                         tmp_tci = FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO,
                                              flow_vlan->vlan_priority) |
                                   FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID,
diff --git a/drivers/net/ethernet/netronome/nfp/flower/offload.c b/drivers/net/ethernet/netronome/nfp/flower/offload.c
index 2edab01c3beb..bd19624f10cf 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/offload.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/offload.c
@@ -192,6 +192,17 @@ nfp_flower_calculate_key_layers(struct nfp_app *app,
                 key_size += sizeof(struct nfp_flower_mac_mpls);
         }
 
+        if (dissector_uses_key(flow->dissector, FLOW_DISSECTOR_KEY_VLAN)) {
+                struct flow_dissector_key_vlan *flow_vlan;
+
+                flow_vlan = skb_flow_dissector_target(flow->dissector,
+                                                      FLOW_DISSECTOR_KEY_VLAN,
+                                                      flow->mask);
+                if (!(priv->flower_ext_feats & NFP_FL_FEATS_VLAN_PCP) &&
+                    flow_vlan->vlan_priority)
+                        return -EOPNOTSUPP;
+        }
+
         if (dissector_uses_key(flow->dissector,
                                FLOW_DISSECTOR_KEY_ENC_CONTROL)) {
                 struct flow_dissector_key_ipv4_addrs *mask_ipv4 = NULL;
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index a1f37d58e2fe..1d8631303b53 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -631,7 +631,7 @@ struct rtl8169_tc_offsets {
 };
 
 enum rtl_flag {
-        RTL_FLAG_TASK_ENABLED,
+        RTL_FLAG_TASK_ENABLED = 0,
         RTL_FLAG_TASK_SLOW_PENDING,
         RTL_FLAG_TASK_RESET_PENDING,
         RTL_FLAG_MAX
@@ -6655,7 +6655,8 @@ static int rtl8169_close(struct net_device *dev)
         rtl8169_update_counters(tp);
 
         rtl_lock_work(tp);
-        clear_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags);
+        /* Clear all task flags */
+        bitmap_zero(tp->wk.flags, RTL_FLAG_MAX);
 
         rtl8169_down(dev);
         rtl_unlock_work(tp);
@@ -6838,7 +6839,9 @@ static void rtl8169_net_suspend(struct net_device *dev)
 
         rtl_lock_work(tp);
         napi_disable(&tp->napi);
-        clear_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags);
+        /* Clear all task flags */
+        bitmap_zero(tp->wk.flags, RTL_FLAG_MAX);
+
         rtl_unlock_work(tp);
 
         rtl_pll_power_down(tp);
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 70921bbe0e28..915fbd66a02b 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -2272,17 +2272,15 @@ static int netvsc_remove(struct hv_device *dev)
 
         cancel_delayed_work_sync(&ndev_ctx->dwork);
 
-        rcu_read_lock();
-        nvdev = rcu_dereference(ndev_ctx->nvdev);
-
-        if  (nvdev)
+        rtnl_lock();
+        nvdev = rtnl_dereference(ndev_ctx->nvdev);
+        if (nvdev)
                 cancel_work_sync(&nvdev->subchan_work);
 
         /*
          * Call to the vsc driver to let it know that the device is being
          * removed. Also blocks mtu and channel changes.
          */
-        rtnl_lock();
         vf_netdev = rtnl_dereference(ndev_ctx->vf_netdev);
         if (vf_netdev)
                 netvsc_unregister_vf(vf_netdev);
@@ -2294,7 +2292,6 @@ static int netvsc_remove(struct hv_device *dev)
         list_del(&ndev_ctx->list);
 
         rtnl_unlock();
-        rcu_read_unlock();
 
         hv_set_drvdata(dev, NULL);
 
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 9407acbd19a9..f17f602e6171 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -908,7 +908,11 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
                         BUG_ON(pull_to <= skb_headlen(skb));
                         __pskb_pull_tail(skb, pull_to - skb_headlen(skb));
                 }
-                BUG_ON(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS);
+                if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) {
+                        queue->rx.rsp_cons = ++cons;
+                        kfree_skb(nskb);
+                        return ~0U;
+                }
 
                 skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
                                 skb_frag_page(nfrag),
@@ -1045,6 +1049,8 @@ err:
                 skb->len += rx->status;
 
                 i = xennet_fill_frags(queue, skb, &tmpq);
+                if (unlikely(i == ~0U))
+                        goto err;
 
                 if (rx->flags & XEN_NETRXF_csum_blank)
                         skb->ip_summed = CHECKSUM_PARTIAL;
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 49f64eb3eab0..de8282420f96 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -25,6 +25,7 @@
 #include <linux/netdevice.h>
 #include <linux/netdev_features.h>
 #include <linux/skbuff.h>
+#include <linux/vmalloc.h>
 
 #include <net/iucv/af_iucv.h>
 #include <net/dsfield.h>
@@ -4699,7 +4700,7 @@ static int qeth_query_oat_command(struct qeth_card *card, char __user *udata)
 
         priv.buffer_len = oat_data.buffer_len;
         priv.response_len = 0;
-        priv.buffer =  kzalloc(oat_data.buffer_len, GFP_KERNEL);
+        priv.buffer = vzalloc(oat_data.buffer_len);
         if (!priv.buffer) {
                 rc = -ENOMEM;
                 goto out;
@@ -4740,7 +4741,7 @@ static int qeth_query_oat_command(struct qeth_card *card, char __user *udata)
                         rc = -EFAULT;
 
 out_free:
-        kfree(priv.buffer);
+        vfree(priv.buffer);
 out:
         return rc;
 }
@@ -5706,6 +5707,8 @@ static struct net_device *qeth_alloc_netdev(struct qeth_card *card)
                 dev->priv_flags &= ~IFF_TX_SKB_SHARING;
                 dev->hw_features |= NETIF_F_SG;
                 dev->vlan_features |= NETIF_F_SG;
+                if (IS_IQD(card))
+                        dev->features |= NETIF_F_SG;
         }
 
         return dev;
@@ -5768,8 +5771,10 @@ static int qeth_core_probe_device(struct ccwgroup_device *gdev)
         qeth_update_from_chp_desc(card);
 
         card->dev = qeth_alloc_netdev(card);
-        if (!card->dev)
+        if (!card->dev) {
+                rc = -ENOMEM;
                 goto err_card;
+        }
 
         qeth_determine_capabilities(card);
         enforced_disc = qeth_enforce_discipline(card);
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 710fa74892ae..b5e38531733f 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -423,7 +423,7 @@ static int qeth_l2_process_inbound_buffer(struct qeth_card *card,
                 default:
                         dev_kfree_skb_any(skb);
                         QETH_CARD_TEXT(card, 3, "inbunkno");
-                        QETH_DBF_HEX(CTRL, 3, hdr, QETH_DBF_CTRL_LEN);
+                        QETH_DBF_HEX(CTRL, 3, hdr, sizeof(*hdr));
                         continue;
                 }
                 work_done++;
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 7175086677fb..ada258c01a08 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -1390,7 +1390,7 @@ static int qeth_l3_process_inbound_buffer(struct qeth_card *card,
                 default:
                         dev_kfree_skb_any(skb);
                         QETH_CARD_TEXT(card, 3, "inbunkno");
-                        QETH_DBF_HEX(CTRL, 3, hdr, QETH_DBF_CTRL_LEN);
+                        QETH_DBF_HEX(CTRL, 3, hdr, sizeof(*hdr));
                         continue;
                 }
                 work_done++;
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 8fc851a9e116..7c097006c54d 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -52,12 +52,12 @@ config SCSI_MQ_DEFAULT
         default y
         depends on SCSI
         ---help---
-          This option enables the new blk-mq based I/O path for SCSI
-          devices by default.  With the option the scsi_mod.use_blk_mq
-          module/boot option defaults to Y, without it to N, but it can
-          still be overridden either way.
+          This option enables the blk-mq based I/O path for SCSI devices by
+          default.  With this option the scsi_mod.use_blk_mq module/boot
+          option defaults to Y, without it to N, but it can still be
+          overridden either way.
 
-          If unsure say N.
+          If unsure say Y.
 
 config SCSI_PROC_FS
         bool "legacy /proc/scsi/ support"
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index 29bf1e60f542..39eb415987fc 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -1346,7 +1346,7 @@ struct fib {
 struct aac_hba_map_info {
         __le32  rmw_nexus;              /* nexus for native HBA devices */
         u8              devtype;        /* device type */
-        u8              reset_state;    /* 0 - no reset, 1..x - */
+        s8              reset_state;    /* 0 - no reset, 1..x - */
                                         /* after xth TM LUN reset */
         u16             qd_limit;
         u32             scan_counter;
diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c
index 23d07e9f87d0..e51923886475 100644
--- a/drivers/scsi/csiostor/csio_hw.c
+++ b/drivers/scsi/csiostor/csio_hw.c
@@ -1602,6 +1602,46 @@ fw_port_cap32_t fwcaps16_to_caps32(fw_port_cap16_t caps16)
 }
 
 /**
+ *      fwcaps32_to_caps16 - convert 32-bit Port Capabilities to 16-bits
+ *      @caps32: a 32-bit Port Capabilities value
+ *
+ *      Returns the equivalent 16-bit Port Capabilities value.  Note that
+ *      not all 32-bit Port Capabilities can be represented in the 16-bit
+ *      Port Capabilities and some fields/values may not make it.
+ */
+fw_port_cap16_t fwcaps32_to_caps16(fw_port_cap32_t caps32)
+{
+        fw_port_cap16_t caps16 = 0;
+
+        #define CAP32_TO_CAP16(__cap) \
+                do { \
+                        if (caps32 & FW_PORT_CAP32_##__cap) \
+                                caps16 |= FW_PORT_CAP_##__cap; \
+                } while (0)
+
+        CAP32_TO_CAP16(SPEED_100M);
+        CAP32_TO_CAP16(SPEED_1G);
+        CAP32_TO_CAP16(SPEED_10G);
+        CAP32_TO_CAP16(SPEED_25G);
+        CAP32_TO_CAP16(SPEED_40G);
+        CAP32_TO_CAP16(SPEED_100G);
+        CAP32_TO_CAP16(FC_RX);
+        CAP32_TO_CAP16(FC_TX);
+        CAP32_TO_CAP16(802_3_PAUSE);
+        CAP32_TO_CAP16(802_3_ASM_DIR);
+        CAP32_TO_CAP16(ANEG);
+        CAP32_TO_CAP16(FORCE_PAUSE);
+        CAP32_TO_CAP16(MDIAUTO);
+        CAP32_TO_CAP16(MDISTRAIGHT);
+        CAP32_TO_CAP16(FEC_RS);
+        CAP32_TO_CAP16(FEC_BASER_RS);
+
+        #undef CAP32_TO_CAP16
+
+        return caps16;
+}
+
+/**
  *      lstatus_to_fwcap - translate old lstatus to 32-bit Port Capabilities
  *      @lstatus: old FW_PORT_ACTION_GET_PORT_INFO lstatus value
  *
@@ -1759,7 +1799,7 @@ csio_enable_ports(struct csio_hw *hw)
                         val = 1;
 
                         csio_mb_params(hw, mbp, CSIO_MB_DEFAULT_TMO,
-                                       hw->pfn, 0, 1, &param, &val, false,
+                                       hw->pfn, 0, 1, &param, &val, true,
                                        NULL);
 
                         if (csio_mb_issue(hw, mbp)) {
@@ -1769,16 +1809,9 @@ csio_enable_ports(struct csio_hw *hw)
                                 return -EINVAL;
                         }
 
-                        csio_mb_process_read_params_rsp(hw, mbp, &retval, 1,
-                                                        &val);
-                        if (retval != FW_SUCCESS) {
-                                csio_err(hw, "FW_PARAMS_CMD(r) port:%d failed: 0x%x\n",
-                                         portid, retval);
-                                mempool_free(mbp, hw->mb_mempool);
-                                return -EINVAL;
-                        }
-
-                        fw_caps = val;
+                        csio_mb_process_read_params_rsp(hw, mbp, &retval,
+                                                        0, NULL);
+                        fw_caps = retval ? FW_CAPS16 : FW_CAPS32;
                 }
 
                 /* Read PORT information */
@@ -2364,8 +2397,8 @@ bye:
 }
 
 /*
- * Returns -EINVAL if attempts to flash the firmware failed
- * else returns 0,
+ * Returns -EINVAL if attempts to flash the firmware failed,
+ * -ENOMEM if memory allocation failed else returns 0,
  * if flashing was not attempted because the card had the
  * latest firmware ECANCELED is returned
  */
@@ -2393,6 +2426,13 @@ csio_hw_flash_fw(struct csio_hw *hw, int *reset)
                 return -EINVAL;
         }
 
+        /* allocate memory to read the header of the firmware on the
+         * card
+         */
+        card_fw = kmalloc(sizeof(*card_fw), GFP_KERNEL);
+        if (!card_fw)
+                return -ENOMEM;
+
         if (csio_is_t5(pci_dev->device & CSIO_HW_CHIP_MASK))
                 fw_bin_file = FW_FNAME_T5;
         else
@@ -2406,11 +2446,6 @@ csio_hw_flash_fw(struct csio_hw *hw, int *reset)
                 fw_size = fw->size;
         }
 
-        /* allocate memory to read the header of the firmware on the
-         * card
-         */
-        card_fw = kmalloc(sizeof(*card_fw), GFP_KERNEL);
-
         /* upgrade FW logic */
         ret = csio_hw_prep_fw(hw, fw_info, fw_data, fw_size, card_fw,
                          hw->fw_state, reset);
diff --git a/drivers/scsi/csiostor/csio_hw.h b/drivers/scsi/csiostor/csio_hw.h
index 9e73ef771eb7..e351af6e7c81 100644
--- a/drivers/scsi/csiostor/csio_hw.h
+++ b/drivers/scsi/csiostor/csio_hw.h
@@ -639,6 +639,7 @@ int csio_handle_intr_status(struct csio_hw *, unsigned int,
 
 fw_port_cap32_t fwcap_to_fwspeed(fw_port_cap32_t acaps);
 fw_port_cap32_t fwcaps16_to_caps32(fw_port_cap16_t caps16);
+fw_port_cap16_t fwcaps32_to_caps16(fw_port_cap32_t caps32);
 fw_port_cap32_t lstatus_to_fwcap(u32 lstatus);
 
 int csio_hw_start(struct csio_hw *);
diff --git a/drivers/scsi/csiostor/csio_mb.c b/drivers/scsi/csiostor/csio_mb.c
index c026417269c3..6f13673d6aa0 100644
--- a/drivers/scsi/csiostor/csio_mb.c
+++ b/drivers/scsi/csiostor/csio_mb.c
@@ -368,7 +368,7 @@ csio_mb_port(struct csio_hw *hw, struct csio_mb *mbp, uint32_t tmo,
                         FW_CMD_LEN16_V(sizeof(*cmdp) / 16));
 
         if (fw_caps == FW_CAPS16)
-                cmdp->u.l1cfg.rcap = cpu_to_be32(fc);
+                cmdp->u.l1cfg.rcap = cpu_to_be32(fwcaps32_to_caps16(fc));
         else
                 cmdp->u.l1cfg32.rcap32 = cpu_to_be32(fc);
 }
@@ -395,8 +395,8 @@ csio_mb_process_read_port_rsp(struct csio_hw *hw, struct csio_mb *mbp,
                         *pcaps = fwcaps16_to_caps32(ntohs(rsp->u.info.pcap));
                         *acaps = fwcaps16_to_caps32(ntohs(rsp->u.info.acap));
                 } else {
-                        *pcaps = ntohs(rsp->u.info32.pcaps32);
-                        *acaps = ntohs(rsp->u.info32.acaps32);
+                        *pcaps = be32_to_cpu(rsp->u.info32.pcaps32);
+                        *acaps = be32_to_cpu(rsp->u.info32.acaps32);
                 }
         }
 }
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index f02dcc875a09..ea4b0bb0c1cd 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -563,35 +563,13 @@ struct Scsi_Host *scsi_host_get(struct Scsi_Host *shost)
 }
 EXPORT_SYMBOL(scsi_host_get);
 
-struct scsi_host_mq_in_flight {
-        int cnt;
-};
-
-static void scsi_host_check_in_flight(struct request *rq, void *data,
-                bool reserved)
-{
-        struct scsi_host_mq_in_flight *in_flight = data;
-
-        if (blk_mq_request_started(rq))
-                in_flight->cnt++;
-}
-
 /**
  * scsi_host_busy - Return the host busy counter
  * @shost:      Pointer to Scsi_Host to inc.
  **/
 int scsi_host_busy(struct Scsi_Host *shost)
 {
-        struct scsi_host_mq_in_flight in_flight = {
-                .cnt = 0,
-        };
-
-        if (!shost->use_blk_mq)
-                return atomic_read(&shost->host_busy);
-
-        blk_mq_tagset_busy_iter(&shost->tag_set, scsi_host_check_in_flight,
-                        &in_flight);
-        return in_flight.cnt;
+        return atomic_read(&shost->host_busy);
 }
 EXPORT_SYMBOL(scsi_host_busy);
 
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 58bb70b886d7..c120929d4ffe 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -976,7 +976,7 @@ static struct scsi_host_template hpsa_driver_template = {
 #endif
         .sdev_attrs = hpsa_sdev_attrs,
         .shost_attrs = hpsa_shost_attrs,
-        .max_sectors = 1024,
+        .max_sectors = 2048,
         .no_write_same = 1,
 };
 
diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index e0d0da5f43d6..43732e8d1347 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -672,7 +672,7 @@ struct lpfc_hba {
 #define LS_NPIV_FAB_SUPPORTED 0x2       /* Fabric supports NPIV */
 #define LS_IGNORE_ERATT       0x4       /* intr handler should ignore ERATT */
 #define LS_MDS_LINK_DOWN      0x8       /* MDS Diagnostics Link Down */
-#define LS_MDS_LOOPBACK      0x16       /* MDS Diagnostics Link Up (Loopback) */
+#define LS_MDS_LOOPBACK      0x10       /* MDS Diagnostics Link Up (Loopback) */
 
         uint32_t hba_flag;      /* hba generic flags */
 #define HBA_ERATT_HANDLED       0x1 /* This flag is set when eratt handled */
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 5a25553415f8..057a60abe664 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -5122,16 +5122,16 @@ LPFC_ATTR_R(enable_SmartSAN, 0, 0, 1, "Enable SmartSAN functionality");
 
 /*
 # lpfc_fdmi_on: Controls FDMI support.
-#       0       No FDMI support (default)
-#       1       Traditional FDMI support
+#       0       No FDMI support
+#       1       Traditional FDMI support (default)
 # Traditional FDMI support means the driver will assume FDMI-2 support;
 # however, if that fails, it will fallback to FDMI-1.
 # If lpfc_enable_SmartSAN is set to 1, the driver ignores lpfc_fdmi_on.
 # If lpfc_enable_SmartSAN is set 0, the driver uses the current value of
 # lpfc_fdmi_on.
-# Value range [0,1]. Default value is 0.
+# Value range [0,1]. Default value is 1.
 */
-LPFC_ATTR_R(fdmi_on, 0, 0, 1, "Enable FDMI support");
+LPFC_ATTR_R(fdmi_on, 1, 0, 1, "Enable FDMI support");
 
 /*
 # Specifies the maximum number of ELS cmds we can have outstanding (for
diff --git a/drivers/scsi/qedi/qedi.h b/drivers/scsi/qedi/qedi.h
index fc3babc15fa3..a6f96b35e971 100644
--- a/drivers/scsi/qedi/qedi.h
+++ b/drivers/scsi/qedi/qedi.h
@@ -77,6 +77,11 @@ enum qedi_nvm_tgts {
         QEDI_NVM_TGT_SEC,
 };
 
+struct qedi_nvm_iscsi_image {
+        struct nvm_iscsi_cfg iscsi_cfg;
+        u32 crc;
+};
+
 struct qedi_uio_ctrl {
         /* meta data */
         u32 uio_hsi_version;
@@ -294,7 +299,7 @@ struct qedi_ctx {
         void *bdq_pbl_list;
         dma_addr_t bdq_pbl_list_dma;
         u8 bdq_pbl_list_num_entries;
-        struct nvm_iscsi_cfg *iscsi_cfg;
+        struct qedi_nvm_iscsi_image *iscsi_image;
         dma_addr_t nvm_buf_dma;
         void __iomem *bdq_primary_prod;
         void __iomem *bdq_secondary_prod;
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index aa96bccb5a96..cc8e64dc65ad 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -1346,23 +1346,26 @@ exit_setup_int:
 
 static void qedi_free_nvm_iscsi_cfg(struct qedi_ctx *qedi)
 {
-        if (qedi->iscsi_cfg)
+        if (qedi->iscsi_image)
                 dma_free_coherent(&qedi->pdev->dev,
-                                  sizeof(struct nvm_iscsi_cfg),
-                                  qedi->iscsi_cfg, qedi->nvm_buf_dma);
+                                  sizeof(struct qedi_nvm_iscsi_image),
+                                  qedi->iscsi_image, qedi->nvm_buf_dma);
 }
 
 static int qedi_alloc_nvm_iscsi_cfg(struct qedi_ctx *qedi)
 {
-        qedi->iscsi_cfg = dma_zalloc_coherent(&qedi->pdev->dev,
-                                             sizeof(struct nvm_iscsi_cfg),
-                                             &qedi->nvm_buf_dma, GFP_KERNEL);
-        if (!qedi->iscsi_cfg) {
+        struct qedi_nvm_iscsi_image nvm_image;
+
+        qedi->iscsi_image = dma_zalloc_coherent(&qedi->pdev->dev,
+                                                sizeof(nvm_image),
+                                                &qedi->nvm_buf_dma,
+                                                GFP_KERNEL);
+        if (!qedi->iscsi_image) {
                 QEDI_ERR(&qedi->dbg_ctx, "Could not allocate NVM BUF.\n");
                 return -ENOMEM;
         }
         QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
-                  "NVM BUF addr=0x%p dma=0x%llx.\n", qedi->iscsi_cfg,
+                  "NVM BUF addr=0x%p dma=0x%llx.\n", qedi->iscsi_image,
                   qedi->nvm_buf_dma);
 
         return 0;
@@ -1905,7 +1908,7 @@ qedi_get_nvram_block(struct qedi_ctx *qedi)
         struct nvm_iscsi_block *block;
 
         pf = qedi->dev_info.common.abs_pf_id;
-        block = &qedi->iscsi_cfg->block[0];
+        block = &qedi->iscsi_image->iscsi_cfg.block[0];
         for (i = 0; i < NUM_OF_ISCSI_PF_SUPPORTED; i++, block++) {
                 flags = ((block->id) & NVM_ISCSI_CFG_BLK_CTRL_FLAG_MASK) >>
                         NVM_ISCSI_CFG_BLK_CTRL_FLAG_OFFSET;
@@ -2194,15 +2197,14 @@ static void qedi_boot_release(void *data)
 static int qedi_get_boot_info(struct qedi_ctx *qedi)
 {
         int ret = 1;
-        u16 len;
-
-        len = sizeof(struct nvm_iscsi_cfg);
+        struct qedi_nvm_iscsi_image nvm_image;
 
         QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
                   "Get NVM iSCSI CFG image\n");
         ret = qedi_ops->common->nvm_get_image(qedi->cdev,
                                               QED_NVM_IMAGE_ISCSI_CFG,
-                                              (char *)qedi->iscsi_cfg, len);
+                                              (char *)qedi->iscsi_image,
+                                              sizeof(nvm_image));
         if (ret)
                 QEDI_ERR(&qedi->dbg_ctx,
                          "Could not get NVM image. ret = %d\n", ret);
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 0adfb3bce0fd..eb97d2dd3651 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -345,8 +345,7 @@ static void scsi_dec_host_busy(struct Scsi_Host *shost)
         unsigned long flags;
 
         rcu_read_lock();
-        if (!shost->use_blk_mq)
-                atomic_dec(&shost->host_busy);
+        atomic_dec(&shost->host_busy);
         if (unlikely(scsi_host_in_recovery(shost))) {
                 spin_lock_irqsave(shost->host_lock, flags);
                 if (shost->host_failed || shost->host_eh_scheduled)
@@ -445,12 +444,7 @@ static inline bool scsi_target_is_busy(struct scsi_target *starget)
 
 static inline bool scsi_host_is_busy(struct Scsi_Host *shost)
 {
-        /*
-         * blk-mq can handle host queue busy efficiently via host-wide driver
-         * tag allocation
-         */
-
-        if (!shost->use_blk_mq && shost->can_queue > 0 &&
+        if (shost->can_queue > 0 &&
             atomic_read(&shost->host_busy) >= shost->can_queue)
                 return true;
         if (atomic_read(&shost->host_blocked) > 0)
@@ -1606,10 +1600,7 @@ static inline int scsi_host_queue_ready(struct request_queue *q,
         if (scsi_host_in_recovery(shost))
                 return 0;
 
-        if (!shost->use_blk_mq)
-                busy = atomic_inc_return(&shost->host_busy) - 1;
-        else
-                busy = 0;
+        busy = atomic_inc_return(&shost->host_busy) - 1;
         if (atomic_read(&shost->host_blocked) > 0) {
                 if (busy)
                         goto starved;
@@ -1625,7 +1616,7 @@ static inline int scsi_host_queue_ready(struct request_queue *q,
                                      "unblocking host at zero depth\n"));
         }
 
-        if (!shost->use_blk_mq && shost->can_queue > 0 && busy >= shost->can_queue)
+        if (shost->can_queue > 0 && busy >= shost->can_queue)
                 goto starved;
         if (shost->host_self_blocked)
                 goto starved;
@@ -1711,9 +1702,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
          * with the locks as normal issue path does.
          */
         atomic_inc(&sdev->device_busy);
-
-        if (!shost->use_blk_mq)
-                atomic_inc(&shost->host_busy);
+        atomic_inc(&shost->host_busy);
         if (starget->can_queue > 0)
                 atomic_inc(&starget->target_busy);
 
diff --git a/drivers/target/iscsi/cxgbit/cxgbit_ddp.c b/drivers/target/iscsi/cxgbit/cxgbit_ddp.c
index 768cce0ccb80..76a262674c8d 100644
--- a/drivers/target/iscsi/cxgbit/cxgbit_ddp.c
+++ b/drivers/target/iscsi/cxgbit/cxgbit_ddp.c
@@ -207,8 +207,8 @@ cxgbit_ddp_reserve(struct cxgbit_sock *csk, struct cxgbi_task_tag_info *ttinfo,
         ret = dma_map_sg(&ppm->pdev->dev, sgl, sgcnt, DMA_FROM_DEVICE);
         sgl->offset = sg_offset;
         if (!ret) {
-                pr_info("%s: 0x%x, xfer %u, sgl %u dma mapping err.\n",
-                        __func__, 0, xferlen, sgcnt);
+                pr_debug("%s: 0x%x, xfer %u, sgl %u dma mapping err.\n",
+                         __func__, 0, xferlen, sgcnt);
                 goto rel_ppods;
         }
 
@@ -250,8 +250,8 @@ cxgbit_get_r2t_ttt(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
 
         ret = cxgbit_ddp_reserve(csk, ttinfo, cmd->se_cmd.data_length);
         if (ret < 0) {
-                pr_info("csk 0x%p, cmd 0x%p, xfer len %u, sgcnt %u no ddp.\n",
-                        csk, cmd, cmd->se_cmd.data_length, ttinfo->nents);
+                pr_debug("csk 0x%p, cmd 0x%p, xfer len %u, sgcnt %u no ddp.\n",
+                         csk, cmd, cmd->se_cmd.data_length, ttinfo->nents);
 
                 ttinfo->sgl = NULL;
                 ttinfo->nents = 0;
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 94bad43c41ff..9cdfccbdd06f 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -4208,22 +4208,15 @@ int iscsit_close_connection(
                 crypto_free_ahash(tfm);
         }
 
-        free_cpumask_var(conn->conn_cpumask);
-
-        kfree(conn->conn_ops);
-        conn->conn_ops = NULL;
-
         if (conn->sock)
                 sock_release(conn->sock);
 
         if (conn->conn_transport->iscsit_free_conn)
                 conn->conn_transport->iscsit_free_conn(conn);
 
-        iscsit_put_transport(conn->conn_transport);
-
         pr_debug("Moving to TARG_CONN_STATE_FREE.\n");
         conn->conn_state = TARG_CONN_STATE_FREE;
-        kfree(conn);
+        iscsit_free_conn(conn);
 
         spin_lock_bh(&sess->conn_lock);
         atomic_dec(&sess->nconn);
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 9e74f8bc2963..bb90c80ff388 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -67,45 +67,10 @@ static struct iscsi_login *iscsi_login_init_conn(struct iscsi_conn *conn)
                 goto out_req_buf;
         }
 
-        conn->conn_ops = kzalloc(sizeof(struct iscsi_conn_ops), GFP_KERNEL);
-        if (!conn->conn_ops) {
-                pr_err("Unable to allocate memory for"
-                        " struct iscsi_conn_ops.\n");
-                goto out_rsp_buf;
-        }
-
-        init_waitqueue_head(&conn->queues_wq);
-        INIT_LIST_HEAD(&conn->conn_list);
-        INIT_LIST_HEAD(&conn->conn_cmd_list);
-        INIT_LIST_HEAD(&conn->immed_queue_list);
-        INIT_LIST_HEAD(&conn->response_queue_list);
-        init_completion(&conn->conn_post_wait_comp);
-        init_completion(&conn->conn_wait_comp);
-        init_completion(&conn->conn_wait_rcfr_comp);
-        init_completion(&conn->conn_waiting_on_uc_comp);
-        init_completion(&conn->conn_logout_comp);
-        init_completion(&conn->rx_half_close_comp);
-        init_completion(&conn->tx_half_close_comp);
-        init_completion(&conn->rx_login_comp);
-        spin_lock_init(&conn->cmd_lock);
-        spin_lock_init(&conn->conn_usage_lock);
-        spin_lock_init(&conn->immed_queue_lock);
-        spin_lock_init(&conn->nopin_timer_lock);
-        spin_lock_init(&conn->response_queue_lock);
-        spin_lock_init(&conn->state_lock);
-
-        if (!zalloc_cpumask_var(&conn->conn_cpumask, GFP_KERNEL)) {
-                pr_err("Unable to allocate conn->conn_cpumask\n");
-                goto out_conn_ops;
-        }
         conn->conn_login = login;
 
         return login;
 
-out_conn_ops:
-        kfree(conn->conn_ops);
-out_rsp_buf:
-        kfree(login->rsp_buf);
 out_req_buf:
         kfree(login->req_buf);
 out_login:
@@ -310,11 +275,9 @@ static int iscsi_login_zero_tsih_s1(
                 return -ENOMEM;
         }
 
-        ret = iscsi_login_set_conn_values(sess, conn, pdu->cid);
-        if (unlikely(ret)) {
-                kfree(sess);
-                return ret;
-        }
+        if (iscsi_login_set_conn_values(sess, conn, pdu->cid))
+                goto free_sess;
+
         sess->init_task_tag     = pdu->itt;
         memcpy(&sess->isid, pdu->isid, 6);
         sess->exp_cmd_sn        = be32_to_cpu(pdu->cmdsn);
@@ -1149,6 +1112,75 @@ iscsit_conn_set_transport(struct iscsi_conn *conn, struct iscsit_transport *t)
         return 0;
 }
 
+static struct iscsi_conn *iscsit_alloc_conn(struct iscsi_np *np)
+{
+        struct iscsi_conn *conn;
+
+        conn = kzalloc(sizeof(struct iscsi_conn), GFP_KERNEL);
+        if (!conn) {
+                pr_err("Could not allocate memory for new connection\n");
+                return NULL;
+        }
+        pr_debug("Moving to TARG_CONN_STATE_FREE.\n");
+        conn->conn_state = TARG_CONN_STATE_FREE;
+
+        init_waitqueue_head(&conn->queues_wq);
+        INIT_LIST_HEAD(&conn->conn_list);
+        INIT_LIST_HEAD(&conn->conn_cmd_list);
+        INIT_LIST_HEAD(&conn->immed_queue_list);
+        INIT_LIST_HEAD(&conn->response_queue_list);
+        init_completion(&conn->conn_post_wait_comp);
+        init_completion(&conn->conn_wait_comp);
+        init_completion(&conn->conn_wait_rcfr_comp);
+        init_completion(&conn->conn_waiting_on_uc_comp);
+        init_completion(&conn->conn_logout_comp);
+        init_completion(&conn->rx_half_close_comp);
+        init_completion(&conn->tx_half_close_comp);
+        init_completion(&conn->rx_login_comp);
+        spin_lock_init(&conn->cmd_lock);
+        spin_lock_init(&conn->conn_usage_lock);
+        spin_lock_init(&conn->immed_queue_lock);
+        spin_lock_init(&conn->nopin_timer_lock);
+        spin_lock_init(&conn->response_queue_lock);
+        spin_lock_init(&conn->state_lock);
+
+        timer_setup(&conn->nopin_response_timer,
+                    iscsit_handle_nopin_response_timeout, 0);
+        timer_setup(&conn->nopin_timer, iscsit_handle_nopin_timeout, 0);
+
+        if (iscsit_conn_set_transport(conn, np->np_transport) < 0)
+                goto free_conn;
+
+        conn->conn_ops = kzalloc(sizeof(struct iscsi_conn_ops), GFP_KERNEL);
+        if (!conn->conn_ops) {
+                pr_err("Unable to allocate memory for struct iscsi_conn_ops.\n");
+                goto put_transport;
+        }
+
+        if (!zalloc_cpumask_var(&conn->conn_cpumask, GFP_KERNEL)) {
+                pr_err("Unable to allocate conn->conn_cpumask\n");
+                goto free_mask;
+        }
+
+        return conn;
+
+free_mask:
+        free_cpumask_var(conn->conn_cpumask);
+put_transport:
+        iscsit_put_transport(conn->conn_transport);
+free_conn:
+        kfree(conn);
+        return NULL;
+}
+
+void iscsit_free_conn(struct iscsi_conn *conn)
+{
+        free_cpumask_var(conn->conn_cpumask);
+        kfree(conn->conn_ops);
+        iscsit_put_transport(conn->conn_transport);
+        kfree(conn);
+}
+
 void iscsi_target_login_sess_out(struct iscsi_conn *conn,
                 struct iscsi_np *np, bool zero_tsih, bool new_sess)
 {
@@ -1198,10 +1230,6 @@ old_sess_out:
                 crypto_free_ahash(tfm);
         }
 
-        free_cpumask_var(conn->conn_cpumask);
-
-        kfree(conn->conn_ops);
-
         if (conn->param_list) {
                 iscsi_release_param_list(conn->param_list);
                 conn->param_list = NULL;
@@ -1219,8 +1247,7 @@ old_sess_out:
         if (conn->conn_transport->iscsit_free_conn)
                 conn->conn_transport->iscsit_free_conn(conn);
 
-        iscsit_put_transport(conn->conn_transport);
-        kfree(conn);
+        iscsit_free_conn(conn);
 }
 
 static int __iscsi_target_login_thread(struct iscsi_np *np)
@@ -1250,31 +1277,16 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
         }
         spin_unlock_bh(&np->np_thread_lock);
 
-        conn = kzalloc(sizeof(struct iscsi_conn), GFP_KERNEL);
+        conn = iscsit_alloc_conn(np);
         if (!conn) {
-                pr_err("Could not allocate memory for"
-                        " new connection\n");
                 /* Get another socket */
                 return 1;
         }
-        pr_debug("Moving to TARG_CONN_STATE_FREE.\n");
-        conn->conn_state = TARG_CONN_STATE_FREE;
-
-        timer_setup(&conn->nopin_response_timer,
-                    iscsit_handle_nopin_response_timeout, 0);
-        timer_setup(&conn->nopin_timer, iscsit_handle_nopin_timeout, 0);
-
-        if (iscsit_conn_set_transport(conn, np->np_transport) < 0) {
-                kfree(conn);
-                return 1;
-        }
 
         rc = np->np_transport->iscsit_accept_np(np, conn);
         if (rc == -ENOSYS) {
                 complete(&np->np_restart_comp);
-                iscsit_put_transport(conn->conn_transport);
-                kfree(conn);
-                conn = NULL;
+                iscsit_free_conn(conn);
                 goto exit;
         } else if (rc < 0) {
                 spin_lock_bh(&np->np_thread_lock);
@@ -1282,17 +1294,13 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
                         np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
                         spin_unlock_bh(&np->np_thread_lock);
                         complete(&np->np_restart_comp);
-                        iscsit_put_transport(conn->conn_transport);
-                        kfree(conn);
-                        conn = NULL;
+                        iscsit_free_conn(conn);
                         /* Get another socket */
                         return 1;
                 }
                 spin_unlock_bh(&np->np_thread_lock);
-                iscsit_put_transport(conn->conn_transport);
-                kfree(conn);
-                conn = NULL;
-                goto out;
+                iscsit_free_conn(conn);
+                return 1;
         }
         /*
          * Perform the remaining iSCSI connection initialization items..
@@ -1442,7 +1450,6 @@ old_sess_out:
                 tpg_np = NULL;
         }
 
-out:
         return 1;
 
 exit:
diff --git a/drivers/target/iscsi/iscsi_target_login.h b/drivers/target/iscsi/iscsi_target_login.h
index 74ac3abc44a0..3b8e3639ff5d 100644
--- a/drivers/target/iscsi/iscsi_target_login.h
+++ b/drivers/target/iscsi/iscsi_target_login.h
@@ -19,7 +19,7 @@ extern int iscsi_target_setup_login_socket(struct iscsi_np *,
 extern int iscsit_accept_np(struct iscsi_np *, struct iscsi_conn *);
 extern int iscsit_get_login_rx(struct iscsi_conn *, struct iscsi_login *);
 extern int iscsit_put_login_tx(struct iscsi_conn *, struct iscsi_login *, u32);
-extern void iscsit_free_conn(struct iscsi_np *, struct iscsi_conn *);
+extern void iscsit_free_conn(struct iscsi_conn *);
 extern int iscsit_start_kthreads(struct iscsi_conn *);
 extern void iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8);
 extern void iscsi_target_login_sess_out(struct iscsi_conn *, struct iscsi_np *,
diff --git a/fs/afs/proc.c b/fs/afs/proc.c
index 0c3285c8db95..476dcbb79713 100644
--- a/fs/afs/proc.c
+++ b/fs/afs/proc.c
@@ -98,13 +98,13 @@ static int afs_proc_cells_write(struct file *file, char *buf, size_t size)
                 goto inval;
 
         args = strchr(name, ' ');
-        if (!args)
-                goto inval;
-        do {
-                *args++ = 0;
-        } while(*args == ' ');
-        if (!*args)
-                goto inval;
+        if (args) {
+                do {
+                        *args++ = 0;
+                } while(*args == ' ');
+                if (!*args)
+                        goto inval;
+        }
 
         /* determine command to perform */
         _debug("cmd=%s name=%s args=%s", buf, name, args);
@@ -120,7 +120,6 @@ static int afs_proc_cells_write(struct file *file, char *buf, size_t size)
 
                 if (test_and_set_bit(AFS_CELL_FL_NO_GC, &cell->flags))
                         afs_put_cell(net, cell);
-                printk("kAFS: Added new cell '%s'\n", name);
         } else {
                 goto inval;
         }
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 53af9f5253f4..2cddfe7806a4 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -1280,6 +1280,7 @@ struct btrfs_root {
         int send_in_progress;
         struct btrfs_subvolume_writers *subv_writers;
         atomic_t will_be_snapshotted;
+        atomic_t snapshot_force_cow;
 
         /* For qgroup metadata reserved space */
         spinlock_t qgroup_meta_rsv_lock;
@@ -3390,9 +3391,9 @@ do {									\
 #define btrfs_debug(fs_info, fmt, args...) \
         btrfs_no_printk(fs_info, KERN_DEBUG fmt, ##args)
 #define btrfs_debug_in_rcu(fs_info, fmt, args...) \
-        btrfs_no_printk(fs_info, KERN_DEBUG fmt, ##args)
+        btrfs_no_printk_in_rcu(fs_info, KERN_DEBUG fmt, ##args)
 #define btrfs_debug_rl_in_rcu(fs_info, fmt, args...) \
-        btrfs_no_printk(fs_info, KERN_DEBUG fmt, ##args)
+        btrfs_no_printk_in_rcu(fs_info, KERN_DEBUG fmt, ##args)
 #define btrfs_debug_rl(fs_info, fmt, args...) \
         btrfs_no_printk(fs_info, KERN_DEBUG fmt, ##args)
 #endif
@@ -3404,6 +3405,13 @@ do {							\
         rcu_read_unlock();                              \
 } while (0)
 
+#define btrfs_no_printk_in_rcu(fs_info, fmt, args...)   \
+do {                                                    \
+        rcu_read_lock();                                \
+        btrfs_no_printk(fs_info, fmt, ##args);          \
+        rcu_read_unlock();                              \
+} while (0)
+
 #define btrfs_printk_ratelimited(fs_info, fmt, args...)         \
 do {                                                            \
         static DEFINE_RATELIMIT_STATE(_rs,                      \
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 5124c15705ce..05dc3c17cb62 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1187,6 +1187,7 @@ static void __setup_root(struct btrfs_root *root, struct btrfs_fs_info *fs_info,
         atomic_set(&root->log_batch, 0);
         refcount_set(&root->refs, 1);
         atomic_set(&root->will_be_snapshotted, 0);
+        atomic_set(&root->snapshot_force_cow, 0);
         root->log_transid = 0;
         root->log_transid_committed = -1;
         root->last_log_commit = 0;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index de6f75f5547b..2d9074295d7f 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -5800,7 +5800,7 @@ void btrfs_trans_release_chunk_metadata(struct btrfs_trans_handle *trans)
  * root: the root of the parent directory
  * rsv: block reservation
  * items: the number of items that we need do reservation
- * qgroup_reserved: used to return the reserved size in qgroup
+ * use_global_rsv: allow fallback to the global block reservation
  *
  * This function is used to reserve the space for snapshot/subvolume
  * creation and deletion. Those operations are different with the
@@ -5810,10 +5810,10 @@ void btrfs_trans_release_chunk_metadata(struct btrfs_trans_handle *trans)
  * the space reservation mechanism in start_transaction().
  */
 int btrfs_subvolume_reserve_metadata(struct btrfs_root *root,
-                                     struct btrfs_block_rsv *rsv,
-                                     int items,
+                                     struct btrfs_block_rsv *rsv, int items,
                                      bool use_global_rsv)
 {
+        u64 qgroup_num_bytes = 0;
         u64 num_bytes;
         int ret;
         struct btrfs_fs_info *fs_info = root->fs_info;
@@ -5821,12 +5821,11 @@ int btrfs_subvolume_reserve_metadata(struct btrfs_root *root,
 
         if (test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags)) {
                 /* One for parent inode, two for dir entries */
-                num_bytes = 3 * fs_info->nodesize;
-                ret = btrfs_qgroup_reserve_meta_prealloc(root, num_bytes, true);
+                qgroup_num_bytes = 3 * fs_info->nodesize;
+                ret = btrfs_qgroup_reserve_meta_prealloc(root,
+                                qgroup_num_bytes, true);
                 if (ret)
                         return ret;
-        } else {
-                num_bytes = 0;
         }
 
         num_bytes = btrfs_calc_trans_metadata_size(fs_info, items);
@@ -5838,8 +5837,8 @@ int btrfs_subvolume_reserve_metadata(struct btrfs_root *root,
         if (ret == -ENOSPC && use_global_rsv)
                 ret = btrfs_block_rsv_migrate(global_rsv, rsv, num_bytes, 1);
 
-        if (ret && num_bytes)
-                btrfs_qgroup_free_meta_prealloc(root, num_bytes);
+        if (ret && qgroup_num_bytes)
+                btrfs_qgroup_free_meta_prealloc(root, qgroup_num_bytes);
 
         return ret;
 }
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 9357a19d2bff..3ea5339603cf 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1271,7 +1271,7 @@ static noinline int run_delalloc_nocow(struct inode *inode,
         u64 disk_num_bytes;
         u64 ram_bytes;
         int extent_type;
-        int ret, err;
+        int ret;
         int type;
         int nocow;
         int check_prev = 1;
@@ -1403,11 +1403,8 @@ next_slot:
                          * if there are pending snapshots for this root,
                          * we fall into common COW way.
                          */
-                        if (!nolock) {
-                                err = btrfs_start_write_no_snapshotting(root);
-                                if (!err)
-                                        goto out_check;
-                        }
+                        if (!nolock && atomic_read(&root->snapshot_force_cow))
+                                goto out_check;
                         /*
                          * force cow if csum exists in the range.
                          * this ensure that csum for a given extent are
@@ -1416,9 +1413,6 @@ next_slot:
                         ret = csum_exist_in_range(fs_info, disk_bytenr,
                                                   num_bytes);
                         if (ret) {
-                                if (!nolock)
-                                        btrfs_end_write_no_snapshotting(root);
-
                                 /*
                                  * ret could be -EIO if the above fails to read
                                  * metadata.
@@ -1431,11 +1425,8 @@ next_slot:
                                 WARN_ON_ONCE(nolock);
                                 goto out_check;
                         }
-                        if (!btrfs_inc_nocow_writers(fs_info, disk_bytenr)) {
-                                if (!nolock)
-                                        btrfs_end_write_no_snapshotting(root);
+                        if (!btrfs_inc_nocow_writers(fs_info, disk_bytenr))
                                 goto out_check;
-                        }
                         nocow = 1;
                 } else if (extent_type == BTRFS_FILE_EXTENT_INLINE) {
                         extent_end = found_key.offset +
@@ -1448,8 +1439,6 @@ next_slot:
 out_check:
                 if (extent_end <= start) {
                         path->slots[0]++;
-                        if (!nolock && nocow)
-                                btrfs_end_write_no_snapshotting(root);
                         if (nocow)
                                 btrfs_dec_nocow_writers(fs_info, disk_bytenr);
                         goto next_slot;
@@ -1471,8 +1460,6 @@ out_check:
                                              end, page_started, nr_written, 1,
                                              NULL);
                         if (ret) {
-                                if (!nolock && nocow)
-                                        btrfs_end_write_no_snapshotting(root);
                                 if (nocow)
                                         btrfs_dec_nocow_writers(fs_info,
                                                                 disk_bytenr);
@@ -1492,8 +1479,6 @@ out_check:
                                           ram_bytes, BTRFS_COMPRESS_NONE,
                                           BTRFS_ORDERED_PREALLOC);
                         if (IS_ERR(em)) {
-                                if (!nolock && nocow)
-                                        btrfs_end_write_no_snapshotting(root);
                                 if (nocow)
                                         btrfs_dec_nocow_writers(fs_info,
                                                                 disk_bytenr);
@@ -1532,8 +1517,6 @@ out_check:
                                              EXTENT_CLEAR_DATA_RESV,
                                              PAGE_UNLOCK | PAGE_SET_PRIVATE2);
 
-                if (!nolock && nocow)
-                        btrfs_end_write_no_snapshotting(root);
                 cur_offset = extent_end;
 
                 /*
@@ -6639,6 +6622,8 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
                 drop_inode = 1;
         } else {
                 struct dentry *parent = dentry->d_parent;
+                int ret;
+
                 err = btrfs_update_inode(trans, root, inode);
                 if (err)
                         goto fail;
@@ -6652,7 +6637,12 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
                                 goto fail;
                 }
                 d_instantiate(dentry, inode);
-                btrfs_log_new_name(trans, BTRFS_I(inode), NULL, parent);
+                ret = btrfs_log_new_name(trans, BTRFS_I(inode), NULL, parent,
+                                         true, NULL);
+                if (ret == BTRFS_NEED_TRANS_COMMIT) {
+                        err = btrfs_commit_transaction(trans);
+                        trans = NULL;
+                }
         }
 
 fail:
@@ -9388,14 +9378,21 @@ static int btrfs_rename_exchange(struct inode *old_dir,
         u64 new_idx = 0;
         u64 root_objectid;
         int ret;
-        int ret2;
         bool root_log_pinned = false;
         bool dest_log_pinned = false;
+        struct btrfs_log_ctx ctx_root;
+        struct btrfs_log_ctx ctx_dest;
+        bool sync_log_root = false;
+        bool sync_log_dest = false;
+        bool commit_transaction = false;
 
         /* we only allow rename subvolume link between subvolumes */
         if (old_ino != BTRFS_FIRST_FREE_OBJECTID && root != dest)
                 return -EXDEV;
 
+        btrfs_init_log_ctx(&ctx_root, old_inode);
+        btrfs_init_log_ctx(&ctx_dest, new_inode);
+
         /* close the race window with snapshot create/destroy ioctl */
         if (old_ino == BTRFS_FIRST_FREE_OBJECTID)
                 down_read(&fs_info->subvol_sem);
@@ -9542,15 +9539,29 @@ static int btrfs_rename_exchange(struct inode *old_dir,
 
         if (root_log_pinned) {
                 parent = new_dentry->d_parent;
-                btrfs_log_new_name(trans, BTRFS_I(old_inode), BTRFS_I(old_dir),
-                                parent);
+                ret = btrfs_log_new_name(trans, BTRFS_I(old_inode),
+                                         BTRFS_I(old_dir), parent,
+                                         false, &ctx_root);
+                if (ret == BTRFS_NEED_LOG_SYNC)
+                        sync_log_root = true;
+                else if (ret == BTRFS_NEED_TRANS_COMMIT)
+                        commit_transaction = true;
+                ret = 0;
                 btrfs_end_log_trans(root);
                 root_log_pinned = false;
         }
         if (dest_log_pinned) {
-                parent = old_dentry->d_parent;
-                btrfs_log_new_name(trans, BTRFS_I(new_inode), BTRFS_I(new_dir),
-                                parent);
+                if (!commit_transaction) {
+                        parent = old_dentry->d_parent;
+                        ret = btrfs_log_new_name(trans, BTRFS_I(new_inode),
+                                                 BTRFS_I(new_dir), parent,
+                                                 false, &ctx_dest);
+                        if (ret == BTRFS_NEED_LOG_SYNC)
+                                sync_log_dest = true;
+                        else if (ret == BTRFS_NEED_TRANS_COMMIT)
+                                commit_transaction = true;
+                        ret = 0;
+                }
                 btrfs_end_log_trans(dest);
                 dest_log_pinned = false;
         }
@@ -9583,8 +9594,26 @@ out_fail:
                         dest_log_pinned = false;
                 }
         }
-        ret2 = btrfs_end_transaction(trans);
-        ret = ret ? ret : ret2;
+        if (!ret && sync_log_root && !commit_transaction) {
+                ret = btrfs_sync_log(trans, BTRFS_I(old_inode)->root,
+                                     &ctx_root);
+                if (ret)
+                        commit_transaction = true;
+        }
+        if (!ret && sync_log_dest && !commit_transaction) {
+                ret = btrfs_sync_log(trans, BTRFS_I(new_inode)->root,
+                                     &ctx_dest);
+                if (ret)
+                        commit_transaction = true;
+        }
+        if (commit_transaction) {
+                ret = btrfs_commit_transaction(trans);
+        } else {
+                int ret2;
+
+                ret2 = btrfs_end_transaction(trans);
+                ret = ret ? ret : ret2;
+        }
 out_notrans:
         if (new_ino == BTRFS_FIRST_FREE_OBJECTID)
                 up_read(&fs_info->subvol_sem);
@@ -9661,6 +9690,9 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         int ret;
         u64 old_ino = btrfs_ino(BTRFS_I(old_inode));
         bool log_pinned = false;
+        struct btrfs_log_ctx ctx;
+        bool sync_log = false;
+        bool commit_transaction = false;
 
         if (btrfs_ino(BTRFS_I(new_dir)) == BTRFS_EMPTY_SUBVOL_DIR_OBJECTID)
                 return -EPERM;
@@ -9818,8 +9850,15 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         if (log_pinned) {
                 struct dentry *parent = new_dentry->d_parent;
 
-                btrfs_log_new_name(trans, BTRFS_I(old_inode), BTRFS_I(old_dir),
-                                parent);
+                btrfs_init_log_ctx(&ctx, old_inode);
+                ret = btrfs_log_new_name(trans, BTRFS_I(old_inode),
+                                         BTRFS_I(old_dir), parent,
+                                         false, &ctx);
+                if (ret == BTRFS_NEED_LOG_SYNC)
+                        sync_log = true;
+                else if (ret == BTRFS_NEED_TRANS_COMMIT)
+                        commit_transaction = true;
+                ret = 0;
                 btrfs_end_log_trans(root);
                 log_pinned = false;
         }
@@ -9856,7 +9895,19 @@ out_fail:
                 btrfs_end_log_trans(root);
                 log_pinned = false;
         }
-        btrfs_end_transaction(trans);
+        if (!ret && sync_log) {
+                ret = btrfs_sync_log(trans, BTRFS_I(old_inode)->root, &ctx);
+                if (ret)
+                        commit_transaction = true;
+        }
+        if (commit_transaction) {
+                ret = btrfs_commit_transaction(trans);
+        } else {
+                int ret2;
+
+                ret2 = btrfs_end_transaction(trans);
+                ret = ret ? ret : ret2;
+        }
 out_notrans:
         if (old_ino == BTRFS_FIRST_FREE_OBJECTID)
                 up_read(&fs_info->subvol_sem);
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 63600dc2ac4c..d60b6caf09e8 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -747,6 +747,7 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir,
         struct btrfs_pending_snapshot *pending_snapshot;
         struct btrfs_trans_handle *trans;
         int ret;
+        bool snapshot_force_cow = false;
 
         if (!test_bit(BTRFS_ROOT_REF_COWS, &root->state))
                 return -EINVAL;
@@ -763,6 +764,11 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir,
                 goto free_pending;
         }
 
+        /*
+         * Force new buffered writes to reserve space even when NOCOW is
+         * possible. This is to avoid later writeback (running dealloc) to
+         * fallback to COW mode and unexpectedly fail with ENOSPC.
+         */
         atomic_inc(&root->will_be_snapshotted);
         smp_mb__after_atomic();
         /* wait for no snapshot writes */
@@ -773,6 +779,14 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir,
         if (ret)
                 goto dec_and_free;
 
+        /*
+         * All previous writes have started writeback in NOCOW mode, so now
+         * we force future writes to fallback to COW mode during snapshot
+         * creation.
+         */
+        atomic_inc(&root->snapshot_force_cow);
+        snapshot_force_cow = true;
+
         btrfs_wait_ordered_extents(root, U64_MAX, 0, (u64)-1);
 
         btrfs_init_block_rsv(&pending_snapshot->block_rsv,
@@ -837,6 +851,8 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir,
 fail:
         btrfs_subvolume_release_metadata(fs_info, &pending_snapshot->block_rsv);
 dec_and_free:
+        if (snapshot_force_cow)
+                atomic_dec(&root->snapshot_force_cow);
         if (atomic_dec_and_test(&root->will_be_snapshotted))
                 wake_up_var(&root->will_be_snapshotted);
 free_pending:
@@ -3453,6 +3469,25 @@ static int btrfs_extent_same_range(struct inode *src, u64 loff, u64 olen,
 
                 same_lock_start = min_t(u64, loff, dst_loff);
                 same_lock_len = max_t(u64, loff, dst_loff) + len - same_lock_start;
+        } else {
+                /*
+                 * If the source and destination inodes are different, the
+                 * source's range end offset matches the source's i_size, that
+                 * i_size is not a multiple of the sector size, and the
+                 * destination range does not go past the destination's i_size,
+                 * we must round down the length to the nearest sector size
+                 * multiple. If we don't do this adjustment we end replacing
+                 * with zeroes the bytes in the range that starts at the
+                 * deduplication range's end offset and ends at the next sector
+                 * size multiple.
+                 */
+                if (loff + olen == i_size_read(src) &&
+                    dst_loff + len < i_size_read(dst)) {
+                        const u64 sz = BTRFS_I(src)->root->fs_info->sectorsize;
+
+                        len = round_down(i_size_read(src), sz) - loff;
+                        olen = len;
+                }
         }
 
 again:
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 4353bb69bb86..d4917c0cddf5 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1019,10 +1019,9 @@ out_add_root:
         spin_unlock(&fs_info->qgroup_lock);
 
         ret = btrfs_commit_transaction(trans);
-        if (ret) {
-                trans = NULL;
+        trans = NULL;
+        if (ret)
                 goto out_free_path;
-        }
 
         ret = qgroup_rescan_init(fs_info, 0, 1);
         if (!ret) {
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 1650dc44a5e3..3c2ae0e4f25a 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -6025,14 +6025,25 @@ void btrfs_record_snapshot_destroy(struct btrfs_trans_handle *trans,
  * Call this after adding a new name for a file and it will properly
  * update the log to reflect the new name.
  *
- * It will return zero if all goes well, and it will return 1 if a
- * full transaction commit is required.
+ * @ctx can not be NULL when @sync_log is false, and should be NULL when it's
+ * true (because it's not used).
+ *
+ * Return value depends on whether @sync_log is true or false.
+ * When true: returns BTRFS_NEED_TRANS_COMMIT if the transaction needs to be
+ *            committed by the caller, and BTRFS_DONT_NEED_TRANS_COMMIT
+ *            otherwise.
+ * When false: returns BTRFS_DONT_NEED_LOG_SYNC if the caller does not need to
+ *             to sync the log, BTRFS_NEED_LOG_SYNC if it needs to sync the log,
+ *             or BTRFS_NEED_TRANS_COMMIT if the transaction needs to be
+ *             committed (without attempting to sync the log).
  */
 int btrfs_log_new_name(struct btrfs_trans_handle *trans,
                         struct btrfs_inode *inode, struct btrfs_inode *old_dir,
-                        struct dentry *parent)
+                        struct dentry *parent,
+                        bool sync_log, struct btrfs_log_ctx *ctx)
 {
         struct btrfs_fs_info *fs_info = trans->fs_info;
+        int ret;
 
         /*
          * this will force the logging code to walk the dentry chain
@@ -6047,9 +6058,34 @@ int btrfs_log_new_name(struct btrfs_trans_handle *trans,
          */
         if (inode->logged_trans <= fs_info->last_trans_committed &&
             (!old_dir || old_dir->logged_trans <= fs_info->last_trans_committed))
-                return 0;
+                return sync_log ? BTRFS_DONT_NEED_TRANS_COMMIT :
+                        BTRFS_DONT_NEED_LOG_SYNC;
+
+        if (sync_log) {
+                struct btrfs_log_ctx ctx2;
+
+                btrfs_init_log_ctx(&ctx2, &inode->vfs_inode);
+                ret = btrfs_log_inode_parent(trans, inode, parent, 0, LLONG_MAX,
+                                             LOG_INODE_EXISTS, &ctx2);
+                if (ret == BTRFS_NO_LOG_SYNC)
+                        return BTRFS_DONT_NEED_TRANS_COMMIT;
+                else if (ret)
+                        return BTRFS_NEED_TRANS_COMMIT;
+
+                ret = btrfs_sync_log(trans, inode->root, &ctx2);
+                if (ret)
+                        return BTRFS_NEED_TRANS_COMMIT;
+                return BTRFS_DONT_NEED_TRANS_COMMIT;
+        }
+
+        ASSERT(ctx);
+        ret = btrfs_log_inode_parent(trans, inode, parent, 0, LLONG_MAX,
+                                     LOG_INODE_EXISTS, ctx);
+        if (ret == BTRFS_NO_LOG_SYNC)
+                return BTRFS_DONT_NEED_LOG_SYNC;
+        else if (ret)
+                return BTRFS_NEED_TRANS_COMMIT;
 
-        return btrfs_log_inode_parent(trans, inode, parent, 0, LLONG_MAX,
-                                      LOG_INODE_EXISTS, NULL);
+        return BTRFS_NEED_LOG_SYNC;
 }
 
diff --git a/fs/btrfs/tree-log.h b/fs/btrfs/tree-log.h
index 122e68b89a5a..7ab9bb88a639 100644
--- a/fs/btrfs/tree-log.h
+++ b/fs/btrfs/tree-log.h
@@ -71,8 +71,16 @@ void btrfs_record_unlink_dir(struct btrfs_trans_handle *trans,
                              int for_rename);
 void btrfs_record_snapshot_destroy(struct btrfs_trans_handle *trans,
                                    struct btrfs_inode *dir);
+/* Return values for btrfs_log_new_name() */
+enum {
+        BTRFS_DONT_NEED_TRANS_COMMIT,
+        BTRFS_NEED_TRANS_COMMIT,
+        BTRFS_DONT_NEED_LOG_SYNC,
+        BTRFS_NEED_LOG_SYNC,
+};
 int btrfs_log_new_name(struct btrfs_trans_handle *trans,
                         struct btrfs_inode *inode, struct btrfs_inode *old_dir,
-                        struct dentry *parent);
+                        struct dentry *parent,
+                        bool sync_log, struct btrfs_log_ctx *ctx);
 
 #endif
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index da86706123ff..f4405e430da6 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -4491,7 +4491,12 @@ again:
 
         /* Now btrfs_update_device() will change the on-disk size. */
         ret = btrfs_update_device(trans, device);
-        btrfs_end_transaction(trans);
+        if (ret < 0) {
+                btrfs_abort_transaction(trans, ret);
+                btrfs_end_transaction(trans);
+        } else {
+                ret = btrfs_commit_transaction(trans);
+        }
 done:
         btrfs_free_path(path);
         if (ret) {
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index 43ca3b763875..eab1359d0553 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -602,6 +602,8 @@ static int extra_mon_dispatch(struct ceph_client *client, struct ceph_msg *msg)
 
 /*
  * create a new fs client
+ *
+ * Success or not, this function consumes @fsopt and @opt.
  */
 static struct ceph_fs_client *create_fs_client(struct ceph_mount_options *fsopt,
                                         struct ceph_options *opt)
@@ -609,17 +611,20 @@ static struct ceph_fs_client *create_fs_client(struct ceph_mount_options *fsopt,
         struct ceph_fs_client *fsc;
         int page_count;
         size_t size;
-        int err = -ENOMEM;
+        int err;
 
         fsc = kzalloc(sizeof(*fsc), GFP_KERNEL);
-        if (!fsc)
-                return ERR_PTR(-ENOMEM);
+        if (!fsc) {
+                err = -ENOMEM;
+                goto fail;
+        }
 
         fsc->client = ceph_create_client(opt, fsc);
         if (IS_ERR(fsc->client)) {
                 err = PTR_ERR(fsc->client);
                 goto fail;
         }
+        opt = NULL; /* fsc->client now owns this */
 
         fsc->client->extra_mon_dispatch = extra_mon_dispatch;
         fsc->client->osdc.abort_on_full = true;
@@ -677,6 +682,9 @@ fail_client:
         ceph_destroy_client(fsc->client);
 fail:
         kfree(fsc);
+        if (opt)
+                ceph_destroy_options(opt);
+        destroy_mount_options(fsopt);
         return ERR_PTR(err);
 }
 
@@ -1042,8 +1050,6 @@ static struct dentry *ceph_mount(struct file_system_type *fs_type,
         fsc = create_fs_client(fsopt, opt);
         if (IS_ERR(fsc)) {
                 res = ERR_CAST(fsc);
-                destroy_mount_options(fsopt);
-                ceph_destroy_options(opt);
                 goto out_final;
         }
 
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index b380e0871372..a2b2355e7f01 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -105,9 +105,6 @@ convert_sfm_char(const __u16 src_char, char *target)
         case SFM_LESSTHAN:
                 *target = '<';
                 break;
-        case SFM_SLASH:
-                *target = '\\';
-                break;
         case SFM_SPACE:
                 *target = ' ';
                 break;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index c832a8a1970a..7aa08dba4719 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2547,7 +2547,7 @@ cifs_setup_ipc(struct cifs_ses *ses, struct smb_vol *volume_info)
         if (tcon == NULL)
                 return -ENOMEM;
 
-        snprintf(unc, sizeof(unc), "\\\\%s\\IPC$", ses->serverName);
+        snprintf(unc, sizeof(unc), "\\\\%s\\IPC$", ses->server->hostname);
 
         /* cannot fail */
         nls_codepage = load_nls_default();
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index d32eaa4b2437..6e8765f44508 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -467,6 +467,8 @@ cifs_sfu_type(struct cifs_fattr *fattr, const char *path,
         oparms.cifs_sb = cifs_sb;
         oparms.desired_access = GENERIC_READ;
         oparms.create_options = CREATE_NOT_DIR;
+        if (backup_cred(cifs_sb))
+                oparms.create_options |= CREATE_OPEN_BACKUP_INTENT;
         oparms.disposition = FILE_OPEN;
         oparms.path = path;
         oparms.fid = &fid;
diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
index db0453660ff6..6a9c47541c53 100644
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -248,16 +248,20 @@ smb2_check_message(char *buf, unsigned int len, struct TCP_Server_Info *srvr)
                  * MacOS server pads after SMB2.1 write response with 3 bytes
                  * of junk. Other servers match RFC1001 len to actual
                  * SMB2/SMB3 frame length (header + smb2 response specific data)
-                 * Some windows servers do too when compounding is used.
-                 * Log the server error (once), but allow it and continue
+                 * Some windows servers also pad up to 8 bytes when compounding.
+                 * If pad is longer than eight bytes, log the server behavior
+                 * (once), since may indicate a problem but allow it and continue
                  * since the frame is parseable.
                  */
                 if (clc_len < len) {
-                        printk_once(KERN_WARNING
-                                "SMB2 server sent bad RFC1001 len %d not %d\n",
-                                len, clc_len);
+                        pr_warn_once(
+                             "srv rsp padded more than expected. Length %d not %d for cmd:%d mid:%llu\n",
+                             len, clc_len, command, mid);
                         return 0;
                 }
+                pr_warn_once(
+                        "srv rsp too short, len %d not %d. cmd:%d mid:%llu\n",
+                        len, clc_len, command, mid);
 
                 return 1;
         }
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 247a98e6c856..d954ce36b473 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -630,7 +630,10 @@ smb2_is_path_accessible(const unsigned int xid, struct cifs_tcon *tcon,
         oparms.tcon = tcon;
         oparms.desired_access = FILE_READ_ATTRIBUTES;
         oparms.disposition = FILE_OPEN;
-        oparms.create_options = 0;
+        if (backup_cred(cifs_sb))
+                oparms.create_options = CREATE_OPEN_BACKUP_INTENT;
+        else
+                oparms.create_options = 0;
         oparms.fid = &fid;
         oparms.reconnect = false;
 
@@ -779,7 +782,10 @@ smb2_query_eas(const unsigned int xid, struct cifs_tcon *tcon,
         oparms.tcon = tcon;
         oparms.desired_access = FILE_READ_EA;
         oparms.disposition = FILE_OPEN;
-        oparms.create_options = 0;
+        if (backup_cred(cifs_sb))
+                oparms.create_options = CREATE_OPEN_BACKUP_INTENT;
+        else
+                oparms.create_options = 0;
         oparms.fid = &fid;
         oparms.reconnect = false;
 
@@ -858,7 +864,10 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon,
         oparms.tcon = tcon;
         oparms.desired_access = FILE_WRITE_EA;
         oparms.disposition = FILE_OPEN;
-        oparms.create_options = 0;
+        if (backup_cred(cifs_sb))
+                oparms.create_options = CREATE_OPEN_BACKUP_INTENT;
+        else
+                oparms.create_options = 0;
         oparms.fid = &fid;
         oparms.reconnect = false;
 
@@ -1453,7 +1462,10 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon,
         oparms.tcon = tcon;
         oparms.desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA;
         oparms.disposition = FILE_OPEN;
-        oparms.create_options = 0;
+        if (backup_cred(cifs_sb))
+                oparms.create_options = CREATE_OPEN_BACKUP_INTENT;
+        else
+                oparms.create_options = 0;
         oparms.fid = fid;
         oparms.reconnect = false;
 
@@ -1857,7 +1869,10 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
         oparms.tcon = tcon;
         oparms.desired_access = FILE_READ_ATTRIBUTES;
         oparms.disposition = FILE_OPEN;
-        oparms.create_options = 0;
+        if (backup_cred(cifs_sb))
+                oparms.create_options = CREATE_OPEN_BACKUP_INTENT;
+        else
+                oparms.create_options = 0;
         oparms.fid = &fid;
         oparms.reconnect = false;
 
@@ -3639,7 +3654,7 @@ struct smb_version_values smb21_values = {
 struct smb_version_values smb3any_values = {
         .version_string = SMB3ANY_VERSION_STRING,
         .protocol_id = SMB302_PROT_ID, /* doesn't matter, send protocol array */
-        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION,
+        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION | SMB2_GLOBAL_CAP_DIRECTORY_LEASING,
         .large_lock_type = 0,
         .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK,
         .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK,
@@ -3660,7 +3675,7 @@ struct smb_version_values smb3any_values = {
 struct smb_version_values smbdefault_values = {
         .version_string = SMBDEFAULT_VERSION_STRING,
         .protocol_id = SMB302_PROT_ID, /* doesn't matter, send protocol array */
-        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION,
+        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION | SMB2_GLOBAL_CAP_DIRECTORY_LEASING,
         .large_lock_type = 0,
         .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK,
         .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK,
@@ -3681,7 +3696,7 @@ struct smb_version_values smbdefault_values = {
 struct smb_version_values smb30_values = {
         .version_string = SMB30_VERSION_STRING,
         .protocol_id = SMB30_PROT_ID,
-        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION,
+        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION | SMB2_GLOBAL_CAP_DIRECTORY_LEASING,
         .large_lock_type = 0,
         .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK,
         .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK,
@@ -3702,7 +3717,7 @@ struct smb_version_values smb30_values = {
 struct smb_version_values smb302_values = {
         .version_string = SMB302_VERSION_STRING,
         .protocol_id = SMB302_PROT_ID,
-        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION,
+        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION | SMB2_GLOBAL_CAP_DIRECTORY_LEASING,
         .large_lock_type = 0,
         .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK,
         .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK,
@@ -3723,7 +3738,7 @@ struct smb_version_values smb302_values = {
 struct smb_version_values smb311_values = {
         .version_string = SMB311_VERSION_STRING,
         .protocol_id = SMB311_PROT_ID,
-        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION,
+        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION | SMB2_GLOBAL_CAP_DIRECTORY_LEASING,
         .large_lock_type = 0,
         .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK,
         .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK,
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 5740aa809be6..c08acfc77abc 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2178,6 +2178,9 @@ SMB2_open_init(struct cifs_tcon *tcon, struct smb_rqst *rqst, __u8 *oplock,
         if (!(server->capabilities & SMB2_GLOBAL_CAP_LEASING) ||
             *oplock == SMB2_OPLOCK_LEVEL_NONE)
                 req->RequestedOplockLevel = *oplock;
+        else if (!(server->capabilities & SMB2_GLOBAL_CAP_DIRECTORY_LEASING) &&
+                  (oparms->create_options & CREATE_NOT_FILE))
+                req->RequestedOplockLevel = *oplock; /* no srv lease support */
         else {
                 rc = add_lease_context(server, iov, &n_iov,
                                        oparms->fid->lease_key, oplock);
diff --git a/fs/nilfs2/alloc.c b/fs/nilfs2/alloc.c
index 03b8ba933eb2..235b959fc2b3 100644
--- a/fs/nilfs2/alloc.c
+++ b/fs/nilfs2/alloc.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * alloc.c - NILFS dat/inode allocator
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Originally written by Koji Sato.
  * Two allocators were unified by Ryusuke Konishi and Amagai Yoshiji.
  */
diff --git a/fs/nilfs2/alloc.h b/fs/nilfs2/alloc.h
index 05149e606a78..0303c3968cee 100644
--- a/fs/nilfs2/alloc.h
+++ b/fs/nilfs2/alloc.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * alloc.h - persistent object (dat entry/disk inode) allocator/deallocator
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Originally written by Koji Sato.
  * Two allocators were unified by Ryusuke Konishi and Amagai Yoshiji.
  */
diff --git a/fs/nilfs2/bmap.c b/fs/nilfs2/bmap.c
index 01fb1831ca25..fb5a9a8a13cf 100644
--- a/fs/nilfs2/bmap.c
+++ b/fs/nilfs2/bmap.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * bmap.c - NILFS block mapping.
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/bmap.h b/fs/nilfs2/bmap.h
index 2b6ffbe5997a..2c63858e81c9 100644
--- a/fs/nilfs2/bmap.h
+++ b/fs/nilfs2/bmap.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * bmap.h - NILFS block mapping.
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/btnode.c b/fs/nilfs2/btnode.c
index dec98cab729d..ebb24a314f43 100644
--- a/fs/nilfs2/btnode.c
+++ b/fs/nilfs2/btnode.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * btnode.c - NILFS B-tree node cache
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Originally written by Seiji Kihara.
  * Fully revised by Ryusuke Konishi for stabilization and simplification.
  *
diff --git a/fs/nilfs2/btnode.h b/fs/nilfs2/btnode.h
index 4e8aaa1aeb65..0f88dbc9bcb3 100644
--- a/fs/nilfs2/btnode.h
+++ b/fs/nilfs2/btnode.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * btnode.h - NILFS B-tree node cache
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Seiji Kihara.
  * Revised by Ryusuke Konishi.
  */
diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
index 16a7a67a11c9..23e043eca237 100644
--- a/fs/nilfs2/btree.c
+++ b/fs/nilfs2/btree.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * btree.c - NILFS B-tree.
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/btree.h b/fs/nilfs2/btree.h
index 2184e47fa4bf..d1421b646ce4 100644
--- a/fs/nilfs2/btree.h
+++ b/fs/nilfs2/btree.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * btree.h - NILFS B-tree.
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/cpfile.c b/fs/nilfs2/cpfile.c
index a15a1601e931..8d41311b5db4 100644
--- a/fs/nilfs2/cpfile.c
+++ b/fs/nilfs2/cpfile.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * cpfile.c - NILFS checkpoint file.
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/cpfile.h b/fs/nilfs2/cpfile.h
index 6eca972f9673..6336222df24a 100644
--- a/fs/nilfs2/cpfile.h
+++ b/fs/nilfs2/cpfile.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * cpfile.h - NILFS checkpoint file.
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/dat.c b/fs/nilfs2/dat.c
index dffedb2f8817..6f4066636be9 100644
--- a/fs/nilfs2/dat.c
+++ b/fs/nilfs2/dat.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * dat.c - NILFS disk address translation.
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/dat.h b/fs/nilfs2/dat.h
index 57dc6cf466d0..b17ee34580ae 100644
--- a/fs/nilfs2/dat.h
+++ b/fs/nilfs2/dat.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * dat.h - NILFS disk address translation.
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c
index 582831ab3eb9..81394e22d0a0 100644
--- a/fs/nilfs2/dir.c
+++ b/fs/nilfs2/dir.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * dir.c - NILFS directory entry operations
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Modified for NILFS by Amagai Yoshiji.
  */
 /*
diff --git a/fs/nilfs2/direct.c b/fs/nilfs2/direct.c
index 96e3ed0d9652..533e24ea3a88 100644
--- a/fs/nilfs2/direct.c
+++ b/fs/nilfs2/direct.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * direct.c - NILFS direct block pointer.
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/direct.h b/fs/nilfs2/direct.h
index cfe85e848bba..ec9a23c77994 100644
--- a/fs/nilfs2/direct.h
+++ b/fs/nilfs2/direct.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * direct.h - NILFS direct block pointer.
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/file.c b/fs/nilfs2/file.c
index 7da0fac71dc2..64bc81363c6c 100644
--- a/fs/nilfs2/file.c
+++ b/fs/nilfs2/file.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * file.c - NILFS regular file handling primitives including fsync().
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Amagai Yoshiji and Ryusuke Konishi.
  */
 
diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c
index 853a831dcde0..aa3c328ee189 100644
--- a/fs/nilfs2/gcinode.c
+++ b/fs/nilfs2/gcinode.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * gcinode.c - dummy inodes to buffer blocks for garbage collection
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Seiji Kihara, Amagai Yoshiji, and Ryusuke Konishi.
  * Revised by Ryusuke Konishi.
  *
diff --git a/fs/nilfs2/ifile.c b/fs/nilfs2/ifile.c
index b8fa45c20c63..4140d232cadc 100644
--- a/fs/nilfs2/ifile.c
+++ b/fs/nilfs2/ifile.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * ifile.c - NILFS inode file
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Amagai Yoshiji.
  * Revised by Ryusuke Konishi.
  *
diff --git a/fs/nilfs2/ifile.h b/fs/nilfs2/ifile.h
index 188b94fe0ec5..a1e1e5711a05 100644
--- a/fs/nilfs2/ifile.h
+++ b/fs/nilfs2/ifile.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * ifile.h - NILFS inode file
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Amagai Yoshiji.
  * Revised by Ryusuke Konishi.
  *
diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index 6a612d832e7d..671085512e0f 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * inode.c - NILFS inode operations.
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  *
  */
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index 1d2c3d7711fe..9b96d79eea6c 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * ioctl.c - NILFS ioctl operations.
  *
  * Copyright (C) 2007, 2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/mdt.c b/fs/nilfs2/mdt.c
index c6bc1033e7d2..700870a92bc4 100644
--- a/fs/nilfs2/mdt.c
+++ b/fs/nilfs2/mdt.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * mdt.c - meta data file for NILFS
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  */
 
diff --git a/fs/nilfs2/mdt.h b/fs/nilfs2/mdt.h
index 3f67f3932097..e77aea4bb921 100644
--- a/fs/nilfs2/mdt.h
+++ b/fs/nilfs2/mdt.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * mdt.h - NILFS meta data file prototype and definitions
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  */
 
diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c
index dd52d3f82e8d..9fe6d4ab74f0 100644
--- a/fs/nilfs2/namei.c
+++ b/fs/nilfs2/namei.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * namei.c - NILFS pathname lookup operations.
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Modified for NILFS by Amagai Yoshiji and Ryusuke Konishi.
  */
 /*
diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h
index 33f8c8fc96e8..a2f247b6a209 100644
--- a/fs/nilfs2/nilfs.h
+++ b/fs/nilfs2/nilfs.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * nilfs.h - NILFS local header file.
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato and Ryusuke Konishi.
  */
 
diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c
index 4cb850a6f1c2..329a056b73b1 100644
--- a/fs/nilfs2/page.c
+++ b/fs/nilfs2/page.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * page.c - buffer/page management specific to NILFS
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi and Seiji Kihara.
  */
 
diff --git a/fs/nilfs2/page.h b/fs/nilfs2/page.h
index f3687c958fa8..62b9bb469e92 100644
--- a/fs/nilfs2/page.h
+++ b/fs/nilfs2/page.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * page.h - buffer/page management specific to NILFS
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi and Seiji Kihara.
  */
 
diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c
index 5139efed1888..140b663e91c7 100644
--- a/fs/nilfs2/recovery.c
+++ b/fs/nilfs2/recovery.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * recovery.c - NILFS recovery logic
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  */
 
diff --git a/fs/nilfs2/segbuf.c b/fs/nilfs2/segbuf.c
index 68cb9e4740b4..20c479b5e41b 100644
--- a/fs/nilfs2/segbuf.c
+++ b/fs/nilfs2/segbuf.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * segbuf.c - NILFS segment buffer
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  *
  */
diff --git a/fs/nilfs2/segbuf.h b/fs/nilfs2/segbuf.h
index 10e16935fff6..9bea1bd59041 100644
--- a/fs/nilfs2/segbuf.h
+++ b/fs/nilfs2/segbuf.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * segbuf.h - NILFS Segment buffer prototypes and definitions
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  *
  */
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 0953635e7d48..445eef41bfaf 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * segment.c - NILFS segment constructor.
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  *
  */
diff --git a/fs/nilfs2/segment.h b/fs/nilfs2/segment.h
index 04634e3e3d58..f5cf5308f3fc 100644
--- a/fs/nilfs2/segment.h
+++ b/fs/nilfs2/segment.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * segment.h - NILFS Segment constructor prototypes and definitions
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  *
  */
diff --git a/fs/nilfs2/sufile.c b/fs/nilfs2/sufile.c
index c7fa139d50e8..bf3f8f05c89b 100644
--- a/fs/nilfs2/sufile.c
+++ b/fs/nilfs2/sufile.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * sufile.c - NILFS segment usage file.
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  * Revised by Ryusuke Konishi.
  */
diff --git a/fs/nilfs2/sufile.h b/fs/nilfs2/sufile.h
index 673a891350f4..c4e2c7a7add1 100644
--- a/fs/nilfs2/sufile.h
+++ b/fs/nilfs2/sufile.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * sufile.h - NILFS segment usage file.
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index 1b9067cf4511..26290aa1023f 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * super.c - NILFS module and super block management.
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  */
 /*
diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index 4b25837e7724..e60be7bb55b0 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -1,19 +1,10 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * sysfs.c - sysfs support implementation.
  *
  * Copyright (C) 2005-2014 Nippon Telegraph and Telephone Corporation.
  * Copyright (C) 2014 HGST, Inc., a Western Digital Company.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Vyacheslav Dubeyko <Vyacheslav.Dubeyko@hgst.com>
  */
 
diff --git a/fs/nilfs2/sysfs.h b/fs/nilfs2/sysfs.h
index 648cedf9c06e..d001eb862dae 100644
--- a/fs/nilfs2/sysfs.h
+++ b/fs/nilfs2/sysfs.h
@@ -1,19 +1,10 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * sysfs.h - sysfs support declarations.
  *
  * Copyright (C) 2005-2014 Nippon Telegraph and Telephone Corporation.
  * Copyright (C) 2014 HGST, Inc., a Western Digital Company.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Vyacheslav Dubeyko <Vyacheslav.Dubeyko@hgst.com>
  */
 
diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index 1a85317e83f0..484785cdf96e 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * the_nilfs.c - the_nilfs shared structure.
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  *
  */
diff --git a/fs/nilfs2/the_nilfs.h b/fs/nilfs2/the_nilfs.h
index 36da1779f976..380a543c5b19 100644
--- a/fs/nilfs2/the_nilfs.h
+++ b/fs/nilfs2/the_nilfs.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * the_nilfs.h - the_nilfs shared structure.
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  *
  */
diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
index f174397b63a0..ababdbfab537 100644
--- a/fs/notify/fsnotify.c
+++ b/fs/notify/fsnotify.c
@@ -351,16 +351,9 @@ int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is,
 
         iter_info.srcu_idx = srcu_read_lock(&fsnotify_mark_srcu);
 
-        if ((mask & FS_MODIFY) ||
-            (test_mask & to_tell->i_fsnotify_mask)) {
-                iter_info.marks[FSNOTIFY_OBJ_TYPE_INODE] =
-                        fsnotify_first_mark(&to_tell->i_fsnotify_marks);
-        }
-
-        if (mnt && ((mask & FS_MODIFY) ||
-                    (test_mask & mnt->mnt_fsnotify_mask))) {
-                iter_info.marks[FSNOTIFY_OBJ_TYPE_INODE] =
-                        fsnotify_first_mark(&to_tell->i_fsnotify_marks);
+        iter_info.marks[FSNOTIFY_OBJ_TYPE_INODE] =
+                fsnotify_first_mark(&to_tell->i_fsnotify_marks);
+        if (mnt) {
                 iter_info.marks[FSNOTIFY_OBJ_TYPE_VFSMOUNT] =
                         fsnotify_first_mark(&mnt->mnt_fsnotify_marks);
         }
diff --git a/include/linux/blk-cgroup.h b/include/linux/blk-cgroup.h
index 34aec30e06c7..6d766a19f2bb 100644
--- a/include/linux/blk-cgroup.h
+++ b/include/linux/blk-cgroup.h
@@ -56,6 +56,7 @@ struct blkcg {
         struct list_head                all_blkcgs_node;
 #ifdef CONFIG_CGROUP_WRITEBACK
         struct list_head                cgwb_list;
+        refcount_t                      cgwb_refcnt;
 #endif
 };
 
@@ -89,7 +90,6 @@ struct blkg_policy_data {
         /* the blkg and policy id this per-policy data belongs to */
         struct blkcg_gq                 *blkg;
         int                             plid;
-        bool                            offline;
 };
 
 /*
@@ -387,6 +387,49 @@ static inline struct blkcg *cpd_to_blkcg(struct blkcg_policy_data *cpd)
         return cpd ? cpd->blkcg : NULL;
 }
 
+extern void blkcg_destroy_blkgs(struct blkcg *blkcg);
+
+#ifdef CONFIG_CGROUP_WRITEBACK
+
+/**
+ * blkcg_cgwb_get - get a reference for blkcg->cgwb_list
+ * @blkcg: blkcg of interest
+ *
+ * This is used to track the number of active wb's related to a blkcg.
+ */
+static inline void blkcg_cgwb_get(struct blkcg *blkcg)
+{
+        refcount_inc(&blkcg->cgwb_refcnt);
+}
+
+/**
+ * blkcg_cgwb_put - put a reference for @blkcg->cgwb_list
+ * @blkcg: blkcg of interest
+ *
+ * This is used to track the number of active wb's related to a blkcg.
+ * When this count goes to zero, all active wb has finished so the
+ * blkcg can continue destruction by calling blkcg_destroy_blkgs().
+ * This work may occur in cgwb_release_workfn() on the cgwb_release
+ * workqueue.
+ */
+static inline void blkcg_cgwb_put(struct blkcg *blkcg)
+{
+        if (refcount_dec_and_test(&blkcg->cgwb_refcnt))
+                blkcg_destroy_blkgs(blkcg);
+}
+
+#else
+
+static inline void blkcg_cgwb_get(struct blkcg *blkcg) { }
+
+static inline void blkcg_cgwb_put(struct blkcg *blkcg)
+{
+        /* wb isn't being accounted, so trigger destruction right away */
+        blkcg_destroy_blkgs(blkcg);
+}
+
+#endif
+
 /**
  * blkg_path - format cgroup path of blkg
  * @blkg: blkg of interest
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 834e6461a690..d44a78362942 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -526,6 +526,7 @@ struct hid_input {
         const char *name;
         bool registered;
         struct list_head reports;       /* the list of reports */
+        unsigned int application;       /* application usage for this input */
 };
 
 enum hid_type {
diff --git a/include/linux/timekeeping.h b/include/linux/timekeeping.h
index 5d738804e3d6..a5a3cfc3c2fa 100644
--- a/include/linux/timekeeping.h
+++ b/include/linux/timekeeping.h
@@ -258,8 +258,8 @@ extern void ktime_get_snapshot(struct system_time_snapshot *systime_snapshot);
 extern int persistent_clock_is_local;
 
 extern void read_persistent_clock64(struct timespec64 *ts);
-void read_persistent_clock_and_boot_offset(struct timespec64 *wall_clock,
-                                           struct timespec64 *boot_offset);
+void read_persistent_wall_and_boot_offset(struct timespec64 *wall_clock,
+                                          struct timespec64 *boot_offset);
 extern int update_persistent_clock64(struct timespec64 now);
 
 /*
diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
index 7f2e16e76ac4..041f7e56a289 100644
--- a/include/linux/tracepoint.h
+++ b/include/linux/tracepoint.h
@@ -158,8 +158,10 @@ extern void syscall_unregfunc(void);
                  * For rcuidle callers, use srcu since sched-rcu        \
                  * doesn't work from the idle path.                     \
                  */                                                     \
-                if (rcuidle)                                            \
+                if (rcuidle) {                                          \
                         idx = srcu_read_lock_notrace(&tracepoint_srcu); \
+                        rcu_irq_enter_irqson();                         \
+                }                                                       \
                                                                         \
                 it_func_ptr = rcu_dereference_raw((tp)->funcs);         \
                                                                         \
@@ -171,8 +173,10 @@ extern void syscall_unregfunc(void);
                         } while ((++it_func_ptr)->func);                \
                 }                                                       \
                                                                         \
-                if (rcuidle)                                            \
+                if (rcuidle) {                                          \
+                        rcu_irq_exit_irqson();                          \
                         srcu_read_unlock_notrace(&tracepoint_srcu, idx);\
+                }                                                       \
                                                                         \
                 preempt_enable_notrace();                               \
         } while (0)
diff --git a/include/net/netfilter/nf_conntrack_timeout.h b/include/net/netfilter/nf_conntrack_timeout.h
index d5f62cc6c2ae..3394d75e1c80 100644
--- a/include/net/netfilter/nf_conntrack_timeout.h
+++ b/include/net/netfilter/nf_conntrack_timeout.h
@@ -30,7 +30,7 @@ struct nf_conn_timeout {
 };
 
 static inline unsigned int *
-nf_ct_timeout_data(struct nf_conn_timeout *t)
+nf_ct_timeout_data(const struct nf_conn_timeout *t)
 {
         struct nf_ct_timeout *timeout;
 
diff --git a/include/net/tls.h b/include/net/tls.h
index d5c683e8bb22..0a769cf2f5f3 100644
--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -171,15 +171,14 @@ struct cipher_context {
         char *rec_seq;
 };
 
+union tls_crypto_context {
+        struct tls_crypto_info info;
+        struct tls12_crypto_info_aes_gcm_128 aes_gcm_128;
+};
+
 struct tls_context {
-        union {
-                struct tls_crypto_info crypto_send;
-                struct tls12_crypto_info_aes_gcm_128 crypto_send_aes_gcm_128;
-        };
-        union {
-                struct tls_crypto_info crypto_recv;
-                struct tls12_crypto_info_aes_gcm_128 crypto_recv_aes_gcm_128;
-        };
+        union tls_crypto_context crypto_send;
+        union tls_crypto_context crypto_recv;
 
         struct list_head list;
         struct net_device *netdev;
@@ -367,8 +366,8 @@ static inline void tls_fill_prepend(struct tls_context *ctx,
          * size KTLS_DTLS_HEADER_SIZE + KTLS_DTLS_NONCE_EXPLICIT_SIZE
          */
         buf[0] = record_type;
-        buf[1] = TLS_VERSION_MINOR(ctx->crypto_send.version);
-        buf[2] = TLS_VERSION_MAJOR(ctx->crypto_send.version);
+        buf[1] = TLS_VERSION_MINOR(ctx->crypto_send.info.version);
+        buf[2] = TLS_VERSION_MAJOR(ctx->crypto_send.info.version);
         /* we can use IV for nonce explicit according to spec */
         buf[3] = pkt_len >> 8;
         buf[4] = pkt_len & 0xFF;
diff --git a/include/uapi/linux/keyctl.h b/include/uapi/linux/keyctl.h
index 7b8c9e19bad1..910cc4334b21 100644
--- a/include/uapi/linux/keyctl.h
+++ b/include/uapi/linux/keyctl.h
@@ -65,7 +65,7 @@
 
 /* keyctl structures */
 struct keyctl_dh_params {
-        __s32 private;
+        __s32 dh_private;
         __s32 prime;
         __s32 base;
 };
diff --git a/ipc/shm.c b/ipc/shm.c
index b0eb3757ab89..4cd402e4cfeb 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -199,6 +199,7 @@ static inline struct shmid_kernel *shm_lock(struct ipc_namespace *ns, int id)
         }
 
         ipc_unlock_object(ipcp);
+        ipcp = ERR_PTR(-EIDRM);
 err:
         rcu_read_unlock();
         /*
diff --git a/kernel/cpu.c b/kernel/cpu.c
index aa7fe85ad62e..0097acec1c71 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -607,15 +607,15 @@ static void cpuhp_thread_fun(unsigned int cpu)
         bool bringup = st->bringup;
         enum cpuhp_state state;
 
+        if (WARN_ON_ONCE(!st->should_run))
+                return;
+
         /*
          * ACQUIRE for the cpuhp_should_run() load of ->should_run. Ensures
          * that if we see ->should_run we also see the rest of the state.
          */
         smp_mb();
 
-        if (WARN_ON_ONCE(!st->should_run))
-                return;
-
         cpuhp_lock_acquire(bringup);
 
         if (st->single) {
@@ -916,7 +916,8 @@ static int cpuhp_down_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st,
                 ret = cpuhp_invoke_callback(cpu, st->state, false, NULL, NULL);
                 if (ret) {
                         st->target = prev_state;
-                        undo_cpu_down(cpu, st);
+                        if (st->state < prev_state)
+                                undo_cpu_down(cpu, st);
                         break;
                 }
         }
@@ -969,7 +970,7 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen,
          * to do the further cleanups.
          */
         ret = cpuhp_down_callbacks(cpu, st, target);
-        if (ret && st->state > CPUHP_TEARDOWN_CPU && st->state < prev_state) {
+        if (ret && st->state == CPUHP_TEARDOWN_CPU && st->state < prev_state) {
                 cpuhp_reset_state(st, prev_state);
                 __cpuhp_kick_ap(st);
         }
diff --git a/kernel/fork.c b/kernel/fork.c
index d896e9ca38b0..f0b58479534f 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -550,8 +550,7 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm,
                         goto out;
         }
         /* a new mm has just been created */
-        arch_dup_mmap(oldmm, mm);
-        retval = 0;
+        retval = arch_dup_mmap(oldmm, mm);
 out:
         up_write(&mm->mmap_sem);
         flush_tlb_mm(oldmm);
diff --git a/kernel/printk/printk_safe.c b/kernel/printk/printk_safe.c
index a0a74c533e4b..0913b4d385de 100644
--- a/kernel/printk/printk_safe.c
+++ b/kernel/printk/printk_safe.c
@@ -306,12 +306,12 @@ static __printf(1, 0) int vprintk_nmi(const char *fmt, va_list args)
         return printk_safe_log_store(s, fmt, args);
 }
 
-void printk_nmi_enter(void)
+void notrace printk_nmi_enter(void)
 {
         this_cpu_or(printk_context, PRINTK_NMI_CONTEXT_MASK);
 }
 
-void printk_nmi_exit(void)
+void notrace printk_nmi_exit(void)
 {
         this_cpu_and(printk_context, ~PRINTK_NMI_CONTEXT_MASK);
 }
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index f74fb00d8064..0e6e97a01942 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -133,19 +133,40 @@ static void inline clocksource_watchdog_unlock(unsigned long *flags)
         spin_unlock_irqrestore(&watchdog_lock, *flags);
 }
 
+static int clocksource_watchdog_kthread(void *data);
+static void __clocksource_change_rating(struct clocksource *cs, int rating);
+
 /*
  * Interval: 0.5sec Threshold: 0.0625s
  */
 #define WATCHDOG_INTERVAL (HZ >> 1)
 #define WATCHDOG_THRESHOLD (NSEC_PER_SEC >> 4)
 
+static void clocksource_watchdog_work(struct work_struct *work)
+{
+        /*
+         * We cannot directly run clocksource_watchdog_kthread() here, because
+         * clocksource_select() calls timekeeping_notify() which uses
+         * stop_machine(). One cannot use stop_machine() from a workqueue() due
+         * lock inversions wrt CPU hotplug.
+         *
+         * Also, we only ever run this work once or twice during the lifetime
+         * of the kernel, so there is no point in creating a more permanent
+         * kthread for this.
+         *
+         * If kthread_run fails the next watchdog scan over the
+         * watchdog_list will find the unstable clock again.
+         */
+        kthread_run(clocksource_watchdog_kthread, NULL, "kwatchdog");
+}
+
 static void __clocksource_unstable(struct clocksource *cs)
 {
         cs->flags &= ~(CLOCK_SOURCE_VALID_FOR_HRES | CLOCK_SOURCE_WATCHDOG);
         cs->flags |= CLOCK_SOURCE_UNSTABLE;
 
         /*
-         * If the clocksource is registered clocksource_watchdog_work() will
+         * If the clocksource is registered clocksource_watchdog_kthread() will
          * re-rate and re-select.
          */
         if (list_empty(&cs->list)) {
@@ -156,7 +177,7 @@ static void __clocksource_unstable(struct clocksource *cs)
         if (cs->mark_unstable)
                 cs->mark_unstable(cs);
 
-        /* kick clocksource_watchdog_work() */
+        /* kick clocksource_watchdog_kthread() */
         if (finished_booting)
                 schedule_work(&watchdog_work);
 }
@@ -166,7 +187,7 @@ static void __clocksource_unstable(struct clocksource *cs)
  * @cs:         clocksource to be marked unstable
  *
  * This function is called by the x86 TSC code to mark clocksources as unstable;
- * it defers demotion and re-selection to a work.
+ * it defers demotion and re-selection to a kthread.
  */
 void clocksource_mark_unstable(struct clocksource *cs)
 {
@@ -391,9 +412,7 @@ static void clocksource_dequeue_watchdog(struct clocksource *cs)
         }
 }
 
-static void __clocksource_change_rating(struct clocksource *cs, int rating);
-
-static int __clocksource_watchdog_work(void)
+static int __clocksource_watchdog_kthread(void)
 {
         struct clocksource *cs, *tmp;
         unsigned long flags;
@@ -418,12 +437,13 @@ static int __clocksource_watchdog_work(void)
         return select;
 }
 
-static void clocksource_watchdog_work(struct work_struct *work)
+static int clocksource_watchdog_kthread(void *data)
 {
         mutex_lock(&clocksource_mutex);
-        if (__clocksource_watchdog_work())
+        if (__clocksource_watchdog_kthread())
                 clocksource_select();
         mutex_unlock(&clocksource_mutex);
+        return 0;
 }
 
 static bool clocksource_is_watchdog(struct clocksource *cs)
@@ -442,7 +462,7 @@ static void clocksource_enqueue_watchdog(struct clocksource *cs)
 static void clocksource_select_watchdog(bool fallback) { }
 static inline void clocksource_dequeue_watchdog(struct clocksource *cs) { }
 static inline void clocksource_resume_watchdog(void) { }
-static inline int __clocksource_watchdog_work(void) { return 0; }
+static inline int __clocksource_watchdog_kthread(void) { return 0; }
 static bool clocksource_is_watchdog(struct clocksource *cs) { return false; }
 void clocksource_mark_unstable(struct clocksource *cs) { }
 
@@ -810,7 +830,7 @@ static int __init clocksource_done_booting(void)
         /*
          * Run the watchdog first to eliminate unstable clock sources
          */
-        __clocksource_watchdog_work();
+        __clocksource_watchdog_kthread();
         clocksource_select();
         mutex_unlock(&clocksource_mutex);
         return 0;
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 613316724c6a..4966c4fbe7f7 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1277,13 +1277,13 @@ config WARN_ALL_UNSEEDED_RANDOM
           time.  This is really bad from a security perspective, and
           so architecture maintainers really need to do what they can
           to get the CRNG seeded sooner after the system is booted.
-          However, since users can not do anything actionble to
+          However, since users cannot do anything actionable to
           address this, by default the kernel will issue only a single
           warning for the first use of unseeded randomness.
 
           Say Y here if you want to receive warnings for all uses of
           unseeded randomness.  This will be of use primarily for
-          those developers interersted in improving the security of
+          those developers interested in improving the security of
           Linux kernels running on their architecture (or
           subarchitecture).
 
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index f5981e9d6ae2..8a8bb8796c6c 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -491,6 +491,7 @@ static void cgwb_release_workfn(struct work_struct *work)
 {
         struct bdi_writeback *wb = container_of(work, struct bdi_writeback,
                                                 release_work);
+        struct blkcg *blkcg = css_to_blkcg(wb->blkcg_css);
 
         mutex_lock(&wb->bdi->cgwb_release_mutex);
         wb_shutdown(wb);
@@ -499,6 +500,9 @@ static void cgwb_release_workfn(struct work_struct *work)
         css_put(wb->blkcg_css);
         mutex_unlock(&wb->bdi->cgwb_release_mutex);
 
+        /* triggers blkg destruction if cgwb_refcnt becomes zero */
+        blkcg_cgwb_put(blkcg);
+
         fprop_local_destroy_percpu(&wb->memcg_completions);
         percpu_ref_exit(&wb->refcnt);
         wb_exit(wb);
@@ -597,6 +601,7 @@ static int cgwb_create(struct backing_dev_info *bdi,
                         list_add_tail_rcu(&wb->bdi_node, &bdi->wb_list);
                         list_add(&wb->memcg_node, memcg_cgwb_list);
                         list_add(&wb->blkcg_node, blkcg_cgwb_list);
+                        blkcg_cgwb_get(blkcg);
                         css_get(memcg_css);
                         css_get(blkcg_css);
                 }
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index c3bc7e9c9a2a..533f9b00147d 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -821,11 +821,11 @@ vm_fault_t vmf_insert_pfn_pud(struct vm_area_struct *vma, unsigned long addr,
          * but we need to be consistent with PTEs and architectures that
          * can't support a 'special' bit.
          */
-        BUG_ON(!(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)));
+        BUG_ON(!(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) &&
+                        !pfn_t_devmap(pfn));
         BUG_ON((vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) ==
                                                 (VM_PFNMAP|VM_MIXEDMAP));
         BUG_ON((vma->vm_flags & VM_PFNMAP) && is_cow_mapping(vma->vm_flags));
-        BUG_ON(!pfn_t_devmap(pfn));
 
         if (addr < vma->vm_start || addr >= vma->vm_end)
                 return VM_FAULT_SIGBUS;
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 9a085d525bbc..17dd883198ae 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -2097,6 +2097,11 @@ static int __init kmemleak_late_init(void)
 
         kmemleak_initialized = 1;
 
+        dentry = debugfs_create_file("kmemleak", 0644, NULL, NULL,
+                                     &kmemleak_fops);
+        if (!dentry)
+                pr_warn("Failed to create the debugfs kmemleak file\n");
+
         if (kmemleak_error) {
                 /*
                  * Some error occurred and kmemleak was disabled. There is a
@@ -2108,10 +2113,6 @@ static int __init kmemleak_late_init(void)
                 return -ENOMEM;
         }
 
-        dentry = debugfs_create_file("kmemleak", 0644, NULL, NULL,
-                                     &kmemleak_fops);
-        if (!dentry)
-                pr_warn("Failed to create the debugfs kmemleak file\n");
         mutex_lock(&scan_mutex);
         start_scan_thread();
         mutex_unlock(&scan_mutex);
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 4ead5a4817de..e79cb59552d9 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1701,8 +1701,6 @@ static enum oom_status mem_cgroup_oom(struct mem_cgroup *memcg, gfp_t mask, int
         if (mem_cgroup_out_of_memory(memcg, mask, order))
                 return OOM_SUCCESS;
 
-        WARN(1,"Memory cgroup charge failed because of no reclaimable memory! "
-                "This looks like a misconfiguration or a kernel bug.");
         return OOM_FAILED;
 }
 
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 9eea6e809a4e..38d94b703e9d 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1333,7 +1333,8 @@ static unsigned long scan_movable_pages(unsigned long start, unsigned long end)
                         if (__PageMovable(page))
                                 return pfn;
                         if (PageHuge(page)) {
-                                if (page_huge_active(page))
+                                if (hugepage_migration_supported(page_hstate(page)) &&
+                                    page_huge_active(page))
                                         return pfn;
                                 else
                                         pfn = round_up(pfn + 1,
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index b5b25e4dcbbb..f10aa5360616 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -522,6 +522,7 @@ bool __oom_reap_task_mm(struct mm_struct *mm)
 
                         tlb_gather_mmu(&tlb, mm, start, end);
                         if (mmu_notifier_invalidate_range_start_nonblock(mm, start, end)) {
+                                tlb_finish_mmu(&tlb, start, end);
                                 ret = false;
                                 continue;
                         }
@@ -1103,10 +1104,17 @@ bool out_of_memory(struct oom_control *oc)
         }
 
         select_bad_process(oc);
-        /* Found nothing?!?! Either we hang forever, or we panic. */
-        if (!oc->chosen && !is_sysrq_oom(oc) && !is_memcg_oom(oc)) {
+        /* Found nothing?!?! */
+        if (!oc->chosen) {
                 dump_header(oc, NULL);
-                panic("Out of memory and no killable processes...\n");
+                pr_warn("Out of memory and no killable processes...\n");
+                /*
+                 * If we got here due to an actual allocation at the
+                 * system level, we cannot survive this and will enter
+                 * an endless loop in the allocator. Bail out now.
+                 */
+                if (!is_sysrq_oom(oc) && !is_memcg_oom(oc))
+                        panic("System is deadlocked on memory\n");
         }
         if (oc->chosen && oc->chosen != (void *)-1UL)
                 oom_kill_process(oc, !is_memcg_oom(oc) ? "Out of memory" :
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 05e983f42316..89d2a2ab3fe6 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -7708,6 +7708,10 @@ bool has_unmovable_pages(struct zone *zone, struct page *page, int count,
                  * handle each tail page individually in migration.
                  */
                 if (PageHuge(page)) {
+
+                        if (!hugepage_migration_supported(page_hstate(page)))
+                                goto unmovable;
+
                         iter = round_up(iter + 1, 1<<compound_order(page)) - 1;
                         continue;
                 }
diff --git a/mm/util.c b/mm/util.c
index d2890a407332..9e3ebd2ef65f 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -435,11 +435,14 @@ void *kvmalloc_node(size_t size, gfp_t flags, int node)
 EXPORT_SYMBOL(kvmalloc_node);
 
 /**
- * kvfree - free memory allocated with kvmalloc
- * @addr: pointer returned by kvmalloc
+ * kvfree() - Free memory.
+ * @addr: Pointer to allocated memory.
  *
- * If the memory is allocated from vmalloc area it is freed with vfree().
- * Otherwise kfree() is used.
+ * kvfree frees memory allocated by any of vmalloc(), kmalloc() or kvmalloc().
+ * It is slightly more efficient to use kfree() or vfree() if you are certain
+ * that you know which one to use.
+ *
+ * Context: Any context except NMI.
  */
 void kvfree(const void *addr)
 {
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index aa19d86937af..91592fceeaad 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1180,6 +1180,12 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
                 lladdr = neigh->ha;
         }
 
+        /* Update confirmed timestamp for neighbour entry after we
+         * received ARP packet even if it doesn't change IP to MAC binding.
+         */
+        if (new & NUD_CONNECTED)
+                neigh->confirmed = jiffies;
+
         /* If entry was valid and address is not changed,
            do not change entry state, if new one is STALE.
          */
@@ -1201,15 +1207,12 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
                 }
         }
 
-        /* Update timestamps only once we know we will make a change to the
+        /* Update timestamp only once we know we will make a change to the
          * neighbour entry. Otherwise we risk to move the locktime window with
          * noop updates and ignore relevant ARP updates.
          */
-        if (new != old || lladdr != neigh->ha) {
-                if (new & NUD_CONNECTED)
-                        neigh->confirmed = jiffies;
+        if (new != old || lladdr != neigh->ha)
                 neigh->updated = jiffies;
-        }
 
         if (new != old) {
                 neigh_del_timer(neigh);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 60c928894a78..63ce2283a456 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2810,7 +2810,7 @@ int rtnl_configure_link(struct net_device *dev, const struct ifinfomsg *ifm)
         }
 
         if (dev->rtnl_link_state == RTNL_LINK_INITIALIZED) {
-                __dev_notify_flags(dev, old_flags, 0U);
+                __dev_notify_flags(dev, old_flags, (old_flags ^ dev->flags));
         } else {
                 dev->rtnl_link_state = RTNL_LINK_INITIALIZED;
                 __dev_notify_flags(dev, old_flags, ~0U);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index ae714aecc31c..8cce0e9ea08c 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -178,6 +178,9 @@ static void ipgre_err(struct sk_buff *skb, u32 info,
 
         if (tpi->proto == htons(ETH_P_TEB))
                 itn = net_generic(net, gre_tap_net_id);
+        else if (tpi->proto == htons(ETH_P_ERSPAN) ||
+                 tpi->proto == htons(ETH_P_ERSPAN2))
+                itn = net_generic(net, erspan_net_id);
         else
                 itn = net_generic(net, ipgre_net_id);
 
@@ -328,6 +331,8 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
                 ip_tunnel_rcv(tunnel, skb, tpi, tun_dst, log_ecn_error);
                 return PACKET_RCVD;
         }
+        return PACKET_REJECT;
+
 drop:
         kfree_skb(skb);
         return PACKET_RCVD;
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index d9504adc47b3..184bf2e0a1ed 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -106,6 +106,10 @@ config NF_NAT_IPV4
 
 if NF_NAT_IPV4
 
+config NF_NAT_MASQUERADE_IPV4
+        bool
+
+if NF_TABLES
 config NFT_CHAIN_NAT_IPV4
         depends on NF_TABLES_IPV4
         tristate "IPv4 nf_tables nat chain support"
@@ -115,9 +119,6 @@ config NFT_CHAIN_NAT_IPV4
           packet transformations such as the source, destination address and
           source and destination ports.
 
-config NF_NAT_MASQUERADE_IPV4
-        bool
-
 config NFT_MASQ_IPV4
         tristate "IPv4 masquerading support for nf_tables"
         depends on NF_TABLES_IPV4
@@ -135,6 +136,7 @@ config NFT_REDIR_IPV4
         help
           This is the expression that provides IPv4 redirect support for
           nf_tables.
+endif # NF_TABLES
 
 config NF_NAT_SNMP_BASIC
         tristate "Basic SNMP-ALG support"
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 4c2dd9f863f7..4cf2f7bb2802 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -6367,8 +6367,8 @@ static bool tcp_syn_flood_action(const struct sock *sk,
         if (!queue->synflood_warned &&
             net->ipv4.sysctl_tcp_syncookies != 2 &&
             xchg(&queue->synflood_warned, 1) == 0)
-                pr_info("%s: Possible SYN flooding on port %d. %s.  Check SNMP counters.\n",
-                        proto, ntohs(tcp_hdr(skb)->dest), msg);
+                net_info_ratelimited("%s: Possible SYN flooding on port %d. %s.  Check SNMP counters.\n",
+                                     proto, ntohs(tcp_hdr(skb)->dest), msg);
 
         return want_cookie;
 }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 18e00ce1719a..3eed045c65a5 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -4670,20 +4670,31 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
                          int iif, int type, u32 portid, u32 seq,
                          unsigned int flags)
 {
-        struct rtmsg *rtm;
+        struct rt6_info *rt6 = (struct rt6_info *)dst;
+        struct rt6key *rt6_dst, *rt6_src;
+        u32 *pmetrics, table, rt6_flags;
         struct nlmsghdr *nlh;
+        struct rtmsg *rtm;
         long expires = 0;
-        u32 *pmetrics;
-        u32 table;
 
         nlh = nlmsg_put(skb, portid, seq, type, sizeof(*rtm), flags);
         if (!nlh)
                 return -EMSGSIZE;
 
+        if (rt6) {
+                rt6_dst = &rt6->rt6i_dst;
+                rt6_src = &rt6->rt6i_src;
+                rt6_flags = rt6->rt6i_flags;
+        } else {
+                rt6_dst = &rt->fib6_dst;
+                rt6_src = &rt->fib6_src;
+                rt6_flags = rt->fib6_flags;
+        }
+
         rtm = nlmsg_data(nlh);
         rtm->rtm_family = AF_INET6;
-        rtm->rtm_dst_len = rt->fib6_dst.plen;
-        rtm->rtm_src_len = rt->fib6_src.plen;
+        rtm->rtm_dst_len = rt6_dst->plen;
+        rtm->rtm_src_len = rt6_src->plen;
         rtm->rtm_tos = 0;
         if (rt->fib6_table)
                 table = rt->fib6_table->tb6_id;
@@ -4698,7 +4709,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
         rtm->rtm_scope = RT_SCOPE_UNIVERSE;
         rtm->rtm_protocol = rt->fib6_protocol;
 
-        if (rt->fib6_flags & RTF_CACHE)
+        if (rt6_flags & RTF_CACHE)
                 rtm->rtm_flags |= RTM_F_CLONED;
 
         if (dest) {
@@ -4706,7 +4717,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
                         goto nla_put_failure;
                 rtm->rtm_dst_len = 128;
         } else if (rtm->rtm_dst_len)
-                if (nla_put_in6_addr(skb, RTA_DST, &rt->fib6_dst.addr))
+                if (nla_put_in6_addr(skb, RTA_DST, &rt6_dst->addr))
                         goto nla_put_failure;
 #ifdef CONFIG_IPV6_SUBTREES
         if (src) {
@@ -4714,12 +4725,12 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
                         goto nla_put_failure;
                 rtm->rtm_src_len = 128;
         } else if (rtm->rtm_src_len &&
-                   nla_put_in6_addr(skb, RTA_SRC, &rt->fib6_src.addr))
+                   nla_put_in6_addr(skb, RTA_SRC, &rt6_src->addr))
                 goto nla_put_failure;
 #endif
         if (iif) {
 #ifdef CONFIG_IPV6_MROUTE
-                if (ipv6_addr_is_multicast(&rt->fib6_dst.addr)) {
+                if (ipv6_addr_is_multicast(&rt6_dst->addr)) {
                         int err = ip6mr_get_route(net, skb, rtm, portid);
 
                         if (err == 0)
@@ -4754,7 +4765,14 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
         /* For multipath routes, walk the siblings list and add
          * each as a nexthop within RTA_MULTIPATH.
          */
-        if (rt->fib6_nsiblings) {
+        if (rt6) {
+                if (rt6_flags & RTF_GATEWAY &&
+                    nla_put_in6_addr(skb, RTA_GATEWAY, &rt6->rt6i_gateway))
+                        goto nla_put_failure;
+
+                if (dst->dev && nla_put_u32(skb, RTA_OIF, dst->dev->ifindex))
+                        goto nla_put_failure;
+        } else if (rt->fib6_nsiblings) {
                 struct fib6_info *sibling, *next_sibling;
                 struct nlattr *mp;
 
@@ -4777,7 +4795,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
                         goto nla_put_failure;
         }
 
-        if (rt->fib6_flags & RTF_EXPIRES) {
+        if (rt6_flags & RTF_EXPIRES) {
                 expires = dst ? dst->expires : rt->expires;
                 expires -= jiffies;
         }
@@ -4785,7 +4803,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
         if (rtnl_put_cacheinfo(skb, dst, 0, expires, dst ? dst->error : 0) < 0)
                 goto nla_put_failure;
 
-        if (nla_put_u8(skb, RTA_PREF, IPV6_EXTRACT_PREF(rt->fib6_flags)))
+        if (nla_put_u8(skb, RTA_PREF, IPV6_EXTRACT_PREF(rt6_flags)))
                 goto nla_put_failure;
 
 
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 71709c104081..f61c306de1d0 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -771,13 +771,13 @@ config NETFILTER_XT_TARGET_CHECKSUM
         depends on NETFILTER_ADVANCED
         ---help---
           This option adds a `CHECKSUM' target, which can be used in the iptables mangle
-          table.
+          table to work around buggy DHCP clients in virtualized environments.
 
-          You can use this target to compute and fill in the checksum in
-          a packet that lacks a checksum.  This is particularly useful,
-          if you need to work around old applications such as dhcp clients,
-          that do not work well with checksum offloads, but don't want to disable
-          checksum offload in your device.
+          Some old DHCP clients drop packets because they are not aware
+          that the checksum would normally be offloaded to hardware and
+          thus should be considered valid.
+          This target can be used to fill in the checksum using iptables
+          when such packets are sent via a virtual network device.
 
           To compile it as a module, choose M here.  If unsure, say N.
 
diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index 9f14b0df6960..51c5d7eec0a3 100644
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -776,9 +776,26 @@ static const struct nf_hook_ops ipv6_conntrack_ops[] = {
 };
 #endif
 
+static int nf_ct_tcp_fixup(struct nf_conn *ct, void *_nfproto)
+{
+        u8 nfproto = (unsigned long)_nfproto;
+
+        if (nf_ct_l3num(ct) != nfproto)
+                return 0;
+
+        if (nf_ct_protonum(ct) == IPPROTO_TCP &&
+            ct->proto.tcp.state == TCP_CONNTRACK_ESTABLISHED) {
+                ct->proto.tcp.seen[0].td_maxwin = 0;
+                ct->proto.tcp.seen[1].td_maxwin = 0;
+        }
+
+        return 0;
+}
+
 static int nf_ct_netns_do_get(struct net *net, u8 nfproto)
 {
         struct nf_conntrack_net *cnet = net_generic(net, nf_conntrack_net_id);
+        bool fixup_needed = false;
         int err = 0;
 
         mutex_lock(&nf_ct_proto_mutex);
@@ -798,6 +815,8 @@ static int nf_ct_netns_do_get(struct net *net, u8 nfproto)
                                             ARRAY_SIZE(ipv4_conntrack_ops));
                 if (err)
                         cnet->users4 = 0;
+                else
+                        fixup_needed = true;
                 break;
 #if IS_ENABLED(CONFIG_IPV6)
         case NFPROTO_IPV6:
@@ -814,6 +833,8 @@ static int nf_ct_netns_do_get(struct net *net, u8 nfproto)
                                             ARRAY_SIZE(ipv6_conntrack_ops));
                 if (err)
                         cnet->users6 = 0;
+                else
+                        fixup_needed = true;
                 break;
 #endif
         default:
@@ -822,6 +843,11 @@ static int nf_ct_netns_do_get(struct net *net, u8 nfproto)
         }
  out_unlock:
         mutex_unlock(&nf_ct_proto_mutex);
+
+        if (fixup_needed)
+                nf_ct_iterate_cleanup_net(net, nf_ct_tcp_fixup,
+                                          (void *)(unsigned long)nfproto, 0, 0);
+
         return err;
 }
 
diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
index 8c58f96b59e7..f3f91ed2c21a 100644
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -675,7 +675,7 @@ static int nlattr_to_dccp(struct nlattr *cda[], struct nf_conn *ct)
 }
 #endif
 
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_cttimeout.h>
@@ -697,6 +697,8 @@ static int dccp_timeout_nlattr_to_obj(struct nlattr *tb[],
                         timeouts[i] = ntohl(nla_get_be32(tb[i])) * HZ;
                 }
         }
+
+        timeouts[CTA_TIMEOUT_DCCP_UNSPEC] = timeouts[CTA_TIMEOUT_DCCP_REQUEST];
         return 0;
 }
 
@@ -726,7 +728,7 @@ dccp_timeout_nla_policy[CTA_TIMEOUT_DCCP_MAX+1] = {
         [CTA_TIMEOUT_DCCP_CLOSING]      = { .type = NLA_U32 },
         [CTA_TIMEOUT_DCCP_TIMEWAIT]     = { .type = NLA_U32 },
 };
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 
 #ifdef CONFIG_SYSCTL
 /* template, data assigned later */
@@ -827,6 +829,11 @@ static int dccp_init_net(struct net *net, u_int16_t proto)
                 dn->dccp_timeout[CT_DCCP_CLOSEREQ]      = 64 * HZ;
                 dn->dccp_timeout[CT_DCCP_CLOSING]       = 64 * HZ;
                 dn->dccp_timeout[CT_DCCP_TIMEWAIT]      = 2 * DCCP_MSL;
+
+                /* timeouts[0] is unused, make it same as SYN_SENT so
+                 * ->timeouts[0] contains 'new' timeout, like udp or icmp.
+                 */
+                dn->dccp_timeout[CT_DCCP_NONE] = dn->dccp_timeout[CT_DCCP_REQUEST];
         }
 
         return dccp_kmemdup_sysctl_table(net, pn, dn);
@@ -856,7 +863,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp4 = {
         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = dccp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = dccp_timeout_obj_to_nlattr,
@@ -864,7 +871,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp4 = {
                 .obj_size       = sizeof(unsigned int) * CT_DCCP_MAX,
                 .nla_policy     = dccp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = dccp_init_net,
         .get_net_proto          = dccp_get_net_proto,
 };
@@ -889,7 +896,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp6 = {
         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = dccp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = dccp_timeout_obj_to_nlattr,
@@ -897,7 +904,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp6 = {
                 .obj_size       = sizeof(unsigned int) * CT_DCCP_MAX,
                 .nla_policy     = dccp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = dccp_init_net,
         .get_net_proto          = dccp_get_net_proto,
 };
diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
index ac4a0b296dcd..1df3244ecd07 100644
--- a/net/netfilter/nf_conntrack_proto_generic.c
+++ b/net/netfilter/nf_conntrack_proto_generic.c
@@ -70,7 +70,7 @@ static bool generic_new(struct nf_conn *ct, const struct sk_buff *skb,
         return ret;
 }
 
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_cttimeout.h>
@@ -113,7 +113,7 @@ static const struct nla_policy
 generic_timeout_nla_policy[CTA_TIMEOUT_GENERIC_MAX+1] = {
         [CTA_TIMEOUT_GENERIC_TIMEOUT]   = { .type = NLA_U32 },
 };
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 
 #ifdef CONFIG_SYSCTL
 static struct ctl_table generic_sysctl_table[] = {
@@ -164,7 +164,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic =
         .pkt_to_tuple           = generic_pkt_to_tuple,
         .packet                 = generic_packet,
         .new                    = generic_new,
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = generic_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = generic_timeout_obj_to_nlattr,
@@ -172,7 +172,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic =
                 .obj_size       = sizeof(unsigned int),
                 .nla_policy     = generic_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = generic_init_net,
         .get_net_proto          = generic_get_net_proto,
 };
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index d1632252bf5b..650eb4fba2c5 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -285,7 +285,7 @@ static void gre_destroy(struct nf_conn *ct)
                 nf_ct_gre_keymap_destroy(master);
 }
 
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_cttimeout.h>
@@ -334,7 +334,7 @@ gre_timeout_nla_policy[CTA_TIMEOUT_GRE_MAX+1] = {
         [CTA_TIMEOUT_GRE_UNREPLIED]     = { .type = NLA_U32 },
         [CTA_TIMEOUT_GRE_REPLIED]       = { .type = NLA_U32 },
 };
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 
 static int gre_init_net(struct net *net, u_int16_t proto)
 {
@@ -367,7 +367,7 @@ static const struct nf_conntrack_l4proto nf_conntrack_l4proto_gre4 = {
         .nlattr_to_tuple = nf_ct_port_nlattr_to_tuple,
         .nla_policy      = nf_ct_port_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout    = {
                 .nlattr_to_obj  = gre_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = gre_timeout_obj_to_nlattr,
@@ -375,7 +375,7 @@ static const struct nf_conntrack_l4proto nf_conntrack_l4proto_gre4 = {
                 .obj_size       = sizeof(unsigned int) * GRE_CT_MAX,
                 .nla_policy     = gre_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .net_id         = &proto_gre_net_id,
         .init_net       = gre_init_net,
 };
diff --git a/net/netfilter/nf_conntrack_proto_icmp.c b/net/netfilter/nf_conntrack_proto_icmp.c
index 036670b38282..43c7e1a217b9 100644
--- a/net/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/netfilter/nf_conntrack_proto_icmp.c
@@ -273,7 +273,7 @@ static unsigned int icmp_nlattr_tuple_size(void)
 }
 #endif
 
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_cttimeout.h>
@@ -313,7 +313,7 @@ static const struct nla_policy
 icmp_timeout_nla_policy[CTA_TIMEOUT_ICMP_MAX+1] = {
         [CTA_TIMEOUT_ICMP_TIMEOUT]      = { .type = NLA_U32 },
 };
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 
 #ifdef CONFIG_SYSCTL
 static struct ctl_table icmp_sysctl_table[] = {
@@ -374,7 +374,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp =
         .nlattr_to_tuple        = icmp_nlattr_to_tuple,
         .nla_policy             = icmp_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = icmp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = icmp_timeout_obj_to_nlattr,
@@ -382,7 +382,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp =
                 .obj_size       = sizeof(unsigned int),
                 .nla_policy     = icmp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = icmp_init_net,
         .get_net_proto          = icmp_get_net_proto,
 };
diff --git a/net/netfilter/nf_conntrack_proto_icmpv6.c b/net/netfilter/nf_conntrack_proto_icmpv6.c
index bed07b998a10..97e40f77d678 100644
--- a/net/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/netfilter/nf_conntrack_proto_icmpv6.c
@@ -274,7 +274,7 @@ static unsigned int icmpv6_nlattr_tuple_size(void)
 }
 #endif
 
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_cttimeout.h>
@@ -314,7 +314,7 @@ static const struct nla_policy
 icmpv6_timeout_nla_policy[CTA_TIMEOUT_ICMPV6_MAX+1] = {
         [CTA_TIMEOUT_ICMPV6_TIMEOUT]    = { .type = NLA_U32 },
 };
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 
 #ifdef CONFIG_SYSCTL
 static struct ctl_table icmpv6_sysctl_table[] = {
@@ -373,7 +373,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6 =
         .nlattr_to_tuple        = icmpv6_nlattr_to_tuple,
         .nla_policy             = icmpv6_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = icmpv6_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = icmpv6_timeout_obj_to_nlattr,
@@ -381,7 +381,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6 =
                 .obj_size       = sizeof(unsigned int),
                 .nla_policy     = icmpv6_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = icmpv6_init_net,
         .get_net_proto          = icmpv6_get_net_proto,
 };
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 8d1e085fc14a..e4d738d34cd0 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -591,7 +591,7 @@ static int nlattr_to_sctp(struct nlattr *cda[], struct nf_conn *ct)
 }
 #endif
 
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_cttimeout.h>
@@ -613,6 +613,8 @@ static int sctp_timeout_nlattr_to_obj(struct nlattr *tb[],
                         timeouts[i] = ntohl(nla_get_be32(tb[i])) * HZ;
                 }
         }
+
+        timeouts[CTA_TIMEOUT_SCTP_UNSPEC] = timeouts[CTA_TIMEOUT_SCTP_CLOSED];
         return 0;
 }
 
@@ -644,7 +646,7 @@ sctp_timeout_nla_policy[CTA_TIMEOUT_SCTP_MAX+1] = {
         [CTA_TIMEOUT_SCTP_HEARTBEAT_SENT]       = { .type = NLA_U32 },
         [CTA_TIMEOUT_SCTP_HEARTBEAT_ACKED]      = { .type = NLA_U32 },
 };
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 
 
 #ifdef CONFIG_SYSCTL
@@ -743,6 +745,11 @@ static int sctp_init_net(struct net *net, u_int16_t proto)
 
                 for (i = 0; i < SCTP_CONNTRACK_MAX; i++)
                         sn->timeouts[i] = sctp_timeouts[i];
+
+                /* timeouts[0] is unused, init it so ->timeouts[0] contains
+                 * 'new' timeout, like udp or icmp.
+                 */
+                sn->timeouts[0] = sctp_timeouts[SCTP_CONNTRACK_CLOSED];
         }
 
         return sctp_kmemdup_sysctl_table(pn, sn);
@@ -773,7 +780,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 = {
         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = sctp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = sctp_timeout_obj_to_nlattr,
@@ -781,7 +788,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 = {
                 .obj_size       = sizeof(unsigned int) * SCTP_CONNTRACK_MAX,
                 .nla_policy     = sctp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = sctp_init_net,
         .get_net_proto          = sctp_get_net_proto,
 };
@@ -806,7 +813,8 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 = {
         .nlattr_tuple_size      = nf_ct_port_nlattr_tuple_size,
         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
         .nla_policy             = nf_ct_port_nla_policy,
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#endif
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = sctp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = sctp_timeout_obj_to_nlattr,
@@ -814,8 +822,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 = {
                 .obj_size       = sizeof(unsigned int) * SCTP_CONNTRACK_MAX,
                 .nla_policy     = sctp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
-#endif
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = sctp_init_net,
         .get_net_proto          = sctp_get_net_proto,
 };
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index d80d322b9d8b..b4bdf9eda7b7 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -1279,7 +1279,7 @@ static unsigned int tcp_nlattr_tuple_size(void)
 }
 #endif
 
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_cttimeout.h>
@@ -1301,6 +1301,7 @@ static int tcp_timeout_nlattr_to_obj(struct nlattr *tb[],
                 timeouts[TCP_CONNTRACK_SYN_SENT] =
                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_SENT]))*HZ;
         }
+
         if (tb[CTA_TIMEOUT_TCP_SYN_RECV]) {
                 timeouts[TCP_CONNTRACK_SYN_RECV] =
                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_RECV]))*HZ;
@@ -1341,6 +1342,8 @@ static int tcp_timeout_nlattr_to_obj(struct nlattr *tb[],
                 timeouts[TCP_CONNTRACK_UNACK] =
                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_UNACK]))*HZ;
         }
+
+        timeouts[CTA_TIMEOUT_TCP_UNSPEC] = timeouts[CTA_TIMEOUT_TCP_SYN_SENT];
         return 0;
 }
 
@@ -1391,7 +1394,7 @@ static const struct nla_policy tcp_timeout_nla_policy[CTA_TIMEOUT_TCP_MAX+1] = {
         [CTA_TIMEOUT_TCP_RETRANS]       = { .type = NLA_U32 },
         [CTA_TIMEOUT_TCP_UNACK]         = { .type = NLA_U32 },
 };
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 
 #ifdef CONFIG_SYSCTL
 static struct ctl_table tcp_sysctl_table[] = {
@@ -1518,6 +1521,10 @@ static int tcp_init_net(struct net *net, u_int16_t proto)
                 for (i = 0; i < TCP_CONNTRACK_TIMEOUT_MAX; i++)
                         tn->timeouts[i] = tcp_timeouts[i];
 
+                /* timeouts[0] is unused, make it same as SYN_SENT so
+                 * ->timeouts[0] contains 'new' timeout, like udp or icmp.
+                 */
+                tn->timeouts[0] = tcp_timeouts[TCP_CONNTRACK_SYN_SENT];
                 tn->tcp_loose = nf_ct_tcp_loose;
                 tn->tcp_be_liberal = nf_ct_tcp_be_liberal;
                 tn->tcp_max_retrans = nf_ct_tcp_max_retrans;
@@ -1551,7 +1558,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 =
         .nlattr_size            = TCP_NLATTR_SIZE,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = tcp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = tcp_timeout_obj_to_nlattr,
@@ -1560,7 +1567,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 =
                                         TCP_CONNTRACK_TIMEOUT_MAX,
                 .nla_policy     = tcp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = tcp_init_net,
         .get_net_proto          = tcp_get_net_proto,
 };
@@ -1586,7 +1593,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6 =
         .nlattr_tuple_size      = tcp_nlattr_tuple_size,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = tcp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = tcp_timeout_obj_to_nlattr,
@@ -1595,7 +1602,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6 =
                                         TCP_CONNTRACK_TIMEOUT_MAX,
                 .nla_policy     = tcp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = tcp_init_net,
         .get_net_proto          = tcp_get_net_proto,
 };
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index 7a1b8988a931..3065fb8ef91b 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -171,7 +171,7 @@ static int udp_error(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
         return NF_ACCEPT;
 }
 
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_cttimeout.h>
@@ -221,7 +221,7 @@ udp_timeout_nla_policy[CTA_TIMEOUT_UDP_MAX+1] = {
        [CTA_TIMEOUT_UDP_UNREPLIED]      = { .type = NLA_U32 },
        [CTA_TIMEOUT_UDP_REPLIED]        = { .type = NLA_U32 },
 };
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 
 #ifdef CONFIG_SYSCTL
 static struct ctl_table udp_sysctl_table[] = {
@@ -292,7 +292,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_udp4 =
         .nlattr_tuple_size      = nf_ct_port_nlattr_tuple_size,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = udp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = udp_timeout_obj_to_nlattr,
@@ -300,7 +300,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_udp4 =
                 .obj_size       = sizeof(unsigned int) * CTA_TIMEOUT_UDP_MAX,
                 .nla_policy     = udp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = udp_init_net,
         .get_net_proto          = udp_get_net_proto,
 };
@@ -321,7 +321,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite4 =
         .nlattr_tuple_size      = nf_ct_port_nlattr_tuple_size,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = udp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = udp_timeout_obj_to_nlattr,
@@ -329,7 +329,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite4 =
                 .obj_size       = sizeof(unsigned int) * CTA_TIMEOUT_UDP_MAX,
                 .nla_policy     = udp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = udp_init_net,
         .get_net_proto          = udp_get_net_proto,
 };
@@ -350,7 +350,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_udp6 =
         .nlattr_tuple_size      = nf_ct_port_nlattr_tuple_size,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = udp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = udp_timeout_obj_to_nlattr,
@@ -358,7 +358,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_udp6 =
                 .obj_size       = sizeof(unsigned int) * CTA_TIMEOUT_UDP_MAX,
                 .nla_policy     = udp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = udp_init_net,
         .get_net_proto          = udp_get_net_proto,
 };
@@ -379,7 +379,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite6 =
         .nlattr_tuple_size      = nf_ct_port_nlattr_tuple_size,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = udp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = udp_timeout_obj_to_nlattr,
@@ -387,10 +387,9 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite6 =
                 .obj_size       = sizeof(unsigned int) * CTA_TIMEOUT_UDP_MAX,
                 .nla_policy     = udp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = udp_init_net,
         .get_net_proto          = udp_get_net_proto,
 };
 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_udplite6);
 #endif
-#include <net/netfilter/nf_conntrack_timeout.h>
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 1dca5683f59f..2cfb173cd0b2 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4637,6 +4637,7 @@ static int nft_flush_set(const struct nft_ctx *ctx,
         }
         set->ndeact++;
 
+        nft_set_elem_deactivate(ctx->net, set, elem);
         nft_trans_elem_set(trans) = set;
         nft_trans_elem(trans) = *elem;
         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index d46a236cdf31..a30f8ba4b89a 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -489,8 +489,8 @@ err:
         return err;
 }
 
-static struct ctnl_timeout *
-ctnl_timeout_find_get(struct net *net, const char *name)
+static struct nf_ct_timeout *ctnl_timeout_find_get(struct net *net,
+                                                   const char *name)
 {
         struct ctnl_timeout *timeout, *matching = NULL;
 
@@ -509,7 +509,7 @@ ctnl_timeout_find_get(struct net *net, const char *name)
                 break;
         }
 err:
-        return matching;
+        return matching ? &matching->timeout : NULL;
 }
 
 static void ctnl_timeout_put(struct nf_ct_timeout *t)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index ea4ba551abb2..d33094f4ec41 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -233,6 +233,7 @@ static void nfqnl_reinject(struct nf_queue_entry *entry, unsigned int verdict)
         int err;
 
         if (verdict == NF_ACCEPT ||
+            verdict == NF_REPEAT ||
             verdict == NF_STOP) {
                 rcu_read_lock();
                 ct_hook = rcu_dereference(nf_ct_hook);
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 26a8baebd072..5dd87748afa8 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -799,7 +799,7 @@ err:
 }
 
 struct nft_ct_timeout_obj {
-        struct nf_conn          *tmpl;
+        struct nf_ct_timeout    *timeout;
         u8                      l4proto;
 };
 
@@ -809,26 +809,42 @@ static void nft_ct_timeout_obj_eval(struct nft_object *obj,
 {
         const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
         struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
-        struct sk_buff *skb = pkt->skb;
+        struct nf_conn_timeout *timeout;
+        const unsigned int *values;
+
+        if (priv->l4proto != pkt->tprot)
+                return;
 
-        if (ct ||
-            priv->l4proto != pkt->tprot)
+        if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
                 return;
 
-        nf_ct_set(skb, priv->tmpl, IP_CT_NEW);
+        timeout = nf_ct_timeout_find(ct);
+        if (!timeout) {
+                timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
+                if (!timeout) {
+                        regs->verdict.code = NF_DROP;
+                        return;
+                }
+        }
+
+        rcu_assign_pointer(timeout->timeout, priv->timeout);
+
+        /* adjust the timeout as per 'new' state. ct is unconfirmed,
+         * so the current timestamp must not be added.
+         */
+        values = nf_ct_timeout_data(timeout);
+        if (values)
+                nf_ct_refresh(ct, pkt->skb, values[0]);
 }
 
 static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
                                    const struct nlattr * const tb[],
                                    struct nft_object *obj)
 {
-        const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
         struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
         const struct nf_conntrack_l4proto *l4proto;
-        struct nf_conn_timeout *timeout_ext;
         struct nf_ct_timeout *timeout;
         int l3num = ctx->family;
-        struct nf_conn *tmpl;
         __u8 l4num;
         int ret;
 
@@ -863,28 +879,14 @@ static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
 
         timeout->l3num = l3num;
         timeout->l4proto = l4proto;
-        tmpl = nf_ct_tmpl_alloc(ctx->net, zone, GFP_ATOMIC);
-        if (!tmpl) {
-                ret = -ENOMEM;
-                goto err_free_timeout;
-        }
-
-        timeout_ext = nf_ct_timeout_ext_add(tmpl, timeout, GFP_ATOMIC);
-        if (!timeout_ext) {
-                ret = -ENOMEM;
-                goto err_free_tmpl;
-        }
 
         ret = nf_ct_netns_get(ctx->net, ctx->family);
         if (ret < 0)
-                goto err_free_tmpl;
-
-        priv->tmpl = tmpl;
+                goto err_free_timeout;
 
+        priv->timeout = timeout;
         return 0;
 
-err_free_tmpl:
-        nf_ct_tmpl_free(tmpl);
 err_free_timeout:
         kfree(timeout);
 err_proto_put:
@@ -896,22 +898,19 @@ static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
                                        struct nft_object *obj)
 {
         struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
-        struct nf_conn_timeout *t = nf_ct_timeout_find(priv->tmpl);
-        struct nf_ct_timeout *timeout;
+        struct nf_ct_timeout *timeout = priv->timeout;
 
-        timeout = rcu_dereference_raw(t->timeout);
         nf_ct_untimeout(ctx->net, timeout);
         nf_ct_l4proto_put(timeout->l4proto);
         nf_ct_netns_put(ctx->net, ctx->family);
-        nf_ct_tmpl_free(priv->tmpl);
+        kfree(priv->timeout);
 }
 
 static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
                                    struct nft_object *obj, bool reset)
 {
         const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
-        const struct nf_conn_timeout *t = nf_ct_timeout_find(priv->tmpl);
-        const struct nf_ct_timeout *timeout = rcu_dereference_raw(t->timeout);
+        const struct nf_ct_timeout *timeout = priv->timeout;
         struct nlattr *nest_params;
         int ret;
 
diff --git a/net/netfilter/xt_CHECKSUM.c b/net/netfilter/xt_CHECKSUM.c
index 9f4151ec3e06..6c7aa6a0a0d2 100644
--- a/net/netfilter/xt_CHECKSUM.c
+++ b/net/netfilter/xt_CHECKSUM.c
@@ -16,6 +16,9 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/xt_CHECKSUM.h>
 
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
+
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Michael S. Tsirkin <mst@redhat.com>");
 MODULE_DESCRIPTION("Xtables: checksum modification");
@@ -25,7 +28,7 @@ MODULE_ALIAS("ip6t_CHECKSUM");
 static unsigned int
 checksum_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
-        if (skb->ip_summed == CHECKSUM_PARTIAL)
+        if (skb->ip_summed == CHECKSUM_PARTIAL && !skb_is_gso(skb))
                 skb_checksum_help(skb);
 
         return XT_CONTINUE;
@@ -34,6 +37,8 @@ checksum_tg(struct sk_buff *skb, const struct xt_action_param *par)
 static int checksum_tg_check(const struct xt_tgchk_param *par)
 {
         const struct xt_CHECKSUM_info *einfo = par->targinfo;
+        const struct ip6t_ip6 *i6 = par->entryinfo;
+        const struct ipt_ip *i4 = par->entryinfo;
 
         if (einfo->operation & ~XT_CHECKSUM_OP_FILL) {
                 pr_info_ratelimited("unsupported CHECKSUM operation %x\n",
@@ -43,6 +48,21 @@ static int checksum_tg_check(const struct xt_tgchk_param *par)
         if (!einfo->operation)
                 return -EINVAL;
 
+        switch (par->family) {
+        case NFPROTO_IPV4:
+                if (i4->proto == IPPROTO_UDP &&
+                    (i4->invflags & XT_INV_PROTO) == 0)
+                        return 0;
+                break;
+        case NFPROTO_IPV6:
+                if ((i6->flags & IP6T_F_PROTO) &&
+                    i6->proto == IPPROTO_UDP &&
+                    (i6->invflags & XT_INV_PROTO) == 0)
+                        return 0;
+                break;
+        }
+
+        pr_warn_once("CHECKSUM should be avoided.  If really needed, restrict with \"-p udp\" and only use in OUTPUT\n");
         return 0;
 }
 
diff --git a/net/netfilter/xt_cluster.c b/net/netfilter/xt_cluster.c
index dfbdbb2fc0ed..51d0c257e7a5 100644
--- a/net/netfilter/xt_cluster.c
+++ b/net/netfilter/xt_cluster.c
@@ -125,6 +125,7 @@ xt_cluster_mt(const struct sk_buff *skb, struct xt_action_param *par)
 static int xt_cluster_mt_checkentry(const struct xt_mtchk_param *par)
 {
         struct xt_cluster_match_info *info = par->matchinfo;
+        int ret;
 
         if (info->total_nodes > XT_CLUSTER_NODES_MAX) {
                 pr_info_ratelimited("you have exceeded the maximum number of cluster nodes (%u > %u)\n",
@@ -135,7 +136,17 @@ static int xt_cluster_mt_checkentry(const struct xt_mtchk_param *par)
                 pr_info_ratelimited("node mask cannot exceed total number of nodes\n");
                 return -EDOM;
         }
-        return 0;
+
+        ret = nf_ct_netns_get(par->net, par->family);
+        if (ret < 0)
+                pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
+                                    par->family);
+        return ret;
+}
+
+static void xt_cluster_mt_destroy(const struct xt_mtdtor_param *par)
+{
+        nf_ct_netns_put(par->net, par->family);
 }
 
 static struct xt_match xt_cluster_match __read_mostly = {
@@ -144,6 +155,7 @@ static struct xt_match xt_cluster_match __read_mostly = {
         .match          = xt_cluster_mt,
         .checkentry     = xt_cluster_mt_checkentry,
         .matchsize      = sizeof(struct xt_cluster_match_info),
+        .destroy        = xt_cluster_mt_destroy,
         .me             = THIS_MODULE,
 };
 
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 9b16402f29af..3e7d259e5d8d 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -1057,7 +1057,7 @@ static struct xt_match hashlimit_mt_reg[] __read_mostly = {
 static void *dl_seq_start(struct seq_file *s, loff_t *pos)
         __acquires(htable->lock)
 {
-        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->private));
+        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->file));
         unsigned int *bucket;
 
         spin_lock_bh(&htable->lock);
@@ -1074,7 +1074,7 @@ static void *dl_seq_start(struct seq_file *s, loff_t *pos)
 
 static void *dl_seq_next(struct seq_file *s, void *v, loff_t *pos)
 {
-        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->private));
+        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->file));
         unsigned int *bucket = v;
 
         *pos = ++(*bucket);
@@ -1088,7 +1088,7 @@ static void *dl_seq_next(struct seq_file *s, void *v, loff_t *pos)
 static void dl_seq_stop(struct seq_file *s, void *v)
         __releases(htable->lock)
 {
-        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->private));
+        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->file));
         unsigned int *bucket = v;
 
         if (!IS_ERR(bucket))
@@ -1130,7 +1130,7 @@ static void dl_seq_print(struct dsthash_ent *ent, u_int8_t family,
 static int dl_seq_real_show_v2(struct dsthash_ent *ent, u_int8_t family,
                                struct seq_file *s)
 {
-        struct xt_hashlimit_htable *ht = PDE_DATA(file_inode(s->private));
+        struct xt_hashlimit_htable *ht = PDE_DATA(file_inode(s->file));
 
         spin_lock(&ent->lock);
         /* recalculate to show accurate numbers */
@@ -1145,7 +1145,7 @@ static int dl_seq_real_show_v2(struct dsthash_ent *ent, u_int8_t family,
 static int dl_seq_real_show_v1(struct dsthash_ent *ent, u_int8_t family,
                                struct seq_file *s)
 {
-        struct xt_hashlimit_htable *ht = PDE_DATA(file_inode(s->private));
+        struct xt_hashlimit_htable *ht = PDE_DATA(file_inode(s->file));
 
         spin_lock(&ent->lock);
         /* recalculate to show accurate numbers */
@@ -1160,7 +1160,7 @@ static int dl_seq_real_show_v1(struct dsthash_ent *ent, u_int8_t family,
 static int dl_seq_real_show(struct dsthash_ent *ent, u_int8_t family,
                             struct seq_file *s)
 {
-        struct xt_hashlimit_htable *ht = PDE_DATA(file_inode(s->private));
+        struct xt_hashlimit_htable *ht = PDE_DATA(file_inode(s->file));
 
         spin_lock(&ent->lock);
         /* recalculate to show accurate numbers */
@@ -1174,7 +1174,7 @@ static int dl_seq_real_show(struct dsthash_ent *ent, u_int8_t family,
 
 static int dl_seq_show_v2(struct seq_file *s, void *v)
 {
-        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->private));
+        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->file));
         unsigned int *bucket = (unsigned int *)v;
         struct dsthash_ent *ent;
 
@@ -1188,7 +1188,7 @@ static int dl_seq_show_v2(struct seq_file *s, void *v)
 
 static int dl_seq_show_v1(struct seq_file *s, void *v)
 {
-        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->private));
+        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->file));
         unsigned int *bucket = v;
         struct dsthash_ent *ent;
 
@@ -1202,7 +1202,7 @@ static int dl_seq_show_v1(struct seq_file *s, void *v)
 
 static int dl_seq_show(struct seq_file *s, void *v)
 {
-        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->private));
+        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->file));
         unsigned int *bucket = v;
         struct dsthash_ent *ent;
 
diff --git a/net/rds/bind.c b/net/rds/bind.c
index 3ab55784b637..762d2c6788a3 100644
--- a/net/rds/bind.c
+++ b/net/rds/bind.c
@@ -76,11 +76,13 @@ struct rds_sock *rds_find_bound(const struct in6_addr *addr, __be16 port,
         struct rds_sock *rs;
 
         __rds_create_bind_key(key, addr, port, scope_id);
-        rs = rhashtable_lookup_fast(&bind_hash_table, key, ht_parms);
+        rcu_read_lock();
+        rs = rhashtable_lookup(&bind_hash_table, key, ht_parms);
         if (rs && !sock_flag(rds_rs_to_sk(rs), SOCK_DEAD))
                 rds_sock_addref(rs);
         else
                 rs = NULL;
+        rcu_read_unlock();
 
         rdsdebug("returning rs %p for %pI6c:%u\n", rs, addr,
                  ntohs(port));
@@ -235,6 +237,7 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 goto out;
         }
 
+        sock_set_flag(sk, SOCK_RCU_FREE);
         ret = rds_add_bound(rs, binding_addr, &port, scope_id);
         if (ret)
                 goto out;
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 1a67af8a6e8c..0a75cb2e5e7b 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -1902,6 +1902,8 @@ replay:
                                 RTM_NEWCHAIN, false);
                 break;
         case RTM_DELCHAIN:
+                tfilter_notify_chain(net, skb, block, q, parent, n,
+                                     chain, RTM_DELTFILTER);
                 /* Flush the chain first as the user requested chain removal. */
                 tcf_chain_flush(chain);
                 /* In case the chain was successfully deleted, put a reference
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 82f665728382..6376467e78f8 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -185,7 +185,10 @@ static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
                 return -ENOMEM;
 
         buf->sk = msg->dst_sk;
-        __tipc_dump_start(&cb, msg->net);
+        if (__tipc_dump_start(&cb, msg->net)) {
+                kfree_skb(buf);
+                return -ENOMEM;
+        }
 
         do {
                 int rem;
diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
index 292742e50bfa..961b07d4d41c 100644
--- a/net/tls/tls_device.c
+++ b/net/tls/tls_device.c
@@ -686,7 +686,7 @@ int tls_set_device_offload(struct sock *sk, struct tls_context *ctx)
                 goto free_marker_record;
         }
 
-        crypto_info = &ctx->crypto_send;
+        crypto_info = &ctx->crypto_send.info;
         switch (crypto_info->cipher_type) {
         case TLS_CIPHER_AES_GCM_128:
                 nonce_size = TLS_CIPHER_AES_GCM_128_IV_SIZE;
@@ -780,7 +780,7 @@ int tls_set_device_offload(struct sock *sk, struct tls_context *ctx)
 
         ctx->priv_ctx_tx = offload_ctx;
         rc = netdev->tlsdev_ops->tls_dev_add(netdev, sk, TLS_OFFLOAD_CTX_DIR_TX,
-                                             &ctx->crypto_send,
+                                             &ctx->crypto_send.info,
                                              tcp_sk(sk)->write_seq);
         if (rc)
                 goto release_netdev;
@@ -862,7 +862,7 @@ int tls_set_device_offload_rx(struct sock *sk, struct tls_context *ctx)
                 goto release_ctx;
 
         rc = netdev->tlsdev_ops->tls_dev_add(netdev, sk, TLS_OFFLOAD_CTX_DIR_RX,
-                                             &ctx->crypto_recv,
+                                             &ctx->crypto_recv.info,
                                              tcp_sk(sk)->copied_seq);
         if (rc) {
                 pr_err_ratelimited("%s: The netdev has refused to offload this socket\n",
diff --git a/net/tls/tls_device_fallback.c b/net/tls/tls_device_fallback.c
index 6102169239d1..450a6dbc5a88 100644
--- a/net/tls/tls_device_fallback.c
+++ b/net/tls/tls_device_fallback.c
@@ -320,7 +320,7 @@ static struct sk_buff *tls_enc_skb(struct tls_context *tls_ctx,
                 goto free_req;
 
         iv = buf;
-        memcpy(iv, tls_ctx->crypto_send_aes_gcm_128.salt,
+        memcpy(iv, tls_ctx->crypto_send.aes_gcm_128.salt,
                TLS_CIPHER_AES_GCM_128_SALT_SIZE);
         aad = buf + TLS_CIPHER_AES_GCM_128_SALT_SIZE +
               TLS_CIPHER_AES_GCM_128_IV_SIZE;
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 180b6640e531..523622dc74f8 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -241,6 +241,16 @@ static void tls_write_space(struct sock *sk)
         ctx->sk_write_space(sk);
 }
 
+static void tls_ctx_free(struct tls_context *ctx)
+{
+        if (!ctx)
+                return;
+
+        memzero_explicit(&ctx->crypto_send, sizeof(ctx->crypto_send));
+        memzero_explicit(&ctx->crypto_recv, sizeof(ctx->crypto_recv));
+        kfree(ctx);
+}
+
 static void tls_sk_proto_close(struct sock *sk, long timeout)
 {
         struct tls_context *ctx = tls_get_ctx(sk);
@@ -294,7 +304,7 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
 #else
         {
 #endif
-                kfree(ctx);
+                tls_ctx_free(ctx);
                 ctx = NULL;
         }
 
@@ -305,7 +315,7 @@ skip_tx_cleanup:
          * for sk->sk_prot->unhash [tls_hw_unhash]
          */
         if (free_ctx)
-                kfree(ctx);
+                tls_ctx_free(ctx);
 }
 
 static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
@@ -330,7 +340,7 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
         }
 
         /* get user crypto info */
-        crypto_info = &ctx->crypto_send;
+        crypto_info = &ctx->crypto_send.info;
 
         if (!TLS_CRYPTO_INFO_READY(crypto_info)) {
                 rc = -EBUSY;
@@ -417,9 +427,9 @@ static int do_tls_setsockopt_conf(struct sock *sk, char __user *optval,
         }
 
         if (tx)
-                crypto_info = &ctx->crypto_send;
+                crypto_info = &ctx->crypto_send.info;
         else
-                crypto_info = &ctx->crypto_recv;
+                crypto_info = &ctx->crypto_recv.info;
 
         /* Currently we don't support set crypto info more than one time */
         if (TLS_CRYPTO_INFO_READY(crypto_info)) {
@@ -499,7 +509,7 @@ static int do_tls_setsockopt_conf(struct sock *sk, char __user *optval,
         goto out;
 
 err_crypto_info:
-        memset(crypto_info, 0, sizeof(*crypto_info));
+        memzero_explicit(crypto_info, sizeof(union tls_crypto_context));
 out:
         return rc;
 }
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index e28a6ff25d96..9e918489f4fb 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -1055,8 +1055,8 @@ static int tls_read_size(struct strparser *strp, struct sk_buff *skb)
                 goto read_failure;
         }
 
-        if (header[1] != TLS_VERSION_MINOR(tls_ctx->crypto_recv.version) ||
-            header[2] != TLS_VERSION_MAJOR(tls_ctx->crypto_recv.version)) {
+        if (header[1] != TLS_VERSION_MINOR(tls_ctx->crypto_recv.info.version) ||
+            header[2] != TLS_VERSION_MAJOR(tls_ctx->crypto_recv.info.version)) {
                 ret = -EINVAL;
                 goto read_failure;
         }
@@ -1136,7 +1136,6 @@ void tls_sw_free_resources_rx(struct sock *sk)
 
 int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx)
 {
-        char keyval[TLS_CIPHER_AES_GCM_128_KEY_SIZE];
         struct tls_crypto_info *crypto_info;
         struct tls12_crypto_info_aes_gcm_128 *gcm_128_info;
         struct tls_sw_context_tx *sw_ctx_tx = NULL;
@@ -1181,12 +1180,12 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx)
 
         if (tx) {
                 crypto_init_wait(&sw_ctx_tx->async_wait);
-                crypto_info = &ctx->crypto_send;
+                crypto_info = &ctx->crypto_send.info;
                 cctx = &ctx->tx;
                 aead = &sw_ctx_tx->aead_send;
         } else {
                 crypto_init_wait(&sw_ctx_rx->async_wait);
-                crypto_info = &ctx->crypto_recv;
+                crypto_info = &ctx->crypto_recv.info;
                 cctx = &ctx->rx;
                 aead = &sw_ctx_rx->aead_recv;
         }
@@ -1265,9 +1264,7 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx)
 
         ctx->push_pending_record = tls_sw_push_pending_record;
 
-        memcpy(keyval, gcm_128_info->key, TLS_CIPHER_AES_GCM_128_KEY_SIZE);
-
-        rc = crypto_aead_setkey(*aead, keyval,
+        rc = crypto_aead_setkey(*aead, gcm_128_info->key,
                                 TLS_CIPHER_AES_GCM_128_KEY_SIZE);
         if (rc)
                 goto free_aead;
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 5219280bf7ff..161b0224d6ae 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -380,6 +380,7 @@ our $Attribute	= qr{
                         __noclone|
                         __deprecated|
                         __read_mostly|
+                        __ro_after_init|
                         __kprobes|
                         $InitAttribute|
                         ____cacheline_aligned|
@@ -3311,7 +3312,7 @@ sub process {
                         # known declaration macros
                       $sline =~ /^\+\s+$declaration_macros/ ||
                         # start of struct or union or enum
-                      $sline =~ /^\+\s+(?:union|struct|enum|typedef)\b/ ||
+                      $sline =~ /^\+\s+(?:static\s+)?(?:const\s+)?(?:union|struct|enum|typedef)\b/ ||
                         # start or end of block or continuation of declaration
                       $sline =~ /^\+\s+(?:$|[\{\}\.\#\"\?\:\(\[])/ ||
                         # bitfield continuation
diff --git a/scripts/depmod.sh b/scripts/depmod.sh
index 999d585eaa73..e083bcae343f 100755
--- a/scripts/depmod.sh
+++ b/scripts/depmod.sh
@@ -11,13 +11,14 @@ DEPMOD=$1
 KERNELRELEASE=$2
 
 if ! test -r System.map ; then
+        echo "Warning: modules_install: missing 'System.map' file. Skipping depmod." >&2
         exit 0
 fi
 
 if [ -z $(command -v $DEPMOD) ]; then
-        echo "'make modules_install' requires $DEPMOD. Please install it." >&2
+        echo "Warning: 'make modules_install' requires $DEPMOD. Please install it." >&2
         echo "This is probably in the kmod package." >&2
-        exit 1
+        exit 0
 fi
 
 # older versions of depmod require the version string to start with three
diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
index 4a7bd2192073..67ed9f6ccdf8 100644
--- a/scripts/kconfig/Makefile
+++ b/scripts/kconfig/Makefile
@@ -221,7 +221,6 @@ $(obj)/zconf.tab.o: $(obj)/zconf.lex.c
 
 # check if necessary packages are available, and configure build flags
 define filechk_conf_cfg
-        $(CONFIG_SHELL) $(srctree)/scripts/kconfig/check-pkgconfig.sh; \
         $(CONFIG_SHELL) $<
 endef
 
diff --git a/scripts/kconfig/check-pkgconfig.sh b/scripts/kconfig/check-pkgconfig.sh
deleted file mode 100644
index 7a1c40bfb58c..000000000000
--- a/scripts/kconfig/check-pkgconfig.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/bin/sh
-# SPDX-License-Identifier: GPL-2.0
-# Check for pkg-config presence
-
-if [ -z $(command -v pkg-config) ]; then
-        echo "'make *config' requires 'pkg-config'. Please install it." 1>&2
-        exit 1
-fi
diff --git a/scripts/kconfig/gconf-cfg.sh b/scripts/kconfig/gconf-cfg.sh
index 533b3d8f8f08..480ecd8b9f41 100755
--- a/scripts/kconfig/gconf-cfg.sh
+++ b/scripts/kconfig/gconf-cfg.sh
@@ -3,6 +3,13 @@
 
 PKG="gtk+-2.0 gmodule-2.0 libglade-2.0"
 
+if [ -z "$(command -v pkg-config)" ]; then
+        echo >&2 "*"
+        echo >&2 "* 'make gconfig' requires 'pkg-config'. Please install it."
+        echo >&2 "*"
+        exit 1
+fi
+
 if ! pkg-config --exists $PKG; then
         echo >&2 "*"
         echo >&2 "* Unable to find the GTK+ installation. Please make sure that"
diff --git a/scripts/kconfig/mconf-cfg.sh b/scripts/kconfig/mconf-cfg.sh
index e6f9facd0077..c812872d7f9d 100755
--- a/scripts/kconfig/mconf-cfg.sh
+++ b/scripts/kconfig/mconf-cfg.sh
@@ -4,20 +4,23 @@
 PKG="ncursesw"
 PKG2="ncurses"
 
-if pkg-config --exists $PKG; then
-        echo cflags=\"$(pkg-config --cflags $PKG)\"
-        echo libs=\"$(pkg-config --libs $PKG)\"
-        exit 0
-fi
+if [ -n "$(command -v pkg-config)" ]; then
+        if pkg-config --exists $PKG; then
+                echo cflags=\"$(pkg-config --cflags $PKG)\"
+                echo libs=\"$(pkg-config --libs $PKG)\"
+                exit 0
+        fi
 
-if pkg-config --exists $PKG2; then
-        echo cflags=\"$(pkg-config --cflags $PKG2)\"
-        echo libs=\"$(pkg-config --libs $PKG2)\"
-        exit 0
+        if pkg-config --exists $PKG2; then
+                echo cflags=\"$(pkg-config --cflags $PKG2)\"
+                echo libs=\"$(pkg-config --libs $PKG2)\"
+                exit 0
+        fi
 fi
 
-# Unfortunately, some distributions (e.g. openSUSE) cannot find ncurses
-# by pkg-config.
+# Check the default paths in case pkg-config is not installed.
+# (Even if it is installed, some distributions such as openSUSE cannot
+# find ncurses by pkg-config.)
 if [ -f /usr/include/ncursesw/ncurses.h ]; then
         echo cflags=\"-D_GNU_SOURCE -I/usr/include/ncursesw\"
         echo libs=\"-lncursesw\"
diff --git a/scripts/kconfig/mconf.c b/scripts/kconfig/mconf.c
index 83b5836615fb..143c05fec161 100644
--- a/scripts/kconfig/mconf.c
+++ b/scripts/kconfig/mconf.c
@@ -490,7 +490,6 @@ static void build_conf(struct menu *menu)
                         switch (prop->type) {
                         case P_MENU:
                                 child_count++;
-                                prompt = prompt;
                                 if (single_menu_mode) {
                                         item_make("%s%*c%s",
                                                   menu->data ? "-->" : "++>",
diff --git a/scripts/kconfig/nconf-cfg.sh b/scripts/kconfig/nconf-cfg.sh
index 42f5ac73548e..001559ef0a60 100644
--- a/scripts/kconfig/nconf-cfg.sh
+++ b/scripts/kconfig/nconf-cfg.sh
@@ -4,20 +4,23 @@
 PKG="ncursesw menuw panelw"
 PKG2="ncurses menu panel"
 
-if pkg-config --exists $PKG; then
-        echo cflags=\"$(pkg-config --cflags $PKG)\"
-        echo libs=\"$(pkg-config --libs $PKG)\"
-        exit 0
-fi
+if [ -n "$(command -v pkg-config)" ]; then
+        if pkg-config --exists $PKG; then
+                echo cflags=\"$(pkg-config --cflags $PKG)\"
+                echo libs=\"$(pkg-config --libs $PKG)\"
+                exit 0
+        fi
 
-if pkg-config --exists $PKG2; then
-        echo cflags=\"$(pkg-config --cflags $PKG2)\"
-        echo libs=\"$(pkg-config --libs $PKG2)\"
-        exit 0
+        if pkg-config --exists $PKG2; then
+                echo cflags=\"$(pkg-config --cflags $PKG2)\"
+                echo libs=\"$(pkg-config --libs $PKG2)\"
+                exit 0
+        fi
 fi
 
-# Unfortunately, some distributions (e.g. openSUSE) cannot find ncurses
-# by pkg-config.
+# Check the default paths in case pkg-config is not installed.
+# (Even if it is installed, some distributions such as openSUSE cannot
+# find ncurses by pkg-config.)
 if [ -f /usr/include/ncursesw/ncurses.h ]; then
         echo cflags=\"-D_GNU_SOURCE -I/usr/include/ncursesw\"
         echo libs=\"-lncursesw -lmenuw -lpanelw\"
diff --git a/scripts/kconfig/qconf-cfg.sh b/scripts/kconfig/qconf-cfg.sh
index 0862e1562536..02ccc0ae1031 100755
--- a/scripts/kconfig/qconf-cfg.sh
+++ b/scripts/kconfig/qconf-cfg.sh
@@ -4,6 +4,13 @@
 PKG="Qt5Core Qt5Gui Qt5Widgets"
 PKG2="QtCore QtGui"
 
+if [ -z "$(command -v pkg-config)" ]; then
+        echo >&2 "*"
+        echo >&2 "* 'make xconfig' requires 'pkg-config'. Please install it."
+        echo >&2 "*"
+        exit 1
+fi
+
 if pkg-config --exists $PKG; then
         echo cflags=\"-std=c++11 -fPIC $(pkg-config --cflags Qt5Core Qt5Gui Qt5Widgets)\"
         echo libs=\"$(pkg-config --libs $PKG)\"
diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
index fe06e77c15eb..f599031260d5 100755
--- a/scripts/recordmcount.pl
+++ b/scripts/recordmcount.pl
@@ -389,6 +389,9 @@ if ($arch eq "x86_64") {
     $mcount_regex = "^\\s*([0-9a-fA-F]+):\\sR_RISCV_CALL\\s_mcount\$";
     $type = ".quad";
     $alignment = 2;
+} elsif ($arch eq "nds32") {
+    $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*R_NDS32_HI20_RELA\\s+_mcount\$";
+    $alignment = 2;
 } else {
     die "Arch $arch is not supported with CONFIG_FTRACE_MCOUNT_RECORD";
 }
diff --git a/scripts/setlocalversion b/scripts/setlocalversion
index 71f39410691b..79f7dd57d571 100755
--- a/scripts/setlocalversion
+++ b/scripts/setlocalversion
@@ -74,7 +74,7 @@ scm_version()
                 fi
 
                 # Check for uncommitted changes
-                if git diff-index --name-only HEAD | grep -qv "^scripts/package"; then
+                if git status -uno --porcelain | grep -qv '^.. scripts/package'; then
                         printf '%s' -dirty
                 fi
 
diff --git a/security/apparmor/secid.c b/security/apparmor/secid.c
index f2f22d00db18..4ccec1bcf6f5 100644
--- a/security/apparmor/secid.c
+++ b/security/apparmor/secid.c
@@ -79,7 +79,6 @@ int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
         struct aa_label *label = aa_secid_to_label(secid);
         int len;
 
-        AA_BUG(!secdata);
         AA_BUG(!seclen);
 
         if (!label)
diff --git a/security/keys/dh.c b/security/keys/dh.c
index 711e89d8c415..3b602a1e27fa 100644
--- a/security/keys/dh.c
+++ b/security/keys/dh.c
@@ -300,7 +300,7 @@ long __keyctl_dh_compute(struct keyctl_dh_params __user *params,
         }
         dh_inputs.g_size = dlen;
 
-        dlen = dh_data_from_key(pcopy.private, &dh_inputs.key);
+        dlen = dh_data_from_key(pcopy.dh_private, &dh_inputs.key);
         if (dlen < 0) {
                 ret = dlen;
                 goto out2;
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index 69517e18ef07..08d5662039e3 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -129,7 +129,7 @@ static int snd_rawmidi_runtime_create(struct snd_rawmidi_substream *substream)
                 runtime->avail = 0;
         else
                 runtime->avail = runtime->buffer_size;
-        runtime->buffer = kvmalloc(runtime->buffer_size, GFP_KERNEL);
+        runtime->buffer = kvzalloc(runtime->buffer_size, GFP_KERNEL);
         if (!runtime->buffer) {
                 kfree(runtime);
                 return -ENOMEM;
@@ -655,7 +655,7 @@ static int resize_runtime_buffer(struct snd_rawmidi_runtime *runtime,
         if (params->avail_min < 1 || params->avail_min > params->buffer_size)
                 return -EINVAL;
         if (params->buffer_size != runtime->buffer_size) {
-                newbuf = kvmalloc(params->buffer_size, GFP_KERNEL);
+                newbuf = kvzalloc(params->buffer_size, GFP_KERNEL);
                 if (!newbuf)
                         return -ENOMEM;
                 spin_lock_irq(&runtime->lock);
diff --git a/sound/hda/ext/hdac_ext_stream.c b/sound/hda/ext/hdac_ext_stream.c
index 1bd27576db98..a835558ddbc9 100644
--- a/sound/hda/ext/hdac_ext_stream.c
+++ b/sound/hda/ext/hdac_ext_stream.c
@@ -146,7 +146,8 @@ EXPORT_SYMBOL_GPL(snd_hdac_ext_stream_decouple);
  */
 void snd_hdac_ext_link_stream_start(struct hdac_ext_stream *stream)
 {
-        snd_hdac_updatel(stream->pplc_addr, AZX_REG_PPLCCTL, 0, AZX_PPLCCTL_RUN);
+        snd_hdac_updatel(stream->pplc_addr, AZX_REG_PPLCCTL,
+                         AZX_PPLCCTL_RUN, AZX_PPLCCTL_RUN);
 }
 EXPORT_SYMBOL_GPL(snd_hdac_ext_link_stream_start);
 
@@ -171,7 +172,8 @@ void snd_hdac_ext_link_stream_reset(struct hdac_ext_stream *stream)
 
         snd_hdac_ext_link_stream_clear(stream);
 
-        snd_hdac_updatel(stream->pplc_addr, AZX_REG_PPLCCTL, 0, AZX_PPLCCTL_STRST);
+        snd_hdac_updatel(stream->pplc_addr, AZX_REG_PPLCCTL,
+                         AZX_PPLCCTL_STRST, AZX_PPLCCTL_STRST);
         udelay(3);
         timeout = 50;
         do {
@@ -242,7 +244,7 @@ EXPORT_SYMBOL_GPL(snd_hdac_ext_link_set_stream_id);
 void snd_hdac_ext_link_clear_stream_id(struct hdac_ext_link *link,
                                  int stream)
 {
-        snd_hdac_updatew(link->ml_addr, AZX_REG_ML_LOSIDV, 0, (1 << stream));
+        snd_hdac_updatew(link->ml_addr, AZX_REG_ML_LOSIDV, (1 << stream), 0);
 }
 EXPORT_SYMBOL_GPL(snd_hdac_ext_link_clear_stream_id);
 
@@ -415,7 +417,6 @@ void snd_hdac_ext_stream_spbcap_enable(struct hdac_bus *bus,
                                  bool enable, int index)
 {
         u32 mask = 0;
-        u32 register_mask = 0;
 
         if (!bus->spbcap) {
                 dev_err(bus->dev, "Address of SPB capability is NULL\n");
@@ -424,12 +425,8 @@ void snd_hdac_ext_stream_spbcap_enable(struct hdac_bus *bus,
 
         mask |= (1 << index);
 
-        register_mask = readl(bus->spbcap + AZX_REG_SPB_SPBFCCTL);
-
-        mask |= register_mask;
-
         if (enable)
-                snd_hdac_updatel(bus->spbcap, AZX_REG_SPB_SPBFCCTL, 0, mask);
+                snd_hdac_updatel(bus->spbcap, AZX_REG_SPB_SPBFCCTL, mask, mask);
         else
                 snd_hdac_updatel(bus->spbcap, AZX_REG_SPB_SPBFCCTL, mask, 0);
 }
@@ -503,7 +500,6 @@ void snd_hdac_ext_stream_drsm_enable(struct hdac_bus *bus,
                                 bool enable, int index)
 {
         u32 mask = 0;
-        u32 register_mask = 0;
 
         if (!bus->drsmcap) {
                 dev_err(bus->dev, "Address of DRSM capability is NULL\n");
@@ -512,12 +508,8 @@ void snd_hdac_ext_stream_drsm_enable(struct hdac_bus *bus,
 
         mask |= (1 << index);
 
-        register_mask = readl(bus->drsmcap + AZX_REG_SPB_SPBFCCTL);
-
-        mask |= register_mask;
-
         if (enable)
-                snd_hdac_updatel(bus->drsmcap, AZX_REG_DRSM_CTL, 0, mask);
+                snd_hdac_updatel(bus->drsmcap, AZX_REG_DRSM_CTL, mask, mask);
         else
                 snd_hdac_updatel(bus->drsmcap, AZX_REG_DRSM_CTL, mask, 0);
 }
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 0a5085537034..26d348b47867 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -3935,7 +3935,8 @@ void snd_hda_bus_reset_codecs(struct hda_bus *bus)
 
         list_for_each_codec(codec, bus) {
                 /* FIXME: maybe a better way needed for forced reset */
-                cancel_delayed_work_sync(&codec->jackpoll_work);
+                if (current_work() != &codec->jackpoll_work.work)
+                        cancel_delayed_work_sync(&codec->jackpoll_work);
 #ifdef CONFIG_PM
                 if (hda_codec_is_power_on(codec)) {
                         hda_call_codec_suspend(codec);
diff --git a/tools/kvm/kvm_stat/kvm_stat b/tools/kvm/kvm_stat/kvm_stat
index 56c4b3f8a01b..439b8a27488d 100755
--- a/tools/kvm/kvm_stat/kvm_stat
+++ b/tools/kvm/kvm_stat/kvm_stat
@@ -759,12 +759,18 @@ class DebugfsProvider(Provider):
             if len(vms) == 0:
                 self.do_read = False
 
-            self.paths = filter(lambda x: "{}-".format(pid) in x, vms)
+            self.paths = list(filter(lambda x: "{}-".format(pid) in x, vms))
 
         else:
             self.paths = []
             self.do_read = True
-        self.reset()
+
+    def _verify_paths(self):
+        """Remove invalid paths"""
+        for path in self.paths:
+            if not os.path.exists(os.path.join(PATH_DEBUGFS_KVM, path)):
+                self.paths.remove(path)
+                continue
 
     def read(self, reset=0, by_guest=0):
         """Returns a dict with format:'file name / field -> current value'.
@@ -780,6 +786,7 @@ class DebugfsProvider(Provider):
         # If no debugfs filtering support is available, then don't read.
         if not self.do_read:
             return results
+        self._verify_paths()
 
         paths = self.paths
         if self._pid == 0:
@@ -1096,15 +1103,16 @@ class Tui(object):
             pid = self.stats.pid_filter
         self.screen.erase()
         gname = self.get_gname_from_pid(pid)
+        self._gname = gname
         if gname:
             gname = ('({})'.format(gname[:MAX_GUEST_NAME_LEN] + '...'
                                    if len(gname) > MAX_GUEST_NAME_LEN
                                    else gname))
         if pid > 0:
-            self.screen.addstr(0, 0, 'kvm statistics - pid {0} {1}'
-                               .format(pid, gname), curses.A_BOLD)
+            self._headline = 'kvm statistics - pid {0} {1}'.format(pid, gname)
         else:
-            self.screen.addstr(0, 0, 'kvm statistics - summary', curses.A_BOLD)
+            self._headline = 'kvm statistics - summary'
+        self.screen.addstr(0, 0, self._headline, curses.A_BOLD)
         if self.stats.fields_filter:
             regex = self.stats.fields_filter
             if len(regex) > MAX_REGEX_LEN:
@@ -1162,6 +1170,19 @@ class Tui(object):
 
             return sorted_items
 
+        if not self._is_running_guest(self.stats.pid_filter):
+            if self._gname:
+                try: # ...to identify the guest by name in case it's back
+                    pids = self.get_pid_from_gname(self._gname)
+                    if len(pids) == 1:
+                        self._refresh_header(pids[0])
+                        self._update_pid(pids[0])
+                        return
+                except:
+                    pass
+            self._display_guest_dead()
+            # leave final data on screen
+            return
         row = 3
         self.screen.move(row, 0)
         self.screen.clrtobot()
@@ -1184,6 +1205,7 @@ class Tui(object):
         # print events
         tavg = 0
         tcur = 0
+        guest_removed = False
         for key, values in get_sorted_events(self, stats):
             if row >= self.screen.getmaxyx()[0] - 1 or values == (0, 0):
                 break
@@ -1191,7 +1213,10 @@ class Tui(object):
                 key = self.get_gname_from_pid(key)
                 if not key:
                     continue
-            cur = int(round(values.delta / sleeptime)) if values.delta else ''
+            cur = int(round(values.delta / sleeptime)) if values.delta else 0
+            if cur < 0:
+                guest_removed = True
+                continue
             if key[0] != ' ':
                 if values.delta:
                     tcur += values.delta
@@ -1204,13 +1229,21 @@ class Tui(object):
                                values.value * 100 / float(ltotal), cur))
             row += 1
         if row == 3:
-            self.screen.addstr(4, 1, 'No matching events reported yet')
+            if guest_removed:
+                self.screen.addstr(4, 1, 'Guest removed, updating...')
+            else:
+                self.screen.addstr(4, 1, 'No matching events reported yet')
         if row > 4:
             tavg = int(round(tcur / sleeptime)) if tcur > 0 else ''
             self.screen.addstr(row, 1, '%-40s %10d        %8s' %
                                ('Total', total, tavg), curses.A_BOLD)
         self.screen.refresh()
 
+    def _display_guest_dead(self):
+        marker = '   Guest is DEAD   '
+        y = min(len(self._headline), 80 - len(marker))
+        self.screen.addstr(0, y, marker, curses.A_BLINK | curses.A_STANDOUT)
+
     def _show_msg(self, text):
         """Display message centered text and exit on key press"""
         hint = 'Press any key to continue'
@@ -1219,10 +1252,10 @@ class Tui(object):
         (x, term_width) = self.screen.getmaxyx()
         row = 2
         for line in text:
-            start = (term_width - len(line)) / 2
+            start = (term_width - len(line)) // 2
             self.screen.addstr(row, start, line)
             row += 1
-        self.screen.addstr(row + 1, (term_width - len(hint)) / 2, hint,
+        self.screen.addstr(row + 1, (term_width - len(hint)) // 2, hint,
                            curses.A_STANDOUT)
         self.screen.getkey()
 
@@ -1319,6 +1352,12 @@ class Tui(object):
                 msg = '"' + str(val) + '": Invalid value'
         self._refresh_header()
 
+    def _is_running_guest(self, pid):
+        """Check if pid is still a running process."""
+        if not pid:
+            return True
+        return os.path.isdir(os.path.join('/proc/', str(pid)))
+
     def _show_vm_selection_by_guest(self):
         """Draws guest selection mask.
 
@@ -1346,7 +1385,7 @@ class Tui(object):
             if not guest or guest == '0':
                 break
             if guest.isdigit():
-                if not os.path.isdir(os.path.join('/proc/', guest)):
+                if not self._is_running_guest(guest):
                     msg = '"' + guest + '": Not a running process'
                     continue
                 pid = int(guest)
diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c
index 30cb0a0713ff..37908a83ddc2 100644
--- a/tools/vm/page-types.c
+++ b/tools/vm/page-types.c
@@ -159,12 +159,6 @@ static const char * const page_flag_names[] = {
 };
 
 
-static const char * const debugfs_known_mountpoints[] = {
-        "/sys/kernel/debug",
-        "/debug",
-        0,
-};
-
 /*
  * data structures
  */
diff --git a/tools/vm/slabinfo.c b/tools/vm/slabinfo.c
index f82c2eaa859d..334b16db0ebb 100644
--- a/tools/vm/slabinfo.c
+++ b/tools/vm/slabinfo.c
@@ -30,8 +30,8 @@ struct slabinfo {
         int alias;
         int refs;
         int aliases, align, cache_dma, cpu_slabs, destroy_by_rcu;
-        int hwcache_align, object_size, objs_per_slab;
-        int sanity_checks, slab_size, store_user, trace;
+        unsigned int hwcache_align, object_size, objs_per_slab;
+        unsigned int sanity_checks, slab_size, store_user, trace;
         int order, poison, reclaim_account, red_zone;
         unsigned long partial, objects, slabs, objects_partial, objects_total;
         unsigned long alloc_fastpath, alloc_slowpath;
diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
index 91aaf73b00df..ed162a6c57c5 100644
--- a/virt/kvm/arm/mmu.c
+++ b/virt/kvm/arm/mmu.c
@@ -1817,18 +1817,6 @@ static int kvm_unmap_hva_handler(struct kvm *kvm, gpa_t gpa, u64 size, void *dat
         return 0;
 }
 
-int kvm_unmap_hva(struct kvm *kvm, unsigned long hva)
-{
-        unsigned long end = hva + PAGE_SIZE;
-
-        if (!kvm->arch.pgd)
-                return 0;
-
-        trace_kvm_unmap_hva(hva);
-        handle_hva_to_gpa(kvm, hva, end, &kvm_unmap_hva_handler, NULL);
-        return 0;
-}
-
 int kvm_unmap_hva_range(struct kvm *kvm,
                         unsigned long start, unsigned long end)
 {
@@ -1860,13 +1848,20 @@ static int kvm_set_spte_handler(struct kvm *kvm, gpa_t gpa, u64 size, void *data
 void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte)
 {
         unsigned long end = hva + PAGE_SIZE;
+        kvm_pfn_t pfn = pte_pfn(pte);
         pte_t stage2_pte;
 
         if (!kvm->arch.pgd)
                 return;
 
         trace_kvm_set_spte_hva(hva);
-        stage2_pte = pfn_pte(pte_pfn(pte), PAGE_S2);
+
+        /*
+         * We've moved a page around, probably through CoW, so let's treat it
+         * just like a translation fault and clean the cache to the PoC.
+         */
+        clean_dcache_guest_page(pfn, PAGE_SIZE);
+        stage2_pte = pfn_pte(pfn, PAGE_S2);
         handle_hva_to_gpa(kvm, hva, end, &kvm_set_spte_handler, &stage2_pte);
 }
 
diff --git a/virt/kvm/arm/trace.h b/virt/kvm/arm/trace.h
index e53b596f483b..57b3edebbb40 100644
--- a/virt/kvm/arm/trace.h
+++ b/virt/kvm/arm/trace.h
@@ -134,21 +134,6 @@ TRACE_EVENT(kvm_mmio_emulate,
                   __entry->vcpu_pc, __entry->instr, __entry->cpsr)
 );
 
-TRACE_EVENT(kvm_unmap_hva,
-        TP_PROTO(unsigned long hva),
-        TP_ARGS(hva),
-
-        TP_STRUCT__entry(
-                __field(        unsigned long,  hva             )
-        ),
-
-        TP_fast_assign(
-                __entry->hva            = hva;
-        ),
-
-        TP_printk("mmu notifier unmap hva: %#08lx", __entry->hva)
-);
-
 TRACE_EVENT(kvm_unmap_hva_range,
         TP_PROTO(unsigned long start, unsigned long end),
         TP_ARGS(start, end),